Data Processing Agreement

1.1 This Data Processing Agreement (“DPA”) supplements and forms part of the Master Service Agreement, Service Annexes or other written or electronic agreement (“Agreement”) between BICS (a Proximus Global company), hereinafter called “BICS”, that has entered into such Agreement to provide or procure voice, messaging, mobile connectivity, identity verification, numbers, internet-of-things, analytics, and/or fraud detection services (“Services”) to a user of such Services (“COMPANY”). BICS and COMPANY are also hereinafter, each referred to as a “Party” and collectively as the “Parties”.

1.2 For the purposes of this DPA, the Services include services provided directly by BICS as well as services resold or otherwise made available by BICS from other entities within the Proximus Global group or, where applicable, its Affiliates. This DPA is necessary to ensure secure information processing since the provision of the Services under the Agreement may give rise to the exchange of certain information including personal data about individuals.

2.1  Unless the context requires otherwise, the following terms shall when used in this DPA have the meaning set out hereunder:

a) “Affiliate” means a company, person or entity that is owned or controlled by, that owns or controls or is under common ownership or control with a Party. Ownership means direct or indirect ownership of more than 50% of the shares in a company or entity, and control means any power to appoint persons to the board of directors of a company or entity.

b) “Applicable Data Protection Law” means all applicable data protection, privacy, and information security laws and regulations – including but not limited to the EU General Data Protection Regulation (“EU GDPR”) and any national implementing legislation, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”), the UK GDPR and the UK Data Protection Act 2018 (“UK GDPR”), Colombia’s Statutory law 1581 of 2012, Brasil’s Lei Geral de Proteção de Dados Pessoais 13.709/2018 (“LGPD”), the Swiss Federal Act on Data Protection (“Swiss DPA”), India’s Digital Personal Data Protection Act 2023 (“DPDP”) and Indonesia’s Law No. 27 of 2022 concerning Personal Data Protection (“PDP Law”), together with their implementing rules – that are applicable to either Party and/or its processing of personal data in connection with the Agreement.

c) “Controller” means the natural or legal person, which, alone or jointly with others, determines the purposes and means of the processing of personal data.

d) “Data Subject” means an identified or identifiable natural person whose personal data is processed.

e) “Processor” means a natural or legal person which processes personal data on behalf of a Controller.

f) “Restricted Transfer” means: (i) where the EU GDPR applies, a transfer of personal data from the European Economic Area to a country outside of the European Economic Area which is not subject to an adequacy determination by the European Commission; (ii) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data from Switzerland to any other country which is not based on an adequacy decision recognized under the Swiss DPA.

g) “Standard Contractual Clauses” means: (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU SCCs”); (ii) where the UK GDPR applies, the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner under s.119A(1) of the Data Protection Act 2018 (“UK Addendum”); and (iii) where the Swiss DPA applies, the EU SCC’s with the Swiss additions (“Swiss SCCs”).

h) “Sub-processor” means any sub-contractor or agent who is engaged by a Processor and agrees to receive personal data and process same on behalf of the Controller and/or Processor.

i) “Supervisory Authority” means any independent public authority, regulatory authority, or governmental body responsible for the enforcement or supervision of Applicable Data Protection Law, including, where applicable, data protection authorities.

2.2 The terms “personal data”, “personal data breach”, “process”, and “processing” when used shall have the meanings given to them under Article 4 of the EU GDPR.

2.3 The terms “sell” and “share” when used shall have the meanings given to them under the CCPA.

2.4 The terms used in this DPA not defined hereunder shall have their meanings given within the Applicable Data Protection Law.

2.5 Words used in the singular, where the context so permits, shall be deemed to include the plural and vice versa.

3.1 Each Party shall comply with its obligations under the Applicable Data Protection Law in relation to the processing of personal data, including obtaining valid consent or other applicable lawful basis for processing. For the avoidance of doubt, this DPA is in addition to, and does not relieve, remove or replace, a Party’s obligations under the Applicable Data Protection Law.

