Foreword

This Compliance Pack consolidates GoldFynch's international data transfer documentation into a single reference instrument. It comprises four interconnected documents:

This Pack supplements and forms part of the GoldFynch Data Processing Addendum ("DPA") and Terms of Service ("Principal Agreement"). Capitalised terms not defined herein have the meanings given in the DPA.

PART A - Updated Standard Contractual Clauses (2021)

Replaces: Annex 2 of the GoldFynch Data Processing Addendum (Directive 95/46/EC SCCs) Legal basis: Commission Implementing Decision (EU) 2021/914 of 4 June 2021

A1. Module Selection and Application

The following Module applies to GoldFynch's processing of Company Personal Data:

For the purposes of this Part A, Module 2 applies by default unless the Company notifies GoldFynch in writing that Module 3 applies to its use case.

A2. Clause 1 - Purpose and Scope

These Standard Contractual Clauses ("Clauses") set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council, for the transfer by the data exporter to the data importer of the personal data as specified in Annex I.

A3. Clause 2 - Effect and Invariability

These Clauses set out appropriate safeguards for the transfer of personal data to a third country (the United States), which does not ensure an adequate level of protection. These Clauses shall not be modified except to select the appropriate Module(s) or to add or update information in the Annexes.

A4. Clause 3 - Third-Party Beneficiaries

Data subjects may invoke and enforce these Clauses as third-party beneficiaries against the data exporter and/or data importer, including where data subjects' rights have been infringed as a result of the processing of their personal data.

A5. Clause 7 - Docking Clause

An entity that is not a party to these Clauses may, with the agreement of the parties, accede to these Clauses at any time, either as a data exporter or data importer by completing the Annexes and signing Annex I.A.

A6. Clause 8 - Data Protection Obligations (Module 2 Summary)

GoldFynch, as data importer, shall:

• Process Company Personal Data only on documented instructions from Company
• Inform Company immediately if it believes instructions infringe applicable data protection law
• Ensure persons authorised to process data are subject to confidentiality obligations
• Implement appropriate technical and organisational measures (see Annex II and Part D)
• Assist Company in ensuring compliance with data subject rights obligations
• Delete or return all personal data at the choice of Company after end of services
• Make available to Company all information necessary to demonstrate compliance
• Allow for and contribute to audits conducted by Company or a mandated auditor

A7. Clause 9 - Sub-Processors (Module 2)

• Option 2 (General Written Authorisation) applies: Company provides general authorisation to GoldFynch to engage sub-processors listed in the Sub-processors Register (DPA Annex 1, Appendix 1)
• GoldFynch will give Company at least 14 days' prior written notice of any intended addition or replacement of sub-processors
• Company may object on reasonable grounds within that period; resolution procedure as per DPA section 6.3

A8. Clause 13 - Supervision

The competent supervisory authority is determined as follows:

A9. Clause 14 - Local Laws and Practices Assessment

Both parties warrant, as of the date of these Clauses, that they have no reason to believe that the laws and practices applicable to the processing by the data importer - including any requirements to disclose personal data or measures authorising public authorities' access - prevent the data importer from fulfilling its obligations under these Clauses.

GoldFynch's formal assessment of US law is set out in full in Part C (Transfer Impact Assessment) of this Compliance Pack.

A10. Clause 15 - Government Access Obligations

GoldFynch commits to:

• Notify Company of any legally binding request for access to Company Personal Data by a public authority as soon as legally permissible
• Notify Company of any direct access by public authorities to Company Personal Data
• Challenge any government access request it reasonably considers unlawful or disproportionate before complying
• Publish an annual transparency report disclosing aggregate information on government access requests received (to the extent permitted by law)

A11. Clause 17 - Governing Law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The parties select the law of the Republic of Ireland.

(Note: For UK transfers, Clause 17 is amended by the UK IDTA (Part B) to refer to the law of England and Wales.)

A12. Clause 18 - Choice of Forum and Jurisdiction

Any dispute arising from these Clauses shall be resolved by the courts of the Republic of Ireland.

(Note: For UK transfers, Clause 18 is amended by the UK IDTA (Part B) to refer to the courts of England and Wales.)

A13. Annex I - Description of Transfer

Annex I.A - List of Parties

Annex I.B - Description of Transfer

Annex I.C - Competent Supervisory Authority

A14. Annex II - Technical and Organisational Security Measures

The following measures are implemented by GoldFynch as data importer:

A15. Annex III - Sub-Processors

Sub-processors authorised under Clause 9 (General Written Authorisation) are listed in the GoldFynch DPA, Annex 1, Appendix 1 (Sub-processors Register). All currently authorised sub-processors are located in North America - US.

The current sub-processors list is available at https://goldfynch.com/GoldFynch-Data-Processing-Addendum.html and will be updated with at least 14 days' notice of any changes.

---

PART B - UK International Data Transfer Addendum

Legal basis: s.119A Data Protection Act 2018; ICO IDTA Version B1.0 (in force 21 March 2022) Reference: GF-IDTA-001

B1. Introduction and Purpose

This UK Addendum supplements and forms part of the Standard Contractual Clauses set out in Part A of this Compliance Pack ("SCCs"), adapting them for the transfer of personal data from the United Kingdom to the United States, as required by the UK GDPR and Data Protection Act 2018.

