Data Processing Addendum

1. Definitions

"Data Protection Law" means every law applicable to a party's processing under this Addendum, including the US state privacy laws identified in §14, the Asia-Pacific laws identified in §15, and the data protection law of any other jurisdiction to which a party is subject.

"Personal data" means information relating to an identified or identifiable individual. "Data subject" means that individual. "Processing" means any operation performed on personal data. "Controller" means the party that determines the purposes and means of processing, and "processor" the party that processes on the controller's behalf. "Personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. For US state laws, "business", "service provider", "sell" and "share" have the meanings those laws give them.

"Customer Personal Data" means personal data contained in Customer Data, as the Agreement defines Customer Data, that TraceVial processes on the Customer's behalf.

"Sub-processor" means a third party engaged by TraceVial to process Customer Personal Data.

2. Roles, and the boundaries of this Addendum

The Customer is the controller and TraceVial is the processor of Customer Personal Data. Where the Customer is itself a processor for a third-party controller — a sponsor, a consortium, a partner institution — TraceVial is a sub-processor, the Customer warrants it has the authority to appoint one, and this Addendum applies as if references to the controller were to that third party.

Each party is an independent controller of the account, contact, billing and security data described in the Privacy Policy, §1. This Addendum does not govern that data.

The Customer determines what personal data enters its Workspace. TraceVial does not select the records a laboratory keeps, does not see a consent form, and cannot judge whether a record should exist. The Customer warrants it has a lawful basis for every processing operation it instructs, including for health, genetic and other sensitive categories of personal data wherever applicable law imposes additional conditions on them.

This Addendum is not a Business Associate Agreement. It does not authorise the Customer to process protected health information under HIPAA in the platform beyond a limited data set, and it creates no obligation of a business associate.

3. Instructions

TraceVial processes Customer Personal Data only on the Customer's documented instructions, including as to international transfers, unless required otherwise by law it is subject to — in which case it will inform the Customer before processing, unless that law forbids the notification on important grounds of public interest.

The Agreement, this Addendum and the Customer's use of the product's own features are the Customer's complete documented instructions. A configuration a Customer's administrator sets, an integration it enables, and a request its authorised users make through the interface or the API are instructions. An instruction outside them requires written agreement and may attract a fee.

TraceVial will tell the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend performance of that instruction until it is withdrawn or amended.

Purpose limitation. TraceVial will not process Customer Personal Data for its own purposes, and in particular will not sell it, share it for cross-context behavioural advertising, combine it with personal data from another source, or use it to train machine learning models.

4. Confidentiality and personnel

TraceVial ensures that every person authorised to process Customer Personal Data is bound by an appropriate confidentiality obligation, receives data protection and security training appropriate to their role, and has access only to the data their role requires.

5. Security

TraceVial implements and maintains the technical and organisational measures in Annex II, which are designed to provide a level of security appropriate to the risk and to meet the reasonable-security requirements of the US state privacy laws in §14. TraceVial may update those measures, provided the overall level of security is not reduced.

6. Sub-processors

General authorisation. The Customer authorises TraceVial to engage the sub-processors listed in Annex III, and further sub-processors under this section.

Flow-down and responsibility. Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than this Addendum. TraceVial remains fully liable to the Customer for a sub-processor's performance of those obligations.

Notice of a change. TraceVial will give the Customer at least 30 days' notice before a new sub-processor starts processing Customer Personal Data, by email to the Customer's notice address and by updating Annex III.

Objection. The Customer may object on reasonable data protection grounds within that notice period, by written notice setting out those grounds. The parties will discuss it in good faith. If TraceVial cannot make available a commercially reasonable alternative within a reasonable period, the Customer's sole remedy is to terminate the affected subscription on written notice, with a pro-rata refund of prepaid fees for the unused remainder of the term. An objection does not suspend the engagement of the sub-processor, and failing to object within the notice period is acceptance.

An AI assistant a Customer's user connects is not a TraceVial sub-processor. When a user authorises an assistant through the MCP connector, the provider of that assistant receives data in response to that user's requests. The Customer chooses that provider and contracts with it directly; TraceVial neither selects it nor controls what it does. Annex III lists it for transparency in a separate section headed as such, not as a sub-processor.