3.2 The Parties acknowledge that, depending on the nature of the Services, BICS may act either as a Processor (or Sub-processor) on behalf of COMPANY, or as an independent Controller. The specific processing activities are described in Annex I. To the extent that BICS processes personal data as a Processor, on behalf of the COMPANY (or COMPANY’s customer) acting as a Controller, in connection with the Agreement, BICS shall fully comply with the obligations as set out hereunder:

a) process the personal data only as necessary for the performance of the Agreement and strictly in accordance with the COMPANY’s documented instructions, and inform the COMPANY immediately if, in its opinion, an instruction of the COMPANY infringes Applicable Data Protection Law. The permitted purposes of BICS’ processing of personal data are as outlined in Annex I to this DPA. If BICS would be required by any law to process any personal data otherwise than as permitted by the COMPANY, BICS shall inform the COMPANY of the requirement before processing, unless that law prohibits such information on important grounds of public interest.

b) treat the personal data as confidential information, entrust only such employees or agents who have been bound to confidentiality and have previously been familiarised with the data protection provisions relevant to their work with the processing of personal data, and ensure that disclosure of or access to personal data is restricted to its employees or agents that strictly require such personal data to perform the tasks assigned to them in relation to the Services.

c) implement appropriate technical and organizational security measures as set out in Annex II to this DPA, prior to and during processing of any personal data to protect the security, confidentiality and integrity of the personal data and to protect the personal data against any form of accidental, unlawful or unauthorized processing.

d) co-operate with COMPANY to enable COMPANY to comply with its obligations with regard to personal data security, taking into account the nature of the processing and the information available to BICS.

e) provide reasonable co-operation and assistance to COMPANY, if and when COMPANY is required to perform a data protection impact assessment, an international data transfer impact assessment, or consultation with a Supervisory Authority having appropriate jurisdiction. BICS shall promptly inform the COMPANY if BICS becomes aware that certain processing activities are likely to result in a high risk to the rights and freedoms of Data Subjects.

f) co-operate, at its own expense, as requested by COMPANY to enable it to respond and comply with (i) the exercise of rights of Data Subjects pursuant to Applicable Data Protection Law (such as their right of access, right to rectification, right to object to the processing of their personal data, right to erasure and right to restrict processing of their personal data and their right to data portability) and (ii) any other correspondence, enquiry or complaint received from a Data Subject, Supervisory Authority or any other third party in respect of personal data processed by BICS under this DPA.

g) promptly inform COMPANY, to the extent legally permitted, of any requests relating to the exercise of such rights or complaints, enquiry or correspondence if they are received directly by BICS, and shall provide all details thereof. BICS shall provide all information requested by COMPANY, within a reasonable timescale specified by the COMPANY and shall provide such assistance to COMPANY to comply with the relevant request within the applicable timeframes. If necessary, BICS shall co-operate with the competent Supervisory Authority

h) upon COMPANY’s request, make available to COMPANY all records, appropriate personnel, data processing facilities, and any relevant materials relating to personal data processing in connection to the Services provided to COMPANY, to enable COMPANY to demonstrate compliance with its obligations under Applicable Data Protection Law.

i) promptly return or delete the personal data and any existing copies thereof, as soon as it is no longer required for the performance of the Services, unless any applicable law requires the further storage of the personal data. Where deletion is necessary and BICS cannot destroy or delete the personal data due to technical reasons, BICS will take all appropriate steps to (i) come to the closest possible to a complete and permanent deletion of the personal data and to fully and effectively anonymize the remaining personal data; and (ii) make the remaining personal data which is not deleted or effectively anonymized unavailable for any further processing except to the extent required by any applicable law.

j) promptly notify COMPANY if: (i) BICS cannot comply with this DPA; (ii) it has breached or is likely to breach Applicable Data Protection Law; or (iii) Applicable Data Protection Law no longer permits lawful processing or transfer of personal data. BICS shall take reasonable steps to remedy such issues or cease processing as instructed by the COMPANY.

