Schedule 1: Details of Processing of Personal Data

[PRIVACY_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025

Nature and Purpose of Processing. Scaleflex will Process Personal Data as necessary to provide the Product pursuant to the Agreement and as further instructed by Customer in its use of the Product.

Duration of Processing. Subject to Section 10 of this DPA, Scaleflex will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

Categories of Data Subjects. Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole Personal Data required for the use of the Product relates to the following categories of Data Subjects:

• Employees of Customer

• Customer’s Users

Upon Customer’s sole discretion, additional Data Subjects might be relevant for the use of (opt-in) AI features within the Product:

• Data Subjects in Customer Assets

Types of Personal Data. Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole categories of Personal Data required for the use of the Product are:

• First and last name

• Email address

• IP addresses

Upon Customer’s sole discretion, additional categories might be used for the use of (opt-in) AI features within the Product:

• Biometric data

Special categories of data. The Product is not intended for Customer to store Sensitive Categories of Data, which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person (unless AI features have been enabled), data concerning health or data concerning a natural person’s sex life or sexual orientation, or Personal Data relating to criminal convictions and offences.

Notwithstanding the foregoing, when AI features have been enabled, Scaleflex highly advises Customer against including Special Categories of Data within Scaleflex' asset labelling taxonomy, particularly in tags or free-form text.