Data Processing Addendum

Customer Role

Customer determines the purpose for which documents are uploaded to Re-Doc and the processing workflow selected for those documents.

Customer is generally the Controller, Data Fiduciary, Business, or equivalent decision-maker for Customer Personal Data processed through the Services.

Customer is responsible for determining whether it has the necessary rights, permissions, consents, notices, approvals, lawful basis, and authority to upload documents to Re-Doc and have them processed through the Services.

Re-Doc Role

Re-Doc processes Customer Personal Data on behalf of Customer and in accordance with Customer's documented instructions, this DPA, the Agreement, and applicable Data Protection Laws.

Re-Doc generally acts as a Processor, Data Processor, Service Provider, or equivalent role when processing Customer Personal Data on behalf of Customer.

Re-Doc does not determine the purpose for which Customer uploads documents or the legal basis on which Customer processes personal data contained in those documents.

No Compliance Guarantee

Re-Doc provides document-processing technology.

Re-Doc does not guarantee that Customer's use of the Services will make Customer compliant with any specific law, regulation, court order, contractual obligation, professional duty, industry standard, privacy framework, healthcare requirement, financial requirement, or regulatory requirement.

Customer remains responsible for determining whether the Services are appropriate for Customer's intended use and legal obligations.

1. Subject Matter of Processing

The subject matter of processing is Re-Doc's provision of document-processing services to Customer.

This may include processing uploaded documents and related information for the purpose of providing redaction, anonymization, pseudonymization, document conversion, OCR, AI-assisted document analysis, text replacement, output generation, and related document-processing workflows.

2. Duration of Processing

Re-Doc will process Customer Personal Data for the duration of the Agreement and for the period necessary to provide the Services, unless a shorter retention period is agreed in writing or Customer requests earlier deletion where supported.

Unless deleted earlier or agreed otherwise:

• ·uploaded documents are retained for up to 30 days;
• ·generated outputs are retained for up to 30 days;
• ·document metadata may be retained for operational, billing, audit, security, support, and compliance purposes;
• ·account information may be retained while the account remains active;
• ·billing and payment records may be retained as required for tax, accounting, payment, and legal obligations;
• ·logs and technical records may be retained for security, troubleshooting, audit, and operational purposes.

After the applicable retention period, uploaded documents and generated outputs are scheduled for deletion from Re-Doc's active processing systems.

3. Nature of Processing

The nature of processing may include:

• ·receiving uploaded documents;
• ·temporarily storing uploaded documents;
• ·extracting text;
• ·performing OCR;
• ·analyzing document layout and structure;
• ·detecting sensitive information;
• ·identifying personal data, confidential data, or other selected entities;
• ·converting documents between supported formats, including PDF to DOCX and DOCX to PDF where required;
• ·using AI-assisted processing where applicable;
• ·generating anonymized, redacted, pseudonymized, replaced, or converted outputs;
• ·creating processing reports;
• ·making generated outputs available for download;
• ·storing document metadata;
• ·maintaining account and subscription records;
• ·processing payment and billing information;
• ·maintaining application, API, security, and diagnostic logs;
• ·providing customer support;
• ·troubleshooting processing errors;
• ·monitoring service reliability and security;
• ·deleting documents and generated outputs according to the applicable retention period; and
• ·other processing reasonably necessary to provide, secure, support, and operate the Services.

4. Purpose of Processing

Re-Doc processes Customer Personal Data for the purpose of providing the Services requested by Customer. The purposes may include:

• ·document redaction;
• ·document anonymization;
• ·document pseudonymization;
• ·sensitive information detection;
• ·synthetic or replacement text generation;
• ·document transformation;
• ·OCR and document extraction;
• ·document conversion;
• ·preserving document layout and structure where supported;
• ·generating processed documents and outputs;
• ·enabling download of generated outputs;
• ·maintaining customer accounts;
• ·processing subscriptions and billing;
• ·providing technical support;
• ·improving service reliability and usability;
• ·maintaining security;
• ·detecting abuse or misuse;
• ·complying with applicable legal obligations; and
• ·enforcing the Agreement.

Re-Doc will not process Customer Personal Data for purposes unrelated to providing, securing, supporting, maintaining, or improving the Services, unless required by applicable law or expressly authorized by Customer.

5. Categories of Customer Personal Data

The categories of Customer Personal Data processed by Re-Doc depend on the documents uploaded by Customer and the workflow selected.

