DATA PROCESSING ADDENDUM (DPA)

Document: TC-OPT-COM-DPA Version: 1.0 Effective date: June 18, 2026 Site: https://optique.tinycio.com

This Addendum applies where, in providing the Services, TinyCIO Inc. ("Processor") processes personal data on behalf of a business Subscriber ("Controller"). It forms part of the Terms of Service (TC-OPT-COM-TOS-MAIN). It is intended to support GDPR (Art. 28) and CCPA/CPRA "service provider" requirements.

1. Roles and scope

1.1. For personal data submitted to the Services by the Controller ("Subscriber Data"), the Controller is the controller/business and TinyCIO is the processor/service provider. The Controller determines the purposes and means; TinyCIO processes Subscriber Data only on documented instructions, including those in the Terms and this Addendum.

1.2. CCPA/CPRA. TinyCIO will not sell or share Subscriber Data, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than performing the Services, and will not combine it with other data except as permitted by the CCPA.

2. Subject matter and details

Subject matter: provision of the Services. Duration: term of the Terms. Nature/purpose: hosting, support, development, and related processing. Data subjects: Controller's personnel, subscribers, and contacts. Data types: identification and contact data and any data the Controller chooses to submit; no special-category data unless agreed in writing.

3. Obligations of TinyCIO (Processor)

• process only on documented instructions; notify if an instruction infringes applicable law;
• ensure persons authorized to process are bound by confidentiality;
• implement appropriate technical and organizational security measures (Art. 32 GDPR): access control, encryption in transit and at rest where feasible, backups, logging, and resilience;
• assist the Controller, taking into account the nature of processing, with data-subject requests and with security, breach notification, and impact assessments;
• notify the Controller without undue delay after becoming aware of a personal-data breach;
• at the Controller's choice, delete or return Subscriber Data at the end of the Services, subject to legal retention.

4. Subprocessors

The Controller authorizes TinyCIO to engage subprocessors (cloud infrastructure, payment, accounting) under written terms providing protection consistent with this Addendum. TinyCIO remains responsible for subprocessors' performance and will inform the Controller of intended changes, allowing reasonable objection.

5. International transfers

Where Subscriber Data of EEA/UK data subjects is transferred outside the EEA/UK, the parties will rely on a valid transfer mechanism (e.g., the EU Standard Contractual Clauses and the UK Addendum), incorporated by reference where applicable.

6. Audits

TinyCIO will make available information reasonably necessary to demonstrate compliance and will allow audits (including inspections) by the Controller or its mandated auditor, on reasonable notice, no more than once per year unless required by a supervisory authority, subject to confidentiality and TinyCIO's security policies.

7. Liability

The liability of the parties under this Addendum is subject to the limitations of liability in the Terms of Service.

Special-category data (optical). Subscriber Data may include vision, prescription, or health data of the optical store's customers, which can be sensitive/special-category data. The Subscriber (controller) must ensure a valid legal basis (e.g., explicit consent), and the Provider applies enhanced safeguards when processing it.

Legal notice. Template to support Art. 28 GDPR and CCPA service-provider terms. For high-volume EEA processing, attach the current EU SCCs and a security-measures schedule. Not legal advice.