Data Processing Addendum

Terms such as "controller", "processor", "data subject", "personal data", "processing", "sub-processor", and "personal data breach" have the meanings given in the GDPR (or the equivalent under other applicable law). "Customer Personal Data" means personal data within the data that you or your authorised users and customers submit to or generate within the Service and that GoSorted processes on your behalf. "Applicable Data Protection Law" means all privacy and data-protection laws applicable to a party's processing of Customer Personal Data. "Standard Contractual Clauses" or "SCCs" means the clauses approved by the European Commission for transfers of personal data to third countries, and, where relevant, the UK International Data Transfer Addendum.

As between the parties, you are the controller (or, where you act as a processor for another controller, the processor) of Customer Personal Data, and GoSorted is the processor (or sub-processor). GoSorted processes Customer Personal Data only to provide, secure, support, and maintain the Service, and only in accordance with this DPA, the Agreement, and your documented instructions — including those given through your configuration and use of the Service. GoSorted will inform you if, in its opinion, an instruction infringes Applicable Data Protection Law (without obligation to provide legal advice). Details of the processing are set out in Annex 1.

You are responsible for the lawfulness of the Customer Personal Data and of your instructions, including having a valid legal basis, providing required notices, and obtaining any required consents (for example to send email or SMS communications through the Service). You must not instruct GoSorted to process Customer Personal Data in breach of Applicable Data Protection Law, and you must not submit special categories of personal data except as expressly agreed and with appropriate safeguards.

GoSorted will:

• process Customer Personal Data only on your documented instructions, including for transfers, unless required to do otherwise by law (in which case it will inform you unless legally prohibited);
• ensure that personnel authorised to process Customer Personal Data are bound by confidentiality;
• implement appropriate technical and organisational security measures (Annex 2), as required by GDPR Art. 32;
• respect the conditions in sections 5 and 6 for engaging sub-processors;
• taking into account the nature of the processing, assist you by appropriate measures, insofar as possible, to respond to data-subject requests (section 7);
• assist you in ensuring compliance with your obligations on security, breach notification, data-protection impact assessments, and prior consultation (Art. 32–36), taking into account the information available to GoSorted;
• at your choice, delete or return Customer Personal Data after the end of the provision of the Service, and delete existing copies unless storage is required by law (section 8); and
• make available the information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits (section 9).

You provide general authorisation for GoSorted to engage sub-processors to process Customer Personal Data. The sub-processors GoSorted currently uses, and any it has given notice under this section that it intends to engage, are listed in Annex 3; a sub-processor listed as a notified addition is not engaged until its notice period has ended. GoSorted imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for its sub-processors' performance. GoSorted will give you at least 30 days' notice of any intended addition or replacement of a sub-processor (for example by updating Annex 3 or the public sub-processor list and, where you have subscribed, by notification), and you may object on reasonable data-protection grounds. If the parties cannot resolve the objection, you may terminate the affected part of the Service, with a pro-rata refund of prepaid fees for the period after the termination takes effect.

GoSorted and its sub-processors may process Customer Personal Data in countries outside your own, including the United States, the European Union, the United Arab Emirates, and Australia. Where Customer Personal Data originating in the EU/EEA is transferred to a country without an adequacy decision, the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are incorporated into and form part of this DPA as follows: Module Two (controller to processor) applies where you act as controller, and Module Three (processor to processor) applies where you act as processor for another controller; in each case the optional docking clause (Clause 7) is included; Clause 9(a) Option 2 (general written authorisation) applies with the 30-day notice period stated in section 5; the optional redress language in Clause 11 is not included; for Clause 17 (Option 1) the Clauses are governed by the law of Sweden, and for Clause 18 disputes are resolved before the courts of Sweden; and Annexes I, II and III to the Clauses are deemed completed by Annexes 1, 2 and 3 of this DPA respectively, with the competent supervisory authority determined in accordance with Clause 13. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies with its Tables deemed completed by reference to the same annexes. In case of conflict between the Clauses and this DPA for the transfers they govern, the Clauses prevail. You may request further information about these transfers using the contact details below.

Taking into account the nature of the processing, GoSorted will assist you with appropriate technical and organisational measures, insofar as possible, to fulfil your obligation to respond to data subjects exercising their rights (access, rectification, erasure, restriction, portability, and objection). Many such requests can be actioned by you directly through the Service. If GoSorted receives a request from a data subject relating to Customer Personal Data, it will, unless legally prohibited, refer the data subject to you and not respond directly except on your instruction.

