Data Processing Agreement (DPA)

This Data Processing Annex (the "Annex") is entered into between Morpheous Dynamics ("Processor") and the person using the "Cryptic AI" software under a License Agreement between the parties (the "License Agreement", and such person, the "Controller"). This Annex forms an integral part of the License Agreement and governs the Processor's processing of personal data that the Controller itself uploads into the "Cryptic AI" software (the "Software") in the course of using it. It does not cover the processing of personal data of visitors to the Processor's website, which is governed by a separate Privacy Policy.

1. Definitions

1.1."Processor" means Morpheous Dynamics, which processes personal data on behalf of and for the benefit of the Controller in connection with providing access to the Software under the License Agreement.

1.2."Controller" means the Licensee under the License Agreement, which independently determines the purposes and content of the processing of personal data it uploads into the Software.

1.3."Personal data" means any information relating to an identified or identifiable natural person (a data subject) that the Controller uploads into the Software as part of the materials described in Section 3 of this Annex.

1.4."Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, blocking, erasure, or destruction of personal data.

1.5."Sub-processor" means a third party engaged by the Processor to carry out specific processing activities on personal data on behalf of the Controller.

1.6."Data subject" means a natural person whose personal data is contained in materials (documents, files, reports) uploaded by the Controller into the Software, including the Controller's clients, counterparties, and counterparties' representatives.

1.7."Data breach" means a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data processed within the Software.

1.8."GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, to the extent it applies to the Controller under the law to which the Controller is subject.

1.9.Terms used in this Annex and not otherwise defined herein have the meaning given to them in the License Agreement, including the terms "On-chain data" and "External data sources" as defined in clauses 1.8 and 1.5 of the License Agreement, respectively.

2. Subject matter and duration

2.1.This Annex sets out the terms on which the Processor processes personal data that the Controller itself uploads into the Software in the course of using its functionality, in particular when uploading KYC documents, case materials, exchange reports, and other files that may contain the personal data of third parties.

2.2.This Annex remains in effect for the entire term of the License Agreement (the License Period), the calculation, renewal, and termination of which is governed by the Agreement (Договор) and the License Agreement, and terminates simultaneously with them, except for provisions which by their nature are intended to survive termination (Section 10 of this Annex).

3. Nature and purpose of processing, categories of data subjects and categories of data

3.1.The Processor processes personal data solely for the purpose of providing the Controller with the functionality of the "Cryptic AI" Software: analysis of crypto-asset data, automation of AML/CTF investigations, KYC/EDD checks, risk-score calculation, and the generation of reports for the Controller.

3.2.Categories of data subjects whose personal data may be contained in materials uploaded by the Controller into the Software:

• the Controller's own clients and their representatives;
• counterparties of the Controller's clients referenced in case materials;
• other natural persons whose information is contained in KYC documents, exchange reports, internal investigation materials, and other files uploaded by the Controller.

3.3.Categories of personal data that may be contained in materials uploaded by the Controller into the Software:

• identification data (full name, date of birth, nationality, identity document details);
• contact data (postal address, telephone number, email address);
• information contained in KYC/EDD documents and exchange reports (data on client transactions, screenshots, account statements);
• other information which the Controller, at its own discretion, includes in case materials to the extent necessary for the purposes of the analysis.

3.4.For the avoidance of doubt, On-chain data (wallet addresses, transaction hashes and parameters, attribution and cluster data) and data obtained from External data sources are not personal data for the purposes of this Annex and the License Agreement (clause 11.4 of the License Agreement), and the provisions of this Annex do not apply to them.

4. Processor's obligations

4.1.The Processor processes personal data only on the Controller's documented instructions, to the extent and for the purposes set out in Section 3 of this Annex. The Controller's act of uploading the relevant materials into the Software in the course of using its functionality itself constitutes a documented instruction of the Controller.

4.2.The parties acknowledge that the Processor's use of anonymized and/or aggregated data on Users' interactions with the Software for the purposes set out in clause 11.2 of the License Agreement (further training and tuning of models, improving the accuracy and relevance of analytical output, improving the interface and methodology) constitutes a standing instruction of the Controller and does not require separate case-by-case authorization, provided that such processing does not allow identification of a specific natural person.

4.3.The Processor ensures that persons authorized to process personal data (its employees and engaged specialists) are bound by confidentiality obligations with respect to such data.

4.4.The Processor applies reasonable technical and organizational measures to protect personal data, proportionate to the risks of processing, including, in particular: encryption of data in transit using TLS; hashing of User passwords using the bcrypt algorithm; and role-based access control over the Software's functionality and data. This clause does not establish or imply that the Processor maintains any measure not expressly listed here (including encryption of data at rest or compliance with industry information-security certifications), unless separately agreed by the parties.

4.5.The Processor may engage Sub-processors to process personal data only with the Controller's general or specific prior authorization. The list of Sub-processors engaged as of the date of this Annex is set out in Section 6. The Processor notifies the Controller of any planned changes to the list of Sub-processors in accordance with clause 6.2.

