This Data Processing Addendum ("DPA") forms part of and is incorporated into the Terms of Service or other written agreement (the "Agreement") between Leany Pte. Ltd, Singapore ("Processor", "we", "us") and the customer identified in the Agreement ("Customer", "Controller", "you"). It takes effect on the effective date of the Agreement.

Last updated: 04/10/2026 · Effective: 04/10/2026

1. Definitions and precedence

1.1 Terms not defined here have the meaning given in the Agreement.

• "Applicable Data Protection Law" - the Personal Data Protection Act 2012 of Singapore ("PDPA") and any other data protection law applicable to a party's processing under this DPA.
• "User" - an individual authorised by Customer to access the Service.
• "Customer Data" - personal data that Customer or its Users submit to, or generate through, the Service.
• "Sub-processor" - a third party we engage to process Customer Data.
• "Personal Data Breach" - a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Data.

1.2 Precedence. This DPA prevails over the Agreement in respect of Customer Data. Where they apply, the Standard Contractual Clauses prevail over this DPA.

2. Roles

2.1 Customer is the controller (under the PDPA, the organisation) of Customer Data. We are the processor (data intermediary).

2.2 Where Customer is itself a processor for a third party, Customer warrants it has authority to appoint us as sub-processor on these terms.

2.3 This DPA does not cover data for which we act as controller in our own right, including account, billing, usage and support data. Nor does it cover data processed by a merchant of record or payment provider acting as an independent controller.

3. Processing and instructions

3.1 We process Customer Data only on Customer's documented instructions, as necessary to provide, secure and support the Service, and as required by law applicable to us. Where the law requires processing, we will notify Customer first unless prohibited from doing so.

3.2 The Agreement, this DPA including Annex 1, and Customer's configuration and use of the Service are Customer's complete documented instructions.

3.3 We will inform Customer if an instruction appears to us to infringe Applicable Data Protection Law. We are not obliged to review the lawfulness of Customer's instructions.

3.4 We will not sell Customer Data, use it for our own marketing, or use it to train generally available machine learning models. We may use aggregated, anonymised data that does not identify Customer, any User or any individual.

3.5 Customer responsibilities. Customer is responsible for the lawfulness of Customer Data and of our processing of it on Customer's instructions, including all required notices and consents; for not submitting special category, sensitive or criminal offence data except where the Service is designed to receive it; and for configuring the Service and managing User access appropriately.

4. Confidentiality and security

4.1 Personnel authorised to process Customer Data are bound by written confidentiality obligations, subject to least-privilege access controls, and trained appropriately.

4.2 We maintain the technical and organisational measures set out in Annex 2. We may update them provided the overall level of security is not materially reduced.

5. Sub-processors

5.1 Customer grants general authorisation for us to engage Sub-processors. The current list is set out in Annex 3.

5.2 We will give at least [THIRTY (30)] days' notice before a new Sub-processor begins processing Customer Data. Notice will be given by email to Customer's registered contact or by in-product notification.

5.3 Customer may object on reasonable data protection grounds within the notice period. We will use reasonable efforts to offer a configuration change or alternative that avoids the processing. If we cannot within [THIRTY (30)] days, Customer may terminate the affected Service as its sole remedy. Fees already paid are refunded only as provided in our Refund Policy.

5.4 We impose on each Sub-processor obligations no less protective than this DPA, and remain liable for their performance. We may engage a Sub-processor without prior notice where necessary to address a material security or availability risk, notifying Customer as soon as practicable.

6. International transfers

6.1 The Service is hosted primarily in Singapore. Customer Data is transferred to and accessed from other jurisdictions as set out in the sub-processor list.

6.2 For transfers out of Singapore we comply with section 26 PDPA and Regulation 10 of the Personal Data Protection Regulations 2021, ensuring by contract that each recipient provides a comparable standard of protection. Where other law applies to a transfer, we implement the measures that law requires and will enter into such further arrangements as Customer reasonably needs for its own compliance.

6.3 EEA and UK. [TBA - to be confirmed before this DPA is offered to EEA or UK Customers.] Where GDPR or UK GDPR applies, the Standard Contractual Clauses (Module Two or Three as applicable) are incorporated by reference, with the UK Addendum for UK transfers. Annexes 1 and 2 of this DPA populate Annexes I and II. The docking clause applies; Clause 9(a) operates as general written authorisation with the notice period in clause 5.2; governing law and forum are Ireland.

6.4 Certain file storage is globally distributed by default. Where Customer requires storage restricted to a specified region, it must request this before the relevant data is uploaded; restriction is configured at bucket level and cannot be applied retrospectively.

6.5 We will provide, on reasonable request, information in our possession that Customer needs to complete a transfer risk assessment.

7. Government and law enforcement requests

Unless legally prohibited, we will notify Customer without undue delay of any binding request from a public authority for Customer Data, refer the authority to Customer, challenge any request that is unlawful or overbroad, and disclose only the minimum necessary. Where notification is prohibited we will use reasonable efforts to obtain a waiver.

8. Assistance

8.1 We will assist Customer, insofar as possible and taking into account the nature of the processing, in responding to requests from individuals to exercise their rights. The Service provides self-service access, export, correction and deletion; Customer will use it in the first instance.

8.2 Where we receive a request directly from an individual, we will not respond substantively other than to direct them to Customer, and will notify Customer without undue delay.

