Data Processing Addendum

Version: 1.0
Effective date: 2026-10-17

This Data Processing Addendum (the Addendum) forms part of the Terms and Conditions (the Terms) between One Place Business Platform Pty Ltd (ACN 621 278 180), trading as VibeCFO Business Platform (the Company, we, us) and the customer firm that has accepted the Terms (the Customer, you). Capitalised terms not defined here have the meaning given in the Terms and the Privacy Policy.

1 Application and acceptance

1.1 This Addendum applies to all Personal Information that the Company processes on the Customer's behalf in providing the Platform (Customer Personal Data).

1.2 The Customer is the controller (or, under Australian and New Zealand law, the entity that holds the Personal Information and discloses it to the Company) and the Company is the processor. Where the Customer itself acts as a processor for its own clients, the Company is a sub-processor and the Customer warrants that its instructions to the Company are authorised by its clients.

1.3 The Customer accepts this Addendum by accepting the Terms on or after the Effective Date below, or by continuing to use the Platform thirty days after notice of it. No signature is required. A Customer that needs a countersigned copy may request one at privacy@vibecfo.ai.

1.4 Effective Date: the date this Addendum is published at vibecfo.ai/dpa, shown at the foot of the page.

2 Details of the processing

2.1 Subject matter, duration, nature and purpose, categories of data and of data subjects are set out in Annex I. The Company processes Customer Personal Data only to provide, secure, support and improve the Platform as described in the Terms and the Privacy Policy, and for no other purpose.

3 The Company's obligations as processor

3.1 Instructions. The Company processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this Addendum, the Customer's configuration of the Platform and its users' use of the Platform's features (including questions put to EVA). The Company will inform the Customer if, in its opinion, an instruction infringes applicable data protection law, and may suspend the instruction until it is confirmed or withdrawn. Where the law of a country in which the Company processes requires it to process otherwise, the Company will inform the Customer before processing unless that law prohibits it.

3.2 Confidentiality. Persons authorised to process Customer Personal Data are bound by written confidentiality obligations (employment or contractor agreements) and have received information security training. The Company's staff are in Australia.

3.3 Security. The Company implements and maintains the technical and organisational measures in Annex II, and such further measures as are appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. The Company may update Annex II provided the overall level of protection is not reduced.

3.4 Sub-processors. The Customer gives general written authorisation to the Company's engagement of the sub-processors listed at vibecfo.ai/subprocessors (Annex III) on the Effective Date. The Company will give at least thirty days' notice by email to the Customer's administrators and by updating that page before adding or replacing a sub-processor that processes Customer Personal Data, and the Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected service under the Terms without penalty. The Company imposes on each sub-processor data protection obligations no less protective than this Addendum, and remains liable for the sub-processor's performance.

3.5 Assistance. The Company will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights, and in meeting the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation, so far as the Company has the relevant information. Where a data subject contacts the Company directly about Customer Personal Data, the Company will refer the request to the Customer without undue delay and will not respond except on the Customer's instruction or as required by law.

3.6 Personal data breaches. The Company will notify the Customer's administrators without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Company has at the time (nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, measures taken or proposed, a contact point), and will supplement the notice as more becomes known. The Company's own notifications to a supervisory authority, where it is itself required to make one, are described in the Privacy Policy.

3.7 Deletion and return. On termination of the Customer's account the Company deletes Customer Personal Data, and existing copies, in accordance with the retention periods in the Terms and the Privacy Policy (the Customer's databases and documents deleted on termination or at the end of the stated retention period; backups expire on their own seven-day cycle), unless applicable law requires the Company to retain it. Before deletion the Customer may export its data through the Platform's export features; the Company will provide reasonable assistance with an export on request.

3.8 Audit. The Company will make available to the Customer the information necessary to demonstrate compliance with this Addendum: its then-current security page, its Privacy Policy, its sub-processor list, and, on written request no more than once in twelve months (and additionally after a personal data breach affecting the Customer), a summary of its information security management system, its ISO/IEC 27001 and ISO/IEC 42001 certification status and the most recent certification body audit result, and written answers to a reasonable security questionnaire. Where these do not reasonably satisfy a legal obligation of the Customer, the Company will allow an audit by the Customer or an independent auditor bound by confidentiality, at the Customer's cost, on at least thirty days' notice, during business hours, limited to the systems that process Customer Personal Data, and not more than once in twelve months unless required by a supervisory authority.

3.9 Records. The Company maintains a record of its processing activities on behalf of its Customers and makes it available to a supervisory authority on request.

4 The Customer's obligations

4.1 The Customer is responsible for the lawfulness of the Personal Information it and its users upload to or connect to the Platform, for giving the notices and obtaining the consents its own law requires (including for the disclosure of its clients' information to the Company and for the AI processing described in the Privacy Policy), for the accuracy of its configuration, and for its users' credentials and access rights.

