ZNAPP!

WAYSIGHTS INC. / ZNAPP!™ END USER LICENSE AGREEMENT (EULA) Last updated: January 1, 2026 This End User License Agreement ("EULA") governs access to and use of the Waycam™ mobile application, the Wayboard™ web/desktop portal, and related services (collectively, the "Services") provided by Waysights Inc., operating under the business names Waysights™ and ZNAPP!™ (collectively, the "Company"). By installing, accessing, or using the Services, you ("User" or collectively "Users") agree to be bound by this EULA. If you do not agree, do not install, access, or use the Services. 1. Parties, scope, and definitions 1.1 The Company. The provider of the Services is Waysights Inc., an Ontario corporation, operating under the business names Waysights and ZNAPP!. The Company’s principal place of business is 12-111 Fourth Ave, Suite 369, St. Catharines, ON L2S 3P5, Canada. References to "Company" in this EULA refer to Waysights Inc. and both of its operating names collectively. 1.2 User definitions. "Customer" means the entity (business, government, or organization) that has a written agreement with the Company to access and use the Services, or that is authorized to use the Services under a Trial or evaluation arrangement. A Customer may be: A municipality or other public body. A channel partner, reseller, or third-party service provider that has contracted with the Company to deliver or resell services. The Company itself (for purposes of engaging independent contractor drivers or for demo/marketing use). "User" means any individual natural person who accesses or uses the Services. "Authorized User" means a User whom a Customer authorizes to use the Services under the Customer’s account and to whom the Company (at the Customer’s direction) has provisioned unique credentials. A Customer is responsible for all use of the Services by its Authorized Users. 1.3 The Services. The Services consist of: Wayboard™: a hosted web/desktop portal providing dashboard access, analytics, roadway data visualization, and customer account management. Waycam™: a mobile application for on-device roadway imagery capture, geolocation data collection, device calibration, and in-app routing. Related APIs, backend infrastructure, and support services as made available by the Company. The Services are provided in the following principal use cases: 1.4 Territory. The Services may be used only within Canada and the United States of America. Any use from or within other jurisdictions is prohibited and constitutes a material breach. 1.5 Business / non-consumer use. Each Customer and User represents and warrants that the Services are used solely in a business, governmental, or independent-contractor capacity, and not as a consumer. 2. Relationship to other agreements 2.1 Primary governing agreement. Where a Customer has executed a separate master services agreement, SaaS agreement, purchase order, independent contractor agreement, or other written contract with the Company (an "MSA"), the MSA governs the commercial relationship and specific terms for that Customer. In any direct conflict between this EULA and the MSA: For municipalities and channel partners: the MSA controls. For ZNAPP! independent contractors: the Independent Contractor Agreement controls for overlapping subject matter; this EULA controls for software access and use. For Trials without an MSA: this EULA is the primary governing document. 2.2 EULA applicability. This EULA applies to all use of the Services, supplementing (not replacing) any MSA or Independent Contractor Agreement. 3. License grant and seat limits 3.1 License grant. Subject to compliance with this EULA and any applicable MSA or Independent Contractor Agreement, the Company grants each Customer a limited, revocable, non-exclusive, non-transferable license to: permit its Authorized Users to install and use one instance of Waycam™ on a single compatible mobile device per Authorized User; and permit its Authorized Users to access Wayboard™ via browser or supported desktop client; in each case for the purposes specified in the Customer’s agreement with the Company or, if no agreement exists, for evaluating the Services during a Trial. 3.2 Seat / user limits. ZNAPP!™ independent contractor drivers. Each independent-contractor User may install and use Waycam™ only on one personal device at a time, under one User account, and solely to perform authorized data-collection services for the Company.​ Municipality and channel-partner Customers. Unless otherwise specified in an MSA or order form: Customer is entitled to one (1) Authorized User at the start of the engagement. Additional Authorized Users require a separate written amendment or order. Sharing credentials among multiple Users is prohibited; each Authorized User must use unique credentials. Demonstration and marketing use. The Company’s officials, employees, and authorized channel partners may use Waycam™ and Wayboard™ for product demonstrations, internal training, and marketing purposes, subject to the Company’s internal policies. 