k) COMPANY allows BICS to be assisted by BICS’s subcontractors and Affiliates, and allows BICS to appoint those subcontractors and Affiliates as Sub-processors of personal data involved in the Services, with a view to delivering, facilitating and improving the Services, provided that BICS shall: (i) prior to appointing a Sub-processor, carry out appropriate due diligence on the Sub-processor; (ii) inform the COMPANY at least 30 days in advance and by means of a written communication about its intention to engage a new Sub-processor, including details on the identity of the Sub-processor, the location where the personal data will be processed by such Sub-processor and the concerned data processing activities; (iii) enter into written agreements with such appointed Sub-processor guaranteeing at least the level of data protection and information security provided in this DPA; and (iv) remain liable to the COMPANY for the Sub-processor’s acts, errors or omissions resulting in a breach of Applicable Data Protection Law. COMPANY may within 15 days of BICS’ notification of a new Sub-processor, object to the appointment of the Sub-processor on reasonable grounds relating to the protection of the personal data, in which case the Parties shall then work together promptly and in good faith to resolve the COMPANY’s objections and to agree upon a mutually satisfactory solution. BICS’ current subcontractors and Affiliates are detailed in Annex III to this DPA.

3.3 To the extent BICS acts as an independent Controller of personal data that is collected, exchanged, or otherwise processed in connection with BICS’ performance of the Agreement or delivery of the Services, BICS will comply with its Controller obligations under Applicable Data Protection Law, for example by providing protection for the personal data, ensuring data minimization and that the personal data is processed lawfully, fairly and in a transparent manner in relation to the Data Subject, as well as responding to Data Subjects’ requests to exercise their rights. The provisions of Section 3.2 shall not apply in such circumstances.

4.1 BICS shall implement appropriate and sufficient, technical and organisational security measures prior to and during processing of any personal data to protect the security, confidentiality and integrity of the personal data and to protect the personal data against any form of accidental, unlawful or unauthorized processing. In particular, without limitation, BICS shall protect the personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, use or access to personal data transmitted, stored or otherwise processed and against any form of unlawful processing.

4.2 BICS shall ensure a level of security appropriate to the risks presented by the processing of personal data and the nature of such personal data. Such measures shall include, as appropriate: (i) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (ii) the ability to restore the availability and access to the personal data in a timely manner in the event of a physical or technical incident; and (iii) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. At a minimum, such measures shall include the organisational and technical measures, which meet or exceed relevant industry practice. These measures shall remain in place throughout the duration that BICS provides Services to the COMPANY or until BICS ceases to process personal data, whichever is later. As of the effective date of the Agreement, BICS has implemented the security measures set out in Annex II to this DPA. BICS may update or modify such security measures from time to time provided that such updates and modifications do not result in the material degradation of the security of the Services.

4.3 BICS shall upon becoming aware of any personal data breach, promptly inform the COMPANY of the breach without undue delay and shall provide all such timely information and cooperation as the COMPANY may reasonably require including in order for the COMPANY to fulfil its personal data breach reporting obligations under and in accordance with the timescales required by Applicable Data Protection Law. BICS shall further take all such measures and actions as are necessary to remedy or mitigate the effects of the breach and shall keep the COMPANY up to date about all developments in connection with the breach.

4.4 BICS shall make available to COMPANY, on request, all information reasonably necessary to demonstrate compliance with this DPA. BICS may demonstrate compliance by providing either (i) a certification as to compliance with ISO 27001 or another information security management standard implemented by BICS; or (ii) an audit or attestation report of an independent third-party. To the extent that COMPANY requires further evidence of BICS’ compliance with the DPA or further assurances of information security COMPANY or its appointed third-party auditor may, upon written reasonable request, conduct an inspection of BICS’ records, processes and systems, to the extent necessary according to Applicable Data Protection Law. Such inspection shall be conducted (i) with at least 90 days prior notice; (ii) during regular business hours and under a duty of confidentiality; (iii) with minimal disruption to BICS’ business operations; and (iv) entirely at COMPANY’s expense. Such inspection shall be conducted no more than once annually unless (i) further inspections are required by instruction of a competent Supervisory Authority or (ii) the COMPANY believes that further inspections are necessary due to a personal data breach suffered by BICS. COMPANY and its agents may (at BICS’s election) be accompanied by a member of BICS’s staff should COMPANY require access to BICS’s premises during the inspection.

