This Data Processing Agreement ("Agreement") forms part of the GTrack Terms of Service between you ("Controller") and Server Management LLC, a Delaware limited liability company with its registered office at 1201 N Orange St, STE 700 #7246, Wilmington, DE 19801, United States, operating the GTrack service ("Processor"). Terms not defined here have the meaning given in the Terms of Service.

This Agreement applies where Controller processes personal data through GTrack on behalf of its own customers or end users. Where Processor determines the purposes and means of processing — for example account registration, billing and product analytics — Processor acts as controller and the GTrack Privacy Policy applies instead.

Controller's instructions shall comply with all applicable data protection laws, including Regulation (EU) 2016/679 ("GDPR"). Controller has sole responsibility for the accuracy, quality and lawfulness of the personal data ("PD") and for the means by which it was obtained.

Subject matter and purpose

Provision of the local search rank tracking, geo-grid scanning, SERP tracking, reporting and related services set out in the Terms of Service.

Categories of data subjects

Controller's authorised users; individuals identifiable from business listing information submitted or scanned, including sole traders and named individuals appearing in public business profiles; Controller's own clients where their details are entered into the Service (for example as report recipients).

Categories of personal data

Names and email addresses of authorised users; IP address, approximate location derived from IP address, browser and device information, and access logs; business names, addresses and Google Place IDs; search keywords, tracked URLs and geo-grid coordinates; scan and ranking results; support and chat correspondence.

Special categories of data

None. Controller shall not submit special category data to the Service.

Frequency

Continuous for the duration of the Terms of Service.

Duration

As set out in clause 13 below.

Processor shall process PD only on Controller's documented instructions, including with regard to transfers to third countries, unless required to do so by applicable law, in which case Processor shall inform Controller of that requirement before processing unless the law prohibits it. Controller's instructions are set out in this Agreement, the Terms of Service, and Controller's use of the Service's features. Processor shall not use PD processed on Controller's behalf for its own purposes and shall not sell it.

Processor shall assist Controller by appropriate technical and organisational measures in fulfilling Controller's obligations to respond to data subject requests. Where a data subject contacts Processor directly in relation to PD processed on Controller's behalf, Processor shall refer the request to Controller without undue delay.

Processor shall ensure that personnel engaged in processing PD are bound by confidentiality undertakings and process PD only as necessary to provide the Service.

Processor will notify Controller without undue delay after becoming aware of any breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to PD, and will provide the information reasonably required for Controller to meet its own notification obligations under Articles 33 and 34 GDPR.

Processor maintains written records of its processing activities and will provide an up-to-date copy on request.

Controller gives general written authorisation for Processor to engage the sub-processors listed in Appendix 1. Processor will give at least 30 days' prior notice of the addition or replacement of a sub-processor by updating Appendix 1 and notifying Controller through the Service or by email, and Controller may object on reasonable data protection grounds within that period. Where the parties cannot resolve an objection, Controller may terminate the affected Services. Sub-processors are bound by written obligations no less protective than those in this Agreement, and Processor remains liable for their performance.

Taking into account the nature of the processing and the information available to it, Processor will assist Controller with security of processing, breach notification, data protection impact assessments, and prior consultation with or requests from supervisory authorities.

Where Processor considers that an instruction would breach applicable data protection law, Processor shall notify Controller without undue delay.

Processor shall make available information necessary to demonstrate compliance with Article 28 GDPR and shall cooperate with audits, including inspections, by Controller or an auditor appointed by Controller, on at least 30 days' notice and no more than once in any twelve-month period unless required by a supervisory authority or following a breach affecting Controller's PD. Audits shall be conducted during business hours, without unreasonable disruption to Processor's operations, and subject to confidentiality. Costs are borne by Controller except where the audit reveals material non-compliance.

Processor shall implement and maintain the measures set out in Appendix 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to data subjects. Processor may update those measures provided the overall level of protection is not reduced.

PD processed on Controller's behalf is stored on dedicated servers operated by Hetzner Online GmbH in Germany.

