Data Processing Agreement

This Data Processing Agreement (the "DPA") is concluded between:

• NEXT BP, a French simplified joint-stock company (SAS) with a share capital of €100, registered with the Paris Trade and Companies Register under number 920 753 233, whose registered office is at 127 rue de la Tour, 75016 Paris, France ("NEXT BP" or the "Processor"); and
• the legal entity that subscribes to Blast Audit or starts a free trial (the "Client").

It forms part of the Terms and Conditions and of the End-User License Agreement (EULA) (together, the "Principal Agreement"). It sets out the conditions under which NEXT BP processes Personal Data on behalf of the Client when it provides Blast Audit: the Excel add-in, the web dashboard, the connectors to the Client's cloud storage, the MCP server, the engagement agent, the financial statement review, the PBC request lists, analysis projects, the Blast Audit Academy and any other function of Blast Audit that NEXT BP adds and describes in this DPA (together, the "Software"). It is the contract required by Article 28 of the GDPR.

This DPA draws on the standard contractual clauses of Commission Implementing Decision (EU) 2021/915, without reproducing them where a clause so indicates: Annex 1 corresponds to their Annexes I and II, Annex 2 to their Annex III and Annex 3 to their Annex IV.

---

1. Definitions

Terms defined in the GDPR (including "Controller", "Processor", "Personal Data", "Processing", "Data Subject", "Personal Data Breach" and "Supervisory Authority") have the meaning given to them in the GDPR. In addition:

• "GDPR" means Regulation (EU) 2016/679 of 27 April 2016.
• "Data Protection Legislation" means the GDPR, French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and any other Union or Member State law on the protection of Personal Data that applies to the Processing.
• "Client Data" means the documents, files, images, audio, text, instructions, workpapers and results that the Client or its Users submit to the Software or that the Software produces from them, and the Personal Data they contain. Usage Data that identify a User are included.
• "Usage Data" means data relating to the use of the Software by Users, as described in Section 2.5. Organisation-level totals that do not identify a User, the product-analytics data referred to in Section 2.3, and the billing records of artificial-intelligence credits and of pages submitted for optical character recognition referred to in Section 2.3, are not included. The volume of credits shown per member is an indicator of the view in Section 2.5, distinct from those records.
• "Sub-processor" means any processor engaged by NEXT BP to carry out Processing of Client Data on behalf of the Client.
• "Users" means the persons whom the Client authorises to use the Software.
• "Annexes" means the four annexes to this DPA, which form part of it.

This DPA is read and interpreted in the light of the GDPR. It may not be interpreted in a way that runs counter to the rights and obligations provided for in the GDPR or in a way that prejudices the fundamental rights or freedoms of Data Subjects.

---

2. Roles and Scope

2.1 The Client is the Controller of the Personal Data contained in Client Data. It determines the purposes of the Processing and alone decides which documents its Users submit to the Software. Where the Client itself processes these data as a processor on behalf of a third party, NEXT BP acts as its sub-processor and the Client passes on to NEXT BP the instructions it receives.

2.2 NEXT BP is the Processor. It processes Client Data only to provide the Software to the Client, in accordance with this DPA.

2.3 Data outside this DPA. NEXT BP acts as an independent Controller, and not under this DPA, for the data it needs to run its own business: Users' accounts and authentication, billing, support requests, security of the service, product analytics and commercial relations. These data are described in the Privacy Policy.

Product analytics do not include the consultation of usage per member. That consultation is the Processing in Section 2.5, carried out on behalf of the Client.

Product analytics are carried out with PostHog (Annex 3, Part B). NEXT BP transmits to PostHog, linked to the User's identifier, product usage, billing, e-mail and AI-consumption events, with no document content. Per-member detail (name, e-mail address and the indicators in Section 2.5) and the usage events recorded on behalf of the Client, together with their aggregates, are not transmitted to PostHog. Events sent by NEXT BP's servers do not depend on the cookie banner, which concerns only the browser. Those transmissions fall under this Section.

Technical metrics that contain no document content may be kept by NEXT BP for billing, quotas, security and service reliability. These data, and their retention periods, are described for information in the Privacy Policy.

2.4 Scope. This DPA is without prejudice to the obligations to which the Client is subject as Controller under the GDPR. It is not enough on its own to govern transfers outside the European Economic Area, which are covered by Section 8 and Annex 4.