5.1 To the extent that either Party processes personal data originating from or otherwise subject to the data protection or security law of a particular jurisdiction, the corresponding jurisdiction-specific terms set out below shall apply in addition to, and in the event of conflict prevail over, the foregoing terms of this DPA.

European Economic Area, United Kingdom and Switzerland – International Data Transfers

5.2 BICS shall not make or permit a Restricted Transfer of any personal data (whether as an exporter or as an importer) unless an adequate level of protection in accordance with the Applicable Data Protection Law is ensured. The applicable transfer mechanism and Standard Contractual Clauses module shall be determined based on the Parties’ roles as set out in Annex I The Parties agree that when the transfer of personal data from COMPANY to BICS is a Restricted Transfer it shall be subject to the appropriate Standard Contractual Clauses as follows:

a) EU GDPR (Controller to Controller): in relation to personal data that is protected by the EU GDPR where BICS is a Controller, the EU SCCs will apply completed as follows: (i) Module One will apply; (ii) in Clause 7, the optional docking clause will apply; (iii) in Clause 11, the optional language will not apply; (iv) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Belgian law; (v) in Clause 18(b), disputes shall be resolved before the courts of Belgium; (vi) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex I to this DPA; and (vii) Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II to this DPA.

b) EU GDPR (Controller to Processor): in relation to personal data that is protected by the EU GDPR where BICS is a Processor and COMPANY is the Controller, the EU SCCs will apply completed as follows: (i) Module Two will apply; (ii) in Clause 7, the optional docking clause will apply; (iii) in Clause 9, Option 1 will apply, and the time period for prior notice of Sub-processor changes shall be as set out in Clause 5.1 of this DPA; (iv) in Clause 11, the optional language will not apply; (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Belgian law; (vi) in Clause 18(b), disputes shall be resolved before the courts of Belgium; (vii) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex I to this DPA; (viii) Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II to this DPA; and (ix) Annex III of the EU SCCs shall be deemed completed with the information set out in Annex III to this DPA.

c) EU GDPR (Processor to Processor): in relation to personal data that is protected by the EU GDPR where BICS is a Sub-processor and COMPANY is a Processor of the personal data on behalf of a third party Controller, the EU SCCs will apply completed as follows: (i) Module Three will apply; (ii) in Clause 7, the optional docking clause will apply; (iii) in Clause 9, Option 1 will apply, and the time period for prior notice of Sub-processor changes shall be as set out in Clause 5.1 of this DPA; (iv) in Clause 11, the optional language will not apply; (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Belgian law; (vi) in Clause 18(b), disputes shall be resolved before the courts of Belgium; (vii) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex I to this DPA; (viii) Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II to this DPA; and (ix) Annex III of the EU SCCs shall be deemed completed with the information set out in Annex III to this DPA.

d) UK GDPR: in relation to personal data that is protected by the UK GDPR, the UK Addendum will apply completed as follows: The EU SCCs, completed as set out above in Clause 3.2(a)-(c) of this DPA shall also apply to transfers of such personal data; Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, completed as set out above; and the option “neither party” shall be deemed checked in Table 4. The start date of the UK Addendum (as set out in Table 1) shall be the date of this DPA.

e) Swiss DPA: In relation to personal data that is protected by the Swiss DPA, the EU SCCs as implemented in accordance with Clause 3.2(a)-(c) will apply provided that: (i) references in the EU SCCs to “Regulation (EU) 2016/679” or the “GDPR” shall be interpreted as references to the Swiss DPA; (ii) references to “EU”, “Union” and “Member State law” shall be interpreted as references to Switzerland and to Swiss law, as the case may be; (iii) the term ‘member state’ shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland); (iv) the EU SCCs should be interpreted as protecting the data of legal entities until the entry into force of the revised Swiss DPA; (v) references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the Swiss Federal Data Protection and Information Commissioner (FDPIC) and competent courts in Switzerland; and (vi) if the Restricted Transfer is subject to both the Swiss DPA and the GDPR, then a parallel supervision takes place: FDPIC, insofar as the data Restricted Transfer is governed by the Swiss DPA; and the competent EU Supervisory Authority insofar as the Restricted Transfer is governed by the GDPR (the criteria of Clause 13a for the selection of the competent authority must be observed).