3.3 Territorial restriction. All Users may access and use the Services only from within Canada or the USA; use from or within embargoed or sanctioned countries or by sanctioned parties is prohibited (see Section 17). 3.4 Reservation of rights. The Services are licensed, not sold, and the Company and its licensors reserve all rights not expressly granted. 4. Prohibited uses Customer and all Users must not: use the Services for consumer or purely personal purposes; copy, modify, adapt, translate, create derivative works of, reverse engineer, decompile, or disassemble the Services except as required by law; circumvent technical measures, usage limits (including any Trial kilometre/mile limits), or security controls; rent, lease, sublicense, resell, or otherwise commercially exploit the Services, except as expressly allowed in an MSA; use the Services to build a competing product or service or for benchmarking beyond what an MSA permits; upload or transmit malicious code or interfere with the integrity or performance of the Services. Customer must ensure that its Authorized Users comply with these restrictions. 5. Trials and freemium use 5.1 Definition. "Trial" means any free, discounted, or evaluation access to the Services provided without a fully executed MSA or Independent Contractor Agreement, including “freemium” offerings. 5.2 10 km Trial limit. During a Trial, Customer must ensure that its Authorized Users do not use Waycam™ to capture more than 10 km/6.2 mile total of driving distance, as measured by an odometer-like GPS-based metric within Waycam™. The Company may automatically disable Waycam™ once this limit is reached. 5.3 No production or safety-critical use. Trial access is provided solely to evaluate the Services’ functionality. Customer and Users must not use Trial-generated data for production operations, regulatory filings, or safety-critical decisions. 5.4 Circumvention is breach. Any attempt by Customer or its Users to circumvent Trial limits (including tampering with GPS, spoofing location, or similar) is a material breach and permits immediate suspension or termination. 5.5 Trials “as is” and no liability. Trials are provided “as is” and “as available,” with no warranties and, to the fullest extent permitted by law, no liability of the Company of any kind to Customer or any User. 6. Data captured and processing 6.1 Captured Data. The Services may capture and process: roadway imagery; GPS traces, timestamps, speed, and accelerometer/telematics data; EXIF data produced by the device (which may vary by model); device diagnostics and calibration data; metadata required for account, routing, and analytics purposes. 6.2 Faces and license plates. Roadway imagery may incidentally capture faces or license plates. The Company operates a secondary redaction process intended to de-identify such personal information before data is presented to end users, but cannot guarantee that all personal information is always removed. 6.3 Navigation features. Waycam™ provides routing or navigation-type features to assist in data-collection assignments, but these are not a primary navigation or safety system and must not be relied on as such. Customer and Users remain solely responsible for route choices and safe driving. 7. Ownership of data and IP 7.1 Ownership of Services. The Company and its licensors own all rights, title, and interest in and to the Services, including all software, interfaces, algorithms, models, analytics, documentation, and trademarks (including Waycam™ and Wayboard™). 7.2 IP assignment of Captured and Derived Data. To the maximum extent permitted by law, Customer and each User assign to the Company all rights, title, and interest in and to: all images and other data captured via the Services (“Captured Data”); and all scores, assessments, analytics, models, derivative works, and other outputs generated from or using Captured Data (“Derived Data”). Customer will ensure that it has obtained all necessary assignments or rights from its Authorized Users and any other contributors. 7.3 License back for municipalities and channel partners. Where Customer is (a) a municipality or other public entity, or (b) a channel partner or reseller delivering services to an end-customer using the Services, the Company grants Customer a perpetual, non-exclusive, non-transferable, non-sublicensable license to use Captured Data and Derived Data: solely for non-commercial purposes and only to the extent necessary to perform or document the specific project or scope of work for which the data was collected under the applicable agreement; and not for resale, licensing, or sharing with any third party for that third party’s independent commercial use. For clarity, channel partners and resellers may not use Captured Data or Derived Data to build or offer competing products or analytics services or to service unrelated customers. 