Data Processing Addendum (DPA) Effective Date: June 25, 2026 This Data Processing Addendum ("DPA") forms part of the agreement between MailSecurity.ai ("Processor", "MailSecurity", "we", "our", or "us") and the Customer ("Controller") for the provision of MailSecurity services. This DPA applies where MailSecurity.ai processes Personal Data on behalf of the Customer in connection with the Services. This DPA is intended to satisfy the requirements of: • General Data Protection Regulation (GDPR) • UK GDPR • Protection of Personal Information Act (POPIA) – South Africa • California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) • Other applicable privacy and data protection laws Definitions Unless otherwise defined in this DPA, terms such as Personal Data, Processing, Controller, Processor, Data Subject, Subprocessor, Personal Data Breach and Supervisory Authority have the meanings assigned under applicable data protection legislation. Scope This DPA governs MailSecurity.ai's processing of Personal Data when providing: • Email Security Gateway • Spam Filtering • Malware Protection • Phishing Detection • Business Email Compromise (BEC) Protection • Email Encryption • Email Continuity • Email Signature Management • Directory Synchronization • Email Archiving • API Integrations • Security Monitoring • Reporting and Analytics Roles of the Parties For the purposes of applicable privacy legislation: • The Customer acts as the Data Controller. • MailSecurity.ai acts as the Data Processor. MailSecurity.ai processes Personal Data solely on documented instructions from the Customer except where required by applicable law. Categories of Personal Data Depending on the Services used, MailSecurity.ai may process: • Names • Business Email Addresses • Email Aliases • Distribution Lists • Job Titles • Departments • Telephone Numbers • Office Locations • Authentication Information • IP Addresses • Email Headers • Email Routing Information • Email Metadata • Email Content (only where required to provide the contracted Services) • Security Event Logs • Threat Detection Information MailSecurity.ai does not intentionally collect special category personal data unless such information is contained within customer email traffic and processing is necessary to provide the Services. Categories of Data Subjects Data Subjects may include: • Employees • Contractors • Consultants • Customers • Suppliers • Partners • Prospective Customers • Authorized Users • Other individuals whose information is processed within customer email communications. Nature and Purpose of Processing MailSecurity.ai processes Personal Data solely for the purpose of delivering contracted cybersecurity services, including: • Email Routing • Spam Filtering • Malware Detection • Phishing Prevention • Recipient Validation • Signature Synchronization • Security Monitoring • Threat Intelligence • Incident Investigation • Reporting • Customer Support • Platform Administration MailSecurity.ai will not process Personal Data for advertising, profiling, or unrelated commercial purposes. Customer Instructions MailSecurity.ai shall process Personal Data only: • On documented instructions from the Customer. • As necessary to provide the Services. • As required by applicable law. Where legally permitted, MailSecurity.ai will notify the Customer if it believes an instruction infringes applicable privacy legislation. Confidentiality MailSecurity.ai ensures that all personnel authorized to process Personal Data: • Are subject to confidentiality obligations. • Receive security and privacy training. • Access Personal Data only where required for their job responsibilities. • Operate under least-privilege access controls. Security Measures MailSecurity.ai maintains appropriate technical and organizational measures including: • Encryption in transit using TLS 1.2 or higher • Encryption at rest using industry-standard encryption • Role-Based Access Control (RBAC) • Multi-Factor Authentication (MFA) • Security Monitoring • Audit Logging • Vulnerability Management • Secure Software Development Lifecycle • Patch Management • Incident Response Procedures • Backup and Recovery Procedures • Business Continuity Planning • Principle of Least Privilege These measures are regularly reviewed and updated to address evolving cybersecurity threats. Artificial Intelligence Where artificial intelligence or machine learning technologies are used, they are employed solely to deliver contracted security services such as: • Spam Detection • Malware Classification • Threat Analysis • Phishing Detection Customer Personal Data is never used to train publicly available or shared artificial intelligence models. Subprocessors MailSecurity.ai may engage carefully selected subprocessors to support service delivery. Categories of subprocessors may include: • Cloud Infrastructure Providers • Identity Providers • Monitoring Providers • Backup Providers • Payment Processors • Customer Support Platforms • Analytics Providers MailSecurity.ai