6. Sensitive or Special Categories of Data

Customer acknowledges that uploaded documents may contain sensitive or special categories of personal data depending on the documents submitted. Such information may include, without limitation:

• ·health or medical information;
• ·financial information;
• ·legal information;
• ·government identification information;
• ·children's or minors' information;
• ·biometric-like information appearing in documents, such as photographs or signatures;
• ·employment records;
• ·insurance records;
• ·criminal or legal proceeding information;
• ·family or relationship information;
• ·other sensitive, confidential, or regulated information.

Customer is responsible for ensuring that it has the necessary authority, legal basis, permissions, consents, notices, and safeguards to upload and process such information using the Services.

Re-Doc processes such information only to provide the selected document-processing workflow and related Services.

7. Categories of Data Subjects

The categories of Data Subjects may include any individuals whose personal data appears in Customer-uploaded documents or related processing records. Depending on Customer's use case, this may include:

• ·Customer's users;
• ·Customer's employees;
• ·contractors;
• ·consultants;
• ·customers;
• ·clients;
• ·patients;
• ·policyholders;
• ·claimants;
• ·applicants;
• ·vendors;
• ·business partners;
• ·legal parties;
• ·witnesses;
• ·beneficiaries;
• ·family members;
• ·dependents;
• ·students;
• ·government identification holders;
• ·data subjects or data principals named in uploaded documents;
• ·individuals appearing in scanned documents, images, signatures, or forms;
• ·other individuals whose information is included in documents uploaded by Customer.

8. Processing Frequency

Processing occurs when Customer uses the Services, uploads documents, selects a workflow, uses APIs, generates outputs, requests support, maintains an account, or otherwise interacts with Re-Doc.

Processing may occur on a one-time, occasional, recurring, subscription-based, usage-based, API-based, or enterprise workflow basis depending on Customer's use of the Services.

9. Subprocessors

Re-Doc may use subprocessors to support the processing activities described in this Annex. Subprocessor roles may include:

• ·cloud hosting;
• ·OCR and document extraction;
• ·document conversion;
• ·AI-assisted document processing;
• ·authentication;
• ·payments;
• ·analytics;
• ·infrastructure operations;
• ·security;
• ·customer support;
• ·application monitoring.

The current main subprocessors are described in Re-Doc's Subprocessor List.

10. Customer Instructions

Customer instructs Re-Doc to process Customer Personal Data as necessary to provide the Services, perform the selected document-processing workflow, operate and secure the platform, retain and delete data according to applicable retention terms, and otherwise perform the Agreement.

Additional or modified instructions may be agreed in writing through an enterprise agreement, order form, statement of work, DPA amendment, or other written agreement.

1. Transmission Security

Re-Doc uses Transport Layer Security (TLS) or similar secure transmission protocols to protect data transmitted between the customer's browser, device, or API client and the Re-Doc Services. This includes transmission of:

• ·uploaded documents;
• ·account information;
• ·authentication-related information;
• ·generated outputs;
• ·API requests;
• ·API responses;
• ·processing instructions;
• ·application data.

Customers are responsible for accessing the Services through secure devices, networks, browsers, and integrations.

2. Hosting and Infrastructure

Re-Doc's primary application and document-processing infrastructure is hosted on cloud servers located within the European Union.

Uploaded documents and Generated Outputs are stored within access-controlled infrastructure for the limited retention period described in the Agreement, Privacy Policy, and DPA.

Re-Doc applies infrastructure configuration controls and operational safeguards designed to reduce unauthorized access to production systems.

Re-Doc does not claim that uploaded documents or Generated Outputs are encrypted at the block-storage level in the standard hosted environment unless such encryption is expressly implemented and agreed in writing for a specific deployment or enterprise arrangement.

3. Access Controls

Re-Doc restricts access to production systems, uploaded documents, Generated Outputs, and Customer Personal Data to authorized personnel who require access for legitimate operational, support, security, or legal purposes. Access to Customer Personal Data is limited based on need to know. Authorized access may be used only for purposes such as:

• ·providing the Services;
• ·maintaining the platform;
• ·troubleshooting failed or incomplete processing jobs;
• ·providing customer-requested support;
• ·investigating security incidents;
• ·detecting misuse or abuse;
• ·complying with applicable legal obligations;
• ·protecting the Services, customers, users, or third parties.

Re-Doc does not routinely review uploaded documents manually.