7.4 Contractor drivers’ use. ZNAPP! independent-contractor Users obtain no ownership or license in Captured Data or Derived Data for their own purposes. They may use such data solely to perform contracted services for the Company and must delete any local copies immediately upon request.​ 7.5 Retention and reuse. The Company may retain and use Captured Data and Derived Data indefinitely for analytics, product improvement, model training, and any other lawful business purpose, subject to applicable privacy laws and this EULA. 7.6 De-identified and aggregated data. The Company may create and freely use de-identified or aggregated data derived from Customer’s use of the Services for any business purpose, including benchmarking, research, and product development. 8. Privacy and data protection 8.1 Privacy Policy. Personal data processed through the Services is handled in accordance with the Company’s Privacy Policy at www.waysights.com/terms, which is incorporated by reference. 8.2 GDPR-style rights (contractual only). The Company may, at its discretion and where technically feasible, honor reasonable requests from data subjects (such as access, correction, or deletion of personal data), but has no obligation to do so where required logs or identifiers do not exist, where responding would compromise security or proprietary information, or where data is de-identified or aggregated. 8.3 Cross-border transfers. Customer consents to the transfer and processing of personal data between Canada and the USA, and in any other locations where the Company or its subprocessors maintain facilities, subject to applicable law. 8.4 Redaction responsibility and local law. The Company will operate reasonable redaction processes to de-identify faces and license plates in Captured Data, but Customer remains responsible for complying with any surveillance, privacy, or records-retention laws that apply to Customer’s own operations beyond the basic PII redaction provided by the Company. 8.5 Data Processing Addendum. Where the Company processes Customer Personal Data (as defined in the Company’s Data Processing Addendum) on behalf of a Customer, it does so as a processor and the Waysights Data Processing Addendum (DPA) available at www.waysights.com/terms is incorporated by reference into the applicable agreement between the Company and that Customer. 9. Safety, driving, and eligibility 9.1 Driving responsibility. Customer and Authorized Users are solely responsible for: safe operation of vehicles; compliance with all traffic and road-safety laws; avoiding distraction while driving, including using mobile devices only in a lawful hands-free manner; ensuring any phone mounts, power supplies, or accessories comply with local laws. 9.2 Licensing and MVR. Any User operating a vehicle while using the Services must: be of legal driving age in the applicable jurisdiction; hold a valid driver’s license; not have disqualifying violations on their motor vehicle record as defined by the Company or applicable law. 9.3 Insurance. Customer is responsible for maintaining all required vehicle liability insurance and complying with its insurer’s disclosure obligations. The Company does not provide auto insurance and is not an insurer or broker. 10. Support, uptime, and updates 10.1 Support. For non-Trial Customers, the Company will use reasonable efforts to provide technical support for the Services, subject to any more specific service levels in an MSA. 10.2 Updates. The Company may provide patches, updates, or new versions of the Services, which may be installed automatically or require Customer action; such updates are part of the Services and subject to this EULA. 10.3 Service changes. The Company may modify or discontinue features of the Services at any time, provided that material adverse changes for paying Customers are handled in accordance with any applicable MSA. 11. Term, suspension, and termination 11.1 Term. This EULA applies from the earliest of installation, access, or use of the Services and continues until terminated as set out here. 11.2 Suspension/termination by the Company. The Company may immediately suspend or terminate access if: Customer or a User violates law or this EULA; the Company suspects fraud, abusive or unsafe use, or security risk; use occurs outside the authorized Territory; an applicable MSA or Independent Contractor Agreement terminates; or required by law or governmental order. 11.3 Effect on Waycam™ and Wayboard™. Access to Waycam™ terminates on the effective date of contract termination or suspension (or earlier for Trials). Subject to any contrary MSA terms, Customer may retain access to Wayboard™ for up to three (3) months after contract termination solely to self-serve export data using available tools, at Customer’s own cost and effort. The Company will not provide migration services unless separately agreed. Customer may request earlier removal of access in writing. 