Personal data processing addendum — DPA Version 2026-09-30.2 — 30 September 2026 1. Parties, purpose and roles The business customer identified at registration or in the subscription summary, represented where appropriate by its authorised user, acts as controller for the processing it determines. THELOS SAS, 10 rue de Penthièvre, 75008 Paris, France, 789 713 310 RCS Paris, acts as processor for the operations described in Annex A. If the customer itself acts for another controller, it must hold the necessary authorisations and communicate applicable requirements. This situation must be described in special terms; it is not presumed for every customer. This addendum does not govern THELOS's own processing, including accounting and management of its contractual relationship, described in the Privacy Policy. Non-personal financial data remain protected by contractual confidentiality without being artificially classified as personal data. The French version prevails in case of differences between translations, subject to Article 1 of the Terms of Use. This rule does not alter the DPA's priority for its subject matter. This DPA is annexed to the Terms of Use and accepted with them upon registration, including for a free account. It applies only to entrusted personal-data processing described in its annexes. Acceptance is not general consent to THELOS's own processing. 2. Instructions and purposes THELOS processes data only on the customer's documented instructions, including transfers outside the EEA, unless otherwise legally required. The contract, agreed parameters and requests from authorised persons constitute instructions within their scope. If an instruction appears contrary to the GDPR or applicable law, THELOS immediately informs the customer and seeks clarification. If the law requires an operation, THELOS informs the customer before acting where permitted. THELOS does not reuse data for its own purposes incompatible with its processor role, including resale or model training for purposes unrelated to the contract. Any change of role or purpose requires appropriate analysis and information. 3. Customer obligations The customer determines lawfulness, purposes and minimisation of entrusted data, informs individuals and organises exercise of their rights. It keeps instruction-givers' authorisations up to date and avoids sending data unnecessary for the service. These duties do not reduce THELOS's own processor obligations. Sensitive data or an operation not described in Annex A requires prior assessment and, where necessary, adjustment of that annex. 4. Confidentiality and security THELOS limits access to authorised persons who need to know. They are subject to a confidentiality commitment or appropriate statutory obligation. Subsequent providers are governed by this document. Technical and organisational measures must suit the nature of the data and risks and be documented in Annex B. They include permissions, protection of communications, continuity, restoration, traceability and incident handling. Any measure described as operational must be substantiable. Subscribing to a cloud service alone does not prove all such measures. Significant changes affecting the safeguards provided must be documented and addressed with the customer. 5. Subprocessors The customer generally authorises the subprocessors identified in Annex C supplied with the contract. THELOS informs the customer's authorised contact by email in a retainable medium at least thirty days before a proposed addition or replacement. The information identifies the provider, operations, processing locations and safeguards relevant to review. Within that period the customer may submit a reasoned data-protection objection. THELOS examines the objection and seeks a proportionate solution preserving agreed safeguards. Disputed operations are not entrusted to the new provider until the objection is resolved. If no reasonable solution can be agreed, the customer may terminate affected services without penalty and recover prepaid amounts for the unprovided period. This procedure does not reduce applicable statutory remedies. THELOS imposes equivalent protection obligations on the subprocessor for entrusted operations and remains responsible to the customer for their performance under the GDPR. Providers acting as independent controllers must be distinguished and have their own lawful basis for disclosure. 6. Assistance and individual rights THELOS forwards requests concerning processing on the customer's behalf without undue delay and does not decide alone to answer them substantively unless instructed or legally required. It provides appropriate assistance for access, rectification, erasure, restriction, portability and other applicable rights. Taking account of available information and the nature of processing, it assists with security, impact assessments and any prior consultation of the supervisory authority. Commercial allocation of assistance costs cannot neutralise these duties. 7. Personal data breaches THELOS notifies the customer of any personal data breach covered by this DPA without undue delay after becoming aware of it. According to available information, the notification describes affected data and individuals, likely consequences, measures taken or proposed and the incident contact. Information may be supplied in stages without undue delay. THELOS preserves useful evidence, cooperates in containing the incident and documents its actions. The customer decides on notifications it owes to authorities and individuals; THELOS assists. The controller's statutory deadline must not be presented as an authorised waiting period for the processor. 8. International transfers Processing and access locations are described in Annex C. Transfers outside the EEA may occur only under authorised instructions and GDPR Chapter V. The applicable mechanism, necessary assessment and supplementary measures must be documented. Database location in France does not implicitly authorise all third-country access. Requests from foreign authorities must be assessed under applicable law; the customer is informed where permitted. 9. Documentation and audits THELOS makes available information necessary to demonstrate compliance and allows audits, including inspections, by the customer or its appointed auditor. Practical arrangements protect security and other customers' information without preventing effective examination. The parties agree proportionate scope and arrangements, considering urgency or an authority's request. This DPA imposes no automatic frequency cap, mandatory certification or audit tariff. 