4. Authentication

Re-Doc currently supports user authentication through Google Sign-In. Authentication is used to help ensure that only authorized users can access their accounts and available Services.

Customers are responsible for maintaining the security of their Google accounts or other authentication methods used to access Re-Doc. Customers should use strong security practices including secure passwords, device protection, and multi-factor authentication where available.

5. Customer Account Security

Customers are responsible for managing access to their Re-Doc accounts and ensuring that only authorized users access the Services. Customers should:

• ·restrict account access to authorized users;
• ·avoid sharing login credentials;
• ·promptly remove users who no longer require access, where user management is available;
• ·protect downloaded documents and Generated Outputs;
• ·notify Re-Doc promptly of suspected unauthorized access;
• ·review Generated Outputs before using or sharing them.

Re-Doc is not responsible for unauthorized access caused by compromised customer credentials, insecure customer devices, customer-side sharing, or customer failure to protect downloaded files, except to the extent caused by Re-Doc's breach of the Agreement or applicable law.

6. Automated Processing by Default

Re-Doc is designed to process uploaded documents through automated workflows by default. Depending on the selected workflow, automated processing may include:

• ·document upload;
• ·temporary storage;
• ·OCR;
• ·text extraction;
• ·layout analysis;
• ·document conversion;
• ·AI-assisted detection;
• ·redaction;
• ·anonymization;
• ·pseudonymization;
• ·replacement text generation;
• ·output generation;
• ·download delivery;
• ·scheduled deletion.

Automated processing helps reduce unnecessary human exposure to uploaded documents and Generated Outputs.

7. Data Minimization

Re-Doc aims to collect and retain only the information reasonably necessary to provide, secure, support, maintain, and improve the Services. Where possible, Re-Doc limits processing to the information required for the selected workflow. For example:

• ·OCR is used where text extraction or document analysis is required;
• ·document conversion is used where required for processing or output generation;
• ·AI-assisted processing is used where required for detection, redaction, anonymization, pseudonymization, replacement, or related workflows;
• ·analytics providers are not intentionally used to process uploaded document contents.

8. Retention Controls

Unless deleted earlier or agreed otherwise, uploaded documents and Generated Outputs are retained for up to 30 days. After the applicable retention period, they are scheduled for deletion from Re-Doc's active processing systems.

Customers may request earlier deletion, including immediate deletion where technically supported.

Re-Doc may retain document metadata, logs, account information, support records, payment records, and operational records for longer where necessary for security, billing, audit, support, legal, tax, accounting, dispute-resolution, or compliance purposes.

9. Backup Practices

Uploaded documents and Generated Outputs are not intentionally included in Re-Doc's code or application backups.

Re-Doc may maintain backups of application code, configuration, and operational systems for continuity, recovery, maintenance, and business operations.

If any Customer Personal Data is present in backups, replicated systems, logs, or archival records, Re-Doc will handle that information according to applicable retention, security, and deletion procedures.

10. Logging and Monitoring

Re-Doc may maintain application logs, API logs, diagnostic logs, security logs, and operational records to support platform reliability, troubleshooting, security, and abuse prevention. Logs may include:

• ·timestamps;
• ·account identifiers;
• ·IP addresses;
• ·API request metadata;
• ·processing status;
• ·error messages;
• ·job identifiers;
• ·browser or device information;
• ·security events;
• ·operational events.

Re-Doc does not intentionally use logs for unrelated advertising purposes.

Where logs contain Customer Personal Data, Re-Doc may delete or anonymize such logs upon request where technically feasible and legally permitted.

11. Subprocessor Controls

Re-Doc uses subprocessors to support functions such as hosting, authentication, payment processing, analytics, OCR, document extraction, document conversion, AI-assisted processing, infrastructure operations, security, and support. Re-Doc selects subprocessors based on factors such as:

• ·technical capability;
• ·operational reliability;
• ·data handling practices;
• ·security commitments;
• ·availability of relevant privacy controls;
• ·ability to support the required processing workflow.

Subprocessors are expected to process Customer Personal Data only for the purpose of providing the relevant service to Re-Doc.

The current main subprocessors are described in Re-Doc's Subprocessor List.

12. AI Processing Safeguards

Where AI-assisted processing is used, Re-Doc may transmit extracted text, relevant document content, prompts, workflow instructions, metadata, and model outputs to selected AI subprocessors.

Where supported by the relevant provider and configuration, Re-Doc uses Zero Data Retention or similar provider-side settings designed to limit retention of prompts, extracted text, document content, and model outputs.