will: • Select subprocessors using appropriate due diligence. • Require equivalent contractual privacy and security obligations. • Remain responsible for the performance of its subprocessors. A current list of subprocessors will be made available upon request or published on the MailSecurity.ai website. International Data Transfers Where Personal Data is transferred internationally, MailSecurity.ai will implement appropriate safeguards including: • Standard Contractual Clauses (SCCs) • UK International Data Transfer Addendum where applicable • Contractual Safeguards • Technical Safeguards • Organizational Safeguards Assistance to the Customer MailSecurity.ai will provide reasonable assistance to enable the Customer to comply with applicable privacy legislation, including requests relating to: • Data Subject Rights • Data Protection Impact Assessments (DPIAs) • Prior Consultations with Regulators • Security Assessments • Compliance Audits Data Subject Requests Where MailSecurity.ai receives a request directly from a Data Subject regarding Personal Data processed on behalf of a Customer, MailSecurity.ai will: • Promptly notify the Customer where legally permitted. • Not respond directly unless authorized by the Customer or required by law. Personal Data Breaches MailSecurity.ai maintains documented incident response procedures. Following confirmation of a Personal Data Breach affecting Customer Personal Data, MailSecurity.ai will: • Notify the Customer without undue delay. • Provide available information regarding the incident. • Describe the likely impact. • Outline containment measures. • Provide updates as additional information becomes available. • Cooperate with the Customer in meeting applicable legal obligations. Data Retention and Deletion MailSecurity.ai retains Personal Data only for as long as necessary to provide the Services or comply with legal obligations. Upon termination of the Services, MailSecurity.ai will, at the Customer's election and subject to applicable law: • Return Customer Personal Data where technically feasible. • Securely delete Customer Personal Data. Certain information may be retained where required by law or necessary to establish, exercise, or defend legal claims. Audit Rights Upon reasonable written notice, and no more than once annually unless required by law or following a confirmed security incident, the Customer may request reasonable information demonstrating MailSecurity.ai's compliance with this DPA. MailSecurity.ai may satisfy audit requests through: • Independent Audit Reports • Security Certifications • Compliance Documentation • Security Questionnaires • Reasonable Virtual or On-Site Assessments, subject to confidentiality and operational security requirements. Liability Liability arising under this DPA shall be governed by the liability provisions contained within the applicable Master Services Agreement, Subscription Agreement, or Terms of Service. Term This DPA remains in effect for the duration of the Services and continues for as long as MailSecurity.ai processes Personal Data on behalf of the Customer. Order of Precedence If a conflict exists between this DPA and another agreement governing the Services: • This DPA shall prevail with respect to Personal Data processing obligations. • All remaining provisions of the applicable agreement remain unaffected. Governing Law This DPA shall be governed by the governing law specified in the applicable service agreement unless otherwise required by mandatory privacy legislation. Processing Details Subject Matter of Processing Provision of cloud-based email security and related services. Duration For the duration of the Customer's subscription and any legally required retention period. Nature of Processing Collection, storage, organization, consultation, transmission, analysis, synchronization, retrieval, deletion, and other processing necessary to deliver the Services. Purpose Delivery of contracted cybersecurity services. Categories of Personal Data As described in the "Categories of Personal Data" section of this DPA. Categories of Data Subjects As described in the "Categories of Data Subjects" section of this DPA. Technical and Organizational Security Measures MailSecurity.ai maintains security controls including: • Encryption in Transit • Encryption at Rest • Role-Based Access Control • Multi-Factor Authentication • Security Monitoring • Continuous Logging • Secure Software Development Lifecycle • Regular Vulnerability Assessments • Patch Management • Backup and Disaster Recovery • Business Continuity Planning • Incident Response Procedures • Least-Privilege Administrative Access • Vendor Risk Management • Personnel Confidentiality Obligations • Security Awareness Training These measures are reviewed periodically to ensure continued effectiveness against evolving cybersecurity threats. Contact MailSecurity.ai Email: [privacy@mailsecurity.ai](mailto:privacy@mailsecurity.ai) Website: [https://mailsecurity.ai](https://mailsecurity.ai)