Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the agreement between the Customer and CYBER WAVE INC., a corporation existing under the laws of Ontario, Canada (Ontario Corporation Number 1000780137), located in Markham, Ontario, Canada ("CyberWave", "we", "us" or "our"). It describes how CyberWave processes personal information on the Customer's behalf when the Customer uses the Services.

1. Definitions

Terms defined in the Terms of Service (the "Terms") and not defined here keep the meaning given there. The "Agreement" is the Terms, any order or plan selection, this DPA and the other policies the Terms incorporate.

Applicable Privacy Laws — the privacy laws applying to a party here: for CyberWave, the Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where the Customer or the Individuals concerned are in Quebec, Alberta or British Columbia, the applicable provincial statute, including Quebec's Act respecting the protection of personal information in the private sector ("the Quebec Act"). Section 13 addresses the EU and UK GDPR.

Customer Content — the data, files, records and text the Customer or its Users submit to, or generate in, the Services: evidence files, policies, risks, assessments, vendor records, actions and notes.

Customer Personal Information — Personal Information within Customer Content that CyberWave processes on the Customer's behalf. It excludes CyberWave Account Data.

CyberWave Account Data — Personal Information CyberWave processes for its own purposes: account identity, billing, support correspondence, platform security monitoring and business contacts. The Privacy Policy governs it; this DPA does not.

Individual — an identifiable natural person to whom Personal Information relates; a "data subject" under the EU or UK GDPR.

Personal Information — information about an identifiable individual, read broadly: a work email address used as a credential, a user identifier, an IP address in a security log, an employee's name typed into a free-text field or contained in an uploaded document. "Processing" is any operation performed on it.

Security Incident — a confirmed breach of CyberWave's security safeguards resulting in unauthorised access to, or unauthorised disclosure, loss, alteration or destruction of, Customer Personal Information held by CyberWave or a Subprocessor. Unsuccessful attempts that compromise nothing are not Security Incidents, subject to 11.6.

Services — CyberWave Sentinel and the other services described in the Terms, including any free trial and any advisory service delivered under a statement of work.

Subprocessor — a third party engaged by CyberWave that processes Customer Personal Information in providing the Services. The Subprocessor List is the version-controlled list of them at /legal/subprocessors/, version SUBPROCESSORS_2026_09_V1.

User — an individual the Customer authorises to use the Services, including an Administrator.

2. Scope and application

2.1 This DPA applies where CyberWave processes Customer Personal Information on the Customer's behalf in providing the Services. It covers every plan, the free trial and advisory engagements unless a signed statement of work says otherwise. It does not govern CyberWave Account Data, or aggregate statistics identifying no Individual and no Customer. It takes effect without a separate signature; CyberWave will sign a copy on request.

2.2 Acceptance and authority. The person accepting the Terms represents that they are of legal age to contract, that they are using the Services for business or professional purposes and not for personal, family or household purposes, and that they have authority to bind the organisation identified as the Customer. Where mandatory consumer protection law nonetheless applies, that law prevails over any inconsistent provision of this DPA.

2.3 The free trial. The 14-day free trial of the plan the Customer selects, Essentials or Full Platform, is covered by this DPA in full. No payment card is required. There is no automatic charge and no automatic conversion to a paid subscription. A trial is not a paid plan and includes no fees. Continuing after the trial means choosing a paid subscription. Customer Content is not deleted merely because a trial has ended. Deletion is governed by section 14 and by nothing else.

2.4 What the Services are not. CyberWave does not certify compliance, issue audit opinions, guarantee compliance, or replace auditors, certification bodies or legal advisers. It is not an insurer or broker, does not bind coverage, and does not guarantee coverage, premium, insurer acceptance or claim outcomes. It does not operate a security operations centre or provide 24/7 monitoring, and it does not provide managed detection and response, incident response retainers, penetration testing or forensics. Nothing here transfers the Customer's own compliance obligations to CyberWave.

3. Roles of the parties

3.1 For Customer Personal Information the Customer determines the purposes and is the accountable organisation; CyberWave processes on its behalf and on its instructions. Where a law applying to the Customer uses the terms "controller" and "processor", the Customer is the controller and CyberWave the processor.

