Flexnet Data Processing Addendum

Version 1.0, 1 October 2026.

This Data Processing Addendum (DPA) forms part of the Enterprise SaaS Agreement, Order Form or other written subscription agreement (the Agreement) between the customer named in the Agreement (Customer, you) and the Flexnet entity named in the Agreement, being Flexnet Pty Ltd (ACN 678 588 844), Flexnet Inc. or Flexnet CA Inc. (Flexnet, we, us). It applies whenever Flexnet processes Personal Data contained in Customer Data. Capitalised terms not defined here have the meaning given in the Agreement.

This DPA is incorporated into the Agreement by reference and takes effect on the later of the Agreement's commencement date and 1 October 2026. A signed copy is available on request for customers whose internal policies require one.

1. Definitions

• Account Data means Personal Data about Customer's staff, Authorised Users and billing contacts that Flexnet collects to set up, secure, bill and support the Account, and which Flexnet handles as a controller under its Privacy Policy. Account Data is not Customer Data.
• Customer Data means Your Data as defined in the Agreement, to the extent it contains Personal Data.
• Data Protection Laws means all laws that apply to the processing of Personal Data under this DPA, which may include the Privacy Act 1988 (Cth) and the Australian Privacy Principles (Privacy Act), the EU General Data Protection Regulation 2016/679 (GDPR), the GDPR as retained in United Kingdom law and the Data Protection Act 2018 (UK GDPR), the Swiss Federal Act on Data Protection (FADP), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (CCPA), and other United States state privacy laws (US State Laws).
• Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Supervisory Authority have the meanings given in the GDPR. Where the CCPA applies, Controller includes "business", Processor includes "service provider" and Personal Data includes "personal information". Where the Privacy Act applies, Personal Data includes "personal information".
• Hosting Region means the Google Cloud region in which Flexnet provisions Customer's tenant, currently the United States (us-central1), Singapore (asia-southeast1) or Belgium (europe-west1). Flexnet selects the Hosting Region and tells Customer which one applies at onboarding. Flexnet will give Customer at least 30 days' notice before moving Customer Data to a different Hosting Region.
• Restricted Transfer means a transfer of Personal Data that would be prohibited by the GDPR, UK GDPR or FADP without a valid transfer mechanism.
• Security Incident means a Personal Data Breach affecting Customer Data. It does not include unsuccessful attempts or activities that do not compromise Customer Data, such as blocked login attempts, port scans or denial-of-service attempts that do not result in access.
• Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, as completed in Annex 4.
• Sub-processor means any third party, including a Flexnet affiliate, engaged by Flexnet to process Customer Data.
• UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as completed in Annex 4.

2. Roles

2.1 For Customer Data, Customer is the Controller (or, where Customer processes Customer Data on behalf of its own customers, a Processor acting on their instructions) and Flexnet is Customer's Processor.

2.2 For Account Data, Flexnet is a Controller and handles that data under its Privacy Policy. This DPA does not apply to Account Data.

2.3 Where Customer is itself a Processor, Customer warrants that its instructions to Flexnet are consistent with the instructions of the relevant Controller, and that the Controller has authorised Flexnet as a Sub-processor and the Sub-processors listed in Annex 3.

3. Customer's obligations

3.1 Customer is responsible for the accuracy, quality and lawfulness of Customer Data and the means by which Customer obtained it, including providing any notices and obtaining any consents required for Flexnet to process it as described in this DPA and the Agreement. This includes notices to Customer's staff, its wholesale customers and their contacts, and shoppers on any storefront Customer operates on the Platform.

3.2 Customer must not enter special categories of Personal Data, health information, government identifiers or card and bank account numbers into the Platform. Payment details are collected by the payment provider in Annex 3.

3.3 Customer must ensure its instructions comply with Data Protection Laws. Customer is responsible for configuring the Platform, including user permissions, integrations, AI Features and storefront settings, in a way that meets its obligations.