11.4 Post-termination data use. Previously collected Captured Data and Derived Data remain the Company’s property, subject to any municipal or channel-partner license under Section 7.3, and may continue to be used as described in this EULA. 12. App stores and third-party components 12.1 App stores. Where obtained via Apple App Store or Google Play, Customer acknowledges that the app store provider is not a party to this EULA, has no responsibility for the Services, and is a third-party beneficiary only to the extent required by its own terms. 12.2 Third-party terms. The Services may incorporate or integrate third-party software, APIs, and services; applicable third-party terms or notices may be provided within the Services or on the Company’s website and are passed through to Customer as required. 13. Publicity and benchmarking 13.1 Name and logo use. Customer grants the Company a non-exclusive, worldwide license to use Customer’s name and logo in customer lists and on the Company’s websites and marketing materials, and as part of non-detailed public references to Customer’s use of the Services. 13.2 Aggregated statistics and cooperative procurement. The Company may publish anonymized and aggregated statistics derived from all customers’ use of the Services and may seek support or endorsements from municipal Customers for cooperative procurement entities, where permitted by Customer policy. 14. Warranties and disclaimers 14.1 General disclaimer. Except as expressly set out in an applicable MSA, the Services are provided “as is” and “as available,” and the Company disclaims all warranties and conditions, express, implied, or statutory (including fitness for a particular purpose, merchantability, and non-infringement), to the fullest extent permitted by law. 14.2 No safety or navigation warranty. The Services are not a safety, collision-avoidance, emergency, or primary navigation system and must not be relied on as such. 14.3 No data accuracy guarantee. The Company does not warrant that any Captured Data or Derived Data is complete, accurate, or suitable for any specific legal, regulatory, or engineering purpose, and Customer is responsible for validating results before relying on them. 15. Limitation of liability 15.1 Exclusion of certain damages. To the fullest extent permitted by law, neither the Company nor its affiliates, officers, employees, or contractors will be liable for any:​ indirect, incidental, special, consequential, or punitive damages; loss of income, profits, revenue, goodwill, or data; business interruption; arising out of or relating to the Services or this EULA, even if advised of the possibility of such damages.​ 15.2 Liability cap for paid contracts. For Customers under a paid contract (other than Trials), the total aggregate direct liability of the Company arising from or relating to the Services or this EULA will not exceed the amount of compensation actually paid by Customer to the Company under this EULA in the twelve (12) months immediately preceding the event giving rise to the claim.​ 15.3 Trials (no liability). For all Trials, the Company will have no liability of any kind to Customer or any User, to the fullest extent permitted by law. 15.4 Carve-outs. The above limitations do not apply where prohibited by applicable law, including for liability that cannot be excluded for intentional misconduct or, where mandatory, for death or personal injury caused by proven negligence.​ 16. Indemnity Customer (including any municipality, channel partner, or reseller) will defend, indemnify, and hold harmless the Company and its affiliates, officers, employees, and contractors from and against any claims, damages, losses, and expenses (including reasonable legal fees) arising from or related to: driving activities, collisions, tickets, or violations occurring while any User uses the Services on Customer’s behalf; any breach of this EULA or applicable law by Customer or its Authorized Users, including those employed or engaged by any channel partner or reseller; misuse of the Services or unauthorized use, disclosure, or sharing of Captured Data or Derived Data; Customer’s failure (or the failure of its channel partners or resellers) to maintain required insurance or valid licensing; any claim that Customer’s or its partners’ data, instructions, or configurations infringe or violate a third party’s rights. 17. Export control and sanctions Customer represents and warrants that it is not: located in, or a resident of, any country subject to comprehensive Canadian or U.S. embargoes or sanctions; or listed on any Canadian or U.S. government denied-party or sanctions list. Customer must not access or use the Services in violation of any applicable Canadian or U.S. export control or sanctions laws. 18. Dispute resolution, arbitration, and class-action waiver 18.1 Governing law. This EULA and any disputes arising from it are governed by the laws of the Province of Ontario, Canada, without regard to conflict-of-laws principles.​ 18.2 Arbitration. Except where Customer is a governmental entity governed by a separate master services agreement with its own dispute-resolution clause, any dispute, controversy, or claim arising out of or relating to this EULA or the Services will be resolved by binding arbitration before a mutually agreed arbitration provider in Ontario, Canada, conducted in English, pursuant to the rules applicable to that provider.