DATA PROCESSING ADDENDUM

Effective Date: August 20, 2026

This Data Processing Addendum (this “DPA”) is the standard form published by GenLogs Corporation. This DPA is incorporated by reference into each Master Subscription Agreement between GenLogs and its customers, unless the parties expressly agree to a modified version in a signed amendment. GenLogs may update this DPA from time to time; GenLogs will provide reasonable advance notice of any material update, and no update will materially diminish the protections afforded to Customer Personal Information under this DPA.

This DPA is incorporated into and forms part of the Master Subscription Agreement (the “Agreement”) between GenLogs Corporation (“GenLogs” or “Service Provider”) and the entity that has entered into the Agreement with GenLogs (“Customer” or “Business”). This DPA governs GenLogs’ processing of Customer Personal Information on behalf of Customer in connection with the Service.

For purposes of applicable U.S. state privacy laws, Customer is the “Business” (the entity that determines the purposes and means of processing) and GenLogs is the “Service Provider” (the entity that processes Customer Personal Information on behalf of the Business). In jurisdictions that use the terms “controller” and “processor,” those terms correspond to Business and Service Provider, respectively.

Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement.

1. Definitions

“Applicable Privacy Laws” means all U.S. federal and state laws and regulations applicable to the processing of personal information, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and any other applicable state privacy law.

“Customer Personal Information” means Personal Information furnished by Customer to or processed by GenLogs on behalf of Customer.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined under Applicable Privacy Laws.

“Process” or “Processing” means any operation performed on Customer Personal Information, including collection, recording, storage, retrieval, use, disclosure, transfer, or deletion.

“Sensitive Personal Information” means Customer Personal Information that is classified as “sensitive” under Applicable Privacy Laws, including precise geolocation data, financial account information, and any other categories specified under CCPA §1798.140(ae).

“Subprocessor” means a third party engaged by GenLogs to process Customer Personal Information on behalf of Customer.

2. Scope and Purpose of Processing

GenLogs will process Customer Personal Information solely for the purpose of providing the Service to Customer as described in the Agreement and the applicable Order Form (the “Business Purpose”). GenLogs will not:

  1. Sell Customer Personal Information, as defined under Applicable Privacy Laws

  2. Share Customer Personal Information for cross-contextual behavioral advertising or targeted advertising

  3. Retain, use, or disclose Customer Personal Information for any purpose other than the Business Purpose, as expressly authorized by Customer in writing, or as otherwise permitted by Applicable Privacy Laws

  4. Retain, use, or disclose Customer Personal Information outside of the direct business relationship between GenLogs and Customer, except as expressly authorized by Customer in writing

  5. Combine Customer Personal Information received from Customer with Customer Personal Information received from other sources, except as permitted by Applicable Privacy Laws to perform the Business Purpose. For clarity, business contact information that Customer or motor carriers make available for use in the Service is governed by the applicable customer agreement and the GenLogs Platform Contact Use Terms

3. Customer Obligations

Customer represents and warrants that: (a) it has provided all necessary notices and obtained all necessary consents or authorizations required under Applicable Privacy Laws for the disclosure of Customer Personal Information to GenLogs; (b) the processing instructions it provides to GenLogs comply with Applicable Privacy Laws; and (c) it has a lawful basis for the collection and processing of Customer Personal Information shared with GenLogs.

4. Security

GenLogs will implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Personal Information against unauthorized access, destruction, use, modification, or disclosure. Such safeguards will be no less protective than industry standards for similar types of information and will include, at a minimum:

  1. Encryption of Customer Personal Information in transit and at rest

  2. Access controls limiting access to Customer Personal Information to personnel with a legitimate need

  3. Regular security assessments and vulnerability testing

  4. Incident response procedures

5. Subprocessors

5.1 Authorization

Customer grants GenLogs general authorization to engage Subprocessors to process Customer Personal Information on behalf of Customer, subject to the requirements of this Section 5.

5.2 List and Notice

GenLogs maintains a current list of Subprocessors and will provide such list to Customer upon written request. GenLogs will provide notice of any change to the Subprocessor list at least thirty (30) days before engaging a new Subprocessor or replacing an existing Subprocessor, by email to Customer’s notice address under the Agreement.