GoSorted will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to it to help you meet your breach-notification obligations. Notification of a breach is not an acknowledgement of fault or liability.

On termination or expiry of the Agreement, and at your choice, GoSorted will delete or return Customer Personal Data and delete existing copies, except to the extent retention is required by law. You may export Customer Personal Data through the Service during the Agreement and for the period stated in the Agreement after termination. Residual copies may persist in routine backups for a limited period before they cycle out (see Annex 1).

ÄTA change orders. The following applies to ÄTAs, the change orders made with the Service's ÄTA form. It is set out in Swedish and followed by an English translation. In both, "företaget" and "the company" mean you, the Customer.

Avslutad ÄTA som utgör underlag för faktura sparas som räkenskapsinformation i sju år från utgången av det kalenderår då räkenskapsåret avslutades. Övriga kopior raderas när de inte längre behövs. GoSorted raderar på företagets instruktion.

English translation: A closed ÄTA that forms the basis of an invoice is kept as accounting information (räkenskapsinformation) for seven years from the end of the calendar year in which the financial year ended. Other copies are deleted when they are no longer needed. GoSorted deletes on the company's instruction.

GoSorted will make available to you the information reasonably necessary to demonstrate compliance with its obligations under this DPA and Art. 28, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. To minimise disruption and protect the confidentiality and security of GoSorted's other customers, audits will be conducted on reasonable prior notice, no more than once per year (unless required by a supervisory authority or following a breach), during business hours, subject to confidentiality, and GoSorted may satisfy audit requests by providing relevant certifications, reports, or written responses where these reasonably address your request.

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any reference to a party's liability means the aggregate liability of that party and its affiliates under and in connection with the Agreement and this DPA together.

This DPA takes effect on the effective date of the Agreement and continues for as long as GoSorted processes Customer Personal Data on your behalf. Except as expressly modified here, the Agreement remains in full force. This DPA is governed by the same law and subject to the same jurisdiction as the Agreement, except to the extent Applicable Data Protection Law requires otherwise.

• Subject matter: GoSorted's provision of the Service to you.
• Duration: the term of the Agreement, plus the retention and backup periods described in the Agreement and the Privacy Policy (account/Customer Data retained for 30 days after closure for export/recovery; financial records for 7 years where required by law; backups for up to 90 days).
• Nature and purpose: hosting, storage, transmission, organisation, and other processing of Customer Personal Data to operate features such as enquiries/leads, quoting, scheduling, jobs, costs and time, invoicing, file/photo storage, communications (email/SMS), AI assistance, and related functions.
• Categories of data subjects: your customers, leads, and contacts; your personnel and authorised users; and other individuals whose personal data you choose to include.
• Categories of personal data: identifiers and contact details (name, email, phone, address); enquiry, quote, job, scheduling, and billing information; files, photos, and notes; communications content; and any other personal data you choose to submit. Special categories of personal data are not intended to be processed and should not be submitted without prior agreement and safeguards.

GoSorted maintains measures appropriate to the risk, including:

• Encryption of personal data in transit (TLS) and encryption of sensitive stored secrets; passwords stored only as salted hashes.
• Database-level tenant isolation (row-level security) so each customer can access only its own data.
• Role-based access controls within the Service and least-privilege access for GoSorted personnel.
• Network and application security controls, logging, and monitoring, with error and anomaly diagnostics.
• Secure development practices, dependency management, and change control.
• Regular backups and the ability to restore availability of personal data in a timely manner after an incident.
• An incident-response process, including breach assessment and notification.

GoSorted uses the following sub-processors to process Customer Personal Data. An entry marked as a notified addition under section 5 is one GoSorted has given notice it intends to engage and has not yet engaged. For personal data originating in the EU/EEA or UK, the transfer safeguard for each is noted; locations are indicative and several providers operate globally.