3.2 PIPEDA has no controller and processor split. PIPEDA allocates obligations by control over information and by purpose, not by role labels. CyberWave's accountability for information transferred to it for processing is therefore not extinguished by a label: it remains answerable for what its Subprocessors do. A contract allocates risk; it does not move accountability.

3.3 Where a Customer holds Personal Information on behalf of its own customers, its instructions are given in that capacity and CyberWave acts as a subprocessor; the Customer is responsible for ensuring its own agreements permit that appointment.

3.4 CyberWave is the accountable organisation for CyberWave Account Data, described in the Privacy Policy. It does not use Customer Personal Information for its own purposes — no cross-tenant benchmarking, no threat-intelligence or data product, no marketing or case studies, and no training or fine-tuning of AI models.

4. Processing instructions

4.1 What the instructions are. CyberWave processes Customer Personal Information only on the Customer's documented instructions: the Agreement, including this DPA and Schedule 1; the configuration, settings and features the Customer and its Users select; and any further written instruction the parties agree. Using a feature is an instruction to process the data that feature processes. An instruction requiring CyberWave to build or operate something the Services do not do today is not a documented instruction; CyberWave may decline it or price it.

4.2 No other purposes. CyberWave will not process Customer Personal Information for any purpose beyond providing, securing, maintaining and supporting the Services under those instructions, or as required by law. It does not sell it, disclose it for advertising, or share it with any third party except a Subprocessor engaged under section 8 or as section 10 requires.

4.3 Instructions that appear unlawful. If CyberWave forms the view that an instruction would cause it to contravene Applicable Privacy Laws, it will say so promptly and may suspend the affected processing until the instruction is resolved. It does not undertake to advise the Customer on the lawfulness of the Customer's own purposes.

4.4 AI features. Sentinel's AI features are assistive and optional. When a User makes an AI request, CyberWave's servers — never the User's browser — send it to a third-party AI provider named on the Subprocessor List.

• What a request sends. A request sends the item the User asked about and often a summary of the workspace: record names, statuses, counts and saved answers. Policy review sends the text of the policy being reviewed, and contract review sends the contract text the User pastes. No AI model reads uploaded evidence files; they receive text extraction and keyword classification.
• What CyberWave stores. CyberWave stores each AI result in the Customer's workspace: the output, a short summary, and a short excerpt or label of the request of up to 300 characters. It also records a short excerpt of the request in an append-only audit log, and records AI usage against the monthly credit allowance for the Customer's plan. Some features write AI output into workspace records, for example vendor and contract summaries and evidence review notes.

The following statements describe CyberWave's own conduct and are contractual commitments:

• Grounding context is assembled from the requesting Customer's own records only. Tenant scoping is enforced by database row-level security and by server-side authorisation — not by the wording of a prompt.
• CyberWave operates no model training or fine-tuning pipeline and does not export Customer Content for model development. No such capability exists in the product. This statement concerns CyberWave's own conduct; how the AI provider handles the content it receives is set by that provider's own terms, and this DPA makes no statement about it.
• AI output is assistive: it may contain errors and must be reviewed before it is relied on, it does not replace professional judgement, and the Customer remains responsible for decisions made using it.

5. Customer obligations and warranties

5.1 Lawful basis and notice. The Customer warrants that it has the authority, consents and lawful basis required to submit Customer Personal Information and to instruct CyberWave to process it, and that it has given the Individuals concerned the notice their law requires — including that their information may be processed by a service provider outside their province, outside Quebec where the Quebec Act applies, and outside Canada. Section 13 and the Subprocessor List exist so that notice can be accurate.

5.2 Minimise what is uploaded. A readiness programme rarely requires named individuals in evidence text. The Customer should prefer role and organisation-level records, and should not upload employee rosters, personnel files or unrelated documents into evidence or free-text fields.

5.3 Data the Services are not built for. The Customer must not submit payment card data (card details go directly to the payment processor and never reach CyberWave's systems), government identifiers or biometric data. It must not submit health information subject to Ontario's Personal Health Information Protection Act or an equivalent statute, or use the Services in a way that would make CyberWave an agent or service provider under such a statute, unless the parties agree that use in writing in advance.

