1. Platform Description

We provide a whitelabel software platform accessible via web, mobile devices, APIs, and third-party integrations. The Platform enables Clients to:

• Manage digital data rooms

• Send email communications to third parties

• Control a branded ecosystem for content sharing

We may collect and process metadata related to device type, browser, IP address, location, and usage activity to secure and improve the Platform.

We do not create, verify, endorse, market, sell, or advise on the content uploaded or shared on the Platform, including any investment-related information.

2. Client Responsibilities

You are solely responsible for:

• All content, documents, and communications shared through your instance of the Platform

• Ensuring compliance with applicable laws, including:

  • Financial services, capital raising, and securities regulations

  • Privacy and anti-spam laws (e.g., GDPR, PECR, CAN-SPAM, Spam Act 2003)

  • Data protection and disclosure obligations for investment materials

• Obtaining all necessary rights, permissions, and consents to upload, email, or share data or documents

• Ensuring email recipients have consented or fall within a valid legal basis for receiving communications

• Publishing your own privacy policy and ensuring your network of recipients understands how their Personal Data will be processed through the Platform

3. No Investment Advice or Marketing Services

We are a technology provider only. We:

• Do not offer investment, legal, financial, or tax advice

• Do not act as a broker-dealer, underwriter, investment adviser, or placement agent

• Do not endorse, review, promote, or solicit interest in any opportunity

• Do not participate in the structuring or distribution of financial products

Any information or materials accessed through the Platform are provided by Clients, and we disclaim all responsibility for their accuracy, legality, or compliance.

4. Whitelabel Ecosystem

Each Client operates their own separate, branded environment on the Platform. You are responsible for:

• Managing user access

• Uploading content

• Sending communications

• Enforcing appropriate permissions within your ecosystem

Client administrators may access and manage all activity within their environment, including sub-users’ communications and uploaded content. SAVA P has no responsibility for supervising such activity.

5. Acceptable Use

You agree not to:

• Send unsolicited bulk emails or spam

• Upload or share false, misleading, illegal, or unauthorized content

• Infringe upon third-party intellectual property or rights

• Use the Platform to promote or facilitate unlawful investment schemes

• Bypass, disable, or interfere with Platform security features

• Engage in or facilitate fraudulent, abusive, or illegal activity, including attempts to circumvent security controls

We may suspend or terminate your account if we believe you are in violation of applicable laws or these Terms.

6. Data Privacy & Protection

Our use of personal data is governed by our Privacy Policy. By using the Platform, you consent to the collection, use, and processing of personal data as outlined in that policy.

You represent and warrant that:

• You have obtained all necessary consents to collect and share personal data via the Platform

• You will respect and enforce opt-outs and unsubscribe requests promptly

• You will not use personal data obtained from the Platform for unrelated marketing or third-party purposes

We act as a Data Processor on your behalf, and you are the Data Controller for all data uploaded or processed in your instance of the Platform.

The Platform uses cookies, log data, and similar tracking technologies to secure access, deliver functionality, and improve performance. By using the Platform, you consent to this usage, subject to your local laws.

We may rely on trusted third-party providers (e.g., storage, CRM, analytics, payment processors) to process data on our behalf. Such providers are bound by obligations equivalent to this Agreement.

7. Email Delivery

You understand that email delivery and performance may depend on recipient systems, spam filters, and behavior. We do not guarantee:

• Delivery success or open rates

• Engagement or response rates

• Compliance of your email content with spam filters or financial promotion rules

We may throttle, flag, or block campaigns that appear abusive or non-compliant.

8. Confidentiality

You agree not to reverse engineer, copy, or disclose proprietary features of the Platform to third parties.

We agree to treat all documents and data you upload as confidential and will not access them except:

• As needed to provide the service

• To troubleshoot or enforce this Agreement

• When required by law, regulation, or compulsory legal request

• To prevent fraud, abuse, or security threats, or to protect the rights, property, or safety of SAVA P, its Clients, or third parties

If we are required to disclose Content to a law enforcement agency, we will comply only as required by law.

9. Indemnity

You agree to defend, indemnify, and hold harmless the Company and its officers, directors, employees, and affiliates from and against claims, damages, fines, regulatory investigations, or expenses arising from:

• Your use of the Platform

• Your uploaded content or emails

• Violations of law (including securities, privacy, and spam laws)

• Third-party disputes or investigations

10. Disclaimer of Warranties

The Platform is provided “as is” and “as available” without warranties of any kind, including implied warranties of merchantability, fitness for a particular purpose, or non-infringement.

While we implement security measures aligned with industry standards, no method of transmission or storage is 100% secure. We disclaim any guarantee of absolute security.