Re-Doc does not use uploaded documents or Generated Outputs to train Re-Doc's own artificial intelligence or machine learning models.

Re-Doc does not permit third-party AI providers to use uploaded documents or Generated Outputs to train Re-Doc-specific models.

Customer acknowledges that AI provider capabilities, routing, model availability, region, logging, retention controls, and privacy settings may vary depending on provider, model, configuration, workflow, and subscription plan.

13. Document Conversion Controls

Re-Doc may convert documents between supported formats where required to preserve layout, support downstream processing, or generate the requested output. This may include, for example, converting PDF files to DOCX format for processing and converting DOCX files back to PDF format for delivery.

Document conversion is performed only where required for the selected workflow.

Where Re-Doc uses third-party document conversion providers, Re-Doc uses available deletion controls where supported and relevant to the processing workflow.

14. OCR and Document Extraction Controls

Where uploaded documents contain scanned pages, image-based content, tables, layout structures, or other content requiring extraction, Re-Doc may use OCR or document extraction providers. OCR and document extraction may involve processing:

• ·uploaded document files;
• ·document images;
• ·page images;
• ·extracted text;
• ·layout information;
• ·table structures;
• ·document structure;
• ·related analysis outputs.

OCR and document extraction are used only where required for the selected workflow.

15. Human Access Controls

Re-Doc does not routinely review uploaded documents manually. Authorized personnel may access uploaded documents, Generated Outputs, extracted text, document metadata, logs, or related information only where reasonably necessary for:

• ·customer-requested support;
• ·troubleshooting;
• ·investigating failed jobs;
• ·investigating suspected misuse;
• ·security incident response;
• ·legal compliance;
• ·enforcing the Agreement;
• ·protecting the rights, safety, or integrity of Re-Doc, customers, users, or third parties.

Access is limited to personnel with an operational need to know.

16. Security Incident Response

Re-Doc maintains procedures designed to identify, investigate, contain, and remediate confirmed Security Incidents involving Customer Personal Data.

Where Re-Doc becomes aware of a confirmed Security Incident affecting Customer Personal Data, Re-Doc will notify Customer according to the DPA, Agreement, and applicable Data Protection Laws. Re-Doc may provide information such as:

• ·nature of the incident;
• ·affected data categories;
• ·known or likely impact;
• ·remedial measures taken or planned;
• ·recommended customer actions;
• ·contact point for follow-up.

17. Deletion Support

Re-Doc supports deletion of uploaded documents and Generated Outputs according to the applicable retention period. Customers may request earlier deletion where supported.

Where technically feasible and legally permitted, Re-Doc may also delete or anonymize certain logs, metadata, or support records upon customer request.

Deletion may be subject to technical feasibility, subprocessor capabilities, backup processes, legal obligations, tax obligations, accounting obligations, security requirements, dispute-resolution needs, and compliance obligations.

18. Separation of Customer Responsibilities

Re-Doc's security measures apply to Re-Doc-controlled systems and processing activities. Customer remains responsible for security measures within Customer's own environment, including:

• ·securing user accounts;
• ·controlling user access;
• ·protecting devices;
• ·protecting networks;
• ·securing API keys, if applicable;
• ·securing downloaded files;
• ·managing internal sharing;
• ·reviewing outputs;
• ·complying with internal policies and applicable laws.

Re-Doc is not responsible for Customer-side security failures except to the extent caused by Re-Doc's breach of the DPA, Agreement, or applicable law.

19. No Certification Claim

Re-Doc does not claim that the Services are certified under any specific privacy, security, healthcare, financial, or regulatory framework unless expressly stated in a signed written agreement.

Re-Doc does not claim ISO 27001, SOC 2, HIPAA, GDPR certification, DPDP certification, or similar certification unless such certification has been formally obtained and expressly published or agreed in writing.

The measures in this Annex describe Re-Doc's current technical and organizational safeguards and do not constitute a certification or regulatory approval.

20. Updates to Security Measures

Re-Doc may update, replace, improve, or modify its technical and organizational measures from time to time.

Re-Doc will not materially reduce the overall level of protection for Customer Personal Data during the term of the Agreement without providing replacement safeguards that are reasonably designed to maintain an appropriate level of protection, taking into account the nature of the Services and the risk of processing.

Enterprise customers may agree to additional or customized technical and organizational measures through a written enterprise agreement, order form, or DPA amendment.

