Data Processing Agreement

Rhomdroid Platform and Software Products

Effective Date: October 13, 2026

Last Updated: October 31, 2026

1. WHEN THIS AGREEMENT APPLIES

1.1. This Data Processing Agreement (the "DPA") is between Mastershop S.A., operating as Rhomdroid (the "Company"), and the User. It forms part of the Terms of Service (the "Terms"). Capitalized terms not defined here have the meaning given in the Terms.

1.2. The DPA applies only when the User, or an entity the User represents (the "Customer"), uses the Platform to process personal data of which the Customer is the controller ("Customer Personal Data"). Examples are data about the Customer's patients, clients or staff that reaches AI agents through an integration, or that the Customer's users submit to the Platform. If you use the Platform only for yourself, this DPA has no effect for you.

1.3. A User accepting this DPA on behalf of an entity warrants that they are authorized to bind it (Terms §2.2).

1.4. For Customer Personal Data, this DPA prevails over the Terms where the two conflict. Integration Terms may add provisions for a specific integration, and those provisions prevail for that integration.

2. ROLES

2.1. The Customer is the controller (responsable del tratamiento). The Company is the processor (encargado del tratamiento) under Article 25 of Argentine Ley 25.326 and its regulatory decree, and under Article 28 of the GDPR where it applies.

2.2. Personal data the Company holds about the User for its own purposes, such as account data, is not Customer Personal Data. The Privacy Policy governs it.

3. SUBJECT MATTER, NATURE, PURPOSE AND DURATION

3.1. Subject matter: Customer Personal Data processed through the Platform.

3.2. Nature: receiving the data; relaying it to Sub-Processors, including AI providers; running tools and integrations on it; storing it as conversation content, contact records and User Content; and, where the Customer turns on such features, analysing it to produce the insights the Customer asks for.

3.3. Purpose: providing the Platform services that the Customer's users request.

3.4. Duration: while the Customer uses the Platform, plus the deletion periods in Section 12.

3.5. Data subjects and categories of data are those the Customer chooses to process. They depend on the content the Customer submits and the integrations it activates. Each integration's Integration Terms describe the data that integration handles.

4. INSTRUCTIONS

4.1. The Company processes Customer Personal Data only on the Customer's documented instructions. These are this DPA and the Terms, together with:

• the Customer's configuration of the Platform,
• the requests its users make to AI agents, and
• the actions its users approve.

4.2. If the Company considers that an instruction infringes data protection law, it will tell the Customer.

4.3. Instructions that go beyond what the Platform does require a separate agreement.

5. PURPOSE LIMITATION

5.1. The Company will not use Customer Personal Data for any purpose of its own, and will not sell it.

5.2. The Company will not disclose Customer Personal Data to anyone except its Sub-Processors (Section 8) or where the law requires it.

5.3. The training restriction in Terms §7.3 applies.

6. CONFIDENTIALITY

The Company keeps Customer Personal Data confidential, as Article 10 of Ley 25.326 requires, including after this DPA ends. Anyone acting for the Company with access to Customer Personal Data is bound by confidentiality. That access is limited to what support, security or a legal obligation requires.

7. SECURITY

In addition to the measures in Terms §7.4:

• data in transit is encrypted with TLS;
• integration credentials are stored encrypted at rest;
• conversation content and User Content are accessible only to the account that owns them;
• content returned by integrations is passed to AI agents as untrusted data, never as instructions;
• where an integration provides for it, actions with real-world effect require a user's on-screen approval of the exact request.

8. SUB-PROCESSORS

8.1. The Customer gives general authorization for the Sub-Processors listed in Terms §7.6.

8.2. The Company engages each Sub-Processor under written terms that protect the data and bind it to confidentiality and security obligations. The Company remains responsible to the Customer for its Sub-Processors' performance of those obligations. Each Sub-Processor may engage its own sub-processors under written terms that protect the data at least as well as this DPA requires; each Sub-Processor publishes its own list.

8.3. The Company will give notice of a new Sub-Processor under Terms §7.6 before that Sub-Processor processes Customer Personal Data.

8.4. The Customer may object by ceasing to use the affected feature or by closing its Account. These are its only remedies for an objection.

9. INTERNATIONAL TRANSFERS

9.1. The Customer authorizes transfers of Customer Personal Data to the countries where the Sub-Processors in Terms §7.6 operate. These include the United States, where the AI providers process data.

9.2. Argentina does not recognize the United States as providing adequate protection. The Company makes these transfers under Article 12 of Ley 25.326, relying on the Customer's authorization and on contractual safeguards with each Sub-Processor (Terms §7.7). Where the GDPR applies, the Company relies on Standard Contractual Clauses or another valid mechanism.

9.3. The Customer is responsible for telling its data subjects that their data may be transferred abroad.

10. DATA SUBJECT REQUESTS

10.1. Data subjects exercise their rights against the Customer. If the Company receives such a request, it will forward it to the Customer and will not answer it itself.

10.2. The Company will give the Customer reasonable assistance with requests concerning Customer Personal Data held in the Platform.

11. SECURITY INCIDENTS

11.1. The Company will notify the Customer without undue delay after becoming aware of a security incident affecting Customer Personal Data. It will share the information it has and cooperate with the Customer's response.

11.2. The Customer decides whether to notify the authority and the data subjects.

11.3. A notification is not an admission of fault.

12. DELETION

12.1. Conversation content is deleted between 30 and 37 days after its last activity (Privacy Policy §8). The Customer may ask for earlier deletion at any time.

12.2. User Content, including contact records and insights that the Customer's assistants save when the Customer turns those options on, is kept until the Customer deletes it. On Account closure it is available for export for 30 days (Terms §11.4(c)) and then deleted within 90 days (Terms §7.8).

12.3. Integration credentials stay stored until the Customer deletes them. Disconnecting an integration stops their use.

12.4. On written request, the Company deletes the remaining Customer Personal Data within 30 days, unless the law requires it to be kept. Copies in backups are deleted as those backups expire.

12.5. Data written to a third-party system through an integration stays in that system.

13. DEMONSTRATING COMPLIANCE

13.1. On written request, the Company will provide the information reasonably needed to show that it complies with this DPA.

13.2. The Customer may run one audit a year through an independent auditor bound by confidentiality. The audit is at the Customer's cost, requires 30 days' notice, and must not disrupt the Company's operations.

13.3. A security incident or a request from a supervisory authority justifies an additional audit.

14. THE CUSTOMER'S OBLIGATIONS

The Customer warrants and agrees that:

1. it has a lawful basis for every processing it instructs;
2. its privacy notice tells data subjects that it uses processors, including the Company and AI providers, and that their data may be transferred abroad;
3. it will process sensitive data, such as health data, through the Platform only where the law allows, and in line with any professional secrecy that binds it;
4. its users will request only the data a task needs and will review AI output and each approval before relying on them.

15. LIABILITY

Liability under this DPA is subject to Section 9 of the Terms, including the data protection cap in Terms §9.4.

16. TERM AND CHANGES

16.1. This DPA applies for as long as the Company processes Customer Personal Data. Sections 6 and 12 survive its end.

16.2. Changes follow Terms §2.3.

Mastershop S.A.
Operating as Rhomdroid
Pedro B. Palacios 910, Mendoza, Argentina
contact@rhomdroid.io