DATA PROCESSING AGREEMENT (DPA)

1. PREAMBLE

1.1. This DPA is an addendum to Yango Services Offer between Yango Urban Digital Services Pvt Ltd, (“Yango” or “Data Processor”) and the Partner, (“Partner” or “Data Controller”), in which this DPA is stipulated as a part of such contract, agreement or document (“Agreement”). In the event of a contradiction between this DPA and the provisions of Agreement, this DPA shall prevail.

1.2. This DPA is deemed to be concluded by using opt-in check-box or by entering into Agreement, including by electronic means (scan, email, etc.).

1.3. This DPA reflects the parties’ agreement on the processing of Personal Data in connection with the Data Protection Legislation.

2. DEFINITIONS AND INTERPRETATION

2.1. In this DPA:

Affiliate means in relation to any person, any other person directly or indirectly Controlled by, or controlling of, or under common Control with, that person.

Personal Data means any personal data that is received from one party and processed by the other party under the Agreement in connection with provision or use (as applicable) of the services to Partner as provided by the Agreement.

Data Protection Legislation means, as applicable: (a) Data Act 2079 (2022); and/or (b) Individual Privacy Act 2025 (2018); and/or (c) any other applicable law, statute regulation, directive or legislative act of another form, applicable to the processing of Personal Data.

2.2. Other capitalized terms when used herein shall have the same meaning as is given such terms in the Agreement.

2.3. The terms “controller” or “data controller”, “data subject”, “personal data”, “processing” and “processor” or “data processor” as used in this DPA have the meanings given in Data Protection Legislation.

2.4. Any reference to a legal framework, statute or other legislative enactment is a reference to it as amended or re-enacted from time to time.

3. PROCESSING OF PERSONAL DATA

3.1. For the purposes of fulfilling the obligations under the Agreement Yango collects and processes Personal Data on behalf of the Partner:

3.1.1. Users: Name, User ID, phone number, e-mail, tax identification number;

3.1.2. Individuals picking the orders: Name, phone number, start and end time of work shift, frequency of orders, time taken to complete an order, number of orders completed, comments, attachments, and other details provided along with support requests

3.2. Personal Data listed above is collected by Yango on behalf of the Partner and shall be transfer to the Partner.

3.3. Where required by applicable law, the Partner shall obtain data subjects’ consents to collect and process Personal Data by Yango and transfer Personal Data to Partner, and, at Yango’s request, shall provide supporting evidence thereof. Partner shall promptly notify Yango if it becomes aware that any such consent is withdrawn.

3.4. Partner shall implement and maintain a privacy policy compatible with the requirements of Data Protection Legislation, governing processing of personal data.

4. DURATION OF PROCESSING

4.1. Yango shall process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

4.2. Personal Data shall be deleted upon the sooner of (i) request of the Partner; or (ii) when Personal Data is no longer needed to perform the Agreement.

5. SUB-PROCESSORS

5.1. Partner acknowledges and agrees that:

a. Yango’s Affiliates may be retained as sub-processors;

b. Yango and Yango’s Affiliates respectively may engage third-party Sub-processors in connection with the performance of this DPA.

5.2. Yango and Yango’s Affiliates respectively may engage third-party Sub-processors in connection with performance of this DPA.

5.3. Yango verifies that its appointed Sub-Processors have provided sufficient guarantees to Yango to implement appropriate technical and organizational measures in such a manner that the processing of Personal Data meets the requirements of the Data Protection Legislation. Yango undertakes that all the Sub-Processors are subject to a written agreement with Yango which imposes data protection obligations on the Sub-Processors that are no less onerous than those imposed on the Yango under this DPA.

5.4. Yango is not bound by any recommendations of the Partner in respect to choice of sub-processors and can follow or not follow such recommendations at its own discretion. Yango can change Sub-processors from time to time and engage new sub processors without any prior approval.

6. DATA SUBJECT RIGHTS

6.1. Partner’s obligations:

6.1.1. The Partner shall promptly notify Yango of any request it has received from a data subject, including access, rectification or erasure requests.

6.1.2. The Partner shall assist Yango in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Data Protection Legislation. In fulfilling its obligations under this section, Yango shall comply with the instructions from the Partner.

6.2. Yango’s obligations:

6.2.1. Yango shall promptly notify the Partner of any request it has received from a data subject, provided that such request refers to Personal Data processing by Yango.

6.2.2. Where Yango processes personal data as Data Processor, Yango shall assist the Partner in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Data Protection Legislation. In fulfilling its obligations under this section, the Data Processor shall comply with the instructions from the Data Controller.

6.3. Redress. In case of a dispute between a data subject and one of the Parties as regards compliance with the present DPA or the Agreement, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

6.4. Where the data subject invokes a third-party beneficiary right, the data processor shall accept the decision of the data subject to: lodge a complaint with the supervisory authority of his/her habitual residence or place of work; refer the dispute to the competent courts.

6.5. The Parties accept that the data subject may be represented by a not-for-profit body, organization or association under the conditions set out in Data Protection Legislation. The data processor shall abide by a decision that is binding under the applicable Data Protection Legislation. The data processor agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

7. REPRESENTATIONS AND WARRANTIES

7.1. Partner represents and warrants, and, at Yango’s request, will provide supporting evidence, to demonstrate that:

7.1.1. Partner collects, obtains and processes Personal Data lawfully, without violating any third parties’ rights, contractual obligations or Data Protection Legislation;

7.1.2. Partner’s data processing activities are compliant with Data Protection Legislation, applicable e-commerce legislation, advertising legislation or consumer protection legislation.