5.4 Accuracy and access. The Customer is responsible for the accuracy of Customer Content and for correcting it — which matters most where a record attributes a control, a gap or a failure to a named person. It is also responsible for whom it invites, what permissions it grants, for removing access when a User leaves, and for keeping its Administrator and notice contacts current, because notices under sections 8 and 11 go to them.

6. Confidentiality of personnel

6.1 Access to Customer Personal Information is limited to personnel who need it to provide, support, secure or maintain the Services.

6.2 An honest statement about access. CyberWave is a small team. Its personnel can access production systems to investigate a defect, answer a support request, or handle a suspected abuse or security issue. CyberWave does not promise that no human will ever see Customer Content, because that promise would be untrue. It commits instead that such access is confined to those purposes and to personnel who need it.

7. Security measures

7.1 CyberWave will implement and maintain technical and organisational measures designed to protect Customer Personal Information against unauthorised access, disclosure, loss, alteration and destruction, appropriate to the sensitivity of the information, the volume held and the medium on which it is stored. The measures in force are in Schedule 2. CyberWave may update them as the Services and the threat environment change, but will not materially reduce the overall level of protection during a subscription term.

7.2 Contextual sensitivity. A readiness workspace concentrates information useful to an attacker: control gaps, unremediated findings, incident history, and the identity of individuals accountable for controls. Both parties acknowledge that this raises the sensitivity of Customer Content, and with it the standard expected under 7.1, above what the data categories alone would suggest.

8. Subprocessors and change notice

8.1 General authorisation. The Customer authorises CyberWave to engage Subprocessors. Those engaged as at the date of this DPA are named on the Subprocessor List, with what each does, what it can see and where it processes. The list is not reproduced here so that there is one authoritative version of it.

8.2 What CyberWave owes. CyberWave remains responsible to the Customer for a Subprocessor's performance.

8.3 Notice of a new Subprocessor. CyberWave will give notice at least thirty (30) days before a new Subprocessor begins processing Customer Personal Information, by both updating the published Subprocessor List — including its version string and date — and writing to the Customer's Administrator and notice contacts.

8.4 Objection. The Customer may object within thirty (30) days of notice, on reasonable grounds relating to the protection of Personal Information, and the parties will discuss it in good faith. If it is not resolved, CyberWave will either not appoint that Subprocessor for the Customer's data, or the Customer may terminate the affected Services without penalty and receive a refund of prepaid, unused fees for the terminated portion of the term, under the termination and refund provisions of the Terms. Termination on this ground creates no further liability for either party. This is notice-and-objection, not a veto: CyberWave cannot obtain advance consent from every customer before changing a hosting region, an email relay or an AI provider, and one non-responding customer must not be able to block a migration the platform needs.

8.5 Urgent replacement. Where a Subprocessor must be added or replaced immediately to preserve the security or continuity of the Services, CyberWave may make the change first and give notice as soon as practicable afterwards. It will not use this provision to avoid the notice period.

9. Assistance with requests from Individuals

9.1 Self-service first. Through its owners and Administrators the Customer can access and correct Customer Content, delete records and uploaded files, and export workspace data in the product. In most cases that is how a request from an Individual is answered.

9.2 Requests that reach CyberWave directly. An Individual, often an employee of the Customer, may write to CyberWave. Where the request concerns Customer Personal Information, CyberWave will not respond to its substance: it will acknowledge the request, explain that it processes the information on the Customer's behalf, and forward it to the Customer's notice contacts without undue delay. Where the request concerns CyberWave Account Data, CyberWave answers it under the Privacy Policy.

9.3 Assistance and timing. Where the Customer cannot answer a request using the Services alone, CyberWave will give reasonable assistance, taking into account the nature of the processing and the information available to it; assistance beyond ordinary use of the Services may be charged at then-current rates, agreed in advance. PIPEDA requires a response to a written access request within thirty days, and the Quebec Act a written reply promptly and within thirty days. Those clocks run against the accountable organisation: CyberWave's role is to enable the Customer to meet them, not to assume them, so requests should reach it promptly rather than near the end of the period.

9.4 Records containing more than one person. A single record — an audit trail, a comment thread, a shared assessment — routinely contains information about several Individuals. Severing third-party information is the Customer's task as the responding organisation, and CyberWave will not export a raw log in answer to a request from an Individual.