European Economic Area – Digital Operational Resilience Act (Regulation (EU) 2022/2554) (“DORA”) and Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (“NIS2 Directive”)

5.3 To the extent applicable, BICS shall provide the COMPANY with all necessary information and assistance to enable the COMPANY to comply with its obligations under the DORA and NI2 Directive, including with respect to ICT risk management, incident handling, and operational resilience. BICS will:

a) implement and maintain risk management measures aligned with the DORA conducting regular risk assessments related to data processing, performing impact analyses to evaluate the potential consequences of ICT-related incidents on data security and availability, and ensuring continuous monitoring of systems and controls to promptly detect, mitigate, and respond to operational and security risks. In alignment with DORA and NIS2 requirements, BICS shall classify and report major ICT-related incidents to the relevant authorities and impacted parties within 72 hours of becoming aware of such incidents, based on severity and applicable regulatory thresholds.

b) conduct annual Threat-Led Penetration Testing (TLPT), performed by qualified and independent third-party security experts, simulating realistic and targeted cyberattacks to assess the effectiveness of BICS’s security controls and incident response capabilities. The scope of such testing shall include critical systems and infrastructure involved in data processing. BICS shall remediate any identified vulnerabilities or weaknesses within a reasonable timeframe based on severity. Upon written request, BICS shall provide the COMPANY with a high-level summary of the TLPT findings and remediation actions, subject to reasonable confidentiality and security considerations.

c) appoint one or more designated security officers responsible for overseeing and ensuring compliance with applicable cybersecurity and operational resilience regulations, including the DORA and the NIS2 Directive. These officers shall coordinate internal security efforts, monitor regulatory developments, and ensure that relevant policies, controls, and response procedures remain aligned with legal and industry obligations.

California US – CCPA

5.4 To the extent that BICS acts as a “Service Provider” as defined in CCPA Section 1798.140(ag)(1), BICS will:

a) comply with the restrictions imposed on Service Providers under the CCPA, and accordingly (i) not sell or share personal data; (ii) not retain, use, or disclose personal data for any purpose other than for the business purposes specified in the Agreement (including retaining, using, or disclosing it for a commercial purpose other than the business purposes specified in the Agreement or as otherwise permitted under Applicable Data Protection Law); (iii) not retain, use, or disclose personal data outside of the direct business relationship between COMPANY and BICS; and (iv) not combine it with personal data it receives from or on behalf of another entity or that it collects from its own interaction with the Data Subject unless permitted by the CCPA.

b) regardless of its role under the CCPA, (i) process personal data only for the limited and specified purposes under the Agreement and this DPA; (ii) comply with applicable obligations under the CCPA and provide the same level of privacy protection as is required by the CCPA; (iii) allow COMPANY to take reasonable and appropriate steps to ensure that BICS uses personal data in a manner consistent with COMPANY’s obligations under the CCPA; (iv) notify COMPANY if BICS makes a determination that it can no longer meet its obligations under the CCPA; and (v) allow COMPANY upon reasonable notice to stop and remediate BICS’s unauthorized use of personal data.

6.1 BICS acknowledges that the obligations set forth in this DPA are essential and that any violation thereof may seriously harm COMPANY. BICS shall have full and sole liability for all damages resulting from a failure on its part to comply with the provisions of this DPA subject to the limitations of liability set forth in the Agreement. Should any Data Subject to whom the personal data relates, a Supervisory Authority, a court or any other regulatory body lodge a claim for compensation against COMPANY that results from BICS’ breach of its obligations under the Applicable Data Protection Law, BICS shall assist and intervene in COMPANY’s defence against such claim upon COMPANY’s request and shall indemnify and hold harmless COMPANY against all costs and damages resulting from such claim subject to the limitations of liability set forth in the Agreement. The COMPANY shall give BICS prompt written notice of any such claim and shall provide all reasonable co-operation in the defence and settlement of such claim, at BICS’ expense. COMPANY shall not make any admission as to BICS’s liability in respect any claim and shall not agree to any settlement in respect of a claim without BICS’ written consent.

