Data Processing

Last updated: 10 September 2026

1. Application and definitions

1.1 This Data Processing Addendum (the DPA) forms part of the near.com for Business Terms and Conditions between Intents Technology Ltd (Intents Technology, we, us) and the customer (you) (the Agreement), and applies where we process personal data on your behalf in providing the Business Platform. By accepting the Agreement you accept this DPA, and no signature is needed for it to take effect.

1.2 If you need an executed copy, or a completed set of the transfer clauses in Annex 4, ask us at legal@near.com and give us your legal name, jurisdiction of incorporation, registered or business address and a contact for data protection matters. We will counter-sign this version as it stands. We do not otherwise collect those details, because access to the Business Platform is by blockchain account.

1.3 If there is a conflict, Annex 4 prevails over the rest of this DPA, and this DPA prevails over the rest of the Agreement, in each case only to the extent of the conflict and only as regards the processing of personal data. Terms defined in the Agreement have the same meaning here.

1.4 Data Protection Law means all laws on the processing of personal data applicable to our processing under this DPA, including the UK GDPR and the Data Protection Act 2018, Regulation (EU) 2016/679 and its implementing laws, the Swiss Federal Act on Data Protection, the Virgin Islands Data Protection Act 2021, and applicable United States state privacy laws. Customer Personal Data means personal data we process on your behalf in providing the Business Platform, as described in Annex 1; it excludes Business Contact Information and personal data we process as controller under clause 2.2. Business Contact Information means the business contact details of your personnel, such as name, business email address, telephone number, job title and employer, processed to manage our relationship with you. Sub-processor means a third party we engage to process Customer Personal Data on our behalf. controller, processor, data subject, personal data, processing and personal data breach have the meanings given in Data Protection Law.

2. Roles

2.1 For Customer Personal Data you are the controller and we are the processor. Where you are yourself a processor for another controller, we are a sub-processor and your instructions to us must be consistent with that controller’s instructions.

2.2 We act as an independent controller, and not as your processor, when we process:

(a) Business Contact Information; information you or your personnel give us in an enquiry, waitlist or early access request; marketing preferences and communications; and support correspondence sent directly to us;

(b) authentication and session information used to identify users, sign them in, manage sessions, record acceptance of the Agreement and secure the Business Platform; and technical, log and security information generated by operation of the Business Platform, where we use it for platform-wide security and abuse prevention, our own security governance and compliance, legal claims or product analytics. We do not use Workspace contents, such as address book entries, notes or transaction details, for product analytics. Where we use technical, log or security information only to deliver, troubleshoot or secure the Business Platform for you, we process it as your processor under clause 3.1;

(c) sanctions, financial crime and blockchain risk screening, and any resulting decision to restrict or decline activity;

(d) access to confidential transaction records for the purposes in clause 10.2(b); and

(e) anything we must do to comply with a legal or regulatory obligation applying to us.

2.3 Our processing as controller is described in our privacy notice at business.near.com/privacy-policy. This DPA does not apply to it.

2.4 You are responsible for deciding what information is entered into your Workspace and for having a lawful basis for it, including information about people who are not your personnel, such as payees recorded in an address book.

3. Our obligations as processor

3.1 We will process Customer Personal Data, including any transfer of it to a third country or an international organisation, only to provide, maintain and secure the Business Platform in accordance with the Agreement, on your further documented instructions where those are consistent with the Agreement and technically feasible, or where required by a law applying to us, in which case we will tell you before processing unless the law prohibits it.

3.2 The Agreement, this DPA and your use of the Business Platform’s features are your complete documented instructions. If you want us to process Customer Personal Data in any other way, ask us.

3.3 We will tell you if, in our opinion, an instruction infringes Data Protection Law, and may suspend performance of that instruction until it is withdrawn or amended.

3.4 We will not sell Customer Personal Data. We will not retain, use or disclose it other than to perform the services, as described in clause 10.2, or as permitted by law, and in particular will not use it for advertising, will not use it to train machine learning models, and will not use it to develop or improve any product or service other than the Business Platform. We may use aggregated information that does not identify you or any individual to improve the Business Platform.

