Data Processing Agreement (DPA)

under Art. 28 of Regulation (EU) 2016/679 (GDPR) and § 34 of Act No. 18/2018 Coll.

Version: 1.0 · Effective date: 21 June 2026

This agreement forms an integral part of the Terms of Service for the Provio Service and is concluded between:

• Controller: the Customer (the Provio service customer) who enters or processes personal data in the Service. Where the Customer processes data on behalf of its own clients, it acts as a processor and the Provider as a sub-processor; the provisions apply accordingly.
• Processor: VisionEdge s. r. o., 29. augusta 1503/1A, 958 01 Partizánske, Company ID (IČO): 51962161, registered in the Commercial Register of the District Court Trenčín, Section Sro, Insert No. 37109/R.

1. Subject matter and duration

1.1 The Processor processes personal data on behalf of the Controller solely for the purpose of providing the Provio service under the Terms — in particular importing and valuing crypto transactions, creating evidence packages, sanctions screening and preparing accounting exports.

1.2 Processing lasts for the duration of the agreement on provision of the Service. After its termination, Art. 7 applies.

2. Nature and purpose of processing

2.1 Nature: collection, import, storage, structuring, valuation, display, generation of evidence packages and exports, screening against sanctions lists, backup and deletion of personal data, carried out by automated means within the Service.

2.2 Purpose: processing crypto transactions for the Controller's accounting purposes.

2.3 Categories of data subjects and data: see Annex 1.

3. Controller's instructions

3.1 The Processor processes personal data only on the basis of the Controller's documented instructions; the use of the Service and these Terms/DPA are also deemed instructions.

3.2 If the Processor is required to process data under EU or Slovak law, it informs the Controller, unless the law prohibits this.

3.3 If the Processor considers that an instruction infringes data protection regulations, it notifies the Controller without delay.

4. Processor's obligations

4.1 Confidentiality: persons authorised to process the data are bound by confidentiality.

4.2 Security (Art. 32 GDPR): measures under Annex 3.

4.3 Assistance to the Controller: to a reasonable extent with data subject requests (Art. 12 to 23 GDPR) and obligations under Art. 32 to 36 GDPR.

4.4 Personal data breach: notification to the Controller without delay, no later than within 48 hours of becoming aware, and cooperation.

4.5 Audit: making available the information necessary to demonstrate compliance with Art. 28 GDPR and allowing for an audit by prior arrangement while maintaining the confidentiality of other customers.

5. Sub-processors

5.1 The Controller grants general authorisation to engage the sub-processors listed in Annex 2.

5.2 The Processor imposes equivalent data protection obligations on sub-processors and informs the Controller in advance of changes to their list, with the option to object.

6. Transfers to third countries

6.1 Transfers outside the EEA take place only where appropriate safeguards under the GDPR exist (in particular SCC). Current sub-processors and their locations are listed in Annex 2.

7. Deletion or return of data

7.1 Upon termination of the provision of the Service, the Processor, at the Controller's choice, returns or deletes the personal data and copies, unless EU or Slovak law requires retention; export is available for 30 days after termination (Terms Art. 11.4).

8. Liability and final provisions

8.1 The liability of the parties is governed by the GDPR and the Terms. In the event of a conflict on matters of personal data processing, this DPA prevails over the Terms and is governed by the law of the Slovak Republic.

Annex 1: Categories of data subjects and personal data

Categories of data subjects:

• the Controller's clients (crypto clients) and their representatives,
• counterparties of transactions and persons associable with wallet addresses (where personal data),
• users to whom the Controller has granted access,
• other persons whose data the Controller enters into the Service.

Categories of personal data:

• identification and contact data (name, email, possibly other contact),
• business and tax identifiers (business name, Company ID, Tax ID, VAT ID),
• transaction data (wallet addresses, counterparties, amounts, dates, network fees, EUR valuation),
• sanctions screening results (flag, source, time of check),
• operational data (logs, audit records, identifiers).

Special categories of data (Art. 9 GDPR) are not to be entered into the Service.

Annex 2: List of sub-processors

Before publishing, confirm the specific processors and their region. If part (e.g. valuation or sanctions screening) is performed within our own infrastructure without a third party, remove that row.

Annex 3: Technical and organisational measures (Art. 32 GDPR)

• Encrypted transmission (HTTPS/TLS) and security headers.
• Secure password storage and access and role management (including read-only access).
• Logical isolation of individual customers' data.
• A content checksum (SHA-256) to demonstrate the integrity of evidence packages.
• Audit logging of key actions.
• Regular encrypted backups and tested recovery.
• Operational monitoring and a controlled change-deployment process.

The measures are reviewed on an ongoing basis according to the state of the art.