7. Assisting with data subject rights

TraceVial will, taking account of the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to data subject requests. The platform's own search, editing, export and deletion features are the primary form of that assistance — a Customer can locate, correct, export and delete records in its own Workspace without involving us.

If a data subject contacts TraceVial directly about Customer Personal Data, TraceVial will not respond substantively, and will promptly forward the request to the Customer.

An audit trail or electronic signature record cannot be altered or erased. That is the control's purpose and, in a Part 11 or equivalent context, a legal obligation of the Customer. The Customer is responsible for determining which exemption applies to an erasure request that would reach such a record.

8. Assisting with security, assessments and notifications

TraceVial will assist the Customer, taking into account the nature of the processing and the information available to it, with: security of processing; notification of a personal data breach to a regulator and communication to affected individuals; risk or data protection assessments the Customer is required to carry out; and any prior consultation with a regulator those assessments require.

9. Personal data breach

TraceVial will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. TraceVial is treated as aware once it has established, with a reasonable degree of certainty, that a security incident has led to a compromise of Customer Personal Data.

The notification will describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where the information is not all available at once, TraceVial will provide it in phases without undue further delay.

TraceVial will take reasonable steps to contain and remediate the breach, and will keep a record of it. A notification is not an admission of fault or of liability.

10. Where data is processed, and cross-border transfers

Customer Data is hosted in AWS ap-southeast-1 (Singapore), as Annex II describes. TraceVial does not move a Workspace to another region without the Customer's written agreement.

TraceVial is established at 27/147 Xuan Dinh Street, Xuan Tao Ward, Hanoi, Vietnam (Enterprise Registration No. 0111184391) and its personnel access Customer Personal Data from there in order to operate and support the Service. Sub-processor locations are in Annex III. Together these are the cross-border transfers this Addendum contemplates, and the Customer's instructions under §3 include them.

The Customer is responsible for any transfer mechanism its own law requires for the transfers described above — a consent, a notification, an assessment, or a contractual clause set its regulator mandates. TraceVial will enter into an additional transfer instrument a Customer's law requires, on reasonable terms, where the Order Form or a written agreement provides for it.

No transfer mechanism is incorporated into this Addendum by default. TraceVial does not offer the Service on the basis of the European Standard Contractual Clauses, the UK International Data Transfer Addendum or the EU-US Data Privacy Framework. A Customer subject to the EU or UK GDPR should raise that before signing, so the right instrument is agreed rather than assumed.

11. Audit and information

TraceVial will make available to the Customer the information reasonably necessary to demonstrate compliance with this Addendum and with Data Protection Law, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

In practice:

• TraceVial will answer a reasonable security questionnaire and provide the documentation described in Annex II, once per twelve-month period, at no charge;
• an on-site or hands-on inspection may be requested where a regulator requires it, or following a personal data breach affecting the Customer. It must be on at least 30 days' written notice, during business hours, without unreasonable disruption, subject to confidentiality, conducted by an auditor who is not a TraceVial competitor, and must not involve access to another customer's data or to the shared infrastructure in a way that could affect another customer — which is a limit on the method, not on the right;
• TraceVial may charge its reasonable costs for an inspection beyond one per twelve-month period, other than one following a breach it caused.

12. Deletion and return

On termination or expiry of the Agreement, TraceVial will, at the Customer's choice, return Customer Personal Data or delete it, and delete existing copies, on the timetable in §14 of the Terms of Service — a retrieval window, then deletion of the Workspace's database schema and its storage.

Deletion excludes two kinds of copy, and anything TraceVial is required by law to retain — in which case it will retain only what the law requires, for only as long as it requires, and continue to protect it.

• Automated backups, which are overwritten on the ordinary backup rotation within the retention period stated in Annex II.
• Release snapshots, taken before a schema-changing deployment as Annex II describes. A snapshot is not on a rotation, so a copy of Customer Personal Data may persist in one after the Workspace itself has been deleted.

Both remain subject to this Addendum's confidentiality and security obligations for as long as they exist, and are never restored into production except to recover the Service. A snapshot covers the whole database rather than a single Workspace, so TraceVial does not extract one Workspace's data from a snapshot: a snapshot is only ever deleted whole.

