Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Arkrel Terms of Service between Conecta Media LLC ("Processor", "we") and the customer agreeing to the Terms ("Controller", "you") whenever you submit personal data to the Service. If there is a conflict between this DPA and the Terms on the handling of personal data, this DPA controls.

1. Roles

You act as the data controller (or, where applicable under a services agreement with your own customers, as a processor acting on their behalf) for any personal data contained in the documents you send us. We act as a data processor, processing that personal data only to provide the Service and only on your documented instructions, which include the instructions built into the Service itself (extract fields, run checks, deliver results and webhooks) and any additional written instructions you give us.

2. Subject Matter and Duration

Subject matter: automated extraction of structured data from documents you submit, and verification checks run against that extracted data.

Duration: for as long as your account is active, and until deletion of your data under the retention terms in the Privacy Policy.

Nature and purpose: optical/text extraction and structured-data verification of business documents (invoices, receipts, purchase orders, bank statements, delivery notes, and custom document types), performed by software and machine-learning models, for the purpose of returning extracted and verified data to you.

Categories of data subjects: typically the individuals named on your business documents, for example vendors, customers, employees, or account holders referenced in an invoice, receipt, purchase order, or bank statement.

Categories of personal data: names, business contact details, and financial line-item data that may appear on the documents you submit. You control what you submit; see the Acceptable Use Policy for data you may not submit (including PHI and other medical records).

3. Our Obligations

We will:

• Process personal data only on your instructions as described above,

unless required to do otherwise by law, in which case we will tell you before processing, unless the law prohibits it.

• Keep personal data confidential, and ensure that anyone with access to it

is bound by an obligation of confidentiality.

• Implement the technical and organizational measures described in our

Security Overview.

• Assist you, at your reasonable request, in responding to data subject

requests (access, correction, deletion, export) that relate to personal data we process on your behalf.

• Notify you without undue delay after becoming aware of a personal data

breach affecting your data, and provide the information you reasonably need to meet your own breach-notification obligations.

• Delete or return personal data at the end of the relationship, per the

retention settings in your account, unless we are required by law to keep it.

• Make available the information reasonably necessary to demonstrate

compliance with this DPA, and allow for audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice.

4. Subprocessors

You give general authorization for us to use the subprocessors listed on our Subprocessors page to help provide the Service. We will keep that page current and will give you the opportunity to object to a new subprocessor by emailing support@arkrel.com within 14 days of a change being posted; if you object and we cannot address the concern, either party may terminate the affected part of the Service.

5. International Transfers

Where personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the Standard Contractual Clauses or another valid transfer mechanism recognized under applicable data protection law, incorporated into this DPA by reference to the extent they apply to your use of the Service.

6. Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms.

7. Contact

Questions about this DPA, or a request for a signed copy, can be sent to support@arkrel.com.