10. End of processing At the end of processing services and at the customer's documented choice, THELOS returns or deletes the personal data concerned, then deletes existing copies unless retention is legally required. Data retained for such an obligation are identified, isolated and used only for that purpose. Organisation closure, return and erasure instructions are sent to contact@otcvalue.com and handled manually. THELOS verifies the requester's authority and data scope. A user's departure or cancellation of a subscription alone is not an instruction to erase all organisation data. Individual-rights requests also follow this addendum's assistance rules. Standard return on request is free, including Free accounts. THELOS agrees the scope, usable format and secure delivery arrangements with the authorised customer. Existing grid exports are not a complete package of all organisation data. Other organisations' data and authentication secrets are not disclosed. Justified limits or exclusions are described without neutralising mandatory return or switching rights. Timing follows applicable duties and lawful customer instructions; required retrieval periods are respected before erasure. Return to the free plan while the organisation continues using the service does not itself end processing services. Necessary data remain stored during active use under authorised instructions. Closure and erasure requests are examined and handled within applicable legal deadlines. The Privacy Policy schedule provides for manual review after three years' inactivity of a free account and at least thirty days' warning before possible closure, after checking organisation activity and rights. It does not permit indefinite purposeless retention. Backup deletion follows the cycle in Annex B; meanwhile data are protected and not reused for ordinary purposes, and deletions must be reapplied after restoration before ordinary use resumes. The customer receives confirmation of handling, distinguishing completed deletions from residual copies awaiting expiry. Azure SQL's seven-day restore window is not a guarantee of physically erasing all backups within seven days. 11. Relationship with contractual liability The customer's contractual compensation claims concerning this DPA are subject to the cap and exceptions in Article 9 of the Terms of Use and, for a paid subscription, Article 9 of the business subscription terms, to the extent legally permitted. These clauses limit neither data subjects' mandatory rights nor remedies that cannot lawfully be limited, and do not reduce THELOS's own GDPR duties. The DPA's priority for processing instructions and safeguards is unchanged. Annex A — Description of standard-service processing Subject matter: Provision of OTCValue to the customer organisation. Duration: Duration of entrusted operations, followed by return, erasure and identified mandatory retention. Operations: Collection through entry or available import, storage, calculation, consultation, access management, export, support, backup and erasure, according to functions actually used. Customer purposes: Managing and analysing its positions and portfolios and organising access to that information. Data subjects: Organisation users, representatives and contacts; individuals identified in positions, portfolios, counterparty names, free-text fields or support material entrusted by the customer. Entrusted identity and access data: Member identifiers, necessary names and professional contact details, membership, profiles, portfolio rights, invitations and user-attributed actions, to the extent performed for the customer. Personal business data: Portfolio, strategy and counterparty names and references; position parameters and events, transactions, calculations, reports and histories where they identify individuals; import-origin and change records attributed to users. Classification boundary: Corporate financial data are not automatically personal. The service's own authentication, payment, accounting and defence of THELOS's rights serve its own purposes described in the Privacy Policy, depending on the operation. Special-category data: Not included in the proposed standard scope; any need must be analysed before collection. Instructions and customer contact: Customer identified in the registration or subscription relationship; instructions from authorised representatives and verified organisation contacts. The customer sends any data-protection contact or specific mandate and updates to contact@otcvalue.com. Payer status is not a general mandate over data. THELOS contact: contact@otcvalue.com; no permanent on-call service or quantified resolution time is promised, without delaying legally required notifications. Annex B — Security, retention and continuity Access: Authenticated accounts, organisation and portfolio permissions, member management and access revocation. The customer keeps administered rights current; THELOS retains its own control and security duties. Technical protection: Protection of HTTPS communications, forms against forged requests and email-queue contents; encryption at rest of the primary database and its automatic backups. Keys and technical access are restricted to authorised persons. Storage and backups: Primary database and backups hosted in France; seven-day restore window. Backup cycle: Files needed for a complete restore chain may be kept for up to one additional week beyond the seven-day window, then purged by Azure when no longer needed. That window does not guarantee physical erasure of every copy within seven days. Continuity: This DPA guarantees no quantified recovery objective or availability percentage. Residual backup data remain protected and excluded from ordinary use. Processed erasures must be reapplied before restored data return to ordinary use. Traceability and retention: Business events, diagnostics, contractual evidence and emails have distinct purposes and periods described in the Privacy Policy. Rights, closure, return and erasure requests are handled manually after checking scope, authority and justified retention. Organisation: Access limited to authorised persons bound by confidentiality; incident handling and customer assistance under this DPA. Contact: contact@otcvalue.com. No permanent on-call service or particular certification is announced. The absence of quantified guarantees does not reduce statutory security or notification duties. Annex C — Providers, roles and locations Subprocessing authorisation covers operations entrusted by the customer. Recipients of THELOS's own processing are distinguished; inclusion in this list does not grant access to all portfolios. Microsoft Ireland Operations Limited — Azure: Hosting, processing and backup of entrusted data under Microsoft's DPA. Primary database and backups in France under Annex B. Support access and other transfers fall under Article 8. OVH SAS — OVHcloud: Email hosting and routing, including content entrusted to support. Address: 2 rue Kellermann, 59100 Roubaix, France. Storage stated to be in France; backups retained fourteen days according to the provider, without a guarantee of physical erasure within that period. Operations from Canada and the United Kingdom are possible; transfers fall under Article 8. Stripe: Payments and subscriptions, billing data and payment references. French terms identify Stripe Payments Europe, Limited and, for relevant regulated services, Stripe Technology Europe, Limited. Stripe acts as processor or independent controller depending on the operation, notably for regulatory and fraud-prevention duties; it is not processor for all business data. Stripe's documents describe transfers to Stripe, LLC in the United States: https://stripe.com/fr/legal/dpa and https://stripe.com/fr/legal/dta. Volentio JSD Limited — jsDelivr: Library distribution and receipt of browser connection data; an England and Wales operator using an international network. Loading libraries does not itself imply transfer of portfolios. Provider policy: https://www.jsdelivr.com/terms/privacy-policy. Applicable operations and safeguards are distinguished from business-data subprocessing. The customer may request relevant information and safeguards from contact@otcvalue.com, subject to redactions necessary for third-party rights and security. Subprocessor additions or replacements follow Article 5.