​ 18.3 Class-action waiver. To the fullest extent permitted by law, all proceedings will be conducted solely on an individual basis, and not in a class, consolidated, or representative action. Customer and all Users waive any right to participate as a class representative or member in any class, collective, or consolidated claim related to the Services.​ 18.4 Injunctive relief. Nothing in this EULA prevents the Company from seeking temporary, preliminary, or permanent injunctive relief or other equitable remedies in a court of competent jurisdiction to protect its intellectual property, confidential information, or prevent misuse of the Services, without needing to prove irreparable harm or post a bond beyond any non-waivable minimum. 19. Changes to this EULA The Company may update this EULA from time to time. The current version will always be posted at: www.waysights.com/terms; and www.znapp.app/terms. Updated terms are effective upon posting, and continued use of the Services after posting constitutes acceptance of the updated EULA. 20. Miscellaneous Entire agreement. This EULA, together with any applicable MSA, order, or Independent Contractor Agreement, constitutes the entire agreement regarding the Services.​ Severability. If any provision is held invalid, the remaining provisions remain in full force, and the invalid provision will be replaced by an enforceable provision that most closely reflects the original intent.​ Assignment. Customer may not assign this EULA without the Company’s prior written consent. The Company may assign or transfer this EULA as part of a corporate transaction or reorganization. Language. This EULA is in English only. All communications with the Company must be in English. Trademarks. Waycam™ and Wayboard™ are trademarks of Waysights Inc. All other trademarks are the property of their respective owners. Use Case | Primary Users | Key Services Used Municipality self-serve data collection | Municipal Customers and their Authorized Users (staff) | Waycam™ for data capture; Wayboard™ for viewing/analyzing captured data ZNAPP!™ fleet data collection | Independent contractor drivers engaged by the Company under the ZNAPP! brand | Waycam™ for capture; results accessible via Wayboard™ to Customers Demonstration and marketing | Company officials, employees, and authorized channel partners | Waycam™ and Wayboard™ for demos, training, and marketing

WAYSIGHTS INC. DATA PROCESSING ADDENDUM (DPA) Last updated: January 1, 2026 This Data Processing Addendum (“DPA”) is between Waysights Inc., operating under the business names Waysights™ and ZNAPP!™ (the “Company”), and the customer identified in the applicable master services agreement, order form, or other written agreement (the “Customer”). This DPA forms part of, and is subject to, the agreement between the Company and the Customer that references this DPA (the “Agreement”), such as the Company’s Master Services Agreement (MSA) and any related orders. 1. Scope, roles, and relationship 1.1 Application of this DPA. This DPA applies only where and to the extent the Company processes Customer Personal Data on behalf of the Customer in connection with paid Services under the Agreement. It does not apply to free/Trial use or where the Company acts as an independent controller. 1.2 Controller and processor. For the purposes of this DPA and applicable data protection laws: The Customer acts as controller (or equivalent) of Customer Personal Data; and The Company acts as processor (or equivalent) on behalf of the Customer when providing the Services. 1.3 Independent controller data. The Company acts as independent controller for: Personal data relating to Company independent contractors and drivers processed under the Independent Contractor Agreement and the Company’s Privacy Policy; and De-identified, aggregated, and roadway asset data as set out in the Company’s EULA. Such processing is outside the scope of this DPA. 1.4 Conflict. If there is a direct conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA will control to the extent of that conflict. 2. Definitions For this DPA: “Customer Personal Data” means any personal data that the Company processes on behalf of the Customer in providing the Services under the Agreement, limited to the categories described in Section 3. “Data Protection Laws” means any applicable laws relating to the protection of personal data in Canada and the United States that apply to the processing under this DPA. “Services” means the Company’s hosted applications and related services, including Waycam™ and Wayboard™, as described in the Agreement and EULA. Terms not defined in this DPA have the meaning given in the Agreement or the EULA. 3. Subject matter and categories of Customer Personal Data 3.1 Purpose and subject matter. The Company processes Customer Personal Data only for the purpose of providing the Services to the Customer and performing its obligations under the Agreement, and not for its own independent purposes unless expressly permitted by the Agreement. 