4.2 The Customer will not upload or connect Personal Information of a kind the Platform is not designed to hold (health, biometric or genetic data; data of children under 16 collected from the children themselves; government identifiers beyond those ordinarily present in accounting records) except where the Customer has confirmed with the Company in writing that the Platform is appropriate for it.

5 Where the processing takes place, and transfers

5.1 The Customer's hosting region. The Customer's own database (the financial and accounting data received through Third-Party Connectors and everything built from it) and the documents and knowledge content it uploads are held in the AWS region for the country the Customer selected when its account was created: Asia Pacific (Sydney) for Australia, Asia Pacific (Auckland) for New Zealand, Europe (London) for the United Kingdom, US East (N. Virginia) for the United States, Canada (Central) (Montreal) for Canada. For a Customer hosted in Canada, AI processing takes place in Canada or the United States. Customers whose accounts were created before regional hosting was offered are hosted in Sydney unless moved by agreement. Backups of the Customer's database are kept in the same region.

5.2 The Australian control plane. For every Customer, wherever its database is held, the Platform itself (the application, EVA's service, the scheduler and the nightly data loads) runs in Australia and reads the Customer's database from there, and the Customer's account records, user logins, billing and usage records, EVA's conversation history and working notes, the analyses, reports, pulses and plans EVA writes for the Customer, saved report and dashboard definitions, in-app messages and operational logs are held in Australia. For a Customer hosted outside Australia this is a transfer of Customer Personal Data to Australia, made under clauses 5.4 to 5.7.

5.3 AI model processing. Questions put to EVA and the data needed to answer them are processed by AI models through Amazon Bedrock in the AWS geography stated for the Customer's hosting region in the Privacy Policy clause 7 (the United States for US-hosted Customers; the European Union or United Kingdom for the orchestrating model and AWS infrastructure in other countries for the worker model for UK-hosted Customers; Australia for the orchestrating model and AWS infrastructure in other countries for the worker model for Australian- and New Zealand-hosted Customers), and by Anthropic's own API in the United States for web search, document exports and as a backup. The model providers do not receive Customer Personal Data through Amazon Bedrock and no model is trained on it.

5.4 United Kingdom. For a Customer established in the United Kingdom, the transfers in clauses 5.2 and 5.3 are restricted transfers under the UK GDPR. The parties enter into the EU Standard Contractual Clauses, Module Two (controller to processor), as amended by the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (the UK Addendum), both incorporated into this Addendum by reference and completed as set out in Annex IV. In the event of conflict between this Addendum and the UK Addendum, the UK Addendum prevails for the transfer it governs.

5.5 European Union and European Economic Area. For a Customer established in the EU or EEA (the Company does not offer an EU hosting region today; such a Customer is hosted in London or Sydney by agreement), the transfers are made under the EU Standard Contractual Clauses, Module Two, incorporated by reference and completed as in Annex IV with the EU options stated there.

5.6 Australia. For a Customer subject to the Privacy Act 1988 (Cth), the Company's disclosure of Personal Information to an overseas recipient (the AI model processing in clause 5.3) is made under Australian Privacy Principle 8.1: the Company takes the steps in Annex II and the sub-processor terms in clause 3.4, and remains accountable for the recipient's handling of the information under section 16C.

5.7 New Zealand. For a Customer subject to the Privacy Act 2020 (NZ), the Company's disclosure of Personal Information to a foreign person or entity (clauses 5.2 and 5.3) is made under Information Privacy Principle 12(1)(c): the Company's agreements with those recipients require them to protect the information in a way that, overall, provides comparable safeguards to those in the Act.

5.8 United States. For a Customer subject to a United States state privacy law, the Company acts as the Customer's service provider, processor or contractor within the meaning of that law: it processes Customer Personal Data only for the business purposes in the Terms; it does not sell or share it, retain, use or disclose it outside the direct business relationship or for any purpose other than those business purposes, or combine it with personal information it receives from other sources except as the law permits; it will notify the Customer if it determines it can no longer meet its obligations under that law; and it grants the Customer the right to take reasonable and appropriate steps to stop and remediate unauthorised use.

6 Liability, term and precedence

6.1 Each party's liability under this Addendum is subject to the limitations and exclusions in the Terms, except to the extent applicable data protection law does not permit them to be limited.

6.2 This Addendum lasts as long as the Company processes Customer Personal Data for the Customer.

6.3 This Addendum prevails over the Terms and the Privacy Policy to the extent of any conflict about the processing of Customer Personal Data; the UK Addendum and the Standard Contractual Clauses prevail over this Addendum for the transfers they govern.

