isLUCID DATA PROCESSING AGREEMENT (DPA)

Annex No. 5 to the isLucid Platform Terms and Conditions · Version 26101310/0001 · Last updated: October 13, 2026

This Data Processing Agreement (hereinafter – the DPA) is an integral part of the isLucid Platform Terms and Conditions (hereinafter – the Terms; references in this DPA to the Agreement or the main Agreement are references to the Terms) and is accepted by the Customer together with the Terms. Capitalised terms not defined in this DPA have the meanings given to them in the Terms. For the purposes of the DPA, the Customer is the Data Controller and UAB „Lucid Agreements“ is the Data Processor, to the extent the Service Provider processes personal data on behalf of the Customer.

1. Definitions and subject matter

1.1. The terms “personal data”, “processing”, “controller”, “processor”, “personal data breach” and “sub-processor” used in the DPA have the meanings defined in Regulation (EU) 2016/679 (the GDPR).

1.2. The Data Processor processes personal data only to the extent necessary to provide the Services under the main Agreement and the applicable Order, and only on the documented instructions of the Data Controller, unless processing is required by applicable law; in such case the Data Processor informs the Data Controller in advance, where the law so permits.

1.3. In the event of a conflict between the DPA and the main Agreement regarding the processing of personal data, the provisions of the DPA apply.

1.4. The Data Processor does not use the Customer’s personal data for the training, testing or improvement of its own or third parties’ general AI models as an independent purpose. Such processing may be carried out only if the Parties separately agree on it in writing in advance and, before the commencement of processing, the legal basis applicable to the relevant processing, the role of the Data Processor or other participating person under the GDPR, the transparency and data subject rights requirements and other applicable safeguards have been established and documented. The Customer’s contractual consent alone is not deemed a lawful basis for the processing of data subjects’ personal data under the GDPR. Configuration, testing, error correction and Customer-specific tuning required to provide the Service in accordance with the Customer’s documented instructions are not deemed use for the Data Processor’s own purposes.

1.5. For each Order under which the Data Processor processes personal data on behalf of the Customer, the specific subject matter, purpose, nature and duration of processing, categories of personal data, categories of data subjects, processing of special categories of personal data (if applicable), processing location, retention period and additional Data Controller instructions are set out in the relevant Order or in the Data Processing Schedule set out in Appendix No. 1 to this DPA. This DPA establishes the general legal framework for the processing of personal data applicable to all orders.

1.6. For Orders under the Terms, the Data Processing Schedule set out in Appendix No. 1 to this DPA applies, unless the Customer gives other documented instructions through the Platform.

2. Determination of processing parameters and general categories

2.1. The subject matter, purpose, nature and duration of the specific processing, the categories of personal data and the categories of data subjects are determined in accordance with the relevant Order or the Data Processing Schedule. The Data Processor does not process personal data for a broader purpose or to a broader extent than necessary to perform the specific order and to carry out the documented instructions of the Data Controller.

2.2. Depending on the specific order, processing operations may include the collection, transmission, review, automated analysis and classification, storage, transcription, voice processing, technical logging, alteration, backup, return and erasure of personal data. Only those operations that are necessary for the performance of the specific order apply to it.

2.3. The specific categories of personal data processed are set out in the relevant Order or the Data Processing Schedule. Depending on the Service, they may include identification and contact data, voice recordings and transcriptions, conversation content, technical and contextual data, internal identifiers, Platform user account data, API / tool-call data and other data which the Customer lawfully provides or makes available through the Platform.

2.4. Only the categories of data subjects specified in the relevant Order or the Data Processing Schedule apply to a specific order. Depending on the Service, the possible categories may include the Customer’s employees, candidates, clients, buyers, partners, store employees, Platform users, end users and other persons whose data is lawfully processed using the Platform.

2.5. The processing of special categories of personal data as defined in Article 9 of the GDPR and of data relating to criminal convictions and offences as defined in Article 10 of the GDPR is not envisaged, unless the necessity and legal basis of such processing are expressly set out in the relevant Order or the Data Processing Schedule, and the Parties agree in writing on the applicable additional safeguards before the commencement of such processing.

2.6. Personal data is processed for the entire period set out in the relevant Order or the Data Processing Schedule and retained for the retention period set out therein. If no specific retention period is set, personal data is retained only for as long as necessary to provide the Services, to perform the obligations under the Agreement and the DPA, or for as long as its retention is required by applicable law.

3. Obligations of the Data Processor

3.1. The Data Processor ensures that employees and other authorised persons with access to personal data are bound by confidentiality obligations and process the data only to the extent necessary to perform their functions.

3.2. The Data Processor informs the Data Controller if, in its opinion, an instruction of the Data Controller infringes the GDPR or other applicable data protection laws, and has the right to suspend the execution of such instruction until a lawful solution is agreed.

3.3. The Data Processor maintains the records of processing activities required by Article 30(2) of the GDPR and, upon the Data Controller’s reasonable request, provides the information necessary to assess compliance with the DPA.