2.5 Usage Data and the per-member view.

The Software records Usage Data relating to Users. Usage Data are Personal Data where they relate to an identified or identifiable person, including through a technical identifier that NEXT BP can link to that person.

Usage Data comprise:

• account identification data: name, e-mail address, technical account identifier, role within the Client's organisation, status as an active member, and whether the member holds a licence for the Excel add-in (yes or no);
• the following indicators, and only those indicators: date (the day, without the time) of the last activity over the last 13 months, whatever the period consulted, number of active days in the period consulted, number of documents imported, number of snips, number of matching runs, number of pages submitted for optical character recognition, number of runs of the artificial-intelligence features, and volume of credits consumed for those features, expressed in euros and as a share of the credits consumed by the organisation over the period consulted.

Last activity is the day of the last usage event: an action reported by the Excel add-in or a document import. Runs of the artificial-intelligence features and credits do not count towards it. A sheet for each member breaks those totals down by feature: number of events, runs of the artificial-intelligence features, and credits. The usage of people who have left the organisation, and usage that is not linked to any member, is added up on a single "former members" line, with no name. That line is not anonymous: when only one person has left the organisation, it shows that person's totals.

Usage Data do not include the content of the Client's documents, the names of those documents, the content of exchanges with the artificial-intelligence features, or the chronological detail of actions. They contain no score, no ranking and no individual performance indicator, and do not measure working time. Users' progress in the Blast Audit Academy, including their quiz scores that the owners and administrators of the Client's organisation can see, is not Usage Data: it is described in Annex 1.

The per-member view is hidden by default. Only the owners and administrators of the Client's organisation can see it, and only after an owner or an administrator has turned on the organisation setting. Before turning it on, that person ticks that they have informed the members and consulted the CSE or the Betriebsrat where required. Turning the setting on records who did so and when. Only the last change to the setting is kept: each change replaces the previous one. This record is kept for the duration of the Principal Agreement and then, as evidence of the Client's instruction, for five (5) years after its end; it is then deleted. It is the documented instruction, within the meaning of Section 4.1, to present and export Usage Data per member. While the setting is off, the Software is designed to refuse the detail, including in response to a request. The Client may turn the setting off at any time. After the setting is turned off, the Software is designed to refuse any new request for the detail; figures already displayed or exported are not withdrawn from the Client's browsers or files. Per-user export files already produced on the Exports page can still be downloaded by owners and administrators until they expire (Annex 1).

The period consulted is chosen by the Client, within the limit of the last thirteen (13) months.

The Client is the Controller of this consultation. Before turning the setting on, the Client ensures that the consultation is lawful: legal basis, prior information of the Data Subjects and, where the law that governs the Client so requires, information and consultation of staff representatives or co-determination by the competent body. The box ticked at activation does not prove that those steps took place. NEXT BP provides the Client with a notice describing the view. That notice does not discharge the Client's obligations.

NEXT BP presents and exports the per-member view on that instruction, and only on the terms above. NEXT BP does not use that view for its own purposes, in particular to evaluate a person, to prospect, to build a profile, or to train or adjust a model. Per-member detail is not transmitted to PostHog or to any other product-analytics tool, and it is not sent back to the identity directory.

An export requested by an owner or an administrator contains only the fields of the view and of the per-member sheet. The CSV file is produced in the browser. NEXT BP does not make a copy of this CSV file. The per-user export on the Exports page follows the same rules and gives the same totals, with no row per day; it is produced on NEXT BP's servers and can be downloaded by owners and administrators until it expires (Annex 1), then deleted.

Raw usage events and daily aggregates per User are kept for the period set in Annex 1. Daily aggregates per organisation, which are totals without a personal identifier, are kept for the duration of the Principal Agreement. Records of artificial-intelligence credits and of pages submitted for optical character recognition, page reservations included, are billing records within the meaning of Section 2.3. They keep the User's identifier for billing, refunds and tracking of the credit period, for the period set in Annex 1; the identifier is then removed, and the records and their amounts remain attached to the organisation. Records of the execution of the artificial-intelligence features (date, feature, status, consumption, technical identifiers, storage paths, progress and error messages, technical metadata) follow the same rule. The per-member view reads these entries and these records only for the period consulted. The credits shown per member are an indicator of that view. File names are removed from usage events, including the history. Copies that remain in backups disappear in accordance with Section 7.3. At the end of the Principal Agreement, the raw usage events, daily aggregates per User and per organisation and records of the execution of the artificial-intelligence features that remain, whatever their age, are deleted with the Client Data, in accordance with Section 7.3; the credit and page records are kept, and the User's identifier is removed from them at that deletion.