3.2 Categories of data subjects. Customer Personal Data may relate to: Customer’s employees, officers, and other staff who access Wayboard™ or are otherwise designated as contacts. Individuals whose personal data is incidentally captured in roadway imagery as described below (e.g., faces and license plates). 3.3 Categories of Customer Personal Data. The parties acknowledge that Customer Personal Data processed by the Company as processor is limited to the following categories, to the extent provided by or on behalf of Customer: Customer staff account and contact data: Names, work email addresses, work phone numbers, job titles/roles, and similar identifiers. Authentication and account identifiers used for Wayboard™ or related Services. Audit metadata such as timestamps and records of actions taken within the Services by named users. Incidentally captured imagery personal data: Faces and license plates that may be captured incidentally in roadway imagery collected using Waycam™ before the Company’s redaction process is applied. Other customer-submitted data: Any other personal data that Customer uploads or otherwise makes available to the Company in connection with the Services, to the extent reasonably necessary for the Company to perform the Services (for example, imports or configuration files that include contact fields). The parties do not intend for Customer to transmit special or sensitive categories of personal data (such as health or financial account data) via the Services. 4. Processing instructions 4.1 Customer instructions. The Company will process Customer Personal Data only: On documented instructions from the Customer, as set out in this DPA and the Agreement, and As necessary to provide, maintain, and support the Services. 4.2 Permitted processing. The Customer instructs the Company to process Customer Personal Data: To provide the Services and related support, including storage, back-ups, logging, monitoring, and security; To implement configuration and usage requested by the Customer; To prevent or address technical or security issues; and As required to comply with applicable law. If the Company is required by law to process Customer Personal Data in a manner inconsistent with Customer’s instructions, it will notify the Customer (unless legally prohibited). 5. Sub-processors 5.1 Use of sub-processors. The Customer authorizes the Company to engage third parties (“Sub-processors”) to process Customer Personal Data in connection with the Services, provided the Company: Ensures each Sub-processor is bound by written obligations providing at least the level of protection for Customer Personal Data required by this DPA; and Remains responsible for the performance of each Sub-processor’s obligations. 5.2 Current infrastructure and locations. The Customer acknowledges that the Company currently uses Amazon Web Services (AWS) cloud infrastructure located in Canada and the United States of America to host and process Customer Personal Data. 5.3 Sub-processor disclosure. Upon written request, the Company will provide the Customer with a confidential list of material Sub-processors involved in the processing of Customer Personal Data, subject to reasonable confidentiality restrictions. 5.4 Objections. If the Company adds or replaces a material Sub-processor and the Customer has a reasonable, documented basis to believe that the change would materially increase risk to Customer Personal Data, the Customer may object in writing. The parties will work in good faith to resolve the objection. If a mutually acceptable solution cannot be reached, the Customer’s sole remedy will be to terminate the affected Services in accordance with the Agreement. 6. Security 6.1 Security measures. The Company will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the data and the risks of processing. 6.2 Minimum controls. At a minimum, such measures will include: Access controls limiting access to Customer Personal Data to personnel with a legitimate need-to-know, using authenticated, individual accounts for administrative access. Encryption in transit and at rest for Customer Personal Data stored in production systems hosted on AWS. Use of reputable cloud infrastructure (AWS) in Canada and the USA with network-level protections and separation of environments. The Customer is responsible for configuring the Services and managing its own users and access rights in accordance with the Agreement and EULA. 7. Data subject requests 7.1 Customer responsibility. The Customer is responsible for receiving and validating any requests from data subjects relating to their personal data (such as access, correction, or deletion requests) under applicable law. 7.2 Company assistance. To the extent a data subject request relates to Customer Personal Data processed by the Company as processor, the Customer may submit a written request for assistance to legal@waysights.com. The Company will provide reasonable assistance to the Customer in addressing such requests, taking into account the nature of the processing and the information available to the Company, but does not commit to a strict response timeframe. 