4. Security and confidentiality

4.1 We will implement and maintain technical and organisational measures appropriate to the risk, having regard to the nature of the data and the state of the art. Our current measures are in Annex 2. We may change them provided we do not materially reduce the overall level of security.

4.2 Anyone we authorise to process Customer Personal Data is subject to a duty of confidentiality, has access only to what they need, and is informed of the confidential nature of the data.

5. Sub-processors

5.1 You give us general authorisation to engage Sub-processors. The Sub-processors we engage are listed in Annex 3.

5.2 Before a new Sub-processor starts processing Customer Personal Data we will update Annex 3, publish the updated version of this DPA, and give notice of the change in the Business Platform, in each case at least 15 days beforehand.

5.3 You may object to a new Sub-processor on reasonable data protection grounds within 15 days of that notice. If you do, we will work with you in good faith to find a solution. If we cannot, you may stop using the affected part of the Business Platform, or close your Workspace under clause 8. That is your only remedy.

5.4 We will impose data protection obligations on each Sub-processor no less protective than those in this DPA, and remain responsible to you for their performance.

5.5 The following are not our Sub-processors, and we do not control them or procure their compliance with this DPA:

(a) blockchain networks, protocols, bridges, market makers, solvers and other infrastructure operated by third parties through which a transaction you authorise may be routed. They receive the transaction information necessary to execute it and act on their own account, not on our instructions. Where infrastructure of that kind is operated by us or by an affiliate of ours, this paragraph does not apply to it; and

(b) providers we engage for our own controller processing under clause 2.2, including providers of support, marketing communications, analytics, screening and security incident investigation. They process personal data on our behalf, not on yours, and are addressed in our Privacy Notice. We configure those providers not to receive Customer Personal Data. If any such provider processes Customer Personal Data on our behalf, it is a Subprocessor and will be listed in Annex 3 before that processing begins.

6. Assistance, information and audit

6.1 The Business Platform provides features to access, export and change information in your Workspace, as described in Annex 1. You should use those to respond to a data subject in the first instance. Where a feature is not available for the information in question, clause 6.2 applies.

6.2 We will provide reasonable assistance, at your cost where the request is not straightforward, to help you respond to a request to exercise rights of access, rectification, erasure, restriction, portability or objection, and to carry out a data protection impact assessment or consult a supervisory authority.

6.3 If we receive a request directly from a data subject relating to Customer Personal Data, we will not respond substantively other than to direct the person to you, unless required by law or instructed by you.

6.4 On reasonable written request, and no more than once in any twelve month period unless a supervisory authority requires otherwise or there has been a personal data breach affecting your Customer Personal Data, we will give you the information reasonably necessary to demonstrate our compliance with this DPA.

6.5 If that is not sufficient to meet a requirement of Data Protection Law, we will allow an audit, subject to reasonable notice, confidentiality undertakings, conduct during business hours in a way that does not disrupt our operations or the security or confidentiality of other customers’ data, and your bearing the cost.

7. Personal data breach

7.1 We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe what we know at the time, including the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed and a contact point. Where we cannot provide all of that at once we will provide it in stages without undue delay.

7.2 We will co-operate with you and take reasonable steps to help you meet your own notification obligations. Our notification is not an admission of fault or liability.

8. Deletion

8.1 Your treasury contract exists on the NEAR blockchain independently of the Business Platform. Closing your Workspace, and any deletion under this clause, does not affect your treasury contract, the assets held in it, or your ability to interact with it directly.

8.2 At any time, and on the end of our provision of the Business Platform to you, you may instruct us to return or delete Customer Personal Data held off-chain in our systems, at your choice. Return is provided by export in a commonly used machine-readable format. We will comply as soon as reasonably practicable, will then delete any remaining copies except as clause 8.4 permits, and will confirm in writing on request. Deletion cannot be reversed, so export anything you want to keep first.

