Data Processing Addendum

Terms such as \u201cCustomer Data\u201d, \u201cPersonal Data\u201d, \u201cProcess\u201d, \u201cSubprocessor\u201d, and \u201cData Breach\u201d have the meanings given by the PDPA and the applicable agreement.

The customer determines the purposes and means of processing. Nomos processes Customer Data only on documented instructions.

Processing supports governed extraction, classification, workflow routing, review, audit, and related service operations.

Nomos maintains confidentiality, security, access controls, deletion procedures, and personnel commitments appropriate to the processing.

Nomos may use approved subprocessors for infrastructure, communications, analytics, and service delivery, subject to written obligations.

Cross-border processing is subject to safeguards designed to maintain protection comparable to Singapore data protection requirements.

Nomos will notify the customer without undue delay after confirming a Data Breach affecting Customer Data and will support investigation and response.

Customer Data is not used to train third-party foundation models. Human review and policy controls remain part of the governed workflow.

At the customer\u2019s request or on termination, Nomos will return or delete Customer Data unless retention is required by law.

Nomos will make information reasonably necessary to demonstrate compliance available to the customer, subject to confidentiality and security limits.

Liability for processing activities follows the allocation in the applicable agreement and this Addendum.

If this Addendum conflicts with another agreement, the order of precedence stated in the applicable contract applies.

Processing covers business contact details, operational records, communications, and related metadata needed to provide the Services.

Measures include access control, least privilege, encryption in transit, logging, monitoring, secure development, and incident response.

The current approved Subprocessor list is available from Nomos on request and may be updated with appropriate notice.