MACH Data Processing Addendum

This Data Processing Addendum (this "DPA") supplements the MACH Subscription and End User License Agreement (the "Agreement") between Kinetech Cloud, LLC ("Kinetech") and the Customer that subscribes to the MACH platform. It applies whenever Kinetech processes Personal Data on Customer's behalf in providing the Service. Capitalized terms not defined here have the meanings given in the Agreement.

1. Definitions

• "Applicable Privacy Law" means the U.S. state privacy laws that apply to the processing of Personal Data under the Agreement, including the Texas Data Privacy and Security Act and the California Consumer Privacy Act, as amended.
• "Personal Data" means information within Customer Data that identifies, or is reasonably linkable to, an identified or identifiable individual and is protected under Applicable Privacy Law.
• "Security Incident" means a confirmed unauthorized access to, acquisition of, or loss of Personal Data within Kinetech's systems or facilities. It does not include unsuccessful attempts or activities that do not compromise the security of Personal Data.
• "Subprocessor" means a third party that Kinetech engages to process Personal Data in providing the Service.

2. Details of Processing

Personal Data processed.

Personal Data consists principally of the account records of Authorized Users who access the Hub: names, business contact details, role and permission assignments, and authentication and access logs. The Service captures shop-floor activity at the Work Center and shift level and is not designed to identify, or to report on the performance of, individual operators.

Nature and purpose.

Kinetech processes Personal Data to provide, secure, and support the Service, including user and access management, as described in the Agreement.

Duration.

Kinetech processes Personal Data for the subscription term and for the export and deletion period described in Section 6 of the Agreement.

3. Roles and Instructions

As between the parties, Customer is the controller (and, where applicable, the business) with respect to Personal Data, and Kinetech is the processor (and, where applicable, the service provider). Kinetech will process Personal Data only on Customer's documented instructions, which consist of the Agreement, the applicable Order Form, this DPA, and Customer's use and configuration of the Service. If Applicable Privacy Law requires Kinetech to process Personal Data otherwise, Kinetech will notify Customer before doing so unless the law prohibits that notice. Kinetech will tell Customer if it believes an instruction violates Applicable Privacy Law.

4. Service Provider Commitments

Kinetech will not:

• sell or share Personal Data, as those terms are defined under Applicable Privacy Law;
• retain, use, or disclose Personal Data for any purpose other than performing the Service and the purposes expressly permitted in the Agreement;
• retain, use, or disclose Personal Data outside the direct business relationship between the parties; or
• combine Personal Data with personal information received from another source, except as Applicable Privacy Law permits in order to perform the Service.

Kinetech certifies that it understands and will comply with these restrictions. Kinetech will notify Customer if it determines that it can no longer meet its obligations under Applicable Privacy Law.

5. Confidentiality of Personnel

Kinetech will limit access to Personal Data to personnel who need it to perform the Service and will ensure those personnel are bound by appropriate confidentiality obligations.

6. Security

Kinetech will protect Personal Data under the written information security program described in Section 6 of the Agreement.

7. Security Incidents

Kinetech will notify Customer of a Security Incident without undue delay and in any event within seventy-two (72) hours of confirming it. The notice will describe, to the extent then known, the nature of the incident, the categories of Personal Data involved, the likely consequences, and the measures Kinetech has taken or proposes to take. Kinetech will provide reasonable cooperation and information to help Customer meet its own notification obligations. A notice under this Section is not an acknowledgment of fault or liability.

8. Subprocessors

Customer authorizes Kinetech to engage Subprocessors to provide the Service, including cloud-infrastructure providers. Kinetech will engage each Subprocessor under a written agreement that requires the Subprocessor to protect Personal Data in accordance with Applicable Privacy Law and to meet the obligations of a processor with respect to that Personal Data. Kinetech remains responsible for each Subprocessor's performance. Kinetech will provide its current list of Subprocessors on request.

9. Individual Rights Requests and Assessments

Taking into account the nature of the processing, Kinetech will provide reasonable assistance to Customer, at Customer's expense where the assistance requires material effort, in responding to requests from individuals to exercise their rights under Applicable Privacy Law, and in Customer's data protection assessments, to the extent the required information is within Kinetech's control. If Kinetech receives such a request directly, it will refer the individual to Customer.

10. Demonstrating Compliance

On Customer's written request, no more than once in any twelve-month period, Kinetech will make available the information reasonably necessary to demonstrate its compliance with this DPA, and will cooperate with reasonable assessments by Customer or an independent assessor Customer designates. Assessments must be conducted on reasonable advance notice, during business hours, without unreasonably disrupting Kinetech's operations, and subject to confidentiality obligations. Customer bears its own costs of any assessment.

11. Return and Deletion

On termination or expiration of the Agreement, Kinetech will make Personal Data available for export and will then delete it as described in Section 6 of the Agreement, except for copies retained in routine backups or as required by law, which remain subject to this DPA until deleted.

12. Scope

The Service is offered for processing of Personal Data subject to United States law. Customer will not submit Personal Data to the Service that is subject to the EU or UK General Data Protection Regulation without Kinetech's prior written agreement.

13. General

This DPA forms part of the Agreement and remains in effect for as long as Kinetech processes Personal Data on Customer's behalf. If this DPA conflicts with the Agreement regarding the processing of Personal Data, this DPA controls. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

Version History

• Version 1.0 (effective November 1, 2026): initial published version.