Data Processing Annex

This Data Processing Annex (the “DPA”) is Annex 1 of our Terms and Conditions (henceforth the “Terms”) and supplements our Privacy Policy (henceforth the “Privacy Policy”), as updated from time to time between you and us, or other agreement governing your use of the Services (altogether with the DPA, the Terms and the Privacy Policy, the “Agreement”). This DPA is an agreement between you and the entity you represent (“Customer”, “you” or “your”) and OnTheGoSystems Limited (“we,” “us,” or “our”) under the Agreement. It applies as part of the Terms. By accepting the Terms, you enter into this DPA, including the Standard Contractual Clauses and the UK and Swiss addenda, as the data exporter. Your acceptance counts as your signature of this DPA and of Annex I of the Standard Contractual Clauses. THE PARTIES AGREE AS FOLLOWS:

1. DEFINITIONS AND INTERPRETATION

1.1. The definitions below will have the following meaning: “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, "Processing" (including the derivatives "Processed" and "Process") and "Processor", have the meanings given in the GDPR or, where relevant, the meaning of the essentially equivalent terms in other applicable Data Protection Laws; "Data Protection Laws" means any applicable law relating to the Processing, privacy, and use of Personal Data including: (i) the GDPR; (ii) the UK GDPR; (iii) the Swiss Federal Act on Data Protection; (iv) any laws that implement, replace, extend, re-enact, consolidate, or amend any of the foregoing laws; (v) any corresponding national laws or regulations; and (vi) corresponding guidance, codes or certification mechanisms of the relevant regulatory authority regarding such laws; "(Your) Personal Data" means Personal Data provided or made available to us by (or collected or created for) you in connection with this Agreement. “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), as set out in Annex 1, Schedule 1 of the Terms; “Sub-processors Page” means the web page listing our current subprocessors, available at https://wpml.org/home/sub-processors/. 1.2. All capitalised words not referred to in the above clause 1.1 will have the meaning and definition given to them in either the Privacy Policy or the Terms and Conditions. 1.3. Reference to laws includes subordinate legislation and means that law as amended or re-enacted from time to time. 1.4. In the event of any inconsistency concerning the Processing of Personal Data, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms and the Privacy Policy. This DPA is governed by the same law as the Terms, as set out in clause 12. 1.5. Where the Processing of your Personal Data is subject to the GDPR, a reference to a “legal obligation” in this Agreement means an obligation pursuant to European Union or Member State law.

2. PROCESSING OF YOUR PERSONAL DATA

2.1 For the purposes of this Agreement, You act as the Controller and We act as the Processor with respect to the Processing of Personal Data described in Appendix 1, unless otherwise expressly stated. We shall Process Personal Data only (1) as provided for in this DPA, the Terms and/or the Agreement, (2) as required by applicable legal obligations, in which case We shall inform You of that legal requirement unless prohibited by law, or (3) on documented instructions from You. If We are required by applicable law to Process Personal Data other than on Your instructions, We shall inform You of that legal requirement before Processing, unless prohibited by law from doing so. The subject matter, duration, nature and purpose of Processing, the types of Personal Data, and categories of Data Subjects are set out in Appendix 1. No special categories of Personal Data will be Processed without Your prior written approval. 2.2 The parties acknowledge that, in addition to Processing Personal Data as a Processor on Your behalf, We may process certain Personal Data as an independent Controller for the following limited purposes: (i) management and administration of Your account, (ii) billing and payment processing, (iii) compliance with legal and regulatory obligations applicable to Us, and (iv) internal service administration, security, fraud prevention, service monitoring, product analytics, product improvement, and service development. Such processing is carried out in accordance with our Privacy Policy and applicable Data Protection Laws, and falls outside the scope of this DPA. 2.3 We will only Process Your Personal Data in accordance with this Agreement as necessary to provide the Services. 2.4 We shall: (i) comply with and Process all Your Personal Data in accordance with applicable Data Protection Laws; (ii) co-operate and assist the Customer with any data protection impact assessments and consultations with (or notifications to) or responding to questions from or investigations by regulators or supervisory authorities; (iii) ensure that its policies, measures and procedures meet, perform, and comply with the Data Protection Laws, and (iv) process Personal Data only insofar as provided for in clause 2.1 above. 2.5 You shall: (i) guarantee that the processing commissioned under this Agreement, and the sharing of personal data involved, is carried out in strict compliance with applicable Data Protection Laws; (ii) deliver Your Personal Data to us; (iii) ensure, prior to and throughout the processing, that we comply with Data Protection Laws; (iv) supervise the processing, including carrying out inspections, audits or consultation; (v) reciprocally comply with the obligations set out in this Agreement insofar as applicable, and (vi) any other obligations arising from current and applicable legislation.