4. Flexnet's obligations

4.1 Instructions. Flexnet will process Customer Data only on Customer's documented instructions, which are: the Agreement, this DPA, Customer's use and configuration of the Platform, and any further written instructions Customer gives that are consistent with the Agreement. Flexnet will tell Customer if, in Flexnet's opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or changed.

4.2 No other use. Flexnet will not sell Customer Data, use it for its own marketing, or use identifiable Customer Data to train machine learning models. Flexnet may create de-identified, aggregated statistics as permitted by the Agreement, and will not attempt to re-identify them.

4.3 Confidentiality. Flexnet will ensure that its personnel who access Customer Data are bound by written confidentiality obligations, have been informed of the confidential nature of the data, and access it only to the extent needed to perform the Services.

4.4 Security. Flexnet will implement and maintain the technical and organisational measures described in Annex 2. Flexnet may update those measures from time to time provided the overall level of protection is not reduced.

4.5 Records and cooperation. Flexnet will keep the records of processing that Data Protection Laws require of a Processor and will cooperate with Supervisory Authorities as the law requires.

5. Sub-processors

5.1 Customer gives Flexnet general authorisation to engage Sub-processors, including Flexnet's affiliates, to process Customer Data in connection with the Services. The Sub-processors engaged at the date of this DPA are listed in Annex 3 and on the current list at flexnet.co/legal/subprocessors, which forms part of this DPA.

5.2 Flexnet will give Customer at least 30 days' notice before a new Sub-processor processes Customer Data, or, where the change is an existing Sub-processor's change to its own sub-processors, the shorter period of notice that Flexnet itself receives. Notice is by email to Customer's billing email or to another address Customer nominates in writing. Customer may object in writing within the notice period on reasonable grounds relating to data protection. If Customer objects, Flexnet will work with Customer in good faith to resolve the objection, which may include Flexnet not using the Sub-processor for Customer Data. If no resolution is reached within 30 days of the objection, Customer may terminate the affected Services on written notice and Flexnet will refund any prepaid fees for the period after termination.

5.3 Flexnet will impose on each Sub-processor data protection obligations that are no less protective than those in this DPA, to the extent applicable to the services the Sub-processor provides, and remains liable for the Sub-processor's performance as provided in the Agreement.

5.4 Flexnet entities. Flexnet Pty Ltd owns and operates the Platform and provides engineering support. Flexnet Inc. and Flexnet CA Inc., both wholly owned subsidiaries of Flexnet Pty Ltd, sell and support the Platform in North America. Where Customer contracts with Flexnet Inc. or Flexnet CA Inc., Flexnet Pty Ltd is a Sub-processor for hosting, operation, engineering and support of the Platform. Each Flexnet entity is a Sub-processor for customer support for the other entities' customers. They are bound to each other by written intercompany agreements covering confidentiality and security.

6. Data location and international transfers

6.1 Location. Flexnet stores Customer Data in the Hosting Region. A limited set of routing and configuration data (tenant identifiers, subdomain, region, integration mappings and support access records) is stored in Flexnet's global control plane in the United States. Support and engineering access may occur from Australia, the United States and Canada.

6.2 Australia. Where the Privacy Act applies to Customer, Customer acknowledges that Flexnet will disclose Customer Data to recipients in the countries listed in Annex 3 and consents to that disclosure for the purposes of APP 8. Flexnet will take reasonable steps to ensure those recipients handle the data consistently with the Australian Privacy Principles, including by contract.

6.3 EU, EEA and Switzerland. Where the processing involves a Restricted Transfer from the EEA or Switzerland to Flexnet, the SCCs are incorporated into this DPA and completed as set out in Annex 4. Customer is the data exporter and Flexnet is the data importer. Where Customer is a Controller, Module Two applies; where Customer is a Processor, Module Three applies.

