EvolveX AI — Business Data Processing Addendum

Version 1.3 — Effective 4 October 2026.

1. Parties, application and priority

This Addendum forms part of the EvolveX AI Terms of Service between Evolvex Technology CO. LLC, Office 108, Office 9, Zalfa Building, Al Garhoud, Dubai, United Arab Emirates, commercial licence 1454109, Department of Economic Development, Dubai ("Evolvex", "we"), and the business customer identified in the accepted order or business account ("Customer"). It applies when we process personal data contained in Customer Content on that Customer's documented instructions to provide an enabled service ("Covered Data"). It does not make an individual consumer a business customer or authorise processing for an unidentified organisation.

The Customer is the controller or a processor authorised by its controller, and Evolvex is a processor or subprocessor respectively. Each party retains its obligations under applicable law. Our independent account administration, billing and security processing is governed by our Privacy Policy rather than Customer instructions.

This Addendum prevails over conflicting general Terms concerning Covered Data. An expressly agreed order may provide more specific requirements without reducing mandatory protections. Publication makes this standard Addendum available for incorporation in the applicable business agreement; it does not represent that a separately negotiated order has been signed by any named customer.

2. Instructions and confidentiality

We will process Covered Data only to provide the enabled services, maintain their security and availability on the Customer's behalf, and follow lawful documented instructions within the agreement. Instructions include the accepted order, authorised settings and requests from users acting within their assigned roles. AI-generated suggestions and untrusted third-party content do not independently authorise new purposes, recipients or access.

If law requires processing beyond those instructions, we will inform the Customer beforehand unless prohibited by law. If we consider that an instruction infringes applicable data-protection law, we will inform the Customer, seek clarification and may suspend the affected processing. Personnel permitted to process Covered Data must be bound by confidentiality and have access appropriate to their duties.

We will not use Covered Data for unrelated general-purpose model training, advertising or sale. Additional independent use requires a separate lawful arrangement and any legally required notices and choices. The standard description in section 12 applies unless an agreed order narrows or supplements it. Ordinary registration does not establish a hospital, government or other regulated deployment agreement.

3. Customer responsibilities

The Customer is responsible for the lawfulness of collection and instructions, appropriate notices and permissions, authorised disclosure, and administration of users, integrations and access. A Customer acting as a processor must obtain the necessary controller authority. It must inform us of mandatory location or sector-specific requirements before sending affected data.

The Customer must assess AI outputs and automated actions in their intended context and provide legally required human oversight. These responsibilities do not remove our own obligations or excuse processing outside lawful instructions.

4. Security

We will maintain technical and organisational measures appropriate to the nature, scope and risk of processing, including access control, secure credential handling, protection during transmission, separation of customer access, security maintenance and proportionate recovery and incident-response arrangements.

The applicable measures depend on the enabled features and agreed architecture. The general service does not promise that every stored category uses customer-only encryption keys, every plugin is isolated by an operating-system sandbox, or processing remains in a particular country. Applicable measures, locations and evidence can be requested from [email protected] and must be agreed before a deployment requiring additional safeguards is provisioned. We will not materially reduce the agreed protection during the service term without an appropriate lawful arrangement with the Customer.

5. Personal-data breaches

On becoming aware of a personal-data breach affecting Covered Data, we will notify the Customer without undue delay and within any applicable mandatory period. We will provide available information about its nature, affected categories and approximate scope, likely consequences, mitigation and a contact for further information. Information may be supplied in phases as the investigation progresses.

We will take appropriate containment and investigation steps, preserve relevant evidence and reasonably assist with the Customer's legal obligations. Notification is not by itself an admission of fault. The Customer determines its notifications to individuals and authorities unless law directly requires us to notify or the parties agree otherwise.

6. Subprocessors

The Customer gives general written authorisation for subprocessors needed to provide its agreed services, subject to this section. We will make information about them, their functions and relevant locations available on request before the Customer begins affected processing. We will give reasonable advance notice of additions or replacements and a meaningful opportunity to object on reasonable data-protection grounds before the change affects Covered Data, except where a lawful urgent arrangement requires prompt subsequent notice.

We will consider timely objections in good faith and seek a reasonable alternative, restriction or resolution. If none is available, the Customer may discontinue the affected processing and terminate the affected service without a termination penalty. Unused prepaid amounts attributable to the terminated service will be refunded; services already properly supplied remain payable.

We will impose relevant data-protection obligations on subprocessors by contract and remain responsible for their performance to the extent required by law and this Addendum. Integrations and recipients independently selected and controlled by the Customer are not automatically our subprocessors; their roles and the Customer's instructions must be assessed separately.