An instruction under this clause may identify particular records or request deletion of all Customer Personal Data associated with a Workspace, and may be sent to legal@near.com.

8.3 An instruction to close your Workspace is an instruction to delete. Between instruction and deletion we may restrict processing to storage only.

8.4 We may retain Customer Personal Data where and for as long as required by a law applying to us, or where necessary to establish, exercise or defend legal claims, in which case we will keep it only for that purpose, apply this DPA to it, and delete it when the reason for keeping it ends. Data in backups is overwritten in the ordinary backup cycle, currently within seven days, and we do not delete individual records from a backup already taken.

9. International transfers

9.1 We are established in the British Virgin Islands and may process Customer Personal Data in, or provide access to it from, countries outside the United Kingdom, the European Economic Area and Switzerland.

9.2 Where a transfer of Customer Personal Data is subject to Data Protection Law and no adequacy decision applies, the transfer mechanisms in Annex 4 apply and are incorporated into this DPA. Your details for the purposes of those mechanisms are those you give us under clause 1.2, and until you do so you are identified by the account through which the Agreement was accepted and by our record of that acceptance. If a mechanism we rely on is invalidated or superseded, we will apply an alternative lawful mechanism without undue delay.

10. Blockchain and confidential infrastructure

10.1 Public blockchain records. When you or your personnel authorise a transaction, deploy or configure a treasury contract, or create a proposal or a vote, that instruction is published to the public NEAR blockchain by you, using our interface. The resulting record, including account identifiers, contract addresses, membership and permission configuration, proposals, votes, non-confidential transactions and any free text written to an on-chain field, is public, permanent and outside the control of any person, including us. It cannot be amended, deleted, restricted or made confidential. Configuration recorded on-chain, such as membership and permissions, can be changed by a later transaction, but the earlier record and the change itself both remain permanently visible. You decide what to publish, and should not write personal details into an on-chain field.

10.2 Some transactions may use a confidential execution environment intended to reduce the information visible on a public blockchain. We can access information within that environment as necessary to operate the Business Platform. Operators of the confidential environment and third-party transaction infrastructure may receive the information necessary to perform their functions, as described in clause 5.5 and the Privacy Notice. We will:

(a) Where we access them to provide the Business Platform to you, such as to display your balances and transaction history, we do so as your processor under this DPA.

(b) Where we access them, or permit specialist security, incident response or blockchain analytics providers or an authority to access them, in order to secure the service, to investigate suspected fraud, theft, sanctions evasion, money laundering or other unlawful or prohibited activity, to respond to a security incident, to comply with a legal or regulatory requirement or a lawful request, or to establish, exercise or defend legal claims, we do so as controller and not as your processor. The Agreement sets out the corresponding rights, and our privacy notice describes that processing.

10.3 Effect on data subject rights. A request for erasure, rectification or restriction can be satisfied in relation to data held off-chain in our systems, and we will do that under clauses 6.2 and 8. Neither we nor you can alter or remove a record already written to a public blockchain. Where a request relates to such a record we will take the steps within our control, which may include deleting our off-chain copies and any linkage we hold to it and, where the product allows it, supporting a further transaction that changes the current position going forward.

10.4 We do not require names or contact details from end users to use the Business Platform. Even where we hold such details as controller because an individual made an enquiry or contacted support, we may be unable to link them to a particular Workspace or blockchain account. Where a request concerns information associated with a blockchain account, we may require proof of control of that account before taking action.

11. Your obligations

11.1 You will:

(a) give any notices and obtain any consents or other lawful basis required for us to process Customer Personal Data as described in this DPA, including in relation to people who are not your personnel;

(b) not enter special category data, or data relating to children, into the Business Platform;

(c) tell people whose information you record in your Workspace, before you record it, that account identifiers, transactions and free text published on-chain become a permanent public record; and

(d) keep your Workspace membership and permissions accurate. We cannot recover access to a treasury contract and cannot reverse an authorised transaction.