7.1.3. Partner has all rights, consents, authorization and title to grant the rights and permissions to collect such Personal Data by Yango according to the Agreement and the terms of this DPA;

7.1.4. where required by applicable Data Protection Legislation, Partner has obtained the consent of data subjects to collect, process and share such Personal Data and transfer (including cross-border transfer) such Personal Data to Yango as well as transfer personal data collected by Yango on behalf of Partner to Partner, and, at Yango’s request, will provide supporting evidence thereof;

7.1.5. Partner has implemented and will maintain a privacy policy compatible with the requirements of Data Protection Legislation, governing processing of such Personal Data;

7.1.6. processing of such Personal Data by Yango will not violate the Data Subject’s rights and rights of the other third parties, including without limitation privacy, data protection, good-will, good name, publicity, confidentiality and intellectual property rights.

7.2. Where applicable, Partner has obtained all mandatory licenses, authorizations and approvals provided by applicable law, including legislation of Bolivia.

7.3. Disclosure Notification. Without limiting the aforesaid, Partner confirms, and at Yango’s request will demonstrate that all data subjects whose Personal Data processed by Yango received appropriate disclosures and notifications, as required under Data Protection Legislation. Where a third party provided the notices to the data subjects and (or) received their consent, Partner will bear sole responsibility to verify and will be able to demonstrate that the notices and (or) consents were sufficient for the purposes of use under the terms of the Agreement and this DPA and adequate pursuant to the Data Protection Legislation.

8. COOPERATION

8.1. Assistance in Compliance. Partner shall cooperate with Yango and provide all necessary assistance to Yango in connection with Data Protection Legislation.

8.2. Partner shall cooperate with Yango and provide all necessary to Yango in connection with requests to exercise data subjects’ rights, complaints and inquiries;

8.3. Notices. Unless prohibited under applicable laws, Partner will notify Yango of:

8.3.1. Any violation by Partner, or anyone on Partner’s behalf of any provision under this DPA;

8.3.2. Any official competent supervisory proceedings regarding the processing of the Personal Data;

8.3.3. Any legal or factual circumstances preventing Partner from performing any of its representations, warranties or obligations under the terms of this DPA; and

8.3.4. Any material changes impacting the technical and organizational security measures implemented by Partner which cause such measures to fall short of Partner’s data security obligations under the Data Protection Legislation.

8.4. Inquiries, requests and complaints. Partner will provide all reasonable and timely assistance to Yango, to enable Yango to respond to: (i) supervising authorities’ or data subjects’ requests under the Data Protection Legislation; and (ii) any other correspondence, inquiry or complaint received from data subjects (or on data subjects’ behalf), supervising authority and other regulators, or competent authorities in connection with the processing of the Personal Data provided under this DPA.

8.5. If any such communication is made directly to Partner, Partner will promptly inform Yango about such communication, provide Yango with all related details and will not respond to the communication unless specifically required by Data Protection Legislation or authorized by Yango.

9. LIABILITY

9.1. Partner guarantees the prompt and satisfactory performance of its obligations and responsibilities under this DPA by Partner and Partner agrees that it will be responsible for all costs associated with its compliance with such obligations. Partner is responsible and liable for its acts and omissions under this DPA.

9.2. Partner will defend, indemnify and hold Yango, its Affiliates, their officers, directors, employees, contractors and agents harmless from and against any and all third-party claims, demands, losses, damages or expenses, including reasonable attorneys’ fees and court costs, arising out of or in connection with any failure by Partner to comply with the requirements under this DPA.

10. DATA SECURITY

10.1. Taking into account the state of the art, the costs of implementing technical and organizational measures that align with the nature, scope, context and purposes of the processing of Personal Data, Data Processor shall implement appropriate technical and organizational measures to protect Personal Data against accidental or unlawful loss, destruction, damage, theft, alternation or disclosure and to ensure a level of security appropriate to the risk. Such measures may include, but are not limited to limitation of access, access control mechanisms, data encryption, data pseudonymization, malware protection, possessing the ability to restore the availability of and access to Controller Personal Data in a timely manner after a security incident and other relevant measures.

10.2. Data Processor shall regularly test and monitor the effectiveness of its safeguards, controls, systems and procedures.

11. PRIORITY

11.1. Effect of this DPA. In the event of a contradiction between this DPA and the provisions of Agreement, this DPA shall prevail, unless otherwise is stipulated in the DPA.

11.2. Other Data Processing Agreements. This DPA will not affect any other separate data processing agreements between Yango and Partner in respect of any data processing arising out of the agreements other than Agreement.

12. CHANGES TO THIS DPA

12.1. Yango may change the DPA at any moment in case: (a) changes are required to comply with the applicable law, applicable regulation, a court order or guidance issued by a regulator or agency; or (b) changes are followed the factual Personal Data processing activities of the parties according to the Agreement, or (c) changes do not result in a degradation of the security of Personal Data. Depending on the applicable law, applicable regulation, a court order or guidance issued by a regulator or agency, such changes will be effective in thirty (30) days after prior notice by Yango via e-mail or any other means including web account using by Partner according to the Agreement (or shorter period as may legally be required).

12.2. If Partner objects to any such change, it must terminate the DPA and the Agreement (unless the Agreement could be performed in the remaining part without existence of this DPA) and stop providing services under the Agreement. Yango shall be entitled not to notify Partner about editorial changes.

13. DISCLOSURE OF THE DPA

13.1. Partner acknowledges that Yango may disclose this DPA and any relevant privacy provisions in the Agreement to any supervisory authority, regulator or other competent authority, to the extent required under the applicable law.

Date of publication: 25.05.2026