6.4 United Kingdom. Where the processing involves a Restricted Transfer from the United Kingdom to Flexnet, the SCCs as completed in Annex 4 apply as amended by the UK Addendum, which is incorporated into this DPA.

6.5 Onward transfers. Flexnet will ensure that Restricted Transfers to Sub-processors are covered by a valid transfer mechanism under Data Protection Laws.

6.6 Change in law. If a transfer mechanism relied on under this clause becomes invalid, the parties will cooperate in good faith to put in place an alternative mechanism, and Flexnet may suspend the affected transfer until one is in place.

7. Data Subject requests

7.1 The Platform lets Customer view, export, correct and delete records for its Data Subjects. Flexnet will provide reasonable additional assistance with requests to access, correct, delete, restrict, port or object to the processing of Customer Data, taking into account the nature of the processing, at no charge for requests of reasonable scope and frequency.

7.2 If Flexnet receives a request directly from a Data Subject whose data is Customer Data, Flexnet will not respond except to direct the Data Subject to Customer, and will forward the request to Customer within five business days.

8. Security Incidents

8.1 Flexnet will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. The notice will describe the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Flexnet may provide the information in phases as it becomes available.

8.2 Flexnet will take reasonable steps to contain and remediate the Security Incident and will provide the information Customer reasonably needs to meet its own notification obligations to Supervisory Authorities and Data Subjects.

8.3 Notice of a Security Incident is not an admission of fault or liability.

9. Assessments and consultations

Taking into account the nature of the processing and the information available to it, Flexnet will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities that Data Protection Laws require. Flexnet may charge its then-current professional services rates for assistance that exceeds eight hours in any 12-month period.

10. Audits

10.1 On request, no more than once every 12 months, Flexnet will complete a reasonable written security questionnaire and provide summaries of any independent security assessments it holds, subject to confidentiality.

10.2 Where Data Protection Laws give Customer a right to audit that cannot be satisfied under clause 10.1, or where a Supervisory Authority requires it, or following a Security Incident, Customer or an independent auditor bound by confidentiality may audit Flexnet's compliance with this DPA on at least 30 days' written notice, during business hours, no more than once in any 12-month period unless required by a Supervisory Authority, without access to other customers' data, and at Customer's cost. Flexnet may require the auditor to sign a confidentiality agreement.

11. Return and deletion

11.1 During the term, Customer can export Customer Data through the Platform's export functions or by written request to Flexnet.

11.2 For 30 days after the Agreement ends, Flexnet will keep Customer Data available for export on Customer's written request. After that period Flexnet will delete Customer Data from its production systems within 90 days, and copies in backups will be overwritten in the ordinary backup rotation described in Annex 2. Flexnet will confirm deletion in writing on request.

11.3 Flexnet may retain Customer Data to the extent required by law, and will continue to protect it under this DPA for as long as it is retained.

12. AI Features

12.1 The Platform and Flexnet's support service include features that use large language models provided by the AI Sub-processors listed in Annex 3 (AI Features). At the date of this DPA the AI Features are: lead research, which sends a prospect's business name and address and runs web searches to summarise public information; note drafting, which sends company name, the names of the people mentioned and the note text; and support diagnostics, which allow Flexnet support staff to use an AI assistant within Flexnet's support platform to read Customer's configuration and records in order to answer Customer's support requests.

12.2 AI Sub-processors process Customer Data as processors under written terms that limit processing to providing the service and to abuse monitoring, prohibit using Customer Data to train their models, retain inputs only for a limited period, and cover international transfers with the SCCs and the UK Addendum. Inputs sent to OpenAI are deleted within 30 days.

12.3 Lead research and note drafting run only when an Authorised User chooses to use them. AI output is provided as a suggestion for review by Customer's staff or Flexnet's support staff. Flexnet does not use AI Features to make decisions that produce legal or similarly significant effects on Data Subjects, and Customer must not configure the Platform to do so.