NEXT BP's personnel access per-member detail only to carry out a support request from the Client or to secure the service, and only to the extent necessary. They remain bound by Section 4.3.

---

3. Details of the Processing

The subject matter, nature, purpose and duration of the Processing, the types of Personal Data and the categories of Data Subjects are described in Annex 1. The Processing lasts as long as the Principal Agreement, then until Client Data are deleted or returned in accordance with Section 7.

---

4. Obligations of NEXT BP

4.1 Documented instructions. NEXT BP processes Client Data only on the documented instructions of the Client, including with regard to transfers of Personal Data to a third country or an international organisation, unless it is required to do so by Union or Member State law to which it is subject. In that case, NEXT BP informs the Client of that legal requirement before the Processing, unless that law prohibits such information on important grounds of public interest. The Principal Agreement, this DPA, the Users' actions in the Software and the settings chosen by the Client's administrators (for example, enabling a connector) constitute the Client's documented instructions. Turning on the per-member view setting in Section 2.5 is the documented instruction to present and export those data. Leaving it off is the instruction not to present them: the Software is then designed to refuse the detail. The Client may give further instructions throughout the duration of the Processing; they are always documented, for example by e-mail to privacy [at] blast-audit.com. If NEXT BP cannot carry out a further instruction with the functions of the Software, it informs the Client without delay and Section 12 applies.

4.2 Unlawful instructions. NEXT BP immediately informs the Client if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. NEXT BP may suspend the execution of that instruction until the Client confirms or amends it in writing.

4.3 Confidentiality. NEXT BP ensures that persons authorised to process Client Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access Client Data only to the extent strictly necessary to provide the Software, to answer a support request from the Client, or to handle an incident.

4.4 Sub-processors.

(a) General authorisation. The Client gives NEXT BP a general written authorisation to engage Sub-processors. The Sub-processors engaged on the date of this DPA are listed in Part A of Annex 3, which constitutes NEXT BP's dated sub-processor list.

(b) Obligations of Sub-processors. NEXT BP engages each Sub-processor by way of a contract that imposes on it, in substance, the same data protection obligations as those imposed on NEXT BP under this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. NEXT BP imposes these obligations on each Sub-processor by contract. NEXT BP remains fully liable to the Client for the performance of its Sub-processors' obligations and informs the Client of any failure by a Sub-processor to fulfil its contractual obligations of which NEXT BP is aware.

(c) Changes. NEXT BP informs the Client of any intended addition or replacement of a Sub-processor at least thirty (30) days before it takes effect, by e-mail to the address of the Client's account owner and by publishing an updated, dated Annex 3. The notice states the name of the Sub-processor, its role, the location of the Processing and the transfer mechanism.

(d) Objection. Within this thirty-day period, the Client may object to the change in writing to privacy [at] blast-audit.com, on reasonable grounds relating to the protection of Personal Data. NEXT BP and the Client then seek a solution in good faith, for example a configuration in which the new Sub-processor does not process the Client's data. If no solution is found before the change takes effect, the Client may terminate the affected subscription, without penalty, with effect on the date of the change. The Client is then entitled to the refund provided for in Section 12.5.

(e) Copies of contracts. At the Client's request, NEXT BP provides a copy of the applicable contract concluded with a Sub-processor, in the version in force, and of any amendments to it, including where that contract consists of the standard terms the Sub-processor publishes. NEXT BP may redact trade secrets and other confidential information, including Personal Data.

(f) Disappearance of NEXT BP. NEXT BP uses the standard terms of its Sub-processors and cannot have a clause added to them for the Client's benefit. If NEXT BP has factually disappeared, has ceased to exist in law or has become insolvent, the Client may ask the administrator or liquidator to delete or return Client Data; Client Data remain subject to the retention periods in Annex 1.

(g) Urgent replacement. Where a Sub-processor stops its service or puts the security of Client Data at risk, NEXT BP may replace it with shorter notice. No Client Data are transmitted to the new Sub-processor before the Client is informed. The Client then has the rights in Section 4.4(d) for thirty (30) days. If the Client objects, NEXT BP stops transmitting Client Data through that Sub-processor for that Client.

