Partner Data Processing Addendum

Applies to: delivery partners on partners.dimelegacy.com who process client personal data in the course of assigned docket work.

Between: Dime Legacy Partners ("DLP", the "Controller") and the delivery partner named in the partner agreement (the "Processor").

Effective date: 26 August 2026

This document is an initial legal framework generated from a technical audit of the DLP platform. It is not a substitute for advice from qualified legal counsel and must be reviewed before publication. It is intended to be incorporated into, or executed alongside, the partner onboarding agreement.

1. Purpose and scope

DLP is the controller of the personal data belonging to its clients and, where relevant, HeroHR candidates. Where a delivery partner accesses, handles, or otherwise processes that personal data to carry out work assigned through a docket, the partner acts as a processor on DLP's instructions, and this Addendum sets out the terms of that processing, consistent with the Nigeria Data Protection Act 2023 (NDPA), the Ghana Data Protection Act 2012, and the Kenya Data Protection Act 2019, as applicable.

2. Nature and purpose of processing

The partner processes personal data solely to deliver the work described in the docket(s) assigned to it, for the duration of that assignment. This may include a client's reference number and the specific document, questionnaire, or brief content relevant to the assigned docket, always scoped by the platform's role-based access controls to that docket alone.

3. Processor obligations

The partner:

• Processes personal data only on DLP's documented instructions, as

reflected in the docket assignment and any specific direction from the assigned DLP lead;

• Does not use personal data obtained through a docket for any purpose

other than delivering that docket;

• Does not disclose personal data to any third party, or to a

sub-processor of its own, without DLP's prior written approval;

• Implements appropriate technical and organisational measures to protect

personal data it accesses or stores outside the platform (for example, a downloaded document), including restricting access to personnel who need it and deleting local copies once no longer needed for the engagement;

• Assists DLP, on reasonable request, in responding to a data subject

request (access, correction, or deletion) or a regulatory inquiry concerning data the partner has processed;

• Notifies DLP without undue delay, and in any event within 48 hours of

becoming aware, of any actual or suspected personal data breach involving data processed under this Addendum;

• Deletes or returns all personal data obtained through the platform on

completion of the relevant docket, or on DLP's request, except where the partner is required by law to retain it, in which case the partner will isolate and protect the data from further processing;

• Does not transfer personal data outside the jurisdiction where it was

obtained without DLP's prior written approval and appropriate safeguards.

4. Controller obligations

DLP will:

• Scope the partner's platform access to the specific docket(s) assigned,

and never disclose a client's full company name or profile to a delivery partner;

• Provide the partner with the information reasonably necessary to comply

with this Addendum;

• Remain responsible for determining the purposes and means of processing

client and candidate personal data generally.

5. Confidentiality

This Addendum does not replace, and is in addition to, the confidentiality obligation in the partner agreement and the Partner Portal Terms of Use.

6. Duration

This Addendum applies for as long as the partner has access to client or candidate personal data through the platform, and the deletion and confidentiality obligations survive the end of that access.

7. Liability

Each party is responsible for its own compliance with applicable data protection law in respect of its own role, controller or processor, as described in this Addendum, without prejudice to any liability provision in the partner agreement.

8. Governing law

This Addendum is governed by the laws of the Federal Republic of Nigeria, without prejudice to any mandatory right or obligation arising under the law of Ghana or Kenya where the underlying personal data relates to a data subject in those jurisdictions.

9. Contact

Dime Legacy Partners Email: partners@dimelegacy.com