13. United States state law terms

Where the CCPA or another US State Law applies to Customer Data, Flexnet is a service provider or processor and: (a) will process Customer Data only for the business purpose of providing the Services under the Agreement; (b) will not sell or share Customer Data; (c) will not retain, use or disclose Customer Data outside the direct business relationship with Customer or for any purpose other than the business purpose; (d) will not combine Customer Data with Personal Data it receives from others except as permitted by law; (e) will notify Customer if it determines it can no longer meet its obligations under US State Laws; (f) grants Customer the right to take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Data; and (g) certifies that it understands these restrictions. Flexnet will comply with applicable US State Laws and provide the same level of privacy protection they require.

14. Australian terms

Where the Privacy Act applies to Customer, Flexnet will handle Customer Data in a manner consistent with the Australian Privacy Principles as if it were an APP entity, will not do anything that would cause Customer to breach the Privacy Act, and will cooperate with Customer's assessment and notification of eligible data breaches under Part IIIC of the Privacy Act.

15. Liability

Each party's liability arising out of or in connection with this DPA, including the SCCs and the UK Addendum, is subject to the exclusions and limitations of liability in the Agreement, and the parties' total combined liability under the Agreement and this DPA will not exceed the cap in the Agreement. Nothing in this clause limits either party's liability to Data Subjects under the SCCs.

16. General

16.1 This DPA prevails over the Agreement to the extent of any inconsistency about the processing of Personal Data. The SCCs and UK Addendum prevail over this DPA to the extent of any inconsistency.

16.2 This DPA continues for as long as Flexnet processes Customer Data, notwithstanding the end of the Agreement.

16.3 Flexnet may update this DPA to reflect changes in Data Protection Laws or the Services on 30 days' notice, provided the changes do not materially reduce the protection given to Customer Data. Customer may object in the same way as for a new Sub-processor.

16.4 This DPA is governed by the law governing the Agreement, except that the SCCs and UK Addendum are governed by the law stated in them.

Annex 1: Description of processing

Subject matter. Provision of the Flexnet platform: customer relationship management, sales and leads, ordering, invoicing, inventory and production management, online storefronts, integrations with accounting, e-commerce, payment and logistics systems, and related support.

Duration. The term of the Agreement plus the return and deletion period in clause 11.

Nature and purpose. Hosting, storage, backup, display, transmission to integrations at Customer's direction, generation of documents (invoices, delivery dockets, labels), sending of transactional email and SMS at Customer's direction, search, analytics presented to Customer, AI Features, and troubleshooting support.

Categories of Data Subjects. Customer's staff and Authorised Users (in their capacity as users of Customer Data); Customer's wholesale customers and their staff and contacts; shoppers and account holders on Customer's storefront; leads and prospects; suppliers and carriers; recipients of deliveries.

Categories of Personal Data. Names, business names and roles; email addresses, phone numbers and postal and delivery addresses; order, quote, invoice, payment status and delivery history; storefront account credentials (hashed) and preferences; notes and communications recorded by Customer; IP addresses and usage data for storefront accounts; geocoded addresses.

Special categories. None intended. Customer must not upload them.

Frequency. Continuous, for the duration of the Agreement.

Retention. For the term, then as set out in clause 11. Change history of records is kept for 60 days and logs for 30 days.

Transfers. To the Hosting Region and the Sub-processors and locations in Annex 3.

Annex 2: Technical and organisational measures

A more detailed description is available under a non-disclosure agreement on request.