7.1 If any provision in this DPA shall be held to be illegal, invalid or unenforceable, in whole or in part, the provision shall apply with whatever modification is necessary so that the provision is legal, valid and enforceable and gives effect to the Parties’ intent.

7.2 In the event of a conflict between the provisions of this DPA and those of the Agreement in respect of the processing and protection of personal data, the provisions of this DPA will prevail.

7.3 This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions set out in the Agreement, and any disputes arising out of or in connection with this DPA shall be subject to such provisions.

7.4 This DPA may from time to time be updated by Contractor, as necessary, to reflect regulatory or operational changes. DPA updates shall be deemed automatically incorporated into and made a part of this DPA upon (i) Contractor’s publication of the updates on its website (at https://www.telesign.com/DPA) and (ii) Contractor’s notification of the updates to Client.

MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred:

• COMPANY’s commercial contacts and representatives
• COMPANY’s subscribers or end users
• Calling and called parties

Categories of personal data transferred

• Identification and contact information related to COMPANY’s representatives such as name, job title, email address, phone number
• Identification and contact information related to COMPANY’s subscribers or end users e.g. names, phone numbers, address, and additional information such as data of birth and proof of address as it may be required by applicable local laws for the provision of specific services (only relevant to Cloud Communications services).
• Communications metadata related to calling and called parties: traffic data related to voice and message services e.g. originating and terminating number, call duration and timestamp.
• Telecom and other identifiers (e.g., IMSI, MSISDN, IP address), location information.
• Hashed or pseudonymised message content, only for fraud prevention purposes and appropriate routing, in accordance with applicable regulations, where applicable.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• Sensitive data is not processed.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Continuous basis.

Nature of the processing

• Providing access to and operation of the Services, including transmission, routing, monitoring, verification, storage, support, troubleshooting and service security activities, as applicable.

Purpose(s) of the data transfer and further processing

Data importer may process personal data in accordance with the purposes set out in the Agreement and:

• transmitting, routing, and delivering communications
• detecting, preventing, and mitigating fraud, abuse, and security incidents, including through hashed content-based checks where applicable;
• monitoring service performance, availability, and quality
• troubleshooting, debugging, and error resolution
• billing, reconciliation, and usage reporting
• managing customer relationship
• complying with applicable legal, regulatory, and telecommunications obligations
• maintaining, improving, testing, and developing services, systems, and infrastructure, including through aggregated or anonymized analytics where possible and in accordance with applicable law.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

• Personal data is processed for so long as it is needed for the provision of the Services and to enable Data importer’s purposes as a controller and/or for compliance with local regulatory requirements, accounting, or record‑keeping obligations, or as necessary to resolve disputes, enforce rights in accordance with Applicable Data Protection Laws.

C. COMPETENT SUPERVISORY AUTHORITY

As per the criteria set out in Clause 13(a) of the EU SCCs.

MODULE TWO: Transfer controller to processor
Categories of data subjects whose personal data is transferred:

• Calling and called parties

Categories of personal data transferred

• Communications metadata related to calling and called parties: traffic data related to voice and message services e.g. originating and terminating number, call duration and timestamp.
• Telecom and other identifiers (e.g., IMSI, MSISDN, IP address), location information.
• Hashed message content (only applicable to FraudGuard Managed Services)

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• Sensitive data is not processed.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Continuous basis.

Nature of the processing

• Providing access to and operation to specific Services, such as fraud prevention and analytics services.

Purpose(s) of the data transfer and further processing

Data importer may process personal data in accordance with the purposes set out in the Agreement and:

• providing, operating, supporting and delivering the Services in accordance with the Agreement and the data importer’s instructions;
• detecting, preventing, and mitigating fraud, following specific customer instructions
• monitoring service performance, availability, and quality

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

• The duration of the processing is limited to the duration needed to perform data importer’s obligations under the main Agreement unless a legal obligation applies. The obligations of the data importer with regard to the personal data processing shall in any case continue until the personal data have been properly deleted or have been returned at the request of the data exporter.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

• In performing its services, data importer will use computing and personnel resources from its employees, affiliates and sub-processors in the United States, United Kingdom, Serbia, Singapore, Colombia, China and the European Economic Area for the duration needed to perform its obligations under the main Agreement.