3. OUR PERSONNEL

3.1 We shall ensure that any personnel authorised to process Your Personal Data are subject to an appropriate contractual or statutory duty of confidentiality, and process such Personal Data only as necessary to provide the Services and in accordance with Your instructions. 3.2 We shall cease Processing Your Personal Data when it is no longer necessary to provide the Services unless retention is required by applicable law. Upon termination or expiry, and at Your option, We shall delete or return Your Personal Data within thirty (30) days of Your written request. Where deletion is required, We shall take reasonable steps to securely delete such Personal Data, including from backups, in accordance with our retention practices. In any case, deletion or return of Your Personal Data shall be subject and conditional to applicable legal obligations to Us that may restrict our capacity to do so. Any Personal Data retained pursuant to such legal obligations shall remain subject to the protections of this Agreement.

4. SECURITY

4.1. The Parties warrant they have implemented and shall maintain appropriate technical and organisational measures to protect Your Personal Data against a Personal Data Breach, which shall at all times satisfy, at a minimum, the standards required by Data Protection Laws. 4.2. We shall ensure that we have in place appropriate technical and organisational security measures, as described in Appendix 2, to protect Your Personal Data against unauthorised or unlawful processing and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it.

5. NOTIFICATION AND PERSONAL DATA BREACHES

5.1. If we receive any complaint, claim, or request in relation to the Processing of Your Personal Data (particularly those relating to the exercise of Data Subject rights under applicable laws), we shall, without undue delay, forward such to you and cooperate and assist you with responding to such as directed by you. 5.2 If we become aware of any Personal Data Breach, we shall without undue delay (and in any event within 36 hours) notify you, investigate the Personal Data Breach, remediate/mitigate any damage and prevent re-occurrence (providing you with detailed related information throughout), and cooperate in informing the relevant supervisory authorities or affected Data Subjects. 5.3 We shall, taking into account the nature of the Processing, assist You by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Your obligation to respond to requests for exercising Data Subject rights under applicable Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection. We shall notify You of any such request without undue delay and in any event within five (5) business days of receipt, and shall provide reasonable cooperation to enable You to respond within the timeframes required by applicable Data Protection Laws.

6. SUBCONTRACTORS

6.1 You provide a general authorization for Us to engage subprocessors to process Your Personal Data in connection with the Services. 6.2 We shall ensure that any subprocessor is bound by written obligations that provide at least the same level of protection for Your Personal Data as those set out in this DPA. 6.3 We shall remain liable to You for the performance of any subprocessor and for any acts or omissions of such subprocessor in relation to the Processing of Your Personal Data as Our own, in the terms of this DPA and the Agreement. 6.4 We may update the list of subprocessors from time to time. We shall notify any intended addition or replacement of a subprocessor at least fourteen (14) days before the new subprocessor is engaged, by updating the Sub-processors Page referred to in Appendix 3 and by email. You may object to such change on reasonable grounds related to data protection within those fourteen (14) days. If You raise a reasonable objection and We cannot reasonably accommodate such objection, either Party may terminate the affected Services in accordance with the Agreement.

7. TRANSFERS OF DATA

7.1. We (or any subcontractor) shall only transfer Your Personal Data to a country outside the EEA, the United Kingdom or Switzerland or an international organisation where such transfer is subject to appropriate safeguards and otherwise complies with Data Protection Laws. 7.2. Where Your Personal Data is transferred from the EEA to Us in a country without an adequacy decision, the Standard Contractual Clauses (Module Two) set out in Annex 1, Schedule 1 of the Terms apply and are incorporated into this DPA. Where the transfer is subject to the UK GDPR or the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply as amended by the addenda in Annex 1, Schedules 2 and 3 of the Terms. 7.3. Of the Standard Contractual Clauses, Module Two (transfer controller to processor) applies, with You as the data exporter and Us as the data importer; those clauses are governed by the law of Ireland and disputes arising from them are resolved by the courts of Ireland, as their Clauses 17 and 18 provide.

