TRIO MOBIL DATA PROCESSING AGREEMENT

Effective Date: 03-03-2026

This Data Processing Agreement ("DPA") forms part of any agreement ("Agreement") between Trio Mobil contracting entity — being either Trio Mobil Inc., Trio Mobil Europe B.V., or Trio Mobil Bilişim Sistemleri A.Ş. (collectively and individually referred to as "Trio Mobil", "Processor", or "Provider") and the customer entity ("Customer", "Controller") for the provision of Trio Mobil industrial safety, AI camera, telematics, analytics, cloud platform, and related services ("Services").

1. Roles and Instructions

Customer acts as Controller.
Trio Mobil acts as Processor, processing Personal Data solely on Customer’s documented instructions and only as necessary to provide the Services or comply with applicable law.

Documented Instructions Clarification
For the purposes of this DPA, the Agreement and the Customer’s use and configuration of the Services constitute the Customer’s documented instructions to Processor.

2. Nature and Purpose of Processing

Processing may include:

• collection of video imagery and operational data from safety systems
• automated detection of human–machine interactions and risks
• secure storage, hosting, analytics, and dashboards
• technical support, troubleshooting, and service administration
• communication with Customer-designated contacts

Data Subjects may include employees, visitors, or contractors within monitored areas.
Personal Data may include video recordings/images and business contact details.

Biometric data
The Services are not intended to process biometric data for the purpose of uniquely identifying a natural person, and do not perform facial recognition or similar identification.

Service improvement
Processor may improve system accuracy or performance only on Customer instructions or using anonymized or aggregated data that no longer constitutes Personal Data.

3. Processor Obligations

Processor shall:

a) process Personal Data only on documented instructions
b) ensure confidentiality of authorized personnel
c) implement appropriate technical and organisational measures (Section 5)
d) assist Customer with:

• data subject rights requests
• breach notifications
• DPIAs where legally required

e) delete or return Personal Data upon termination unless law requires retention

If Processor receives a request directly from a Data Subject, Processor will notify Customer without responding unless legally required.

Customer is responsible for verifying the identity of Data Subjects before instructing Processor to disclose or act on Personal Data.

4. Sub-processors

Customer authorizes Processor to use sub-processors necessary to provide the Services (including major EU cloud infrastructure providers).

Processor shall:

• impose equivalent data protection obligations
• remain fully liable for sub-processors
• maintain an updated list at triomobil.com/en/dpa

Notification & objection
Processor shall notify Customer of any intended new sub-processor at least 30 days in advance via email or service notification. Customer may object on reasonable data protection grounds.

5. Security Measures

Processor implements appropriate safeguards including:

• encryption in transit (TLS) and at rest (AES-256 or equivalent)
• role-based access controls and least-privilege principle
• MFA for administrative/remote access
• logging, monitoring, and security event analysis
• encrypted backups and tested disaster recovery procedures
• regular vulnerability scanning and security testing
• staff confidentiality commitments and security training

Processor will maintain these measures at a level not materially less protective than described here.

6. Personal Data Breach

Processor shall notify Customer without undue delay and, where feasible, within 72 hours after becoming aware of a Personal Data breach and provide available information to assist Customer in meeting legal obligations.

7. Data Retention and Deletion

Personal Data is retained:

• during the service period, and
• up to 12 months, or
• 30 days after termination, whichever occurs first

unless applicable law requires longer retention.

Processor may retain anonymized or aggregated data that does not constitute Personal Data for analytics, security, or service improvement purposes.

8. International Transfers

Where Personal Data is transferred outside the EEA/UK/Switzerland:

• the EU Standard Contractual Clauses (Controller-to-Processor, Module Two)
  are incorporated into this DPA by reference.

"The parties incorporate by reference the European Commission’s Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
Module Two (Controller to Processor) and, where applicable, Module Three (Processor to Processor) shall apply.
The full official SCC text is available at:
https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
Annexes I–III of the SCCs are completed by reference to this DPA and its Annexes"

If required, the SCCs may be executed separately.

9. Audits and Compliance

Upon reasonable written request and no more than once per year, Customer may:

• receive documentation demonstrating compliance
• review certifications or security summaries
• conduct an audit directly or via independent auditor

Audits must:

• be reasonable in scope
• protect Processor confidential information
• avoid service disruption

Customer bears audit costs unless a material breach is identified.

10. Liability

Liability under this DPA is subject to the limitations of liability set forth in the Agreement, except where such limitations are prohibited by applicable data protection law.

Statutory carve-out
Nothing in this DPA limits or excludes any party’s liability to Data Subjects or Supervisory Authorities where such limitation is prohibited by applicable data protection law.

11. Termination

Upon termination of the Services, Processor shall:

• delete or return Personal Data per Customer instruction
• retain only data required by law
• continue protecting retained data under this DPA

12. Governing Law

This DPA shall be governed by the law specified in the Agreement.
Where Standard Contractual Clauses apply, their governing law provisions prevail for the purposes of international transfers.

