DATA PROCESSING ADDENDUM
JFK IMPORT-EXPORT LLC — CONFIRMA

*** Draft for review. These documents were prepared as a starting point and have not been reviewed by a lawyer. Do not execute or publish any of them without review by qualified counsel in each relevant jurisdiction — the United States for the entity, the Democratic Republic of the Congo for the counterparties, and any jurisdiction whose law a counterparty insists upon. ***


**DATA PROCESSING ADDENDUM**

This addendum forms part of the Master Programme Agreement or Master Receivables Purchase Agreement between JFK IMPORT-EXPORT LLC, trading as JFKIE LLC (the "Purchaser") and the counterparty (the "Counterparty").

**1. Roles.** Each Party is an **independent controller** of the personal data it handles under the agreement. Neither processes personal data on the other's behalf or under the other's instructions. This reflects what actually happens: the Purchaser decides what it needs in order to decide whether to buy a receivable and to meet its own regulatory obligations, and it is answerable for that decision itself.

**2. Categories.** Personal data exchanged is limited to: names, business contact details, roles and employers of individuals who requisition, receive, approve, submit or sign for invoices; and, for applicants, the identity details of beneficial owners and directors.

**3. Purposes.** Each Party processes only for: performing the agreement; anti-money-laundering, sanctions and due diligence obligations; fraud detection and prevention; producing evidence of signature and consent; and complying with law.

**4. Lawfulness of disclosure.** Each Party warrants that it may lawfully disclose to the other the personal data it discloses, and that the individuals concerned have been given the information required by applicable law about that disclosure and its purposes.

**5. Security.** Each Party shall apply appropriate technical and organisational measures. The Purchaser's measures include encryption in transit, encryption at rest where configured, role-based access control, a second authentication factor for privileged roles, and logging of every action against a request identifier.

**6. Transfers.** The Counterparty acknowledges that the Purchaser processes personal data in the United States. Where a transfer mechanism is required by the Counterparty's own law, the Parties shall enter into the applicable standard contractual clauses, which shall prevail over this addendum in respect of the transfer.

**7. Individual requests.** Each Party handles requests from individuals addressed to it. Where a request is misdirected, the receiving Party shall forward it promptly and shall provide reasonable assistance.

**8. Personal data breach.** Each Party shall notify the other without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach affecting personal data received from the other, with sufficient detail to allow that Party to meet its own notification obligations.

**9. Retention.** Each Party retains personal data for as long as its own legal and regulatory obligations require. The Purchaser's retention periods are set out in its Privacy Notice.

**10. Sub-processors.** Not applicable, the Parties being independent controllers. Each Party remains responsible for those it engages.

**11. Precedence.** In the event of conflict, this addendum prevails over the agreement on data protection matters, and applicable standard contractual clauses prevail over this addendum.

Effective 19 August 2026.