5.3 Objection

If Customer objects to a new Subprocessor on reasonable grounds related to data protection, Customer must notify GenLogs in writing within fifteen (15) days of receiving notice. The Parties will work in good faith to resolve Customer’s concerns. If the Parties are unable to resolve the objection within thirty (30) days, Customer may decline to receive any new Services or Service features that require the use of the Subprocessor to which Customer has objected. Customer’s existing Services and the term of the Agreement shall continue in effect.

5.4 Subprocessor Obligations

GenLogs will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than those in this DPA. GenLogs is responsible to Customer for the acts and omissions of its Subprocessors to the same extent GenLogs would be responsible if performing the services directly.

6. Data Subject Rights

GenLogs will provide reasonable cooperation and assistance to Customer in responding to requests from individuals exercising their rights under Applicable Privacy Laws, including rights of access, deletion, correction, and opt-out. GenLogs will promptly notify Customer if GenLogs receives a request directly from an individual, unless prohibited by law.

7. Security Incident Notification

GenLogs will notify Customer without undue delay, and in any event within seventy-two (72) hours, upon becoming aware of any unauthorized access to, or acquisition, use, or disclosure of, Customer Personal Information processed under this DPA (“Personal Information Security Incident”). The notification will include, to the extent known: (a) the nature of the Personal Information Security Incident; (b) the categories and approximate number of Customer’s individuals affected; (c) the likely consequences; and (d) the measures taken or proposed to address the Personal Information Security Incident.

GenLogs will cooperate with Customer in investigating and remediating the Personal Information Security Incident, including providing reasonable assistance with Customer’s notification obligations under Applicable Privacy Laws.

8. Audit

Upon Customer’s reasonable written request, and no more than once per year unless a Personal Information Security Incident has occurred, GenLogs will make available to Customer information necessary to demonstrate compliance with this DPA. This may include provision of GenLogs’ then-current SOC 2 report, as available, responses to a reasonable security questionnaire, or, where such measures are insufficient, a third-party audit at Customer’s expense, subject to reasonable scope limitations and advance notice.

9. Data Retention and Deletion

Upon termination or expiration of the Agreement, GenLogs will, at Customer’s election, return or delete all Customer Personal Information processed on behalf of Customer within thirty (30) days of receiving Customer’s written instructions, except to the extent that retention is required by applicable law. If the Parties are engaged in good-faith negotiation of a renewal at the time of expiration, the Parties may agree in writing to defer return or deletion until the earlier of the conclusion of those negotiations or a date the Parties specify. GenLogs will provide written certification of deletion upon request. Notwithstanding the foregoing, GenLogs may retain Customer Personal Information in routine backups, archives, and disaster-recovery systems for the duration of GenLogs’s standard backup retention period. Such retained Customer Personal Information will remain subject to the protections of this DPA and will be deleted in the ordinary course of backup rotation.

10. API-Specific Provisions

Notwithstanding the general scope of this DPA, this Section 10 applies to all Personal Information transferred from GenLogs to Customer through the Service, including Personal Information that GenLogs collects directly or otherwise originates and makes available to Customer. Where Customer accesses the Service or otherwise receives an export of data from GenLogs (including via PDF or file download), Personal Information may be transferred from GenLogs’ systems to Customer’s environment. Once Personal Information is transferred to Customer, Customer assumes responsibility for the security and handling of such data in Customer’s systems. GenLogs’ obligations under this DPA apply to Personal Information while it is in GenLogs’ possession or control, including during transmission to Customer. Customer is responsible for ensuring that its systems meet appropriate security standards for the protection of Personal Information received from GenLogs.

11. Compliance

GenLogs certifies that it understands its obligations under this DPA and Applicable Privacy Laws and will comply with them. If GenLogs determines that it can no longer meet its obligations under this DPA, GenLogs will promptly notify Customer in writing. Customer has the right to take reasonable and appropriate steps to ensure that GenLogs uses Customer Personal Information in a manner consistent with Customer’s obligations under Applicable Privacy Laws.

12. Sensitive Personal Information

To the extent GenLogs processes Sensitive Personal Information on behalf of Customer (including precise geolocation data), GenLogs will process such information solely for the Business Purpose and will apply heightened security measures appropriate to the sensitivity of the data. GenLogs will not use Sensitive Personal Information for any purpose beyond what is necessary to perform the Service.

13. General

This DPA is subject to the terms of the Agreement, including its limitation of liability and governing law provisions. In the event of a conflict between this DPA and the Agreement on matters relating to data processing, this DPA controls. This DPA will automatically terminate upon termination of the Agreement, subject to the data deletion obligations in Section 9.