We do not warrant that:

• The Platform will be uninterrupted, secure, or error-free

• Emails will be delivered or opened

• Recipients will engage or invest

• Content shared via the Platform is accurate or lawful

11. Limitation of Liability

To the maximum extent permitted by law:

• We are not liable for indirect, incidental, special, punitive, or consequential damages

• We are not liable for any investment losses, legal violations, or reputational damage

• Our total liability is capped at the total fees paid to us in the 12 months preceding the claim

12. Termination

We may suspend or terminate your access:

• For breach of this Agreement or applicable law

• If your use threatens the integrity or reputation of the Platform

• For excessive complaints, spam activity, or legal notices

Upon termination, you must cease all use of the Platform and export your data (if permitted).

13. Business Transfers

If SAVA P undergoes a merger, acquisition, restructuring, bankruptcy, or sale of assets, Client data may be transferred as part of that transaction.

14. Community Features

If we provide forums, blogs, or community features, Clients acknowledge that any information shared may be publicly accessible, even after account closure.

15. Do Not Track

The Platform does not respond to browser “Do Not Track” signals.

16. Beta Services

From time to time, we may offer access to Beta Services. You acknowledge that:

• Beta Services may contain bugs or errors and are provided “as is.”

• No guarantees are made regarding reliability, security, or availability.

• You remain responsible for compliance with laws when using Beta Services.

17. Governing Law and Jurisdiction

These Terms are governed by:

• The laws of New South Wales, Australia, if your account is registered in Australia

• The laws of England and Wales, if registered in the UK or EU

• The laws of Delaware, USA, if registered in the USA or elsewhere

Disputes shall be subject to the exclusive jurisdiction of the courts of the relevant jurisdiction.

18. Modifications

We may modify these Terms from time to time. Material changes will be notified via the Platform or email. Continued use constitutes acceptance.

19. Notices

All legal notices must be sent in writing to legal@savap.com.au.

20. Entire Agreement

These Terms, the Privacy Policy, and the Data Processing Agreement form the entire agreement between you and SAVA P.

21. Clickwrap Acceptance

By clicking “I accept” or continuing to use the Platform, you confirm you have read, understood, and agreed to these Terms.

—

Data Processing Agreement (DPA)

Effective Date: 01 July 2025

Version: 1.0

This Data Processing Agreement (“DPA”) is entered into by and between:

(1) [Client Name], a legal entity subscribing to and using the SAVA P platform (“Controller” or “Client”); and

(2) SAVA P Pty Ltd (“Processor” or “SAVA P”), a technology service provider incorporated in Australia.

This DPA forms part of and is subject to the Terms of Service or other written agreement between the parties (the “Agreement”).

1. Subject Matter and Scope

This DPA governs the Processing of Personal Data on behalf of the Client in connection with the use of SAVA P’s whitelabel platform, which includes data room services, email communications, and branded content ecosystems.

2. Definitions

• Personal Data means any information relating to an identified or identifiable natural person.

• Processing means any operation performed on Personal Data, including storage, use, transmission, and deletion.

• Controller means the entity determining the purposes and means of Processing Personal Data.

• Processor means the entity Processing Personal Data on behalf of the Controller.

• Data Subject means an individual whose Personal Data is being processed.

3. Roles and Responsibilities

• The Client acts as the Data Controller.

• SAVA P acts solely as a Data Processor.

The Client warrants that it has all necessary rights and legal bases to process and share Personal Data using the Platform.

The Client is solely responsible for:

• Obtaining valid consent or establishing a legal basis for email communications;

• Managing data subject rights requests (access, erasure, rectification);

• Complying with all applicable privacy, data protection, and financial promotion laws.

4. Instructions

SAVA P shall only process Personal Data:

• As necessary to provide the Platform and related support services;

• In accordance with the Client’s documented lawful instructions;

• As required by law (in which case, SAVA P will notify the Client unless prohibited).

5. Confidentiality and Access Controls

• All SAVA P personnel with access to Personal Data are bound by confidentiality obligations.

• Access is restricted based on least-privilege principles and monitored for anomalies.

6. Security Measures

SAVA P implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• TLS encryption for data in transit;

• Access logging and audit trails;

• Role-based access control;

• Regular vulnerability testing and updates;

• Isolated data environments for each client.

7. Subprocessors

SAVA P may engage third-party subprocessors to provide elements of the Platform. A current list will be made available upon request.

SAVA P will:

• Ensure subprocessors are bound by data protection obligations equivalent to this DPA;

• Remain fully liable for subprocessors.