9.5 Retention while a request is open. Where the Customer tells CyberWave that a request or challenge remains open in respect of identified Customer Personal Information, CyberWave will suspend any deletion it would otherwise perform under section 14 until the Customer confirms the matter is closed, as PIPEDA requires retention while recourse remains available.

10. Government and law-enforcement requests

10.1 CyberWave will not disclose Customer Personal Information to a government body, law-enforcement agency or court except where compelled by valid legal process or instructed by the Customer. On receiving such a request it will: assess whether the request is valid and binding; seek to redirect the requester to the Customer, as the organisation that controls the information; notify the Customer promptly and, where possible, before disclosing, unless legally prohibited or where notice would create a risk to a person's safety; disclose only the minimum the process compels; and, on reasonable grounds, challenge a request that is overbroad, defective or unlawful.

10.2 The limit CyberWave cannot contract around. Where Customer Personal Information is processed outside Canada — see section 13 — it may be subject to the lawful access powers of that jurisdiction's courts, law enforcement and national security authorities. No contract, including this one, overrides a valid foreign legal order, and CyberWave will not represent otherwise.

11. Security incidents and confidentiality incidents

11.1 Timing. CyberWave will notify the Customer of a Security Incident affecting that Customer's Personal Information without undue delay after becoming aware of it.

11.2 What "becoming aware" means. CyberWave becomes aware when its personnel have confirmed that a Security Incident has occurred. An alert firing, an anomaly under investigation or an unverified report is not by itself awareness. CyberWave will investigate suspected incidents promptly and will not delay confirmation in order to delay notice.

11.3 What the notice contains. What CyberWave can give at the time: the nature of the incident, the categories of Personal Information involved, the Customer records or systems identified as affected, the approximate number of Individuals affected where it can be estimated, the likely consequences, the measures taken and proposed, and a contact point. Incomplete information is not a reason to delay the first notice; CyberWave will supplement it as the investigation progresses. A notice given or action taken under this section is not an admission of fault, liability or breach.

11.4 Assistance. CyberWave will provide the information the Customer reasonably needs to make its own statutory determinations — whether the incident creates a real risk of significant harm under PIPEDA, or a risk of serious injury under the Quebec Act — and to prepare any report or notification it must make.

11.5 Who notifies. For Customer Personal Information the Customer reports to regulators and notifies affected Individuals, because it controls the information and holds the relationship with those Individuals. CyberWave will not notify on the Customer's behalf unless the parties agree in writing, and makes its own reports in respect of CyberWave Account Data.

11.6 Quebec: attempted violations and the person in charge. The Quebec Act imposes a direct statutory duty on a service provider to notify the customer's person in charge of the protection of personal information, without delay, of any violation or attempted violation of its confidentiality obligations — a duty not limited to material or successful incidents. A Customer to which the Quebec Act applies should give CyberWave the name and contact details of its person in charge, and notices will go to that person as well as to the Administrator contacts.

11.7 This section is a notification and assistance obligation, not an incident response service. CyberWave does not respond to incidents in the Customer's own environment and does not provide incident response retainers or forensics.

12. Privacy impact assessments and regulator engagement

12.1 CyberWave will provide, on reasonable request, the information reasonably available to it that the Customer needs for a privacy impact assessment, a data protection impact assessment, a vendor risk assessment or a security review: the Subprocessor List, Schedule 1, Schedule 2 and the processing locations in 13.1.

12.2 Quebec transfer assessments. The Quebec Act requires an organisation to conduct a privacy impact assessment before communicating personal information outside Quebec, weighing the sensitivity of the information, the purposes of the use, the protection measures including contractual ones, and the legal framework of the receiving jurisdiction. The processing in section 13 is squarely within that requirement. CyberWave will support the Customer's assessment with the material above, and will agree in writing any additional measures the assessment identifies as necessary so far as it can deliver them.

12.3 Where a regulator makes an inquiry of the Customer concerning CyberWave's processing, CyberWave will cooperate reasonably. Where a regulator approaches CyberWave directly, it will notify the Customer unless prohibited.