4.6.The Processor provides the Controller with reasonable assistance in responding to data subject requests to exercise their rights (access, rectification, erasure, restriction of processing) with respect to personal data processed within the Software, to the extent commensurate with the Software's functionality.

4.7.The Processor notifies the Controller without undue delay of any Data breach of which it becomes aware affecting personal data uploaded by the Controller into the Software. Where GDPR applies to the Controller, the Processor uses reasonable efforts to provide such notice within a timeframe that enables the Controller to meet its own obligation to notify the supervisory authority within 72 hours.

4.8.Upon termination of services under the License Agreement (termination of the Controller's access to the Software), the Processor, at the Controller's election, deletes or returns all personal data uploaded by the Controller into the Software, except where applicable law requires the Processor to retain such data further.

4.9.The Processor provides the Controller, upon a reasonable request, with information necessary to demonstrate compliance with the obligations under this Annex, and allows the Controller to conduct an audit (itself or through an independent auditor), subject to reasonable prior notice and to confidentiality obligations with respect to information obtained in the course of such audit.

5. Controller's obligations and rights

5.1.The Controller warrants that it has a lawful basis for uploading into the Software the personal data of any data subject, and bears sole responsibility for the lawfulness of such processing, including, where necessary, obtaining data subjects' consent or having another lawful basis available.

5.2.The Controller undertakes not to upload into the Software personal data beyond what is necessary for the purposes of the analysis, in accordance with clause 11.6 of the License Agreement, and independently determines the composition and volume of the materials it uploads.

5.3.The Controller may issue additional documented instructions to the Processor regarding the processing of personal data within the scope of the Software's functionality. The Processor may decline to follow instructions that conflict with applicable law or this Annex, having notified the Controller accordingly.

5.4.The Controller may exercise the audit right provided for in clause 4.9 of this Annex to verify the Processor's compliance with its obligations.

6. Sub-processors

6.1.As of the date of this Annex, the Processor engages the following Sub-processors to process personal data uploaded by the Controller into the Software:

• cloud infrastructure and hosting provider — OVH SAS: processing on servers located in the French Republic for the production environment; on servers located in Canada for the test/staging environment (at present), with a planned transition to hosting in the Republic of Kazakhstan;

LLM/AI technology provider — Anthropic (United States of America), used to generate analytical interpretations based on case materials uploaded by the Controller into the Software.

6.2.The Processor notifies the Controller of material changes to the list of Sub-processors (engagement of a new Sub-processor or replacement of an existing one) via the Software's Web interface, by email, or by another agreed means, in advance of such Sub-processor beginning to process data. If the Controller does not raise a reasoned objection within a reasonable time after such notice, the change is deemed accepted.

7. International data transfers

7.1.The Controller acknowledges and agrees that, by virtue of clause 6.1 of this Annex, personal data may be processed in the jurisdictions where the above Sub-processors are located, including the French Republic, Canada, and the United States of America, with a planned transition to processing in the Republic of Kazakhstan.

7.2.For Controllers subject to GDPR or other law imposing additional requirements on the international transfer of personal data, the parties will, at the Controller's request, enter into a supplementary annex on the terms of the European Commission's Standard Contractual Clauses or another equivalent mechanism applicable to the relevant transfer. Entering into such a supplementary annex does not, by itself, change the governing law specified in Section 9 of this Annex.

8. Liability

8.1.The Processor's liability for breach of its obligations under this Annex is governed by clause 13.2 of the License Agreement and is limited to the aggregate amount specified therein. This Annex does not establish a separate or additional cap on the Processor's liability beyond the License Agreement.

8.2.The Controller bears sole responsibility for the consequences of breaching its own obligations under Section 5 of this Annex, including uploading personal data into the Software without a lawful basis or in excess of what is necessary.

9. Governing law and dispute resolution

9.1.This Annex is governed by and construed in accordance with the law of the Republic of Kazakhstan, consistent with clause 15.1 of the License Agreement.

9.2.The parties may agree, in a signed supplementary annex to this Annex, on additional terms applicable to a specific Controller, in particular for Controllers subject to GDPR, including the terms referred to in Section 7 of this Annex. Such agreement does not change the governing law set out in clause 9.1 unless the parties expressly agree otherwise with respect to that supplementary annex.

9.3.Disputes arising in connection with this Annex are resolved in the manner provided for in Section 15 of the License Agreement, including litigation at the Processor's place of business if the parties fail to reach agreement through negotiation.

10. Term and entry into force

10.1.This Annex enters into force simultaneously with the License Agreement and forms an integral part of it.

10.2.This Annex remains in effect for the entire term of the License Agreement and terminates simultaneously with it, except for the obligations under clauses 4.7 and 4.8 of this Annex (notification of a Data breach discovered after termination, and deletion or return of personal data) and the definitions in Section 1 to the extent necessary to construe the surviving provisions, which continue to apply until the relevant obligations have been fully performed.

10.3.The current version of this Annex is permanently available on the Processor's website and applies to the processing of personal data carried out from the moment of its publication.