Data Processing Addendum

Last updated: 19 October 2026

This Data Processing Addendum ("DPA") is part of the Ants Terms of Service. It is between you (the "Customer") and Core Engine IT Infrastructure LLC ("Ants").

1. Scope and roles

This DPA applies when an app you build or host on Ants processes personal data about other people, such as your app's users ("App Personal Data"). It applies under the data protection laws that govern that processing, including the UK GDPR and Brazil's LGPD.

You are the controller of App Personal Data. Ants is your processor. We process App Personal Data only to host, run, change, secure and support your app. Annex A gives the details.

2. Instructions

We process App Personal Data only on your documented instructions, unless the law requires otherwise. Your instructions are:

• the Terms;
• this DPA;
• what you ask Ants to build or change in your app.

If we believe an instruction breaks data protection law, we will tell you.

We do not use App Personal Data for our own purposes.

You are responsible for:

• having a lawful basis for the processing;
• giving your app's users the information the law requires;
• obtaining any consents needed.

3. Our obligations

Confidentiality. Only people who need access to App Personal Data can see it, and they are bound by confidentiality.

Security. We apply appropriate technical and organisational measures, summarised in Annex B.

Subprocessors. You give general authorisation for us to use subprocessors. We impose data protection obligations on each of them that are equivalent to this DPA, and we remain responsible for them. You can get the current list by emailing [email protected]. We will tell you before we add or replace a subprocessor. If you object on reasonable data protection grounds, you may stop using the Service.

Assistance. Taking into account what we can access, we will help you to:

• respond to requests from your app's users exercising their rights;
• meet your obligations on security, breach notification, impact assessments and consultation with authorities.

If we receive a request directly from one of your app's users, we will pass it to you.

Breaches. We will notify you without undue delay after we become aware of a personal data breach affecting App Personal Data. We will give you the information you need to meet your own obligations.

Return and deletion. When we stop hosting your app, at your choice we will either return App Personal Data to you or delete it. A request for return must reach [email protected] before the 3-month grace period in the Terms ends. After the grace period we delete App Personal Data, unless the law requires us to keep it.

Audits. We will make available the information needed to demonstrate compliance with this DPA. We will allow and contribute to audits by you or an auditor you appoint. Audits must be on reasonable notice, confidential, and no more than once a year unless an authority requires one.

4. International transfers

App Personal Data is hosted mainly in the European Union. Some subprocessors, and Ants itself in the UAE, may process it in other countries.

• From the UK: the parties agree to the EU Standard Contractual Clauses (Module 2, or Module 3 where you are a processor) with the UK International Data Transfer Addendum.
• From Brazil: the standard contractual clauses approved by the ANPD apply.

These clauses are incorporated by reference and prevail if they conflict with this DPA.

5. Term and liability

This DPA applies for as long as we process App Personal Data for you. The limitations of liability in the Terms apply to it, to the extent the law allows.

Annex A: Processing details

Annex B: Security measures

• Encryption in transit and at rest.
• A separate environment and database for each app.
• Encryption keys and credentials held in dedicated secrets management.
• Staff access based on role, with multi-factor authentication.
• Automated backups.
• Network-level protection against attacks.
• Logging and monitoring of security events, and an incident response process.