Data Protection Addendum

Updated: FEBRUARY 2026

Processing arrangements where the Company act as Processor

In the event that Company acts as a data processor (which the parties largely understand will be in the delivery of screening services) on behalf of the Client with regards to Client Personal Data within the scope of an Order Form or this Agreement, the parties agree that the terms of Data Protection Addendum (“DPA”) shall apply, and that such DPA hereby forms part of this Agreement.

1 Company shall only process Client Personal Data, and in particular only transfer Client Personal Data on Client’s documented instructions. Client hereby instructs Company to process the Client Personal Data only as is necessary for the performance of the Products.

2 Company shall promptly inform Client if, in its opinion, an instruction infringes Data Protection Law.

3 Company shall (i) take appropriate technical and organizational measures to assist Client in responding to requests from data subjects for access to or rectification, erasure or portability of Client Personal Data or for restriction of processing or objections to processing of Client Personal Data; (ii) give Client such assistance as it reasonably requests with regards to , impact assessments and legitimate interests assessments under the applicable data privacy laws, taking into account the information available to Company; (iii) give written notice to Client within seventy-two (72) hours, with all reasonable details, if it becomes aware of the occurrence of any personal data breach or other incident prejudicing, or potentially prejudicing, the security of the Client Personal Data.

4 Client warrants that it will not share or disclose in any way, any Client Personal Data which may consist of personal data of anyone under the age of 18 or any personal data consisting of national identifier number (including but not limited to social security number, National Insurance number or Passport number).

5 Client hereby provides consent for Company to engage other processors (“Sub-processors”). Company will ensure that any Sub-processor is a party to a written agreement binding on it, imposing obligations which are equivalent to those in this clause.

6 Company will ensure that all its employees authorized to have access to (or otherwise to process) the Client Personal Data have committed themselves to confidentiality on appropriate terms or are under an appropriate obligation of confidentiality.

7 Subject to the provisions of this clause, and on reasonable advance written notice, Company will make available to Client such information as it reasonably requests and Company is reasonably able to provide, as is necessary to demonstrate Company’s compliance with this clause.

8 At the termination of this Agreement or applicable Order Form, Company will as soon as is practicable, delete any Client Personal Data in Company’s possession. This clause does not require Company to delete or return Client Personal Data which it is required to retain by the applicable law.

Details of Processing

Sub-processors

Amazon Web Services servers are used for the secured and encrypted passage of data via secure SFTP.

Databricks, Inc.

Subject matter and duration of processing

As detailed in the Order Form

Nature and purpose of processing

In order to deliver the Products as detailed in the Order Form

Types of processed personal data

Client Personal Data identified by Client

Categories of data subjects

Data subjects identified by Client

Transfer of Client Personal Data and Location

Client may choose the storage of Client Personal Data supplied by the Client in order to enable the Company to deliver the Products, in an encrypted Windows server hosted on Amazon Web Services at the following locations:

· United States Server: sftp-us.wealthx.com

· Ireland Server: sftp-ie.wealthx.com

· Singapore Server: sftp-sg.wealthx.com