13. International transfers

13.1 Where processing happens. As at the effective date of this DPA:

13.2 The accurate statement. CyberWave does not claim that all data stays in Canada, because that would be false. The primary database and file storage holding Customer Content are located in Canada. Application hosting and compute, AI features and email delivery involve providers that process data in the United States, and payment processing involves a provider that processes data in the United States and elsewhere. Email sent to the support mailbox may be processed outside Canada.

13.3 Basis under Canadian law. Under PIPEDA a transfer to a service provider for processing is a use rather than a disclosure, and requires accountability and transparency rather than separate consent for each provider or jurisdiction. CyberWave meets that through section 8, the published Subprocessor List and this section; 10.2 states the lawful access limit plainly.

13.4 Customers subject to the EU or UK GDPR. CyberWave does not represent that Standard Contractual Clauses, a UK International Data Transfer Addendum, or any other GDPR transfer mechanism is currently in place. A Customer whose processing is subject to the EU or UK GDPR should contact CyberWave at support@cyberwave.ca before purchase, so that the necessary instruments and a transfer impact assessment can be put in place — or so that the parties can establish that the Services are not suitable for that processing. Nothing in this DPA asserts GDPR compliance.

14. Return and deletion

14.1 During the subscription. The Customer can delete records and uploaded files in the Services at any time, and should use those functions as its primary deletion mechanism.

14.2 On termination. After termination or expiry, the Customer may request return or deletion of Customer Personal Information, including deletion of its workspace, by contacting CyberWave at support@cyberwave.ca. On written request CyberWave will delete Customer Personal Information from the active production systems. A trial that ends is not a deletion event: Customer Content is not deleted because a trial has ended, and it remains subject to this section.

14.3 Active stores and backups behave differently, and are described separately. Deleting a record from the active production systems does not immediately remove every copy of it. CyberWave uses a managed database platform, and that platform operates the backup lifecycle, so copies may persist in backups until they age out of the backup cycle. While they persist they remain subject to the security and confidentiality obligations in this DPA and are not used for any other purpose. A promise of immediate and permanent erasure everywhere, backups included, would be false on the day it was made, and CyberWave does not make it.

14.4 What the product can do today. Deletion of individual records and uploaded files is available in-product, and owners and Administrators can export workspace data in the product. Automated deletion of an entire tenant is deliberately disabled in the product, so full erasure of a workspace is a controlled administrative operation performed on a request made by contacting support@cyberwave.ca, rather than a self-service button.

14.5 What is retained, and why. After deletion under 14.2 CyberWave retains records of acceptance of legal documents, which are append-only because the purpose of a consent record is to survive; entries in the append-only audit log, including the short request excerpts described in 4.4; billing and financial records held by the payment processor, which carry statutory retention; and anything a law requires it to keep. Retained information is used only for the purpose that justifies keeping it. The Customer is responsible for exporting anything it wants to keep before its access ends; CyberWave charges no fee for that export, or for deletion.

15. Audit and information rights

15.1 Documentation first. To support the Customer's audit and verification obligations CyberWave makes available this DPA including Schedules 1 and 2, the Subprocessor List, a description of the data flows and processing locations, and written responses to the Customer's security and privacy questionnaire — one per Customer in any twelve-month period, and a further one after a material change to the Services or the Subprocessor List, at no charge, with a knowledgeable person available for a reasonable discussion by video call. Additional or bespoke assurance work may be charged at then-current rates, agreed in advance.

15.2 Third-party reports. CyberWave does not represent in this DPA that it holds any third-party audit report, certification or penetration test summary. Where CyberWave holds such a report it will provide a copy or summary on request, under confidentiality.

15.3 On-site audit. CyberWave does not offer a general on-site audit right: it does not have the staffing to service one, and granting a right it cannot deliver would be worse than declining it. Instead, where Applicable Privacy Laws require the Customer to be able to verify CyberWave's compliance — as the Quebec Act does, and CyberWave will not refuse that verification on the ground that no on-site audit is offered — or where a regulator requires more than 15.1 and 15.2 give, CyberWave will agree a reasonable verification process: scoped to the Customer's own Personal Information, on reasonable notice in business hours, under confidentiality, subject to the Customer's reasonable costs, and giving no access to another customer's data, to CyberWave's production credentials, or to information whose disclosure would itself create a security risk. Not more than one such exercise will be required in any twelve-month period, except following a Security Incident affecting that Customer.