TraceVial will certify deletion in writing on request.

13. Liability, precedence and term

The limitations and exclusions of liability in the Agreement apply to claims under this Addendum, except where Data Protection Law does not permit them. The cap in §15 of the Terms of Service is a single aggregate limit covering the Agreement and this Addendum together, and is not enlarged by the existence of this Addendum or by the number of claims brought. Nothing in this paragraph affects a data subject's rights against either party under Data Protection Law.

Where this Addendum conflicts with the Agreement on the processing of personal data, this Addendum prevails. Where a transfer instrument agreed under §10 conflicts with this Addendum, that instrument prevails.

This Addendum takes effect on the date of the Agreement and continues while TraceVial processes Customer Personal Data.

14. United States state privacy laws

This section applies where the Customer is subject to the California Consumer Privacy Act as amended by the CPRA, or to the comparable laws of Virginia, Colorado, Connecticut, Utah or another US state with equivalent provisions.

TraceVial acts as a service provider (or "processor", where the applicable law uses that term) in respect of Customer Personal Data, and:

• processes it only to perform the services in the Agreement, which is the business purpose for which it is disclosed;
• does not sell it and does not share it for cross-context behavioural advertising, and no monetary or other valuable consideration is exchanged for it;
• does not retain, use or disclose it outside the direct business relationship between the parties, or for any purpose other than those the Agreement specifies and the law permits;
• does not combine it with personal information from another source, except as the law permits a service provider to do;
• will notify the Customer if it determines it can no longer meet these obligations;
• grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use.

TraceVial certifies that it understands and will comply with these restrictions.

15. Asia-Pacific data protection laws

This section applies where the Customer is subject to one of the laws named below. It adds to §§3 to 12 rather than replacing them: TraceVial's core undertakings — processing only on the Customer's documented instructions, never for its own purposes, never to train machine learning models, and never selling or sharing Customer Personal Data — apply under every regime in this Addendum.

Where a regime requires a transfer instrument before Customer Personal Data may reach TraceVial, §10 governs: none is incorporated by default, and one is agreed per Order Form.

Singapore — Personal Data Protection Act 2012. TraceVial acts as a data intermediary processing Customer Personal Data on the Customer's behalf under a written contract, being this Addendum. It will protect the data and not retain it longer than the purpose requires, as an intermediary must, and will give the Customer what it needs to meet its own notification duties under Part 6A. The Customer remains the organisation for the purposes of consent, notification, access and correction.

Japan — Act on the Protection of Personal Information. The Customer entrusts (委託) the handling of personal information to TraceVial. TraceVial handles it only within the scope of the entrustment, and will supply the information the Customer needs to exercise the supervision the Act requires of it and to inform data subjects about a transfer to a handler in a foreign country — including where Customer Personal Data is held and the security measures applying to it, which are in Annex II and Annex III.

South Korea — Personal Information Protection Act. TraceVial acts as an entrusted party (수탁자). It processes Customer Personal Data only within the scope of the entrusted work, does not use it for any other purpose, engages a further entrusted party only under §6 of this Addendum, and will give the Customer what it needs to disclose the entrustment and to meet its notification duties on a breach. The Customer remains the personal information controller.

Vietnam — Decree 13/2023/ND-CP and the Law on Personal Data Protection. TraceVial acts as a Personal Data Processor on the Customer's instruction. It maintains its own records of processing, and will provide the information the Customer needs for a personal data protection impact assessment dossier and, where one is required, a cross-border transfer dossier. TraceVial's own filing obligations as a Vietnamese entity are its own, not a Customer commitment.

Australia — Privacy Act 1988, and New Zealand — Privacy Act 2020. TraceVial does not use or disclose personal information for its own purposes, holds it only to provide the Service, and will assist the Customer in assessing and notifying an eligible data breach under Part IIIC of the Australian Act and Part 6 of the New Zealand Act, on the timetable in §9.

Where two of these regimes, or one of them and §14, impose different obligations on the same processing, TraceVial meets the stricter. Nothing in this section makes TraceVial the controller, the organisation, the personal information handler or the business in respect of Customer Personal Data.