12. General

12.1 Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Agreement, and claims under this DPA and under the Agreement count towards the same aggregate cap. Nothing in this clause limits either party’s liability to a data subject, or a supervisory authority’s ability to exercise its powers.

12.2 This DPA applies for as long as we process Customer Personal Data, and clauses 8, 10 and 12 survive.

12.3 We may update this DPA. Where a change materially reduces your rights or our obligations we will give at least 15 days’ notice before it takes effect, by a notice in the Business Platform and, where we hold an address for you, by email. Otherwise a change takes effect when we publish it. We will not amend Annex 4 in a way that alters the standard contractual clauses themselves.

12.4 This DPA is governed by the law and subject to the jurisdiction stated in the Agreement, except that Annex 4 is governed as stated in that Annex.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

This Annex describes the measures in place as at the date this DPA was last updated. It may be updated under clause 4.1.

Access control

• Role-based access to production systems, granted on a need to know basis.
• Multi-factor authentication required for administrative access to production systems and to the code repository.

Encryption

• Encryption of all traffic to and from the backend in transit using TLS.
• Encryption at rest of the database, backups and stored quotes using AES-256.

Platform and application security

• End user authentication by a passkey or connected wallet/blockchain account. Private keys, seed phrases and passkeys remain on the user's device; we do not hold or recover them.
• Transactions require the signing threshold configured by the customer on its own treasury contract, which we cannot override.
• Error and exception monitoring.

Resilience and continuity

• Managed cloud infrastructure.
• Automated backups retained for a short period, currently up to seven days, and overwritten thereafter.

Organisational measures

• Confidentiality obligations in contracts with personnel and contractors.
• Contractual data protection terms with Sub-processors.

Annex 3: Sub-processors

The following Sub-processors are engaged as at the date this DPA was last updated.

The list above contains only providers that process Customer Personal Data on our behalf. Providers used only for our controller processing under clause 2.2, including marketing communications and product analytics, are addressed in our Privacy Notice and are not Subprocessors where they are configured not to receive Customer Personal Data. If a provider begins processing Customer Personal Data on our behalf, it will be treated as a Subprocessor and added to this Annex before that processing begins.

Annex 4: Transfer mechanisms

A. European Economic Area

The standard contractual clauses approved by the European Commission in Decision 2021/914 (the SCCs) are incorporated into this DPA and apply to transfers of Customer Personal Data subject to Regulation (EU) 2016/679, as follows.

B. United Kingdom

For transfers subject to the UK GDPR, the SCCs apply as amended by the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (the UK Addendum), which is incorporated into this DPA. Table 1 is completed by the parties’ details in the Agreement. Tables 2 and 3 are completed by section A of this Annex and by Annexes 1 to 3 to this DPA. In Table 4, neither party may end the UK Addendum as set out in its section 19.

C. Switzerland

For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act, references to a member state read so as not to prevent a data subject in Switzerland from bringing proceedings in Switzerland, and the competent authority being the Swiss Federal Data Protection and Information Commissioner.

D. United States

Where United States state privacy law applies to Customer Personal Data, we act as a service provider, contractor or processor as those laws define it, and the following apply.

(a) We will not sell Customer Personal Data or share it for cross-context behavioural advertising. We will not retain, use or disclose it except to perform the business purposes set out in Annex 1 under nature and purpose, and will not use or disclose it for any other commercial purpose, outside our direct business relationship with you, or in combination with personal information from any other source, except as permitted by law.

(b) We will comply with the obligations applicable to us under those laws, will provide the same level of privacy protection as they require of you, and will notify you after determining that we can no longer meet those obligations.

(c) You may take reasonable and appropriate steps to satisfy yourself that we use Customer Personal Data consistently with your obligations, including the exercise in clause 6.4 no more than once in any twelve month period, and to stop and remediate any unauthorised use of Customer Personal Data.

(d) We will assist you in responding to a consumer request in accordance with clause 6, and will impose equivalent obligations on any Sub-processor in accordance with clause 5.4.