Data Processing Agreement

This Data Processing Agreement (the "DPA") forms an integral part of the Terms and Conditions of Use of SabantBet (the "Terms") and governs the processing of Personal Data that SabantBet carries out on behalf of the Client by reason of the provision of the Service.

In the event of a conflict between this DPA and the Terms regarding the processing of Personal Data, the provisions of this DPA shall prevail. Capitalized terms not defined here have the meaning attributed to them in the Terms.

• Personal Data:information about an identified or identifiable natural person, in accordance with Law No. 172-13.
• Processing:any operation carried out on Personal Data, including its collection, storage, use, transmission or deletion.
• Data Controller:the Client, who determines the purposes and means of the processing.
• Data Processor:SabantBet, who processes the Personal Data on behalf of and in accordance with the instructions of the Controller.
• Data Subject:the natural person to whom the Personal Data refers, among others, the Broker's insured clients.
• Sub-processor:the third party engaged by SabantBet to process Personal Data within the framework of the provision of the Service.
• Security Breach:any breach of security that results in the destruction, loss, alteration or unauthorized access to the Personal Data.

The Client acts as the Data Controller with respect to the Personal Data that it uploads, stores or processes through the Service, including that of its own insured clients and third parties. The Client determines the purposes and means of the processing and warrants that it holds the legal basis and the consents necessary under Law No. 172-13.

SabantBet acts exclusively as the Data Processor and processes the Personal Data solely on behalf of the Client and in accordance with its documented instructions, as set out in this DPA.

The subject matter of the processing is the provision of the Service described in the Terms. The nature and purpose consist of hosting, storing, organizing, processing and making available to the Client the Personal Data necessary for the management of insurance brokerage operations (clients, policies, renewals, claims and commissions).

The duration of the processing coincides with the term of the Client's subscription to the Service, except where there is a legal obligation to retain it.

The processing may comprise the following categories of Personal Data, depending on the Client's use of the Service:

• Identification and contact data of insured persons and third parties (name, cédula/RNC, address, telephone, email).
• Data on policies, coverages, premiums, commissions and claims.
• Sensitive data, including health data, when necessary for the management of certain lines of insurance.

The categories of data subjects include the Broker's insured clients, beneficiaries, contacts and users of the Client's Group.

SabantBet undertakes to:

• process the Personal Data only in accordance with the documented instructions of the Client, except where there is a legal obligation to the contrary;
• ensure that the persons authorized to process the Personal Data have committed to confidentiality;
• implement and maintain appropriate technical and organizational security measures;
• reasonably assist the Client in fulfilling its obligations towards data subjects and authorities;
• not engage Sub-processors without the authorization provided for in this DPA;
• delete or return the Personal Data upon termination of the provision, in accordance with Section 14.

The Client's initial instructions are reflected in the Terms and in this DPA. The Client's use of the Service and the configuration that it carries out constitute documented instructions. SabantBet will inform the Client if, in its opinion, an instruction infringes the applicable data protection regulations.

SabantBet will maintain the confidentiality of the Personal Data and will ensure that its personnel and collaborators with access to it are subject to equivalent confidentiality obligations, both during and after the relationship.

SabantBet will apply technical and organizational measures that are reasonable and appropriate to the risk, which may include the encryption of data in transit and at rest, role-based access control, the logical isolation of Groups, activity logging and the performance of backups.

The Client acknowledges that no security measure is infallible and that it is its responsibility to properly configure the access of the users of its Group.

The Client generally authorizes SabantBet to engage Sub-processors for the provision of the Service, provided that SabantBet imposes on them data protection obligations equivalent to those of this DPA and remains liable for their actions.

As of this date, the principal Sub-processors are:

• Paddle.com Market Limited —payment processing (Merchant of Record).
• Cloud infrastructure provider —hosting and storage of the Service.

SabantBet will inform the Client of any intended change in the Sub-processors with reasonable advance notice, giving it the opportunity to object on well-founded grounds.

Taking into account the nature of the processing, SabantBet will reasonably assist the Client, through appropriate technical and organizational measures, so that it can respond to requests for the exercise of data subjects' rights (access, rectification, deletion, objection and others provided for by Law No. 172-13).

When SabantBet directly receives a request from a data subject, it will forward it to the Client without undue delay and will refrain from responding directly, except on the Client's instruction or by legal obligation.

SabantBet will notify the Client without undue delay after becoming aware of a Security Breach affecting the Personal Data processed on behalf of the Client, providing the reasonably available information so that the Client can fulfill its notification obligations.

The Client acknowledges and authorizes that the Personal Data may be processed or stored outside the Dominican Republic by SabantBet or its Sub-processors (for example, in cloud infrastructure located abroad), provided that adequate safeguards are adopted in accordance with the applicable regulations.

Upon termination of the provision of the Service, and at the Client's choice, SabantBet will return or delete the Personal Data, unless retention is required by law. The Client may export its data during the period provided for in the Terms, after which the data may be permanently deleted.

SabantBet will make available to the Client the information reasonably necessary to demonstrate compliance with the obligations of this DPA. Audits, if requested, will be carried out with reasonable advance notice, during business hours, without affecting the operation of the Service and subject to a duty of confidentiality.

This DPA will remain in force for as long as SabantBet processes Personal Data on behalf of the Client and, in any event, for as long as the subscription to the Service is in force. The obligations that by their nature must survive will continue after its termination.

The liability of the parties under this DPA will be governed by the limitations of liability established in the Terms. Each party will be liable to the other in accordance with its role and degree of participation in the processing.

This DPA is governed by the laws of the Dominican Republic, in particular Law No. 172-13. For any dispute, the parties submit to the jurisdiction of the courts of the Distrito Judicial de Santiago, Dominican Republic, in accordance with the Terms.

For matters relating to data protection and to this DPA:

• SabantBet
• Email:law@sabantbet.com
• Site:app.sabantbet.com