7.3 Limitations. If the Company cannot technically identify the data subject within its systems, or if responding would compromise the security of the Services, other individuals’ rights, or the Company’s legitimate interests, the Company may explain such limitations to the Customer and is not required to take further action. 8. Retention, deletion, and return 8.1 Retention during the Agreement. The Company may retain Customer Personal Data for as long as necessary: To provide the Services; To comply with legal obligations; or To resolve disputes and enforce the Agreement. 8.2 Post-termination deletion or anonymization. After the Agreement has expired or been terminated, upon the Customer’s written request, the Company will delete or anonymize Customer Personal Data within ninety (90) days, except to the extent the Company is required by law to retain certain data or is otherwise permitted to retain it for legitimate legal or business purposes. 8.3 Back-ups. The Customer acknowledges that Customer Personal Data may be stored in routine back-up systems. Such back-ups are not modified on a per-Customer basis. Any Customer Personal Data contained in back-ups will be overwritten in the ordinary course of backup cycles, and, if a backup is restored, the Company will apply the same deletion/anonymization commitments in this Section 8 to that environment. 9. Personal data breaches 9.1 Notification. If the Company becomes aware of a personal data breach affecting Customer Personal Data processed under this DPA, the Company will notify the Customer without undue delay and promptly after becoming aware of the breach. 9.2 Content of notification. The Company’s notification will include information the Company is reasonably able to provide at that time, such as: The nature of the incident and, where possible, the categories of data affected; The known or suspected impact; and Initial remedial measures taken or proposed. The Company may provide updates as further information becomes available. 9.3 Communication channel. The Company will send breach notifications to the primary contact designated in the Agreement or order form, or to another contact explicitly designated by the Customer for such notices. 9.4 Customer obligations. The Customer is responsible for determining whether to notify regulators, affected individuals, or other third parties and for making any such notifications, except to the extent explicitly required of the Company by applicable law. 10. International transfers 10.1 Processing locations. The Company will process and store Customer Personal Data in Canada and/or the United States of America. 10.2 No commitments outside Canada/USA. The Company does not offer or commit to compliance with foreign data-transfer regimes (such as EU GDPR cross-border transfer rules) other than as required under applicable Canadian and U.S. law. The Customer is responsible for ensuring that its use of the Services and any transfer of personal data into Canada/USA complies with laws applicable to the Customer and its data subjects. 10.3 Customer responsibility for external regimes. If the Customer chooses to export personal data from other jurisdictions into the Services, the Customer remains solely responsible for any additional safeguards or mechanisms required by those jurisdictions. 11. Audits and information 11.1 Information on request. Upon the Customer’s reasonable written request, the Company will provide information reasonably necessary to demonstrate its compliance with this DPA, which may include high-level descriptions of relevant security and privacy controls. 11.2 Audits. If the Customer is subject to regulatory or contractual requirements that necessitate further assurance, the parties may agree on the scope, method, timing, and cost allocation for any additional audit or assessment, subject to reasonable notice and confidentiality. 12. Miscellaneous 12.1 Incorporation. This DPA is incorporated into and forms part of the Agreement. References in the Agreement to the Agreement’s terms include this DPA. 12.2 Order of precedence. In the event of a direct conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA will prevail to the extent of the conflict. 12.3 Amendments. The Company may update this DPA from time to time to reflect changes in law or in the Services. The current version will be available at https://www.waysights.com/terms. Continued use of the Services after an updated DPA is posted constitutes acceptance of the updated DPA, to the extent permitted by the Agreement. 12.4 Governing law. This DPA is governed by the same law that governs the Agreement (currently the laws of the Province of Ontario, Canada, unless otherwise specified in a particular Agreement).