Data Processing Agreement (DPA)

DATA PROCESSING AGREEMENT (DPA)

GDPR Art. 28 / UK GDPR / LGPD / PIPEDA Compliant

Version 1.0 | Effective June 10, 2026

A software product of Violet Organization, a 501(c)(3) non-profit organization

EIN: 81-3855319

www.scantra.ai | Info@scantra.ai

c/o Violet Organization, a 501(c)(3) non-profit organization (EIN: 81-3855319), 210 Lake Dr E, Cherry Hill, NJ 08002

DATA PROCESSING AGREEMENT (DPA)

GDPR Art. 28 / UK GDPR / LGPD / PIPEDA Compliant

Effective Date: June 10, 2026

This DPA is entered into between Scantra.ai DBA Scantra ("Processor") and the subscribing Client ("Controller"). It governs the processing of personal data by the Processor on behalf of the Controller and supplements the Terms of Service.

Section I. DEFINITIONS

• "Personal Data" — any information relating to an identified or identifiable natural person
• "Processing" — any operation performed on Personal Data
• "Data Subject" — the individual to whom Personal Data relates
• "Sub-Processor" — any third party engaged by Processor to process Personal Data

Section II. PROCESSOR OBLIGATIONS

1. Process Personal Data only on documented written instructions from the Controller
2. Ensure personnel with data access are bound by confidentiality
3. Implement appropriate technical and organizational security measures
4. Assist with Data Subject rights requests within legally required timeframes
5. Notify the Controller of any Personal Data breach within 48 hours
6. Delete or return all Personal Data upon termination of services
7. Provide all information necessary to demonstrate compliance and allow audits

Section III. SECURITY MEASURES

Section IV. SUB-PROCESSORS

The current Sub-Processor list is maintained at www.scantra.ai/sub-processors. At least 30 days' notice will be given before adding or replacing Sub-Processors. The Controller may object within 14 days.

Section V. INTERNATIONAL TRANSFERS

Transfers outside the EEA/UK use Standard Contractual Clauses (SCCs), IDTA, adequacy decisions, or other approved mechanisms.

Section VI. AUDIT RIGHTS

Upon 14 days' written notice, the Controller may audit Processor's data processing activities (max once per year, at Controller's expense). Current SOC 2 / ISO 27001 certifications may fulfill audit requirements.

Section VII. TERM & TERMINATION

This DPA remains in effect for the duration of the Terms of Service. Upon termination, Processor will return or securely delete all Personal Data within 30 days and provide written certification.

EU & UK (GDPR Art. 28 / UK GDPR)

This DPA constitutes the Article 28 GDPR / UK GDPR processor agreement. SCCs (Commission Decision 2021/914) are incorporated for international transfers. The Processor cooperates with supervisory authorities.

Brazil (LGPD Art. 39)

The Processor acts as Operador under LGPD, processing data only per Controller's instructions. Assistance is provided with ANPD notifications and data subject requests.

Canada (PIPEDA / Law 25)

Breach notifications comply with PIPEDA mandatory reporting requirements. Quebec clients receive assistance with Law 25 / CAI (72-hour notification) obligations.

California (CCPA / CPRA)

Processor acts as a Service Provider and agrees not to sell, share, retain, use, or disclose Personal Information outside the scope of the Services.

Australia (Privacy Act 1988)

Personal Information of Australian individuals is handled per the APPs. NDB scheme breach notifications are made within 48 hours of assessment. Assistance is provided with OAIC obligations.

Section VIII. EXECUTION

* * *

Copyright 2026 Violet Organization, a 501(c)(3) non-profit organization. All rights reserved.