Data Processing Addendum

This addendum governs how Saiatech LLC handles the personal data a business's callers and customers provide through NearMax Office.

1. Scope and roles

1.1 This Data Processing Addendum ("DPA") is part of the NearMax Terms of Service and Office Schedule between Saiatech LLC ("NearMax") and the Customer, effective October 17, 2026. Capitalised terms not defined here have the meaning given in those documents.

1.2 Personal Data means Customer Data that identifies or relates to an identifiable person, such as a Caller's name, phone number, address, voice recording or call content.

1.3 Roles. The Customer decides why and how Personal Data is processed and is the "controller" or "business". NearMax processes Personal Data only on the Customer's behalf and is the "processor", "service provider" or "contractor" under the California Consumer Privacy Act as amended ("CCPA") and similar US state privacy laws (together, "Privacy Laws").

1.4 United States only. NearMax Office is offered to businesses in the United States, and NearMax processes and stores Personal Data in the United States. The Customer must not use NearMax Office to process personal data that is subject to the EU or UK GDPR without a separate written agreement with NearMax.

1.5 Your Model. When the Customer connects Your Model, that provider processes data under its own agreement with the Customer and is not a NearMax subprocessor. This DPA does not cover that provider's processing.

1.6 Order of precedence. If this DPA conflicts with the Terms or Office Schedule on the protection of Personal Data, this DPA controls.

2. Processing instructions and restrictions

2.1 Instructions. NearMax processes Personal Data only to provide NearMax Office as described in the Office Terms, as configured by the Customer in its dashboard, and as otherwise instructed in writing by the Customer. NearMax will tell the Customer if it believes an instruction breaks Privacy Laws.

2.2 Service-provider restrictions. NearMax will not:

• sell or share Personal Data, as "sell" and "share" are defined in the CCPA;
• retain, use or disclose Personal Data for any purpose other than providing NearMax Office to the Customer, including any commercial purpose or targeted advertising;
• retain, use or disclose Personal Data outside its direct business relationship with the Customer;
• combine Personal Data with personal data it receives from any other person or business, except as Privacy Laws allow for service providers;
• use Personal Data to train or improve any AI model;
• attempt to re-identify de-identified data.

2.3 Aggregated metrics. NearMax may create counts and measurements about the performance of NearMax Office that contain no call content and cannot reasonably be linked to any person or to the Customer, and may use them to operate and improve NearMax Office.

2.4 Compliance. NearMax will comply with the obligations of Privacy Laws that apply to it as a service provider, provide the same level of privacy protection Privacy Laws require of the Customer, and tell the Customer if it can no longer meet these obligations. The Customer may then take reasonable steps to stop unauthorised processing.

2.5 Certification. NearMax certifies that it understands and will comply with the restrictions in this section 2.

2.6 Customer obligations. The Customer is responsible for having a lawful basis and giving any notices required for the Personal Data it collects through NearMax Office, including the caller notices NearMax provides, and for the accuracy of its instructions.

3. Security, confidentiality and incidents

3.1 Security measures. NearMax maintains reasonable administrative, technical and physical safeguards appropriate to the nature of Personal Data, including:

• encryption of data in transit (TLS) and at rest, and separate encryption of stored credentials;
• separation of each Customer's data enforced by the database (row-level security), in addition to application checks;
• least-privilege access, with services able to reach only the data they need;
• no routine staff access to Customer Data; access only through Customer-granted, time-limited support access or for security investigations, with access logged;
• logs and error reports that exclude call content, names and phone numbers;
• monitoring, backups and tested restore procedures.

NearMax may update these measures as long as the overall level of protection does not decrease.

3.2 Personnel. NearMax ensures that anyone authorised to process Personal Data is bound by confidentiality obligations and accesses it only as needed to provide NearMax Office.

3.3 Security incidents. If NearMax confirms unauthorised access to, or loss, disclosure or alteration of, Personal Data ("Security Incident"), it will notify the Customer without undue delay, and in any case within 72 hours of confirming it. The notice will describe what is known: the nature of the incident, the data and people likely affected, likely consequences, and steps taken. NearMax will update the Customer as more is learned.

3.4 Response. NearMax will take reasonable steps to contain and fix the Security Incident and will give the Customer reasonable help meeting any obligation to notify affected people or regulators. Unless the law requires otherwise, the Customer decides whether and how to notify its Callers.

3.5 No admission. Notifying the Customer of a Security Incident is not an admission of fault or liability.

4. Subprocessors, requests, deletion and audits

4.1 Subprocessors. The Customer authorises NearMax to use the subprocessors listed at nearmax.com/office/subprocessors. NearMax will have a written agreement with each subprocessor that protects Personal Data at least as well as this DPA, including a prohibition on using it to train AI models, and remains responsible for each subprocessor's performance.

4.2 Changes. NearMax will notify the Customer by email at least 30 days before adding or replacing a subprocessor that processes Personal Data. The Customer may object on reasonable data-protection grounds within that period. If the parties can't resolve the objection, the Customer may end NearMax Office and receive a refund of prepaid fees for the unused period.

4.3 Requests from individuals. If NearMax receives a request from a Caller to access, correct, delete or opt out, it will send the request to the Customer and not respond itself, except to direct the Caller to the Customer. NearMax provides tools in the dashboard for the Customer to find, export, correct and delete a Caller's data, including recordings, and will give reasonable further help.

4.4 Retention and deletion. Personal Data is kept for the retention period the Customer sets in its dashboard (1 year by default) and then deleted. Opted-out callers' minimal transcripts are deleted after 30 days. On termination, deletion follows section 9.4 of the Office Terms. NearMax may keep Personal Data only where the law requires it, and then only for that purpose.

4.5 Audits. Once a year, or after a Security Incident, the Customer may ask NearMax to complete a reasonable written security questionnaire and provide relevant documentation. On-site audits are available only where required by law or a regulator, at the Customer's cost, with 30 days' notice, during business hours, and under confidentiality terms.

4.6 Assistance. NearMax will give reasonable help with any data protection assessment the Customer must carry out about NearMax Office, using information NearMax has available.

4.7 Liability. Each party's liability under this DPA is subject to the limits in the NearMax Terms of Service.

Annex: details of processing