Data Processing Addendum

How we comply with the General Data Protection Regulation (GDPR)

Last Updated: 2025-06-07

Effective Date: 2025-06-07

This Data Processing Addendum (the "DPA") is attached to, and incorporates in the entirety, the Master Services Agreement by and between you and eSIM Center (the "MSA") and is immediately effective upon your use of any Service (the "Effective Date"). Capitalized terms not expressly defined in this DPA shall have the meaning found in the MSA.

1. Definitions

Capitalized terms which are used throughout this DPA are defined in the section in which they are first used or expressly modified as follows:

• "Covered Data Breach" means a breach of eSIM Center's security that (i) directly results in the unintended loss or unauthorized disclosure of Covered PII on systems managed or controlled by eSIM Center and (ii) does not arise from any negligent, reckless, or intentional act or omission by any Covered User.
• "Covered PII" means any PII Processed as a result of the Services.
• "Data Subject" means any natural person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to such natural person's cultural, digital, economic, financial, mental, physical, physiological, or social identity.
• "Personal Identifiable Information" or "PII" means data that identifies, makes relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to a Data Subject but excluding any Data that is (i) publicly and lawfully made available from federal, state, or local government records, (ii) publically and lawfully made available by the applicable Data Subject, (iii) is reasonably de-identified or obfuscated; or (iv) aggregated.

2. Instructions

You instruct eSIM Center to Process Covered PII consistent with the provisions of the Agreement. You shall be required to provide written, supplemental instructions to eSIM Center, with at least thirty (30) calendar days Notice, if you wish for eSIM Center to Process Covered PII in a manner that is inconsistent or supplemental to the terms of the Terms of Service. You shall be solely responsible and liable for determining if your instructions to eSIM Center for the Processing of Covered PII are consistent with the Terms of Service and applicable law.

3. Authority

eSIM Center shall be permitted to Process Covered PII as instructed by you, provided that eSIM Center:

• implements and continues to implement technical and organizational measures in such a manner that eSIM Center's provision of the Services complies, at a minimum, with the requirements of this DPA;
• engages TSPs to Process Covered PII after obtaining assurances of compliance with applicable law; and
• in the event of a Covered Data Breach, communicates to you (i) a written Notice promptly and without undue delay upon eSIM Center's validation of the Covered Data Breach; and (ii) information reasonably necessary for your compliance with your data breach notification obligations.

4. General Processing of PII

The Processing of Covered PII by eSIM Center will be used in furtherance of providing the Services to you and as otherwise permitted by the Terms of Service. eSIM Center is prohibited from disclosing or transferring Covered PII to any non-eSIM Center entity or party, except (i) in connection to the ordinary and necessary Processing of Covered PII by an eSIM Center Representative or TSP that has executed an agreement to comply with the material terms of this DPA prior to any such Processing or (ii) where required by law.

5. Processing European Covered PII

5.1 Applicability

This §5 shall only apply to the Processing of European Covered PII arising out of or relating to this DPA.

5.2 Additional Definitions

• "Data Controller" and "Data Exporter" shall have the meanings defined in the EU Model Contract.
• "Data Importer" and "Data Processor" shall have the meanings defined in the EU Model Contract.
• "EU Model Contract" means the Data Processor Agreement and the Standard Contractual Clause C(2010)593 issued by the European Union European Commission, Directorate of General Justice as provided by eSIM Center to you during your onboarding process.
• "European Covered PII" means any Covered PII is sourced from (i) any of the following countries: Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom; or (ii) otherwise in the European Union.
• "GDPR" means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data found here (or in respect of the United Kingdom, any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the United Kingdom leaving the European Union), and the implementing regulations therein.
• "Subprocessor" shall have the meaning prescribed by the GDPR.

5.3 EU Model Contract

You shall be required to review and consent to the EU Model Contract found here if the use of the Services by any Covered User requires eSIM Center or any Covered User to Process European Covered PII.