C. COMPETENT SUPERVISORY AUTHORITY

As per the criteria set out in Clause 13(a) of the EU SCCs.

MODULE THREE: Transfer processor to processor
Categories of data subjects whose personal data is transferred:

• Calling and called parties

Categories of personal data transferred

• Communications metadata related to calling and called parties: traffic data related to voice and message services e.g. originating and terminating number, call duration and timestamp.
• Telecom and other identifiers (e.g., IMSI, MSISDN, IP address), location information.
• Hashed message content (only applicable to FraudGuard Managed Services)

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• Sensitive data is not processed.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Continuous basis.

Nature of the processing

• Providing access to and operation of the Services, including transmission, routing, monitoring, verification, storage, support, troubleshooting and service security activities, as applicable.

Purpose(s) of the data transfer and further processing

Data importer may process personal data in accordance with the purposes set out in the Agreement and:

• providing, operating, supporting and delivering the Services in accordance with the Agreement and the data importer’s instructions;
• detecting, preventing, and mitigating fraud, following specific customer instructions
• monitoring service performance, availability, and quality

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

• The duration of the processing is limited to the duration needed to perform data importer’s obligations under the main Agreement unless a legal obligation applies. The obligations of the data importer with regard to the personal data processing shall in any case continue until the personal data have been properly deleted or have been returned at the request of the data exporter.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

• In performing its services, data importer will use computing and personnel resources from its employees, affiliates and sub-processors in the United States, United Kingdom, Serbia, Singapore, Colombia, China and the European Economic Area for the duration needed to perform its obligations under the main Agreement.

C. COMPETENT SUPERVISORY AUTHORITY

As per the criteria set out in Clause 13(a) of the EU SCCs.

Technical and Organizational Security Measures
This document describes the technical and organizational security measures implemented by BICS, as a Proximus Global company, in connection with the provision of the Services to COMPANY, in order to ensure a level of security appropriate to the risks associated with the processing of personal data. These measures may evolve over time to reflect changes in technology, threats, and business operations, provided that the overall level of security is not decreased.

1.1 BICS maintains an information security management framework and has implemented risk management processes, ensuring risks are properly identified, registered, treated and approved. The risk management practice ensures that measures remain appropriate to evolving threats and the state of the art.

1.2 A clear internal responsibility for security governance has been assigned in the company. A dedicated security team composed of security specialists, reports to the Proximus Global Chief Information Security Officer.

1.3 BICS has documented and maintains security policies supporting these frameworks and measures.

2.1 BICS maintains an information security management framework consistent with the requirements of internationally recognized standards such as ISO 27001, ensures compliance with applicable laws and regulations, and implements risk management measures aligned with industry best practices.

2.2 BICS performs regular testing and evaluation of its security measures, to verify compliance with the predefined requirements, and remediate any identified gaps. BICS conducts periodic penetration tests, under which sensitive applications, systems or platforms are tested by qualified and independent third-party security experts, who assess the effectiveness of the security controls and incident response capabilities.

3.1 BICS’s personnel are required to conduct themselves in a manner consistent with the company’s guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. BICS conducts reasonably appropriate background checks on any employees who will have access to COMPANY data, to the extent legally permissible and in accordance with applicable local labour law, customary practice, statutory regulations, and in proportion to the data processed. Personnel are required to execute a confidentiality agreement and to always protect COMPANY data.

3.2 Personnel are provided with privacy and security training on how to implement and comply with the information security program, at onboarding and periodically thereafter. Procedures are in place to ensure that personnel accesses are updated in the event of a role change and removed in the event of termination.

4.1 BICS protects sensitive data using strong encryption standards, to ensure information is secure both in transit and at rest, according to sensitivity, risk level and technical feasibility.

4.2 Encryption keys are managed through secure key management systems with strict access controls and segregation of duties to prevent unauthorized access.