8. International Data Transfers

SAVA P may transfer Personal Data outside the country of origin, subject to appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) where applicable;

• Data transfer agreements for onward transfers;

• Hosting data in privacy-compliant jurisdictions.

9. Assistance with Data Subject Rights

SAVA P will:

• Promptly forward any request from a Data Subject to the Client;

• Assist the Client in fulfilling data subject requests, as feasible and at Client’s cost if excessive.

10. Data Breach Notification

SAVA P will notify the Client without undue delay upon becoming aware of a Personal Data Breach. The notification will include:

• A description of the breach;

• The likely consequences;

• Measures taken or proposed to address the breach.

11. Data Retention and Deletion

1. Retention During Subscription
   SAVA P will retain Client Data on the Platform for the duration of the Client’s active subscription.
   
   

2. Termination and Export
   Upon termination of the Agreement or closure of the Client’s account, SAVA P will:
   
   

   • Provide the Client with a defined export window (no less than 30 days) to retrieve all Client Data using export tools provided by the Platform.

   • Notify the Client that it is solely responsible for exporting and retaining any records required by applicable law (for example, 7 years for investment-related communications in Australia).

   • After the export window has lapsed, SAVA P may delete Client Data from active systems.
     
     

3. Backups and System Logs
   Residual copies of Client Data (such as system logs, cached data, and backups) will be securely deleted within 90 days of termination, unless retention is required by law, regulation, or ongoing dispute resolution.
   
   
   

4. Client Responsibility for Recordkeeping
   Clients acknowledge that they, not SAVA P, are responsible for ensuring compliance with any statutory or regulatory record-keeping obligations in their jurisdiction. Clients must ensure that they export or otherwise retain such records prior to account closure.
   
   
   

5. Legal and Dispute Retention
   Notwithstanding the above, SAVA P may retain minimal Personal Data where necessary:
   
   

   • To comply with applicable legal obligations;

   • To resolve disputes or enforce agreements; or

   • To preserve evidence relevant to regulatory or legal proceedings.

12. Liability and Indemnity

The Client agrees to indemnify, defend, and hold harmless SAVA P against any claims, fines, damages, or investigations arising from:

• The Client’s failure to comply with applicable data protection laws;

• The Client’s misuse of the Platform;

• Any inaccurate or unlawful instructions given by the Client.

13. Audit & Compliance

SAVA P shall:

1. Provide Documentation
   Within 30 days of a written request, deliver documentation necessary to demonstrate compliance with this DPA.
   
   

2. Allow Audits
   Clients may conduct physical or remote audits no more than once per year, provided:

   • At least 30 days written notice is given;

   • Audits occur during normal business hours;

   • They do not unreasonably disrupt operations;

   • They are limited in duration to one business day, extendable once for cause;

   • The Client bears all audit-related costs.
     
     
     

3. Regulator-Mandated Audits
   If law or a competent supervisory authority requires it, additional audits or inspections are permitted.

14. Governing Law

This DPA shall be governed by:

• Australian law if the Client is based in Australia;

• English law if based in the UK or EU;

• Delaware law if based in the USA or elsewhere.

Addendum A – European Union (GDPR)

• SAVA P complies with the General Data Protection Regulation (EU) 2016/679.

• Standard Contractual Clauses (SCCs) are incorporated by reference.

• Clients must identify their EU representative if applicable.

Addendum B – United Kingdom (UK GDPR)

• SAVA P complies with UK GDPR and the Data Protection Act 2018.

• Transfers to or from the UK are subject to UK IDTA or SCCs as appropriate.

Addendum C – Australia (Privacy Act 1988)

• The Client must ensure that any personal information collected, stored, or disclosed complies with the Australian Privacy Principles.

• Data must not be kept longer than reasonably necessary. For financial services, investment-related communications (excluding invoices), this is generally 7 years.

Addendum D – United States (CCPA & CAN-SPAM)

• SAVA P is a “service provider” under the California Consumer Privacy Act (CCPA).

Clients must:

• Disclose data collection practices in their own privacy notices;

• Honour opt-out and do-not-sell requests;

• Comply with CAN-SPAM for email marketing (include unsubscribe links, accurate sender details).

15. Contact

Questions related to this DPA should be directed to:

Legal & Compliance Team

SAVA P Pty Ltd

16. Acceptance and Execution

This Data Processing Agreement forms part of the Terms of Service governing use of the SAVA P platform.

By clicking “I accept,” creating an account, or continuing to use the Platform, the Client acknowledges and agrees that:

• This DPA is legally binding on the Client;

• The Client acts as the Data Controller and SAVA P acts as the Data Processor;

The Client accepts and assumes responsibility for compliance with all applicable data protection, privacy, and financial promotion laws in connection with its use of the Platform.