---

Annex I — Details of processing

A. The parties

B. The processing

Subject matter. Provision of the TraceVial platform under the Agreement.

Duration. For the term of the Agreement, plus the retention periods in §12.

Nature and purpose. Hosting, storage, retrieval, organisation, structuring, transmission, back-up, and deletion of Customer Data, so that the Customer can manage a biobank and its laboratory work: specimen and inventory records, projects and workflows, task results, uploaded files, and the audit and electronic signature records the platform generates over them.

Frequency. Continuous, for the term.

Categories of data subjects

• the Customer's personnel who hold accounts — researchers, laboratory technicians, managers, administrators;
• specimen donors and research participants, to the extent the Customer records data about them, which the platform is designed for the Customer to hold in pseudonymised form;
• third-party contacts the Customer chooses to record.

Categories of personal data

Sensitive data. The Customer decides whether any is processed. Where its records concern human biological material, they are capable of containing health and genetic data. Where they do, the Customer applies the additional restrictions in Annex II and is responsible for meeting whatever conditions its own law places on that category. TraceVial neither requires nor requests sensitive data, and the platform is designed to be used with pseudonymised specimen records.

---

Annex II — Technical and organisational measures

Measures TraceVial has implemented, at the level of detail a customer's security review asks for. They describe the Service as a whole; TraceVial may update them under §5 provided the overall level of security is not reduced.

No claim of certification is made: TraceVial holds no SOC 2 Type II report and no ISO 27001 certificate, and nothing in this Addendum represents otherwise. No measure described here is a guarantee that Customer Personal Data will not be accessed, altered, disclosed or lost: no method of transmission or storage is completely secure, and these measures are appropriate to the risk rather than absolute.

Tenant isolation

Each Customer's Workspace is a separate PostgreSQL schema within the platform database, with a database router that resolves the schema from the hostname of each request and refuses a cross-schema read. Each Workspace also has its own storage bucket; identifiers are not globally unique across Workspaces, so bucket separation, rather than a key prefix, is what keeps one Workspace's files out of another's. Isolation is covered by automated tests that run on every change.

Encryption

Access control

• Role-based access control in the application, with per-location access control lists for inventory that gate both handling and approval;
• separation between a Workspace's own administrators and TraceVial staff — the staff console runs on a separate hostname against the shared schema and does not carry Workspace login;
• optional single sign-on through the Customer's own identity provider, so account lifecycle and multi-factor authentication can be enforced by the Customer centrally;
• a signing PIN, separate from the login credential, for electronic signatures;
• least-privilege access for TraceVial personnel, granted by role and revoked on role change or departure;
• object storage buckets block public access, and are reachable only through the application's own authorised, time-limited URLs.

Logging, integrity and monitoring

• An application audit trail recording who changed what and when, which cannot be edited or erased through the product;
• electronic signature records with integrity checking over the signed record, so that a later change to the underlying record is detectable;
• infrastructure and application logging, with alerting on error conditions;
• rate limiting on authentication, signing and anonymous signup endpoints;
• an optional web application firewall in front of the service.

Resilience and recovery

• Automated database backups with point-in-time recovery, retained for 30 days;
• a snapshot of the production database taken before any deployment that changes the database schema, which that deployment waits for;
• deletion protection on the production database, and a snapshot taken before any stack-level removal;
• a documented restore procedure;
• availability, backup retention and the recovery objectives are stated in the Service Level Agreement, §9.

Secure development and change management

• Peer review on every change, and an automated test suite plus static checks that gate a merge;
• separate development, staging and production environments, with production data not used for development;
• dependency and vulnerability monitoring;
• documented release and rollback procedure.

Organisational measures

• Confidentiality obligations in every employment and contractor agreement;
• security and data protection guidance for personnel with access to Customer Personal Data;
• an incident response procedure, with the notification obligations in §9;
• a review of each sub-processor before engagement, and contractual flow-down of these obligations.

---

Annex III — Sub-processors

Sub-processors engaged by TraceVial to process Customer Personal Data.

Not sub-processors: services the Customer connects