5.4 Relationship of Covered Users and eSIM Center

The following table shall be deemed to identify and establish the legal and transactional status of Covered Users and eSIM Center, with respect to the Processing of European Covered PII, as between:

5.5 Conditions Precedent to Use

Each Party, individually and jointly, represents, warrants, and certifies that:

• (i) such Party has read, understands, and consents to the EU Model Contract and GDPR with respect to the Processing of European Covered PII;
• (ii) you are deemed to solely be in control, responsible, and liable for the Processing of European Covered PII by Covered Users;
• (iii) eSIM Center is deemed to be a Processor with respect to the Processing of your European Covered PII;
• (iv) eSIM Center is deemed to be your Subprocessor with respect to the Processing of any other Covered User's European Covered PII;
• (v) eSIM Center is deemed to have no direct legal relationship or transactional engagement with any End User;
• (vi) eSIM Center shall be required to secure and maintain the confidentiality of European Covered PII in eSIM Center's possession consistent with the EU Model Contract and GDPR;
• (vii) eSIM Center shall Process European Covered PII only as instructed by the Terms of Service;
• (viii) each Party shall reasonably cooperate with the other Party's obligations to respond to valid data disclosure requests;
• (ix) each Party shall destroy, deliver, or return all European Covered PII to the applicable Party within thirty (30) days of the termination of this DPA except where otherwise permitted under the GDPR or the Terms of Service.

6. Processing California Covered PII

6.1 Applicability

This §6 shall only apply to the Processing of California Covered PII arising out of or relating to this DPA.

6.2 Additional Definitions

• "California Covered PII" means any Covered PII is sourced from the State of California, United States of America.
• "CCPA" means the California Consumer Protection Act, Cal. Civ. Code § 1798.100 et seq., found here and the implementing regulations therein.
• "Data Controller" shall have the meaning assigned to a "business" as defined by the CCPA.
• "Data Processor" shall have the meaning assigned to a "service provider" as defined by the CCPA.
• "Subprocessor" means any Data Processor that Processes California Covered PII on behalf of a non-consumer Data Processor for a business purpose in the context of the CCPA.

6.3 Relationship of Covered Users and eSIM Center

The following table shall be deemed to identify and establish the legal and transactional status of Covered Users and eSIM Center, with respect to the Processing of California Covered PII, as between:

6.4 Conditions Precedent to Use

Each Party, individually and jointly, represents, warrants, and certifies that:

• (i) such Party has read, understands, and consents to the CCPA with respect to the Processing of California Covered PII;
• (ii) Company is deemed to solely be in control, responsible, and liable for the Processing of California Covered PII by any Covered User;
• (iii) eSIM Center is deemed to be a Subprocessor of Company with respect to the Processing of any California Covered PII arising out of or relating to your use of the Services;
• (iv) eSIM Center is deemed to have no direct legal relationship or transactional engagement with any End User;
• (v) eSIM Center shall be required to secure and maintain the confidentiality of California Covered PII in eSIM Center's possession consistent with the CCPA;
• (vi) eSIM Center shall Process California Covered PII only as instructed by the Agreement;
• (vii) each Party shall reasonably cooperate with the other Party's obligations to respond to valid data disclosure requests;
• (viii) each Party shall destroy, deliver, or return all California Covered PII to the applicable Party within thirty (30) days of the termination of this DPA except where otherwise permitted under the CCPA or the MSA.

7. eSIM-Specific Data Processing

7.1 Mobile Network Data

eSIM Center processes specific types of data related to mobile network operations, including but not limited to:

• International Mobile Subscriber Identity (IMSI)
• Integrated Circuit Card Identifier (ICCID)
• Mobile Station International Subscriber Directory Number (MSISDN)
• Device identifiers and location data
• Network usage and connectivity logs

7.2 Cross-Border Data Transfers

Given the international nature of eSIM services, data may be transferred across borders to enable roaming services. All such transfers shall comply with applicable data protection laws and this DPA.

8. Amendment

This DPA is attached to amends the Agreement solely with respect to the subject matter herein. In the event of any conflict of terms between (i) this DPA and (ii) the MSA, the NDA, and/or any mutually executed SLA, SPA, SUP, or Service Order, this DPA shall be deemed controlling and prevailing without exception.