• Stripe — payment processing and subscription billing (United States / Ireland). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Neon — managed PostgreSQL database hosting (Sydney (ap-southeast-2); EU region for EEA customer data). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Cloudflare R2 — storage of uploaded files, photos, logos, and generated PDFs (global; EU-jurisdiction storage for EEA customer data). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Vercel — application hosting, content delivery, and performance measurement (United States / global). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Resend — transactional and notification email delivery (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Mobile Message — SMS delivery for Australian numbers, including sender-ID registration (Australia). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• 46elks — SMS delivery for Swedish and Norwegian numbers (Sweden (EEA)). Transfers: Within the EEA — no transfer mechanism required.
• Twilio — SMS and voice message delivery and dedicated phone numbers for Australian and US numbers (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Anthropic — AI features; processes inputs only to return outputs and not to train its models (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Intercom, Inc. — customer support: help centre, in-app and email support messaging, and AI-assisted answers to support enquiries (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Sentry — error and crash monitoring / diagnostics (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Inngest — background jobs and scheduled tasks (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Google Maps Platform and Google Cloud Route Optimization (Google Cloud EMEA Limited) — address geocoding, travel-time and route computation, and map display; receives job and customer addresses and their coordinates, worker start and end coordinates (an employee's home coordinate where a worker starts from home), and the visit and worker identifiers that label them (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Hetzner Online GmbH — hosting of GoSorted's self-hosted route-computation service (notified addition under section 5 — engaged only once the notice period ends); receives customer address coordinates, worker start coordinates and the accompanying visit and worker identifiers in transit for the duration of a route calculation (Germany (EEA)). Transfers: Within the EEA — no transfer mechanism required.
• Xero (and, where the customer enables it, QuickBooks Online or MYOB) — accounting integration connected by the customer (global). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Google and Apple — optional single sign-on, only where the customer chooses it (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• GoDaddy.com, LLC — domain registration and DNS, and reseller administration of the Microsoft 365 tenant that hosts our support mailbox (support@gosorted.co) (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Microsoft Corporation — hosting of our support mailbox (support@gosorted.co) on Exchange Online; receives and stores inbound support email, including the sender's name, email address and what they write to us (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).

This is the dated record of sub-processors added to, or removed from, Annex 3, most recent first, each under the date Annex 3 was published with that change in it. Where a change was a sub-processor GoSorted intended to engage, publishing it here and in Annex 3 is the notice section 5 describes. Where a change corrected an omission — a provider already in use that Annex 3 had not listed — no section 5 notice period preceded it, and the entry says so. This Annex is a record: it confers no rights and varies no term of this DPA, section 5 included. It was started on 3 September 2026, when the two earlier changes were entered into it; changes before August 2026, and edits to the wording of an entry already listed, are not recorded here.

• 3 September 2026 — GoDaddy.com, LLC and Microsoft Corporation were added to the list above. Together they carry our support mailbox (support@gosorted.co): the mailbox is hosted on Microsoft's Exchange Online, and GoDaddy registers the domain, runs its DNS and administers the Microsoft 365 tenant. Both have done so since before this list named either of them, so this entry corrects an omission rather than announcing providers we are about to start using: no notice period is running, and none could cure processing that has already happened. Your right under section 5 of the DPA to object to a sub-processor on reasonable data-protection grounds is unaffected.
• 31 August 2026 — Intercom was added to the list above, for customer support — the help centre, in-app and email support messaging, and AI-assisted answers to support enquiries. The 30-day notice period in section 5 of the DPA is a protection for the customer, and where a customer had already confirmed in writing that Intercom could be engaged immediately, that customer gave the protection up and no waiting period applied to them; that confirmation is the only basis on which the period was not observed. For a customer who gave no such confirmation the 30-day period runs from 31 August 2026, the date Intercom appeared in the list above. Please read that together with a fact the period does not change: support email for every customer arrives in one shared mailbox, which has been handled in Intercom since 31 August 2026, so we cannot hold one customer's support messages out of it. If you want to object, or to agree a different way of contacting support, write to privacy@gosorted.co.
• 16 August 2026 — Google Maps Platform was added to the list above. It was already in use, so that entry too corrected an omission rather than announcing a new engagement. Hetzner Online GmbH was added in the other sense — as a notified addition under section 5 of the DPA, not engaged until its notice period has ended, which is why it is still marked as one in the list above. Mapbox was removed: it had been listed but was never used, and no personal data ever reached it. The amendment carrying these changes is dated 15 August 2026 and published on 16 August 2026; where a notice period runs from it, it runs from the later date.

These notices are given both under section 5 of this DPA, for Customer Personal Data GoSorted processes on your behalf, and in GoSorted's own right as controller for the account, billing and support data of its customers, their personnel, and anyone else who contacts it — including prospective customers, and individuals who email its support address — which no customer's waiver of the section 5 notice period reaches. To object to a sub-processor on reasonable data-protection grounds, contact privacy@gosorted.co. Changes are published in this Annex, so it is the current position.

Levain Invest L.L.C-FZ (operating as GoSorted), The Meydan Hotel, Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Privacy contact: privacy@gosorted.co.