LIMODIA DATA PROCESSING ADDENDUM (Effective Date: March 6, 2026)

This Data Processing Addendum ("DPA") is incorporated into the agreement between Limodia LLC ("Processor" or "Limodia") and the customer entity using the Services ("Controller" or "Customer").

1. Definitions. "Applicable Data Protection Law" includes laws applicable to personal data processing, including where applicable GDPR, UK GDPR, Swiss data protection law, and relevant U.S. state privacy laws. "Personal Data" means information relating to an identified or identifiable person processed on behalf of Customer. "Subprocessor" means a third party engaged by Limodia to process Personal Data on behalf of Customer.

2. Scope and Roles. This DPA applies when Limodia processes Personal Data on behalf of Customer as processor/service provider. Customer is controller/business and Limodia is processor/service provider unless otherwise stated in writing.

3. Subject Matter and Duration. Processing concerns Limodia provision of Services. Processing continues during the Agreement and limited post-termination retention period as required by Agreement, documented instructions, and law.

4. Nature and Purpose. Processing may include collection, storage, organization, retrieval, use, transmission, support, backup, security monitoring, and deletion as needed to provide and secure Services.

5. Categories. Data subjects may include Customer personnel, dispatchers, drivers, contractors, passengers, leads, billing contacts, support contacts, and others whose data Customer submits. Categories may include identifiers, contact data, reservation/trip data, location data, communications data, device/log data, and uploaded records.

6. Documented Instructions. Limodia processes Personal Data only under Customer documented instructions, including instructions inherent in Service configuration and use. If an instruction appears to violate law, Limodia may notify Customer and suspend affected processing until clarified.

7. Customer Responsibilities. Customer is responsible for legal basis, required notices/consents, data minimization, lawful instructions, rights handling (unless assistance required), and appropriate Service configuration including role permissions and retention settings.

8. Confidentiality. Limodia ensures persons authorized to process Personal Data are bound by confidentiality obligations.

9. Security Measures. Limodia maintains appropriate technical and organizational safeguards, which may include role-based access, authentication controls, encryption where appropriate, logging/monitoring, vulnerability management, backup/recovery, and incident response procedures.

10. Subprocessors. Customer authorizes Limodia use of Subprocessors to provide Services. Limodia imposes data protection obligations on Subprocessors and remains responsible as required by law. Upon written request, Limodia provides a current Subprocessor list or categories.

11. Data Subject Request Assistance. Considering processing nature, Limodia provides reasonable assistance where Customer cannot reasonably fulfill requests through available Service controls. Limodia may redirect direct requests to Customer where permitted.

12. Compliance Assistance. Limodia provides reasonable assistance with security obligations, breach notification obligations, DPIAs, and regulator consultations where required by law and reasonably necessary.

13. Personal Data Breach Notification. Limodia will notify Customer without undue delay after becoming aware of a confirmed breach affecting Customer Personal Data and provide available details (nature, categories, likely consequences, and response actions). Notice is not admission of fault.

14. Return and Deletion. On termination/expiration, Limodia will delete or return Personal Data where feasible and subject to law, backup cycles, and legal defense requirements. Confirmation may be provided where reasonably feasible.

15. Audit and Information Rights. Limodia provides information reasonably necessary to demonstrate compliance. Where required by law, Customer may request limited audits under reasonable notice, scope, confidentiality, and operational safeguards. Limodia may satisfy requests via certifications/reports where appropriate.

16. International Transfers. Where processing occurs in non-adequate jurisdictions, parties implement valid transfer mechanisms, which may include Standard Contractual Clauses and applicable UK/Swiss addenda where required.

17. U.S. State Privacy Terms. Where Limodia acts as service provider/processor under U.S. state law, Limodia processes data for agreed business purposes and does not sell personal data or process outside permitted scope except as legally allowed.

18. Liability. This DPA is subject to liability limitations in the main Agreement to the extent permitted by law.

19. Annexes. Annex I Processing Details: subject matter, duration, purposes, data subjects, and data categories as described above. Annex II Minimum Security Measures: access controls, encryption where appropriate, monitoring, vulnerability management, backup/recovery, confidentiality, and incident response. Annex III Subprocessor Categories: infrastructure, communications, payments, analytics, observability, storage, and identity/security providers.