# DATA PROCESSING ADDENDUM

**(GDPR Article 28 — Processor Terms)**

This Data Processing Addendum ("**DPA**") forms part of and is incorporated by reference into the Master Services Agreement for cloud freight-management and transportation-orchestration software dated **1 March 2025** (the "**Agreement**") by and between:

- **Tidewater Distribution N.V.**, a company organized under the laws of Belgium, with registered office at Noorderlaan 147, 2030 Antwerpen, Belgium, Enterprise No. BE 0641.823.557 (the "**Controller**" or "**Customer**"); and

- **Northwind Logistics Software, Inc.**, a Delaware corporation with principal place of business at 250 Marconi Boulevard, Suite 400, Columbus, OH 43215, Columbus, Ohio 43215, U.S.A. (the "**Processor**" or "**Provider**").

The Controller and the Processor are each a "**Party**" and together the "**Parties**."

---

## RECITALS

WHEREAS, the Processor provides the Controller with access to its cloud freight-management and transportation-orchestration platform (the "**Services**") under the Agreement;

WHEREAS, in the course of providing the Services the Processor Processes Personal Data on behalf of the Controller relating to the Controller's drivers, dispatchers, consignees, and freight contacts located in the European Union;

WHEREAS, the Parties wish to ensure that such Processing complies with **Regulation (EU) 2016/679** (the "**GDPR**"), and in particular **Article 28** (Processor) and **Chapter V** (Transfers of Personal Data to Third Countries) thereof;

NOW, THEREFORE, the Parties agree as follows.

---

## 1. DEFINITIONS

1.1 Capitalized terms not otherwise defined herein have the meanings given in the GDPR. The terms "**Controller**," "**Processor**," "**Data Subject**," "**Personal Data**," "**Processing**," "**Sub-processor**," "**Supervisory Authority**," and "**Personal Data Breach**" shall be interpreted in accordance with the GDPR.

1.2 "**Standard Contractual Clauses**" or "**SCCs**" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

1.3 "**EU Personal Data**" means Personal Data of Data Subjects located in the European Economic Area that is Processed under this DPA.

1.4 "**Term**" has the meaning given in Section 11.1.

---

## 2. SCOPE AND ROLES

2.1 The Controller is the controller and the Processor is the processor with respect to the EU Personal Data Processed under the Agreement.

2.2 The Processor shall Process EU Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

2.3 The annual subscription fee payable by the Controller under the Agreement is **USD $3,100,000** (representing approximately 7.5% of the Provider's total annual recurring revenue), and the Agreement has an initial term of **two (2) years** commencing on the Effective Date.

---

## 3. SUBJECT MATTER, DURATION, NATURE AND PURPOSE (Art. 28(3))

| Item | Detail |
|------|--------|
| **Subject matter** | Provision of cloud freight-management and transportation-orchestration (TMS) Services |
| **Duration** | The Term of the Agreement (2 years from the Effective Date, plus any data-return/deletion period) |
| **Nature and purpose** | Hosting, processing, routing, telematics analytics, and reporting of freight and transportation movement data on behalf of the Controller |
| **Categories of Data Subject** | Drivers, dispatchers, fleet operators, consignees, and freight/delivery contacts of the Controller |
| **Categories of Personal Data** | Names, business contact details, employee/driver identifiers, geolocation and route telemetry, delivery timestamps, signatures of receipt, vehicle assignment data |
| **Special categories** | None Processed under the Agreement |

---

## 4. OBLIGATIONS OF THE PROCESSOR (Art. 28(3)(a)–(h))

4.1 **Confidentiality.** The Processor shall ensure that persons authorized to Process the EU Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.2 **Security.** The Processor shall implement the technical and organizational measures set out in **Annex 1** to ensure a level of security appropriate to the risk (Art. 32).

4.3 **Assistance.** The Processor shall assist the Controller, taking into account the nature of the Processing, in responding to requests from Data Subjects and in ensuring compliance with the Controller's obligations under Articles 32 to 36 GDPR.

4.4 **Breach notification.** The Processor shall notify the Controller without undue delay and in any event within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting EU Personal Data.

4.5 **Deletion or return.** At the Controller's election, the Processor shall delete or return all EU Personal Data after the end of the provision of Services and delete existing copies unless Union or Member State law requires storage.

4.6 **Audit.** The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, no more than once per calendar year on thirty (30) days' prior written notice.

---

## 5. SUB-PROCESSING (Art. 28(2) and (4))

5.1 The Controller grants the Processor general written authorization to engage the Sub-processors listed in **Annex 2**. The Processor shall inform the Controller of any intended addition or replacement of a Sub-processor not less than thirty (30) days in advance, thereby giving the Controller the opportunity to object.

5.2 The Processor shall impose on each Sub-processor, by way of a written contract, data-protection obligations no less protective than those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures.

5.3 **Where any Sub-processor is established in, or Processes EU Personal Data from, a country outside the European Economic Area that has not been the subject of an adequacy decision, the Processor shall ensure that such transfer is covered by the Standard Contractual Clauses or another valid transfer mechanism under Chapter V GDPR, and shall list such Sub-processor in Annex 2 together with the applicable transfer safeguard.**

5.4 The Processor shall remain fully liable to the Controller for the performance of each Sub-processor's data-protection obligations.