8.3 We will provide reasonable assistance with data protection impact assessments and prior consultations with a supervisory authority.

8.4 Assistance that is disproportionate or repeated may be charged at our then-current rates, notified in advance.

9. Personal Data Breach

9.1 We will notify Customer of a Personal Data Breach affecting Customer Data without undue delay after becoming aware of it.

9.2 The notification will describe, so far as known, the nature of the breach, the categories and approximate volume of data and individuals affected, likely consequences, measures taken or proposed, and a point of contact. Where information is incomplete we will provide it in phases.

9.3 We will take reasonable steps to contain, investigate and remediate, and will cooperate with Customer's own notification obligations. Notification is not an acknowledgement of fault or liability.

10. Audit

10.1 We will make available information reasonably necessary to demonstrate compliance with this DPA, including current audit reports, certifications and completed security questionnaires where available.

10.2 Where that is not sufficient, Customer may audit no more than once in any twelve (12) month period, on [THIRTY (30)] days' notice, during business hours, subject to confidentiality, and without disrupting the Service or affecting other customers. Customer bears the cost, including our reasonable costs of participation, unless the audit reveals a material breach.

10.3 Audits may not include penetration testing, vulnerability scanning, or access to shared infrastructure, physical data centres, source code, or other customers' data.

11. Deletion and return

11.1 On termination or expiry, Customer may export Customer Data through the Service for [THIRTY (30)] days.

11.2 We will then delete Customer Data from production systems within [TBA], and from backups in accordance with our backup rotation cycle, not exceeding [TBA]. Data in backups remains subject to this DPA until deleted.

11.3 We may retain Customer Data where required by law, for that period and purpose only, and will continue to protect it under this DPA. We will certify deletion in writing on request.

12. Liability and general

12.1 Liability under this DPA is subject to the exclusions and limitations in the Agreement and counts toward, without increasing, the aggregate cap in it. This does not limit liability to an individual or a supervisory authority where Applicable Data Protection Law does not permit limitation.

12.2 This DPA continues until deletion of all Customer Data under clause 11.

12.3 We may amend this DPA on [THIRTY (30)] days' notice where required by a change in Applicable Data Protection Law, regulatory guidance, or the Service, provided Customer's protections are not materially reduced.

12.4 Governing law is as stated in the Agreement, except where Applicable Data Protection Law or the Standard Contractual Clauses require otherwise. If any provision is held invalid, the remainder continues in effect.

12.5 Data Protection Officier

Leany Pte. Ltd, Singapore - dpo@leany.io

Annex 1 - Details of the processing

Populates Annexes I.A and I.B of the Standard Contractual Clauses where they apply.

Parties. Exporter: Customer, as identified in the Agreement, as controller. Importer: Leany Pte. Ltd, Singapore, as processor.

Subject matter. Provision of the Leany ERP software-as-a-service platform.

Duration. The term of the Agreement, plus the retention periods in clause 11.

Nature and purpose. Hosting, storage, structuring, retrieval, transmission, display, backup and deletion as necessary to provide the Service on Customer's instructions.

Data subjects. Customer's Users and administrators; Customer's own customers, counterparties, prospects and correspondents; other individuals whose data Customer chooses to submit.

Categories of data. Identity and contact data (name, email, telephone, address, organisation, role); records and transaction data submitted by Customer; files, documents and media submitted by Customer, which may contain identity or financial information; correspondence and notes recorded by Users; usage and audit log data.

Special category data. Not anticipated. The Service is not designed to process it.

Frequency. Continuous, for the term of the Agreement.

Recipients. The Sub-processors listed in Annex 3.

Annex 2 - Technical and organisational measures

Populates Annex II of the Standard Contractual Clauses where it applies.

Access control. Role-based access on a least-privilege basis; multi-factor authentication for administrative and production access; unique individual accounts; periodic access review and revocation on role change or departure.

Encryption. TLS 1.2 or above in transit; encryption at rest for databases, object storage and backups; managed key rotation.

Infrastructure and isolation. Production isolated at the network level with no direct public ingress to data stores; segregation of production, staging and development; no production data in non-production environments; logical separation of each Customer's data enforced at the application and data layers.

Logging and monitoring. Audit logging of administrative actions and access to Customer Data; centralised log retention; automated alerting on anomalous access and infrastructure events.

Availability and resilience. Redundant deployment with automated health checking and failover; automated encrypted backups with defined retention; documented and periodically tested restoration procedures; infrastructure defined as code to enable reconstruction.

Vulnerability management. Automated dependency scanning; documented patching timelines by severity.

Development. Peer code review; automated testing in the deployment pipeline; secrets held in a managed secret store and never in source control; change management with audit trail.

Personnel. Background checks where lawful and appropriate; written confidentiality undertakings; security and data protection training on joining and periodically thereafter; documented onboarding and offboarding.

Incident response. Documented plan with defined roles, severity classification, escalation and notification procedures; post-incident review.

Sub-processor management. Due diligence before engagement; written data protection terms with each Sub-processor; periodic review.

Annex 3 - Sub-processors

Current as of 11/09/2026.

Note on Paddle. Paddle acts as merchant of record and is an independent controller of the data it collects in that capacity, not our Sub-processor. It is listed here for transparency because it receives personal data in connection with the Service. Its processing is governed by its own privacy notice.