4.5 Security. NEXT BP implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. NEXT BP may change these measures provided that the overall level of protection is not reduced.

4.6 Requests from Data Subjects. Taking into account the nature of the Processing, NEXT BP assists the Client by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests from Data Subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). If NEXT BP receives such a request directly, it forwards it to the Client without undue delay and does not respond to it itself, except to tell the Data Subject that the request has been forwarded. In an analysis project, the Software cannot erase one person inside a source: NEXT BP can carry out an erasure request about that person only by deleting that source, which remains possible while no dataset has been built from it, or by deleting the project; the Client may then import a redacted version of the source. Copies in backups disappear under Section 7.3, and requests and responses that Microsoft temporarily stores for abuse monitoring are not covered (Section 5.4).

4.7 Data protection impact assessment and prior consultation. Taking into account the nature of the Processing and the information available to it, NEXT BP assists the Client in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR. In particular, it provides the Client, on request, with the information the Client needs to carry out a data protection impact assessment (description of the Processing, data flows, Sub-processors, retention periods, security measures) and assists it in any prior consultation of the CNIL or of another competent Supervisory Authority. NEXT BP informs the Client without delay if it becomes aware that Personal Data it processes on the Client's behalf are inaccurate or have become outdated. For Usage Data, this assistance includes the description of the data, the access rights, the retention periods and the setting in Section 2.5, which the Client may add to its file. NEXT BP does not decide for the Client whether a data protection impact assessment is required, and it does not carry one out in the Client's place.

The assistance provided for in Sections 4.6, 4.7, 4.8(d) and 4.9 comprises the Software's documentation and reasonable assistance. Beyond reasonable use, or where it concerns a Personal Data Breach for which NEXT BP is not responsible, NEXT BP charges for it by time spent, at the rate stated before the service; failing agreement on that rate, NEXT BP provides only the assistance that is included, without charge. Such a disagreement is not a non-payment.

4.8 Personal Data Breaches.

(a) NEXT BP notifies the Client of any Personal Data Breach affecting Client Data without undue delay after becoming aware of it, by e-mail to the address of the Client's account owner.

(b) The notification contains, to the extent known at that time: the nature of the breach, including, where possible, the categories and approximate number of Data Subjects and of records concerned; the name and contact details of NEXT BP's contact point (privacy [at] blast-audit.com); the likely consequences of the breach; and the measures taken or proposed by NEXT BP to address the breach and mitigate its possible adverse effects. Where all the information cannot be provided at the same time, NEXT BP provides it in phases, without further undue delay.

(c) NEXT BP cooperates with the Client so that the Client can notify the Supervisory Authority and, where required, the Data Subjects. NEXT BP does not make these notifications on the Client's behalf unless the Client instructs it to do so in writing.

(d) Where a Personal Data Breach concerns data processed by the Client itself, for example after a User's account has been compromised, NEXT BP assists the Client, taking into account the nature of the Processing and the information available to it, in notifying the Supervisory Authority, gathering the information required by Article 33(3) of the GDPR and, where required, communicating the breach to the Data Subjects.

4.9 Information. The parties are able to demonstrate compliance with this DPA. NEXT BP deals promptly and adequately with the Client's inquiries about the Processing of Client Data. It makes available to the Client all information necessary to demonstrate compliance with Article 28 of the GDPR and with this DPA, under the conditions of Section 6. It makes this information, including the results of any audit, available to the competent Supervisory Authority on request.

---

5. Artificial Intelligence

5.1 No training. NEXT BP does not use Client Data to train or fine-tune any artificial intelligence or machine learning model, whether its own or a third party's.