8. RECORDS

8.1 We shall make available to You all information reasonably necessary to demonstrate compliance with this Agreement and applicable Data Protection Laws, and shall allow for and contribute to audits conducted by You or an independent auditor, subject to reasonable prior notice and confidentiality obligations. 8.2 We may satisfy such obligations by providing relevant certifications, reports, or other independent assessments.

9. TERM AND TERMINATION

9.1. This Agreement shall start when we begin providing the Services to you and shall continue indefinitely unless terminated by either of the parties in accordance with the terms of our collaboration and any obligations relating to the Services. 9.2. The Confidentiality under section 10 of this Agreement shall survive termination or expiry of this Agreement and continue indefinitely.

10. CONFIDENTIALITY

The Parties shall not disclose, without the prior, written consent of the other party, any information disclosed or made available, in any form or medium, directly or indirectly before or after the date of this Agreement, in connection with the processing as well as the information relating to the business Services, financial plans, intellectual property rights, clients, suppliers, employees, plans; the know-how, designs, trade secrets, technical information or software; any other information which each of us wishes to protect against unrestricted disclosure and which is marked as confidential or proprietary or is, by its nature, clearly confidential; and any findings, data or analysis derived from such information, unless it is required to be disclosed in a judicial or administrative proceeding or required to be disclosed by law. In such case Parties shall inform each other in advance to perform any necessary legal precautions to ensure information is protected within the scope of mandatory disclosure.

11. INDEMNITY

11.1 Each Party shall indemnify and hold harmless the other Party against any direct losses, damages, costs, and expenses (including reasonable legal fees) arising from a material breach by the indemnifying Party of its obligations under this Agreement or applicable Data Protection Laws, provided that: (i) the indemnifying Party's liability shall be limited to losses directly attributable to its own acts or omissions; (ii) neither Party shall be liable to the other for any indirect, incidental, special, or consequential damages, including loss of profits, revenue, or business opportunity, howsoever arising; and (iii) the indemnifying Party’s liability for acts or omissions of subprocessors shall be determined in accordance with applicable Data Protection Laws, this Agreement, and the liability limitations set out herein. 11.2 Notwithstanding anything to the contrary in this Agreement, the aggregate liability of each Party arising out of or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the total fees paid or payable by You to Us under the Agreement in the twelve (12) month period immediately preceding the event giving rise to the claim. This limitation shall apply to the fullest extent permitted by applicable law but shall not limit either Party's liability for losses arising from wilful misconduct or gross negligence, or any liability that cannot be excluded or limited under applicable Data Protection Laws. 11.3 Notwithstanding the above, in the event that We as the Processor fail to comply with the stipulations of this Agreement as a direct result of Your acts, omissions, or instructions, You shall bear responsibility for any resulting non-compliance and shall indemnify Us against any direct losses, damages, costs, and expenses arising therefrom, including any claims by Data Subjects or sanctions imposed by the competent supervisory authorities attributable to such acts, omissions, or instructions.

12. GOVERNING LAW

12.1. This Agreement and any dispute or claim arising out of, or in connection with it, its subject matter or formation (including non-contractual disputes or claims), shall be governed by, and construed in accordance with, the laws of the Hong Kong Special Administrative Region, and the Parties hereby submit to the exclusive jurisdiction of the courts of Hong Kong. The standard contractual clauses referred to in clause 7.3 are governed by the law of Ireland, as that clause provides.

13. NOTICES

13.1 All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post, or sent by email to the address or email address set out in the heading of this Agreement at such other address as notified from time to time by the Parties changing address. 13.2 For any questions regarding the processing of Personal Data under this Agreement, You may contact us at hello@wpml.org or such other contact as we may notify from time to time.