16. Relationship to the Terms, including liability

16.1 This DPA is part of the Agreement. It creates no separate contract, no separate remedies and no indemnity; indemnities, if any, are those in the Terms.

16.2 Liability. Each party's liability arising out of or in connection with this DPA is subject to the exclusions, limitations and aggregate cap in the Terms, and claims under this DPA and under the Terms aggregate to the same cap rather than to separate caps.

16.3 What cannot be limited. Nothing in this DPA or the Terms limits or excludes liability that cannot be limited or excluded by law. Under the law of Quebec this includes liability for bodily or moral injury, and liability for material injury caused by intentional or gross fault.

17. Duration

17.1 This DPA takes effect when the Customer accepts the Terms and continues for as long as CyberWave processes Customer Personal Information on the Customer's behalf.

17.2 Survival. Sections 6, 10, 14, 16 and 18 survive the end of the Agreement, as does any other provision that by its nature is intended to survive. Sections 6 and 7 continue to apply to any copy of Customer Personal Information remaining in CyberWave's custody after deletion under section 14.

17.3 Changes. CyberWave may update this DPA to reflect a change in the Services, in Applicable Privacy Laws or in its Subprocessors. Where a change materially reduces the Customer's rights or CyberWave's obligations, notice will be given to the Customer's notice contacts before it takes effect, and the version and effective date shown at the top of this DPA will change. Each version is retained so a Customer can see which was in force at any time.

18. Order of precedence

18.1 On a conflict between documents, the following order applies, highest first:

1. mandatory requirements of Applicable Privacy Laws and any other applicable mandatory law;
2. a data processing agreement signed by both parties that expressly amends or replaces this DPA;
3. this DPA, in respect of the processing of Customer Personal Information;
4. the Terms and any order or plan selection;
5. the Privacy Policy, the Subprocessor List, the AI Features & Data Use Notice and the other policies incorporated into the Terms.

18.2 The Privacy Policy describes CyberWave's processing of CyberWave Account Data for its own purposes; it does not reduce any obligation owed under this DPA. Where this DPA and the Subprocessor List differ as to who a Subprocessor is, what it does or where it processes, the Subprocessor List governs, because it is the version-controlled record of that fact.

Schedule 1 — Details of the processing

The description of processing Applicable Privacy Laws require, and the source for the annexes of any transfer instrument agreed under 13.4.

Schedule 2 — Technical and organisational measures

This Schedule describes the measures referred to in section 7.

Architecture and tenancy

• Customer Content is held in a primary database and file storage located in Canada (ca-central-1).
• Tenant isolation is enforced by PostgreSQL row-level security and by server-side authorisation in the application — not by client-side code, and for AI features not by the wording of a prompt.
• Data is encrypted in transit using HTTPS.
• No analytics, advertising or tracking cookies or scripts are used on the CyberWave website or in the application. The application uses essential authentication session cookies set by the authentication provider, several browser local storage entries for interface state, and a service worker that keeps an offline cache of pages on the User's device.
• Application errors are recorded in CyberWave's own database, not sent to a third-party error tracker.
• Card details go directly to the payment processor and never transit or rest in CyberWave's systems.
• AI requests are sent from CyberWave's servers, never from the User's browser. What a request sends, and what CyberWave stores, is described in 4.4.
• Integrations are connection templates and configuration only: there is no live connection to an external identity, endpoint, service-management or productivity platform, and webhooks and API keys are disabled.

Organisational

• Access by CyberWave personnel to Customer Personal Information confined to the purposes and personnel described in section 6.
• Requests from Individuals handled as set out in section 9, including forwarding to the Customer and suspension of deletion while a request remains open.
• Security Incidents notified to the Customer as set out in section 11.

Contact and notices

CYBER WAVE INC. is located in Markham, Ontario, Canada. Questions about this DPA, and requests for the documentation in section 15, go to CyberWave's privacy contact at support@cyberwave.ca (subject: Privacy). Notices to CyberWave under this DPA are given by email to that address, with the topic of the notice in the subject line. Notices from CyberWave under this DPA are given by email to the Customer's Administrator and notice contacts.

End of document. Version DPA_2026_09_V1.