7. International transfers

We will not transfer Covered Data internationally unless applicable legal requirements are met, including required assessments, transfer mechanisms and safeguards. This Addendum is not itself a substitute for a mandatory transfer instrument; any additional required instrument must be in place before the affected transfer.

Storage, inference, support and Customer-selected integrations may involve different locations. We will provide relevant deployment information on request so the Customer can assess requirements before sending affected data. An on-premise service does not permit undisclosed remote processing; external access and transfers must follow its agreed terms and applicable law.

8. Rights, assessments and cooperation

Taking account of processing and information available, we will reasonably assist with lawful individual rights requests, security obligations, impact assessments and regulator consultations concerning Covered Data. We will promptly forward requests concerning the Customer's processing and not independently decide their substance unless required by law or authorised. Identity verification must be proportionate.

Ordinary service capabilities and assistance included in the plan remain available. Charges for extraordinary assistance must be disclosed and agreed in advance and must not obstruct statutory duties or remedies. We will cooperate with competent authorities as required by law.

9. Information and audits

We will provide information reasonably necessary to demonstrate compliance. The parties will ordinarily begin with current documentation and relevant evidence. Where further audit is reasonably necessary, the Customer or a qualified independent auditor bound by confidentiality may audit on reasonable notice with proportionate safeguards for security, other customers and service continuity.

Practical scope and timing must not be unreasonably withheld. This section does not restrict regulatory powers, legally required audits or urgent measures following a material incident. We do not claim certification unless we expressly identify a valid certification and its scope.

10. Return, deletion and retention

At the Customer's lawful direction or the end of service, we will, at its choice, return Covered Data in an available usable export format or delete it, unless retention is legally required. Requests may use available controls or [email protected]. We will confirm applicable export and deletion arrangements, including any service-specific exit period, and complete them within applicable legal periods and agreed terms. An exit period does not authorise unlimited retention or reuse.

Where law requires retention, we will identify categories and reasons where lawful, restrict processing to that requirement and delete when it ends. Data awaiting expiry in protected backups remains covered by this Addendum, must not be restored for ordinary use and must expire under the applicable backup retention cycle. Necessary recovery must reapply deletion instructions. Relevant retention arrangements are available on request; no undisclosed indefinite retention is authorised.

Customer-held exports and independent recipients' copies are outside our direct deletion control. Local copies may require device controls. This does not excuse deletion of copies we control or our assistance obligations.

11. Term, liability and governing law

This Addendum remains effective while we process Covered Data, including legally required retention. Liability and dispute resolution follow the Terms and expressly agreed business order, subject to mandatory law. No AI disclaimer, limitation or instruction removes a non-excludable obligation. No separate liability cap is created unless an applicable order expressly provides one. Mandatory data-protection law and regulatory powers remain unaffected.

12. Standard processing description

Subject matter and purpose. The EvolveX AI services actually enabled for the Customer, including AI conversations, cloud or local project assistance, email, Drive, project management, support and authorised integrations. Processing follows section 2; optional features are covered only when enabled and used within the agreement.

Operations. Receipt, organisation, storage, retrieval, analysis, generation of requested outputs, transmission to authorised recipients, export and deletion as needed for those services. Local plugins may process data on the Customer's device or LAN; only data transmitted to or accessed by us is processed by us under this Addendum. Local access alone does not authorise cloud transmission.

Data subjects and categories. Authorised users, employees, contractors, customers, business contacts and other individuals whose data the Customer lawfully processes within the agreed service. Categories may include identification and contact details, business communications, project records, documents, images and other provided content, together with technical identifiers needed to carry out instructions. This does not authorise indiscriminate collection of all information accessible to a device or system.

Sensitive and regulated data. Health records, government-restricted information and other data requiring specialised safeguards are not authorised merely by this description. The parties must first agree applicable categories, operations, locations, recipients, security, retention and legal requirements in an appropriate order or additional schedule.

Duration. The enabled service term and the period necessary to complete lawful return or deletion under section 10, subject to legally required retention.

Deployment and recipients. The actual cloud, dedicated cloud or on-premise deployment in the accepted order and configuration. Dedicated and on-premise options apply only once provisioned. Subprocessors and transfers follow sections 6 and 7; Customer-controlled integrations remain subject to lawful Customer instructions.

Contact. Evolvex Technology CO. LLC, Office 108, Office 9, Zalfa Building, Al Garhoud, Dubai, United Arab Emirates; [email protected]. Customer administrative and privacy contacts are those supplied in the business account or order and must be kept current.