13. Updates to this DPA

Processor may update this DPA:

• to reflect legal, technical, or operational changes
• by publishing a new version on its website

Updates will not materially reduce data protection commitments and apply prospectively.

ANNEX I — DESCRIPTION OF PROCESSING

1. Data Subjects

The Personal Data transferred concern:

• Employees and Contractors: personnel operating in monitored industrial areas, warehouses, or vehicles equipped with telematics or safety systems
• Visitors: individuals entering monitored zones or facilities
• Customer Administrators: authorized users of the Trio Mobil cloud platform

2. Categories of Personal Data

The Personal Data transferred may include:

• Visual Data: video footage, snapshots, or images captured by AI cameras (e.g., human–machine proximity, PPE visibility)
• Telemetry & Location Data: GPS coordinates, vehicle speed, engine or CANBUS data, indoor positioning data (RTLS/UWB)
• Identification Metadata: tag or device identifiers, timestamps, and zone identifiers
• Business Contact Data: names, emails, or phone numbers of authorized users for system administration or alerts

3. Special Categories of Data

Biometric Data: NONE.
The Services detect objects such as human presence and do not perform facial recognition or automated identification using biometric templates.

Health Data:
The Services are not intended to process health data. Any incidental capture of injury-related events may occur only as part of standard safety video recording and is not specifically analyzed as health data.

4. Nature and Purpose of Processing

Processing is performed for:

• Industrial Safety: real-time detection of safety risks and generation of alerts
• Safety & Operational Analytics: analysis of movement patterns, zone exposure, and equipment interactions to improve workplace safety, risk visibility, and operational awareness
• Evidence & Compliance: providing Customers with records of safety events for internal investigation or regulatory purposes
• System Maintenance: troubleshooting, monitoring performance, and ensuring service availability

Processing includes automated analysis of video and sensor data.

Processing and storage occur primarily within EU-based cloud infrastructure, unless otherwise agreed.

5. Duration of Processing

Processing continues for the duration of the Agreement and until final deletion or return of Personal Data in accordance with the DPA retention provisions.

ANNEX II — TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

Trio Mobil implements and maintains technical and organisational measures designed to ensure a level of security appropriate to the risk in accordance with Article 32 GDPR. These measures include:

1. Encryption & Data Protection

• Encryption of Personal Data in transit using industry-standard TLS protocols
• Encryption of Personal Data at rest using strong encryption (e.g., AES-256 or equivalent)
• Secure management of encryption keys with restricted administrative access

2. Access Control & Authentication

• Role-based access control (RBAC) enforcing least-privilege principles
• Unique user identification for all personnel accessing systems
• Multi-factor authentication for administrative and remote access
• Periodic review and revocation of access rights

3. Infrastructure & Cloud Security

• Hosting in professionally managed cloud environments located primarily within the European Economic Area
• Network segmentation and firewall protections
• Protection against unauthorized access, malware, and intrusion attempts
• Redundancy and resilience mechanisms to minimize service disruption

4. Logging, Monitoring & Incident Detection

• Logging of administrative actions and system access
• Monitoring systems designed to detect security anomalies or incidents
• Security incident response procedures with escalation workflows

5. Backup & Availability

• Regular encrypted backups stored securely
• Tested disaster recovery procedures
• Measures to ensure restoration of data and service availability within reasonable timeframes

6. Personnel Security & Confidentiality

• Confidentiality obligations for personnel with access to Personal Data
• Security and data protection training for relevant staff
• Access to Personal Data limited to personnel with legitimate business need

7. Development & System Integrity

• Controlled change management procedures
• Security testing and vulnerability management processes
• Periodic review of security posture and measures

8. Data Minimisation & Retention Controls

• Processing limited to data necessary for the Services
• Configurable retention controls and secure deletion procedures
• Mechanisms to delete or anonymize Personal Data upon expiry of retention periods

ANNEX III — LIST OF SUB-PROCESSORS

The Controller authorizes the Processor to engage the following sub-processors to provide elements of the Services:

1. Amazon Web Services EMEA SARL (AWS)

Address: 38 Avenue John F. Kennedy, L-1855 Luxembourg
Purpose: Cloud infrastructure, storage, networking, backup services
Primary Data Location: European Union (e.g., Ireland region)
Certifications: ISO 27001, SOC 1/2/3, CSA STAR, PCI-DSS

2. Google Ireland Ltd. (Google Cloud Platform)

Address: Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Cloud platform services, compute resources, logging, infrastructure components
Primary Data Location: European Union data centers
Certifications: ISO 27001, SOC 1/2/3, CSA STAR, PCI-DSS

3. MongoDB Ireland Ltd. (MongoDB Atlas)

Address: 70 Sir John Rogerson’s Quay, Dublin D02 R296, Ireland
Purpose: Managed database hosting, replication, and backup services
Primary Data Location: European Union (hosted on AWS EU region)
Certifications: ISO 27001, SOC 2/3, CSA STAR, PCI-DSS