6.4 Governing law: as the Terms, except that the UK Addendum is governed by the laws of England and Wales and the Standard Contractual Clauses by the law chosen in Annex IV.

Annex I — Details of the processing

Annex II — Technical and organisational measures

1. Isolation. Each Customer firm has its own database; a Customer's database credential reaches that firm's database only; uploaded documents are stored under the firm's own prefix in the firm's hosting region.
2. Encryption in transit. TLS to the Platform from the internet; TLS on the Platform's connections to databases created in the Auckland, London, N. Virginia and Montreal regions (required by configuration from the date stated in the security page).
3. Encryption at rest. AES-256 for uploaded documents, EVA knowledge content, logs, backups of the platform's records, and every Customer database created in the Auckland, London, N. Virginia or Montreal regions.
4. Access control. Role-based access within the Platform (firm administrator, member, client reporting user); the Company's staff access to production through named accounts; privileged access reviewed quarterly; departing staff and contractors offboarded under a checklist.
5. Logging and monitoring. AWS CloudTrail across all regions; database connection auditing with 365-day retention; alarms on failed connections, capacity and AI invocation; threat detection (Amazon GuardDuty) in the Company's AWS environment as stated on the security page.
6. Backup and recovery. Seven-day point-in-time recovery for every Customer database in its own region; daily immutable backups of the platform's own records with a copy in Melbourne; a documented recovery runbook and a restore test on record.
7. Vulnerability and change management. Dependency, secret and code scanning on every repository; protected branches; a change management policy under which production changes are recorded, approved and verified; vulnerability remediation targets by severity.
8. Incident response. A written incident response policy with severity classes, containment steps and notification duties; breach notification to the Customer under clause 3.6.
9. AI processing. Models accessed through Amazon Bedrock, which does not share inputs with the model providers or train on them; per-firm scoping of every query EVA runs; EVA's data flows documented in the Company's AI management system.
10. Management system. An information security management system (ISO/IEC 27001:2022) and an AI management system (ISO/IEC 42001) under certification audit with a certification body, with certification targeted for December 2026; policies, risk register, asset register and internal audit maintained.
11. People. Confidentiality in every employment and contractor agreement; security awareness training; all staff in Australia.

Annex III — Sub-processors

The list published at vibecfo.ai/subprocessors on the Effective Date is incorporated here. Its principal entries: Amazon Web Services (hosting, storage, AI inference through Amazon Bedrock, in the regions stated in clause 5); Microsoft (Power BI Embedded reporting and Entra ID identity for client reporting users, Azure Australia East, for Customers using the Power BI add-on); Anthropic (model inference through Amazon Bedrock in the geography stated in clause 5.3, and through Anthropic's API in the United States); OpenAI (model inference through Amazon Bedrock as stated in clause 5.3); Stripe (subscription billing: the Customer's own billing contact and payment records, not its clients' data). Changes follow clause 3.4.

Annex IV — Completion of the Standard Contractual Clauses and the UK Addendum

EU Standard Contractual Clauses (Decision (EU) 2021/914), Module Two. Clause 7 (docking): included. Clause 9(a): Option 2, general written authorisation, with the notice period in clause 3.4 of this Addendum. Clause 11(a): the optional independent dispute resolution body is not selected. Clause 13 and Annex I.C: the competent supervisory authority is that of the Member State in which the data exporter is established (or, for the UK, the Information Commissioner under the UK Addendum). Clause 17: Option 1, the law of Ireland (for the UK Addendum, England and Wales). Clause 18: the courts of Ireland (for the UK Addendum, England and Wales). Annex I.A (parties): the Customer as data exporter (controller) with the details on its account; the Company as data importer (processor), One Place Business Platform Pty Ltd, ACN 621 278 180, Australia, privacy@vibecfo.ai. Annex I.B: as Annex I of this Addendum. Annex II: as Annex II of this Addendum. Annex III: as Annex III of this Addendum.

UK International Data Transfer Addendum (ICO, version B1.0). Table 1 (parties): as Annex I.A above, start date the Effective Date; key contact for each party as on the Customer's account and privacy@vibecfo.ai. Table 2 (selected SCCs, modules and clauses): the Approved EU SCCs, Module Two, with the options above, including clause 7, and with the date of the Approved EU SCCs being that of this Addendum. Table 3 (appendix information): Annex 1A and 1B as Annex I of this Addendum; Annex II as Annex II; Annex III as Annex III. Table 4 (ending this Addendum when the Approved Addendum changes): neither party may end the UK Addendum on that ground; both parties will instead comply with the revised Approved Addendum. The mandatory clauses of the UK Addendum (Part 2) apply as published and are not reproduced here.

Published at vibecfo.ai/dpa. Effective Date: 2026-10-17. Version 1.0. Questions to privacy@vibecfo.ai.