---

## 6. INTERNATIONAL TRANSFERS (Chapter V GDPR)

6.1 The Processor shall not transfer EU Personal Data to a country outside the European Economic Area, or to any Sub-processor located in such a country, except where the transfer is governed by an adequacy decision under Article 45, or is subject to appropriate safeguards under Article 46 (including the Standard Contractual Clauses), or another lawful transfer mechanism under Chapter V.

6.2 Where the Standard Contractual Clauses apply, they are hereby incorporated by reference, with the Controller acting as "data exporter" and the relevant recipient acting as "data importer," and **Annex 3** sets out the docking, module selection, and supplementary measures.

6.3 The Processor's primary hosting and Processing of EU Personal Data shall take place within the European Economic Area (Frankfurt, Germany region) save as expressly set out in Annex 2.

---

## 7. RECORDS

7.1 The Processor shall maintain a record of all categories of Processing activities carried out on behalf of the Controller in accordance with Article 30(2) GDPR.

---

## 8. CONTROLLER OBLIGATIONS

8.1 The Controller warrants that it has a lawful basis for the Processing instructed under this DPA and that its instructions to the Processor comply with the GDPR and applicable Member State law.

---

## 9. LIABILITY

9.1 Each Party's liability arising out of or related to this DPA is subject to the limitations of liability set out in the Agreement.

---

## 10. PRECEDENCE

10.1 In the event of any conflict between this DPA and the Agreement with respect to the Processing of EU Personal Data, this DPA shall prevail. In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

---

## 11. TERM AND TERMINATION

11.1 This DPA takes effect on the Effective Date of the Agreement (1 March 2025) and continues for the **two (2) year** initial term of the Agreement and thereafter for so long as the Processor Processes EU Personal Data on behalf of the Controller.

11.2 This DPA shall automatically terminate upon termination or expiry of the Agreement, subject to the survival of those provisions which by their nature should survive (including Sections 4.5, 5.3, 6, and 9).

---

## ANNEX 1 — TECHNICAL AND ORGANIZATIONAL MEASURES (Art. 32)

1. Encryption of EU Personal Data in transit (TLS 1.2+) and at rest (AES-256).
2. Role-based access control with least-privilege provisioning and quarterly access reviews.
3. Multi-factor authentication for all administrative and production access.
4. Network segregation between the EEA production environment and non-production environments.
5. Logging, monitoring, and intrusion detection across production systems.
6. Annual penetration testing by an independent third party.
7. Documented incident-response and business-continuity procedures.
8. Personnel confidentiality undertakings and recurring data-protection training.

---

## ANNEX 2 — APPROVED SUB-PROCESSORS

The Controller authorizes the engagement of the following Sub-processors:

| # | Sub-processor | Location | Service Provided | Transfer Mechanism |
|---|---------------|----------|------------------|--------------------|
| 1 | Aurora Cloud Hosting GmbH | Frankfurt, Germany (EEA) | Primary infrastructure hosting (compute, storage, database) | N/A — within EEA |
| 2 | Helvetia Mail Relay AG | Zürich, Switzerland | Transactional email / notification delivery | Adequacy decision (Switzerland) |
| 3 | Brussels Support Partners BV | Antwerpen, Belgium (EEA) | Tier-2 customer support and ticketing | N/A — within EEA |
| 4 | Northwind Logistics Software, Inc. (intra-group EEA branch operations) | Frankfurt, Germany (EEA) | Platform operations and maintenance | N/A — within EEA |

*Last updated: 14 January 2025.*

> **Note:** Routing, telematics, and aggregate-performance analytics are performed within the Processor's primary EEA production environment listed in row 1.

---

## ANNEX 3 — STANDARD CONTRACTUAL CLAUSES (Module Two: Controller-to-Processor)

The SCCs adopted under Commission Implementing Decision (EU) 2021/914 are incorporated where a transfer of EU Personal Data outside the EEA occurs to a recipient not covered by an adequacy decision. As at the date of this DPA, no such transfer is contemplated, and accordingly no SCCs are executed under this Annex. Should a transfer to a non-adequate third country arise, the Parties shall execute Module Two of the SCCs and complete the appendices thereto prior to any such transfer.

*Status as of the Effective Date: **No SCCs executed** (no Annex-2 Sub-processor located outside the EEA / an adequate country).*

---

## SIGNATURES

Each Party has caused this Data Processing Addendum to be executed by its duly authorized representative.

**CONTROLLER — Tidewater Distribution N.V.**

Signature: _/s/ Signatory E_

Name: **Signatory E**

Title: Gerant / Managing Director

Date: 1 March 2025

<br/>

**PROCESSOR — Northwind Logistics Software, Inc.**

Signature: _/s/ Signatory A_

Name: **Signatory A**

Title: Chief Executive Officer

Date: 1 March 2025

---

*Governing law of this DPA: this DPA is governed by the law of Belgium insofar as it relates to GDPR compliance; in all other respects the governing-law provisions of the Agreement (State of Delaware, U.S.A.) apply.*