3.4. Taking into account the nature of the processing, the Data Processor reasonably assists the Data Controller in fulfilling data subjects’ rights and in complying with the obligations under Articles 32–36 of the GDPR. Assistance exceeding the usual and proportionate scope of cooperation may be charged only after the scope and price have been agreed in writing in advance.

3.5. The Data Controller is responsible for ensuring that the processing of personal data under its instructions has a lawful basis, that data subjects are duly informed (including about call recording and interaction with an artificial intelligence system), that its instructions comply with the GDPR and other applicable laws, and that the processing parameters provided in the Order or the Data Processing Schedule are accurate and complete.

4. Technical and organisational security measures

4.1. The Data Processor implements and maintains appropriate technical and organisational security measures in accordance with Article 32 of the GDPR, taking into account the nature, scope, context and risks of the processing.

4.2. The Data Processor maintains an information security management system based on the principles of the ISO/IEC 27001:2022 standard and, upon the Data Controller’s reasonable request, provides a copy of a valid certificate (if a certificate is held) or a description of the technical and organisational security measures applied.

5. Sub-processors

5.1. The Data Controller grants the Data Processor a general written authorisation to engage sub-processors in accordance with the procedure set out in this DPA. The Data Processor ensures that a sub-processor is bound by the same data protection obligations as are imposed on the Data Processor under this DPA. The current list of sub-processors authorised as at the date of conclusion of this DPA is set out in the table below:

5.2. The Data Processor may change or supplement the list of sub-processors by notifying the Data Controller by e-mail to the address associated with the Customer’s Account no later than 14 (fourteen) calendar days in advance. Within this period the Data Controller may submit a reasoned objection based on a specific data protection risk. The Parties shall in good faith seek a reasonable alternative; if one cannot objectively be found, either Party may terminate only that part of the Service for which the new sub-processor is objectively necessary.

6. Transfers of data outside the EU / EEA

6.1. Unless the specific Order or the Data Processing Schedule provides otherwise, personal data is processed within the territory of the EU / EEA. Transfers of data to, or remote access from, a country outside the EU / EEA are permitted only where a lawful transfer mechanism under Chapter V of the GDPR and other applicable safeguards are in place.

6.2. If standard contractual clauses or another lawful mechanism are required for a transfer, the Parties cooperate in implementing them to the extent necessary for the specific Service.

7. Personal data breaches

7.1. Upon becoming aware of a personal data breach concerning the Customer’s personal data, the Data Processor notifies the Data Controller without undue delay and no later than within 24 hours of becoming aware of it.

7.2. The notification, to the extent the information is available at that time, includes a description of the nature of the breach, the categories and approximate number of affected data and data subjects, a contact person, the likely consequences, the measures taken or planned and other information required for the Data Controller to fulfil its obligations under Articles 33 and 34 of the GDPR.

7.3. The Data Processor documents the personal data breaches identified and, upon the Data Controller’s reasonable request, provides information relating to them to the extent this does not compromise the security of other clients, third parties or systems.

8. Audit

8.1. Upon the Data Controller’s request, the Data Processor provides reasonably necessary information relating to the processing of personal data under the DPA, including available security certificates, descriptions of the measures applied, policy summaries and extracts from audit or compliance documents, to the extent their provision does not compromise the confidentiality, security or trade secrets of other clients or third parties. The Data Processor makes available to the Data Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR.

8.2. An on-site audit may be carried out no more than once every 12 months, upon at least 15 business days’ notice, except where an audit is reasonably necessary due to a security breach that has occurred or a requirement of a competent supervisory authority. The audit is conducted on business days and during working hours, without compromising the data of other clients, trade secrets, the security of the Platform or its uninterrupted operation.

8.3. The auditor may not be a direct competitor of the Data Processor or have a conflict of interest, and must be bound by confidentiality obligations. The Data Controller bears its own and the auditor’s costs; the Data Processor provides usual reasonable cooperation at its own expense, while significant additional staff time or technical demonstrations are charged only upon prior written agreement.

9. Return and deletion of data

9.1. Upon the end of the relevant order or upon receipt of a lawful instruction of the Data Controller, the Data Processor, at the Data Controller’s choice, returns or deletes the personal data within 30 (thirty) calendar days, except where the law requires it to be retained for longer. If the Data Controller does not issue an instruction to return the data within the Data Retrieval Period set out in Clause 11.7 of the Agreement, it is deemed to have chosen deletion. The standard return of personal data in the format specified in Clause 11.7 of the Agreement is free of charge.

9.2. Personal data in backups is deleted within a reasonable technical overwrite cycle and is not used for active processing until then, except to the extent necessary for system recovery or the fulfilment of legal obligations.

10. Liability and term

10.1. The DPA remains in force for as long as the Data Processor processes personal data on behalf of the Customer. The DPA applies together with the limitations of liability of the main Agreement to the extent this does not conflict with mandatory provisions of the GDPR or other applicable laws.

10.2. The Service Provider may amend this DPA, including Appendix No. 1, in accordance with the procedure for amending the Terms set out in Clause 16.3 of the Terms, provided that the amendment does not reduce the level of protection of personal data under this DPA. If an amendment of the DPA is required due to legislation or a decision of a competent authority, the Parties cooperate in good faith to update the DPA to the extent required by law.