Processor retains PD for as long as Controller's account remains active. PD is deleted or anonymised:

• within 90 days of termination or expiry of the subscription; or
• within 90 days of an account being classified as dormant, meaning no login and no scan activity for 12 consecutive months.

Activity records are automatically purged 90 days after they are created. Billing and transaction records are retained for the period required by applicable tax and accounting law. On Controller's request, Processor will return or delete PD earlier, to the extent permitted by law, and will delete existing copies unless applicable law requires their storage.

PD processed on Controller's behalf is stored within the EEA. Transfers outside the EEA occur only in the following circumstances:

• administrative and support access by Processor's personnel from outside the EEA; and
• onward transfer to the sub-processors identified in Appendix 1 as located outside the EEA.

Such transfers are governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (Controller to Processor), incorporated by reference and completed by Appendix 3. Where those Clauses conflict with this Agreement, the Clauses prevail. Where the UK GDPR applies, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0) is incorporated and completed with the same information. Server Management LLC is not certified under the EU-U.S. Data Privacy Framework and does not rely on it. Processor's Transfer Impact Assessment is available on request.

This Agreement remains in force for as long as Processor processes PD on Controller's behalf. In the event of conflict regarding the processing of PD, the Standard Contractual Clauses prevail over this Agreement, and this Agreement prevails over the Terms of Service.

Transfer mechanism refers to the lawful basis for onward transfers from Processor to the sub-processor under Clause 8.8 of the Standard Contractual Clauses. Participation in the EU-U.S. Data Privacy Framework can be verified on the official list at dataprivacyframework.gov; where a sub-processor's terms also include Standard Contractual Clauses, those apply as a fallback. The transfer from Controller to Processor itself is governed by the Standard Contractual Clauses as set out in clause 14.

Server Management LLC is the contracting party and data importer under this Agreement, not a sub-processor.

• Encryption in transit. All connections between users and the Service, and between the Service and its sub-processors, use TLS 1.2 or higher.
• Authentication. The Service does not store user passwords: users authenticate through Google sign-in or single-use login links sent by email. API keys are issued per account and can be revoked by the account holder at any time.
• Access control. Administrative access to production systems is restricted to a small number of authorised personnel with an operational need, using individual credentials. Access is reviewed and revoked on personnel change. Within the Service, access to data is governed by workspace roles (owner, admin, member).
• Network security. Production hosts are firewalled. Database services accept connections only from Processor's application servers and are not exposed to the public internet.
• Backups. Database backups are taken regularly, stored encrypted, and restoration is tested periodically.
• Segregation. Customer data is logically segregated by account and workspace identifiers; every data access is scoped to the requesting account.
• Personnel. Confidentiality undertakings for all personnel with access to personal data.
• Vulnerability management. Application dependencies are continuously monitored for known vulnerabilities through automated dependency scanning and updated according to severity. Production systems run supported software versions.
• Incident response. Security incidents are triaged, contained and escalated under Processor's incident procedure, and affected Controllers are notified in accordance with clause 6.
• Deletion. Personal data is deleted on the schedule in clause 13. Activity records are purged automatically after 90 days. Custom-domain configuration is removed when a domain is disconnected.

Annex I.A — Parties

Data exporter: the Controller, being the account holder identified in Processor's records, acting as controller. Data importer: Server Management LLC, 1201 N Orange St, STE 700 #7246, Wilmington, DE 19801, United States; contact support@wiremo.co; acting as processor.

Annex I.B — Description of transfer

Categories of data subjects, categories of personal data, nature, purpose, frequency and duration as set out in clause 2. Onward transfers limited to the sub-processors in Appendix 1.

Annex I.C — Competent supervisory authority

The supervisory authority of the EEA Member State in which the data exporter is established.

Annex II

As set out in Appendix 2.

Annex III

As set out in Appendix 1.

Optional clauses

Clause 7 (docking) applies. Clause 9: option 2, general written authorisation, 30 days' notice. Clause 11: the optional independent dispute resolution provision does not apply. Clause 17: governing law of Ireland. Clause 18(b): courts of Ireland.

Questions about this Agreement, sub-processor changes, audits or data subject requests:

Version 1.0 — effective 26 August 2026.