4.3 When relevant and feasible, pseudonymisation techniques are applied.

5.1 BICS has developed and maintains a business continuity and disaster recovery program. The services that BICS delivers are supported by redundant systems and backup mechanisms appropriate to the risks.

5.2 Backup procedures are in place, and periodic restoration testing is performed.

6.1 BICS has implemented a formal access control policy that defines the principles, roles and responsibilities related to granting, modifying, reviewing and revoking access rights. Access is granted based on the principles of least privilege and need-to-know, ensuring that users only have access to the systems and data necessary to perform their job functions. Access provisioning and deprovisioning procedures are tied to HR processes.

6.2 A strong password policy is enforced, and multi-factor authentication is required for sensitive accesses (remote access, privileged activities).

6.3 Regular review of user privileges is performed, in order to validate the appropriateness of permissions, and remove those that are no longer necessary

7.1 Physical access to any facility where data is being processed is controlled via badge systems or equivalent measures. Access is granted only to personnel who require such access to perform their duties.

7.2 A visitor process is in place: visitors’ accesses are logged, and visitors are escorted within the facilities.

7.3 Physical and environmental protections are in place in the facilities: fire detection, power backup, climate control,

8.1 BICS maintains documented secure configuration standards for infrastructure and applications. These standards are based on industry best practices and recognized frameworks. This includes system hardening procedures, removal and disabling of unnecessary services, ports and default accounts, enforcement of secure baseline configurations, and controlled change management procedures.

8.2 A vulnerability management program is in place, ensuring the identification, assessment and remediation of any identified weaknesses. BICS performs periodic scanning of internal and external systems, prioritizes identified vulnerabilities based on their severity and associated risks, and defines remediation timelines. A patch management process is in place, to ensure timely application of security updates.

8.3 BICS implements layered protection against malicious software across its network and infrastructure. Centrally managed anti-malware protection solutions are deployed and monitored. Email and web filtering are implemented, to detect malicious attachments and links, and to prevent access to known malicious domains.

8.4 A defense-in-depth approach protects BICS’s network, including network segmentation, firewalls controlling inbound and outbound traffic, and intrusion detection and prevention mechanisms.

8.5 Logging and monitoring systems are implemented, to detect and respond to suspicious activity. Security events are logged and, where feasible, collected centrally. Alert mechanisms are defined to ensure a timely response in the event of an incident. Log retention is aligned with business and legal requirements.

9.1 BICS applies the principle of data minimisation, so that only personal and business data strictly necessary for defined and legitimate purposes is collected and processed. The processing of personal data is limited to what is necessary for contractual, legal, or operational requirements. A privacy-by-design approach is embedded in system and process development.

9.2 A data retention policy defines retention periods, based on legal and regulatory requirements, contractual obligations and business and operational needs.

9.3 When the data is no longer necessary, secure deletion is performed, ensuring that data is irreversibly removed from the systems. Secure erasure methods are used for electronic data. Secure disposal of physical media is performed by certified companies.

10.1 BICS conducts due diligence and security assessment before onboarding suppliers. Suppliers are contractually obliged to ensure at least the same level of security that BICS upholds.

10.2 BICS regularly monitors its supply chain, to verify compliance with the security requirements.

11.1 BICS maintains a formal incident management framework designed to quickly identify, assess, and respond to security events. BICS’s systems are continuously monitored for suspicious activity, with defined escalation procedures to ensure timely containment and remediation.

11.2 In the event of a confirmed incident, a team of experts is gathered to manage the incident. The team follows documented response and communication processes, including root cause analysis, and corrective actions, and, where required, external notification towards impacted customers and/or regulatory notification in line with applicable laws.

11.3 Regular testing and post-incident reviews are performed to strengthen the controls and improve resilience.

BICS engages the following third-party service providers to perform specific processing activities in connection with the Services.

The following entities are BICS’ affiliates that may process data in connection with provision of the Services. Affiliates are engaged due to the global nature of BICS’ operations, and each affiliate is bound by intra-group data processing agreements that impose data protection obligations no less protective than those set out in this DPA.