Appendix 1

• NATURE AND PURPOSE OF THE PROCESSING:

The Processing of Personal Data is carried out for the purpose of delivering the Services offered by OnTheGoSystems, including but not limited to:

• Provision and support of OTGS software products (WPML, Toolset, PTC, and related services), as specified in the corresponding Terms and Conditions,
• Communication necessary to provide and support the Services,
• Technical operations, including hosting, storage, backup, and system monitoring,
• Security logging, access control, abuse prevention, and debugging,

Where required, personal data may also be processed to comply with legal obligations or to exercise or defend legal claims.

• DURATION OF PROCESSING:

Your Personal Data will be Processed for the duration of the Agreement between the parties, and:

• As long as necessary for the specific purpose it was collected for,
• Or as required by applicable laws (e.g., accounting or tax record retention),
• After termination, data will be returned or deleted as per Section 3 of the DPA unless otherwise required by law.

• PERSONAL DATA IN SCOPE:

We may process the following types of Personal Data on your behalf:

Category	Examples
Identification data	Full name, username, user ID, profile photo
Contact data	Email address, phone number, billing/shipping address
Account credentials	Login details (hashed), language preferences
Communication data	Messages, support tickets, chat logs, feedback
Technical metadata	IP address, browser/user agent, access logs, usage behavior, time zone, interactions with designated WPML administration interfaces (including navigation paths and configuration actions)
Document content	Files or text submitted via OTGS services or during support interactions

Special categories of Personal Data are not intentionally collected or processed by OTGS as part of the services. In the event such data is included in user-generated content or embedded within customer data, its processing is incidental and subject to the controller’s instructions and applicable legal requirements.

• PERSONS AFFECTED (DATA SUBJECTS):

The group of Data Subjects affected by the Processing of their Personal Data consists of end users of Our software, clients and customers, website visitors, and service providers. In case You are not the Data Subject affected by our Processing of their Personal Data, you hereby warrant that You have obtained all necessary consents and authorizations from and/or, if applicable, informed, the Data Subjects of Our Processing of their Personal Data.

Appendix 2: Technical and Organisational Measures (TOMs)

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described below. 1. Organisational Measures

• Information security and data protection responsibilities are defined and periodically reviewed
• Access to systems is restricted to authorized personnel based on role and necessity (least privilege)
• Personnel with access to Personal Data are subject to confidentiality obligations
• Security awareness and privacy training is provided internally
• Incident management and response procedures are in place
• Vendors and infrastructure providers are assessed from a security and data protection perspective
• Periodic risk assessments are performed
• Measures are reviewed and updated to reflect changes in risk, technology, and regulatory requirements
• Data protection principles such as privacy by design and by default are applied
• A personal data breach management and notification process is in place

2. Technical Measures

• Personal Data in transit is encrypted using secure protocols (e.g., HTTPS/TLS)
• Access to infrastructure is protected by means of authentication controls and logging
• Systems are subject to regular updates, patching, and vulnerability management
• Monitoring and logging are implemented to detect and respond to security incidents
• Backup and recovery procedures are in place to ensure availability and resilience
• Changes to production systems follow defined change management processes
• Production and non-production environments are segregated

3. Subprocessor and Infrastructure Measures We rely on established infrastructure providers and subprocessors that implement appropriate security measures, including:

• Physical security of data centers
• Network and infrastructure protection
• Redundancy, availability, and resilience controls
• Independent certifications and audits (e.g., ISO 27001, SOC reports)

We rely on these providers under appropriate contractual and data protection terms and periodically review their security commitments. 4. Shared Responsibility Where the Services are integrated into Customer-controlled environments, You are responsible for:

• Securing your systems, infrastructure, and hosting environment
• Managing user access, authentication, and roles
• Applying updates and patches
• Managing data retention and deletion

5. Data Minimisation We process only the Personal Data necessary to provide the Services, such as content submitted for processing, licensing information, and operational metadata. We do not use customer content to train AI models and do not retain it beyond what is necessary to provide the Services.

Appendix 3: Subprocessors

The subprocessors we currently engage, each with its registered seat, its processing location and the service it provides, and a dated record of every change to that list, are published at https://wpml.org/home/sub-processors/; that page is the subprocessor list clause 6.4 refers to.

OnTheGoSystems Limited

22/F 3 Lockhart Road Wanchai Hong Kong