1. Authorization to Use Subprocessors

Customer authorizes Re-Doc to engage subprocessors to process Customer Personal Data where necessary to provide, secure, support, maintain, or improve the Services. Subprocessors may be used for functions such as:

• ·cloud hosting;
• ·OCR and document extraction;
• ·document conversion;
• ·AI-assisted document processing;
• ·authentication;
• ·payment processing;
• ·analytics;
• ·infrastructure operations;
• ·application monitoring;
• ·security and reliability;
• ·customer support; and
• ·related operational services.

Some subprocessors may process uploaded documents, extracted text, generated outputs, filenames, document metadata, account information, billing information, logs, analytics information, or related Customer Personal Data where necessary for the relevant service.

2. Current Subprocessor List

Re-Doc maintains a public Subprocessor List that describes its current main subprocessors, including their purpose, role, whether document content may be involved, typical information processed, processing region, and retention notes. The Subprocessor List is incorporated into this DPA by reference.

Re-Doc may update the Subprocessor List from time to time as the Services evolve, providers are replaced, new features are introduced, infrastructure changes are made, or processing requirements change.

3. Categories of Subprocessors

Re-Doc's subprocessors may include providers in the following categories:

4. Subprocessor Obligations

Re-Doc will take reasonable steps designed to ensure that subprocessors process Customer Personal Data only for the purposes for which they are engaged.

Re-Doc will take reasonable steps designed to ensure that subprocessors apply appropriate technical and organizational safeguards in relation to the processing they perform.

Re-Doc remains responsible for the performance of its subprocessors to the extent required by applicable Data Protection Laws and the Agreement.

5. Subprocessor Changes

Re-Doc may add, replace, remove, or modify subprocessors from time to time.

Where required by applicable law, contract, enterprise agreement, or written amendment, Re-Doc will provide notice of material subprocessor changes. Notice may be provided by:

• ·updating the public Subprocessor List;
• ·email notice;
• ·account notification;
• ·notice through the Services;
• ·contractual notice under an enterprise agreement; or
• ·another reasonable method.

6. Customer Objection Rights

Enterprise customers may have specific subprocessor notice and objection rights under a signed enterprise agreement, order form, or written amendment.

Where Customer has a contractual right to object to a new subprocessor, Customer must submit its objection in writing within the notice period specified in the applicable agreement. Customer's objection must explain the reasonable data protection concern relating to the proposed subprocessor.

If Customer reasonably objects to a new subprocessor, Re-Doc will review the objection in good faith and may, where commercially and technically reasonable:

• ·provide additional information about the subprocessor;
• ·make an alternative configuration available;
• ·restrict use of the subprocessor for Customer's workflow;
• ·work with Customer to resolve the concern;
• ·delay use of the subprocessor for Customer, where feasible; or
• ·allow Customer to terminate the affected Services according to the applicable agreement.

Customer acknowledges that some subprocessors are essential to providing certain Services. If Customer objects to an essential subprocessor and no commercially or technically reasonable alternative is available, Re-Doc may be unable to provide the affected feature or Service.

7. No Direct Subprocessor Relationship With Customer

Re-Doc's subprocessors provide services to Re-Doc and not directly to Customer, unless Customer separately contracts with that provider.

Nothing in this DPA creates a direct contractual relationship between Customer and Re-Doc's subprocessors.

8. Customer-Specific Subprocessor Restrictions

Customer-specific restrictions on subprocessors, AI providers, processing regions, OCR providers, document conversion providers, or analytics providers must be expressly agreed in writing through an enterprise agreement, order form, DPA amendment, or other written agreement signed by both parties.

Unless expressly agreed in writing, Re-Doc may use the subprocessors described in the Subprocessor List to provide the Services.

1. International Processing Overview

Re-Doc is operated by CypherLayer Technologies Private Limited, a company incorporated in India. Re-Doc's primary application and document-processing infrastructure is hosted on cloud servers located within the European Union.

Re-Doc does not intentionally transfer uploaded documents to India for document storage or document processing.

Certain subprocessors may process Customer Personal Data in other jurisdictions where required to provide the Services. This may include processing for:

• ·OCR;
• ·document extraction;
• ·layout analysis;
• ·document conversion;
• ·AI-assisted processing;
• ·authentication;
• ·payment processing;
• ·analytics;
• ·security;
• ·infrastructure operations;
• ·support;
• ·application monitoring; and
• ·related service operations.

