This Data Processing Agreement ("DPA") forms part of the Appointoze Terms of Service between WeByld, operating as Appointoze ("Processor", "we", "us" or "our") and the business or professional using the platform ("Customer" or "Controller"). The Customer determines the purposes and means of processing its clients' Personal Data. Appointoze processes such data on the Customer's behalf to provide its services. This DPA applies to all processing of Personal Data carried out through Appointoze and shall be interpreted in accordance with applicable data protection and privacy laws.

Appointoze processes Personal Data solely as necessary to provide, maintain and secure its services and in accordance with the Customer's documented instructions. Processing includes: • Data subjects: Clients, customers, business owners and authorised staff. • Personal Data: Names, contact details, appointment information, selected services, consent records and operational logs. • Processing activities: Collection, storage, organisation, retrieval, transmission and deletion. • Purpose: Appointment scheduling, client management, booking administration and platform security. • Duration: The term of the Customer's use of Appointoze, subject to applicable retention requirements. Appointoze does not sell Customer Personal Data or use it for targeted advertising or unrelated commercial purposes.

The Customer is responsible for: a. Establishing a lawful basis for collecting and processing Personal Data. b. Providing appropriate privacy notices and obtaining required consents. c. Ensuring that information submitted to Appointoze is accurate, relevant and limited to what is necessary. d. Responding to requests from individuals exercising their data protection rights. e. Managing its own payment accounts, deposits and payment-provider relationships. f. Ensuring that its use of Appointoze complies with applicable privacy and industry-specific regulations.

Appointoze shall: a. Process Personal Data only on documented instructions from the Customer, unless otherwise required by law. b. Ensure that authorised personnel are subject to confidentiality obligations. c. Implement appropriate technical and organisational security measures. d. Maintain access controls, tenant isolation and encryption in transit and at rest. e. Restrict access to Personal Data to authorised personnel who require it for legitimate operational purposes. f. Provide reasonable assistance with data protection requests, regulatory obligations and security assessments. g. Inform the Customer if an instruction appears to violate applicable data protection laws.

Appointoze shall maintain security measures appropriate to the nature and risks of processing, including access restrictions, encryption, secure infrastructure, monitoring and backup procedures. In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Appointoze shall notify the Customer without undue delay and, where reasonably practicable, within 48 hours of becoming aware of the incident. The notification shall include available details concerning the incident, affected data, likely consequences and mitigation measures. Appointoze shall reasonably cooperate with the Customer in investigating and addressing the breach. The Customer remains responsible for fulfilling its applicable regulatory and individual notification obligations.

The Customer authorises Appointoze to engage subprocessors necessary to operate the platform, including providers of hosting, database infrastructure, authentication, communications, monitoring and related technical services. Appointoze shall: a. Ensure that subprocessors are bound by appropriate written data protection obligations. b. Remain responsible for their processing activities to the extent required by applicable law. c. Maintain an up-to-date register of subprocessors available upon request. d. Notify the Customer of material changes to subprocessors where required by applicable law, allowing a reasonable opportunity to raise legitimate data protection objections.

Personal Data may be processed or transferred across international borders where necessary to provide the services. Appointoze shall ensure that such transfers are supported by appropriate safeguards where required by applicable law. These may include recognised adequacy mechanisms, standard contractual clauses, approved transfer agreements or other legally recognised safeguards. Where required, the parties shall complete relevant transfer documentation and assessments.

Appointoze shall provide reasonable assistance to enable the Customer to respond to requests for access, correction, deletion, restriction, portability and objection, where applicable. Requests received directly by Appointoze concerning Customer-controlled Personal Data shall be referred to the Customer where legally permitted. The Customer remains responsible for determining and responding to such requests.

Personal Data shall be retained only for as long as necessary to provide the services, fulfil contractual obligations, comply with applicable law or establish, exercise or defend legal claims. Upon account termination, the Customer may request the return or export of available Personal Data. Appointoze shall delete or return Customer Personal Data within 30 days following termination, unless retention is required or otherwise permitted by applicable law. Data held in backups shall be deleted through the applicable backup retention cycle and remain protected until deletion.

Upon reasonable written request, Appointoze shall provide information necessary to demonstrate compliance with this DPA. Where required by applicable law, Appointoze shall permit reasonable audits by the Customer or an independent auditor, subject to prior notice, confidentiality obligations and appropriate security restrictions. Available security documentation and independent audit reports may be provided where sufficient to address the request.

The parties shall comply with all applicable data protection, privacy and information security laws governing their respective processing activities. Where applicable, Appointoze shall act as a Processor, Service Provider or equivalent regulated entity and shall: a. Process Personal Data only for authorised service-related purposes. b. Not sell or disclose Personal Data for unrelated commercial purposes. c. Not use Personal Data for targeted advertising or independent profiling. d. Maintain appropriate security and confidentiality measures. e. Provide reasonable assistance with compliance obligations. Where mandatory legal requirements impose additional obligations, those requirements shall prevail over inconsistent provisions of this DPA.

Appointoze's standard booking and intake services are intended for administrative information, including client contact details, appointment information, selected services and consent records. Customers must not submit or store clinical records, diagnoses, medical histories, allergies, medications, treatment notes, pregnancy information, medical photographs or other sensitive health information through standard Appointoze booking and intake forms. This DPA does not constitute a healthcare-specific data processing agreement or authorise the processing of regulated clinical records. Any processing requiring additional healthcare-specific safeguards must be separately agreed in writing before such information is submitted.

Each party shall protect confidential information received from the other party and restrict its disclosure to authorised individuals. Appointoze shall ensure that personnel accessing Customer Personal Data are subject to appropriate confidentiality obligations. These obligations survive termination of this DPA.

Each party is responsible for its obligations under this DPA and applicable data protection laws. Any contractual limitations or exclusions of liability shall be governed by the Appointoze Terms of Service, to the extent permitted by applicable law. Nothing in this DPA excludes liability that cannot legally be excluded or restricted.

This DPA becomes effective when the Customer accepts the Appointoze Terms of Service and remains effective while Appointoze processes Personal Data on the Customer's behalf. Termination of the Customer's account terminates this DPA, subject to continuing obligations relating to confidentiality, security, retention and deletion.

This DPA is governed by the governing law provisions of the Appointoze Terms of Service, subject to mandatory applicable data protection legislation. In the event of a conflict between this DPA and the Terms of Service concerning Personal Data processing, this DPA shall prevail. Mandatory statutory data protection requirements take precedence over inconsistent contractual provisions.

This DPA forms part of the Appointoze Terms of Service. By creating a business account, accepting the Terms of Service and using Appointoze to process Personal Data, the Customer agrees to this DPA, where legally effective. Data Protection Contact: Appointoze (WeByld) Email: support@milestones.webyld.pro

• Processor: Appointoze (WeByld) • Controller: Customer / Business • Subject matter: Appointment scheduling and business management • Data subjects: Clients, customers, business owners and staff • Personal Data: Contact details, booking records, consent records and operational logs • Purpose: Providing and maintaining Appointoze • Processing operations: Collection, storage, retrieval, transmission and deletion • Duration: Duration of service and applicable retention period • Special category data: Excluded from standard processing scope

Where required by applicable law, the parties shall execute or incorporate the relevant approved international transfer instruments and supplementary safeguards. Such instruments shall form part of this DPA and prevail over inconsistent provisions to the extent required by their terms or applicable law.