• Encryption in transit. All connections to the Platform and between Flexnet services use TLS 1.2 or higher. Cloudflare terminates public traffic and forwards to Google Cloud over encrypted connections.
• Encryption at rest. Databases, file storage, search indexes and backups on Google Cloud are encrypted at rest with AES-256 using Google-managed keys. Integration credentials and payment provider credentials are additionally encrypted at the application level.
• Tenant isolation. Every record carries a tenant identifier and the application's data access layer enforces tenant scoping on every query. Cross-tenant queries are prohibited by default and are only available to Flexnet root staff for support, with each access logged.
• Access control. Role-based permissions within the Platform. Flexnet staff access to production systems is limited to named engineers, uses individual accounts with multi-factor authentication enforced on the cloud console, follows least privilege, and is removed on offboarding. Administrative and support actions by Flexnet staff, including AI-assisted support diagnostics, are recorded in an audit log.
• Secrets management. Credentials and keys are stored in Google Secret Manager and injected at runtime, never in source code.
• Network security. Cloudflare provides DDoS protection and web application firewall rules in front of the Platform. Regional services communicate over private networking. Databases are not exposed to the internet.
• Backups and recovery. Databases are backed up automatically every day, seven daily backups are retained, and point-in-time recovery is enabled. Control-plane data is backed up daily and retained for 14 days. Deleted Customer Data therefore leaves backup media within 14 days of deletion from production.
• Monitoring and logging. Application errors are captured in an error monitoring service configured to scrub credentials and sensitive fields. Infrastructure and application logs are retained for 30 days.
• Vulnerability management. Dependencies are updated regularly and security advisories are reviewed. Code changes require review and pass automated tests before deployment.
• Incident response. A written incident response plan defines severity levels, containment, evidence preservation, remediation, verification and notification, including customer notification within 72 hours of becoming aware of a Security Incident.
• Personnel. Staff and contractors are bound by confidentiality obligations and receive guidance on handling personal data.
• Data location. Customer Data is stored in the Hosting Region. Control-plane data is stored in the United States.
• Deletion. Customer Data is deleted on the schedule in clause 11 and backup media is overwritten in the ordinary rotation.

Annex 3: Sub-processors

Kept in step with the public page at flexnet.co/legal/subprocessors.

Flexnet's affiliates act as Sub-processors for each other's customers as described in clause 5.4.

Integrations that Customer connects itself, such as accounting, e-commerce, payment and shipping providers, are Customer's own processors and are not Sub-processors of Flexnet. Flexnet's own sales, marketing and website analytics tools do not process Customer Data and are not Sub-processors.

Annex 4: Transfer mechanisms

A. EU Standard Contractual Clauses. The SCCs apply with the following selections:

• Module Two (controller to processor) where Customer is a Controller; Module Three (processor to processor) where Customer is a Processor.
• Clause 7 (docking clause): included.
• Clause 9 (use of sub-processors): Option 2, general written authorisation, with the notice period in clause 5.2 of this DPA.
• Clause 11 (redress): the optional language is not included.
• Clause 13 (supervision): the Supervisory Authority identified in accordance with clause 13 and Annex I.C, being the authority of the EU member state in which the data exporter is established or, where the exporter is not established in the EU, the authority of the member state in which the exporter's representative is established or in which the Data Subjects are located.
• Clause 17 (governing law): Option 1, the law of Ireland.
• Clause 18 (forum): the courts of Ireland.
• Annex I.A (parties): Customer as data exporter and Flexnet as data importer, with the details in the Agreement. Annex I.B (description of transfer): as in Annex 1 of this DPA. Annex I.C: as above. Annex II (measures): as in Annex 2 of this DPA. Annex III (sub-processors): as in Annex 3 of this DPA.

B. Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; the term "member state" is not read so as to exclude Data Subjects in Switzerland from enforcing their rights in Switzerland; and the SCCs also protect data of legal entities until the FADP no longer does so.

C. United Kingdom. For transfers subject to the UK GDPR, the SCCs as completed above apply as amended by the UK Addendum, with: Table 1 (parties) completed with the details in the Agreement; Table 2 (selected SCCs) being the SCCs with the selections in Part A; Table 3 (appendix information) being Annexes 1, 2 and 3 of this DPA; and Table 4 (ending the Addendum) allowing either the importer or the exporter to end the Addendum as set out in section 19 of the Addendum.