2. Provider-Dependent Processing Locations

Customer acknowledges that some subprocessors may have provider-dependent processing locations, routing, infrastructure, retention practices, logging practices, or regional configurations. For example:

• ·hosting and primary storage are currently performed through Re-Doc-controlled infrastructure located within the European Union;
• ·OCR and document extraction may be performed through providers deployed in other jurisdictions, such as the United States;
• ·document conversion may be performed through provider infrastructure used for file transformation;
• ·AI-assisted processing may depend on the AI routing provider, selected model, provider endpoint, privacy configuration, and workflow;
• ·payment, authentication, analytics, and monitoring providers may process information in accordance with their own infrastructure and legal requirements.

Additional information is provided in Re-Doc's Subprocessor List.

3. Transfer Safeguards

Where Customer Personal Data is transferred internationally, Re-Doc will take reasonable steps designed to ensure that appropriate contractual, technical, or organizational safeguards are in place where required by applicable Data Protection Laws. Such safeguards may include, where applicable:

• ·data processing terms with subprocessors;
• ·provider security and privacy commitments;
• ·contractual restrictions on processing;
• ·transfer addenda;
• ·Standard Contractual Clauses;
• ·supplementary safeguards;
• ·limited retention controls;
• ·provider-side deletion controls;
• ·Zero Data Retention or similar settings for AI-assisted processing where supported and configured;
• ·access controls;
• ·retention and deletion limits; and
• ·other lawful transfer mechanisms.

4. European Economic Area, United Kingdom, Switzerland, and Similar Transfers

Where Customer is located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with cross-border transfer restrictions, and where Customer Personal Data is transferred to a country that requires a transfer mechanism, the parties will cooperate in good faith to implement an appropriate transfer mechanism where required. Such mechanism may include:

• ·Standard Contractual Clauses;
• ·a UK International Data Transfer Addendum;
• ·an equivalent transfer addendum;
• ·customer-specific transfer terms;
• ·additional technical or organizational safeguards; or
• ·another lawful transfer mechanism recognized under applicable Data Protection Laws.

Any such transfer mechanism should be documented in an enterprise agreement, written amendment, order form, transfer addendum, or customer-specific DPA amendment where required.

5. No Automatic Transfer Certification

Re-Doc does not claim that the Services are certified under any specific international transfer, privacy, security, healthcare, financial, or regulatory framework unless expressly stated in a signed written agreement.

Re-Doc does not claim GDPR certification, DPDP certification, ISO 27001 certification, SOC 2 certification, HIPAA certification, or similar certification unless such certification has been formally obtained and expressly published or agreed in writing.

6. Customer-Specific Processing Terms

Customer and Re-Doc may agree to customer-specific data processing terms through a signed enterprise agreement, order form, statement of work, DPA amendment, transfer addendum, or other written agreement. Customer-specific terms may include:

• ·shorter retention periods;
• ·immediate deletion workflows;
• ·custom deletion schedules;
• ·regional processing restrictions;
• ·restrictions on AI providers or models;
• ·restrictions on OCR providers;
• ·restrictions on document conversion providers;
• ·dedicated infrastructure;
• ·encryption requirements;
• ·no-analytics configurations;
• ·specific subprocessor exclusions;
• ·breach notification timelines;
• ·audit procedures;
• ·Standard Contractual Clauses or other transfer mechanisms;
• ·regulated industry requirements;
• ·custom security obligations;
• ·confidentiality requirements;
• ·custom support commitments;
• ·customer-managed review procedures;
• ·modified liability or indemnity terms.

7. Written Agreement Required

Customer must notify Re-Doc in writing before using the Services for any workflow requiring legal, regulatory, security, technical, contractual, regional, or compliance controls beyond Re-Doc's standard Services and published documentation.

Re-Doc is not obligated to provide custom controls, restricted processing, dedicated infrastructure, specific provider routing, specific model routing, specific regional processing, encryption requirements, industry-specific compliance commitments, or regulated deployment terms unless expressly agreed in writing.

8. Order of Precedence

If there is a conflict between this Annex and a signed enterprise agreement, order form, DPA amendment, transfer addendum, or customer-specific written agreement, the signed written agreement will control to the extent of the conflict.

If there is a conflict between this Annex and the main body of the DPA, the main body of the DPA will control unless the Annex expressly states otherwise or is modified by a signed written agreement.