This Addendum constitutes the International Data Transfer Addendum (IDTA) issued by the ICO under s.119A DPA 2018.

B2. Amendments to the SCCs for UK Transfers

The following amendments apply to the Part A SCCs where they relate to UK personal data:

B3. Table of Information (IDTA Part 1)

B3.1 Parties

B3.2 Selected SCCs and Module

• SCCs: EU SCCs (Commission Implementing Decision 2021/914) - as set out in Part A
• Module: Module 2 (Controller to Processor) - default; Module 3 where applicable
• Clause 7 docking clause: Included

B3.3 Appendix Information

All Annex I and Annex II information is as set out in Part A (sections A13 and A14) of this Compliance Pack.

B3.4 Supervisory Authority

UK Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

B4. Governing Law (UK Addendum Only)

This UK Addendum is governed by the law of England and Wales. This is a mandatory requirement of the ICO's IDTA and applies to this Addendum only.

The GoldFynch Terms of Service and DPA (other than this UK Addendum) continue to be governed by the law of the State of Iowa, United States.

B5. Amendments to GoldFynch DPA Definitions

For UK transfers, the GoldFynch DPA is amended as follows:

• Section 1.1.6 ("Data Protection Laws"): Extended to include the UK GDPR and Data Protection Act 2018
• Section 1.1.8 ("EU Data Protection Laws"): For UK data subjects, read to include UK GDPR and DPA 2018
• Section 1.1.9 ("GDPR"): For UK personal data, read as UK GDPR
• Section 1.1.10 ("Restricted Transfer"): Extended to include UK-origin transfers to countries without UK adequacy regulations
• Section 12 (Restricted Transfers): Extended so that the SCCs (as amended by this UK Addendum) apply to UK Restricted Transfers

B6. Data Subject Rights (UK GDPR)

GoldFynch shall assist Company in fulfilling UK data subject rights requests under:

• Article 15 UK GDPR - Right of access
• Article 16 UK GDPR - Right to rectification
• Article 17 UK GDPR - Right to erasure
• Article 18 UK GDPR - Right to restriction
• Article 20 UK GDPR - Right to data portability
• Article 21 UK GDPR - Right to object

B7. Breach Notification (UK Transfers)

For breaches affecting UK personal data, GoldFynch shall notify Company without undue delay and, where feasible, within 48 hours, to enable Company to meet its 72-hour reporting obligation to the ICO under Article 33 UK GDPR.

B8. Revision of UK Addendum

If the ICO issues a revised or replacement Addendum: - GoldFynch will provide 30 days' written notice to Customers - Company may terminate affected Services within that period if the revised Addendum does not provide adequate protection - Absent objection within 30 days, the revised Addendum is deemed accepted

B9. Incorporation

This UK Addendum is incorporated automatically into the GoldFynch DPA for all Customers whose processing involves UK personal data. Acceptance of the Principal Agreement constitutes acceptance of this UK Addendum.

---

PART C - Transfer Impact Assessment

Legal basis: Clause 14, EU SCCs (2021/914); ICO IDTA Part 2 Section III; EDPB Recommendations 01/2020 Reference: GF-TIA-001

C1. Scope of Assessment

C2. US Law Assessment

C2.1 FISA Section 702

C2.2 Executive Order 12333

C2.3 NSLs (PATRIOT / FREEDOM Act)

C2.4 ECPA / Stored Communications Act

C2.5 CLOUD Act (2018)

C3. Contextual Risk-Reducing Factors

C4. Overall Risk Assessment

C5. Formal Clause 14 Warranty

GoldFynch has no reason to believe that US law and practice applicable to the processing of personal data under these Clauses - including any requirements to disclose personal data or measures authorising public authority access - prevents GoldFynch from fulfilling its obligations under the SCCs and UK IDTA.

This warranty is based on: the nature of GoldFynch's services and customer base; the technical and organisational measures in place; GoldFynch's commitment to challenge unlawful access requests; the absence of prior government access requests; the US-UK CLOUD Act Agreement (2022); and the safeguards introduced by Executive Order 14086.

C6. TIA Review Triggers

---

PART D - Supplementary Measures Register

Reference: GF-SMR-001

D1. Technical Measures

D2. Contractual Measures

D3. Organisational Measures

D4. Transparency Report Commitment

GoldFynch commits to publishing an annual transparency report disclosing:

• The number of government access requests received (or a statement that none were received)
• The type of request (NSL, court order, FISA order, etc.) - in aggregate, to the extent permitted by law
• Whether any requests were challenged and the outcome

First report to be published by: 6 March 2027

---

Part E - Document Control and Sign-Off

E1. Version History

E2. Approval

E3. Related Documents

E4. Next Review Date

This Compliance Pack must be reviewed in its entirety by 6 March 2027 or sooner if a review trigger in section C6 is met.

Mazira LLC dba GoldFynch | 136 S Dubuque Street, Iowa City, IA 52240 info@goldfynch.com | +1-866-319-7983 | https://goldfynch.com © 2026 Mazira LLC. All rights reserved.