5.2 AI providers. Except where the Client uses its own API key (Section 5.7), the AI models that process Client Data are operated by Microsoft (Azure OpenAI, the Azure AI service in the EU Data Zone that checks the engagement agent's and the Excel agent's results tables, Azure AI Content Understanding, Azure AI Speech) under Microsoft's data protection terms, under which Microsoft does not use Client Data to train generative AI foundation models without documented instructions from NEXT BP, and NEXT BP gives no such instructions. NEXT BP will engage no other AI model provider without imposing the same prohibition on training models with Client Data, and only in accordance with Section 4.4. Reading of scanned pages. When it happens, the reading of a page by NEXT BP's Standard OCR, software that NEXT BP operates itself, runs in the Microsoft Azure environment that hosts the application (Annex 3), in the same region; no separate OCR provider performs that reading. Standard OCR does not read every page. Azure AI Content Understanding reads each scanned page for which the result delivered to the Client does not come from Standard OCR, including pages read again automatically or at a User's request, and all scanned pages when Standard OCR is not in service for the Client. Azure AI Content Understanding may also read pages that Standard OCR reads, in particular while Standard OCR is being evaluated. Measuring reading quality. To measure and maintain the quality of the reading delivered to the Client, Standard OCR may read again, in the same environment, a page already read by Azure AI Content Understanding, whose result is the one delivered to the Client. NEXT BP keeps from this second reading only figures with no document content (numbers, shares, durations), consulted by its teams, for the period set in Annex 1; the pages read again follow the ordinary periods in Annex 1. Where the Client uses its own Azure key (Section 5.7), every scanned page is read by the advanced reading, with the Client's key, under the Client's Azure contract.

5.3 No storage of requests for later retrieval. NEXT BP configures Azure OpenAI so that the service does not keep requests or responses for later retrieval, subject to the abuse monitoring in Section 5.4, which leads Microsoft to temporarily store all requests and all responses.

5.4 Abuse monitoring by Microsoft. Microsoft temporarily stores all requests sent to Azure OpenAI and all responses, to monitor for and prevent abusive or harmful uses or outputs of the service (abuse monitoring). Microsoft's contract sets no duration for this storage. Only data that has triggered its automated systems may be reviewed by authorised Microsoft employees; for EU Data Boundary deployments, those employees are located in the European Economic Area. Microsoft's terms (Privacy & Security Terms) also allow its personnel located outside the EU Data Boundary to access data processing systems inside it remotely, as necessary to operate, troubleshoot, support and secure its services. Microsoft does not use this content to train generative AI foundation models without its customer's documented instructions, and NEXT BP gives no such instructions (Section 5.2). Microsoft has not granted NEXT BP an exemption from this monitoring: this storage therefore takes place. Microsoft may also temporarily store, for abuse monitoring, the requests sent to the Azure AI service in the EU Data Zone that checks results tables (Section 5.2) and that service's responses; Microsoft has given NEXT BP no commitment on how long it keeps them. For this service too, only data that triggered Microsoft's automated systems may be reviewed by authorized Microsoft employees, located in the European Economic Area for a deployment within the EU Data Boundary, and Microsoft does not use this content to train generative AI foundation models without NEXT BP's documented instructions, which NEXT BP does not give. This service runs on a model version that Microsoft offers as a preview: Microsoft's terms for Azure previews apply to it, and Microsoft may apply to previews privacy and security measures that are lesser than or different from those this Section describes, including other abuse-monitoring practices. Microsoft makes no EU Data Boundary commitment for previews: the Microsoft employees who review this service's data are therefore not necessarily located in the European Economic Area. For either service, Microsoft's contract only sets a latest deletion: after NEXT BP's Azure subscription ends, Microsoft keeps this data for ninety (90) days in a limited-function account, then deletes it within the following ninety (90) days. That subscription is NEXT BP's: the end of a Client's Principal Agreement does not end it.

5.5 Web search. The Excel agent can propose a web search. The search query, written by the model, is shown to the User; the Software is designed to send it to Exa (Annex 3) only if the User approves it. The query may contain names or amounts taken from Client Data. The Software is designed to no longer offer web search in a conversation that has used document analysis features.

5.6 No automated decision. The Software produces suggestions (extracted values, answers, classifications, matches) linked, where possible, to the words of the source document so that the User can check them. It makes no decision producing legal effects concerning Data Subjects or similarly significantly affecting them: the Client and its Users validate each result and remain responsible for their conclusions. In an analysis project, the project's AI assistant proposes analysis recipes and packs: the Software is designed so that none runs without the approval of a User with full access to the project (a User with read-only access cannot give it), and the results are computed by the Software's analysis engine, not by the AI model.

5.7 Provider chosen by the Client. When the Client saves in the Software an API key of an AI or OCR provider with which it has contracted itself, the requests concerned are sent to that provider, under the Client's account and on the terms the Client accepted. That provider is chosen by the Client and bound to it by its own contract: it is not a Sub-processor of NEXT BP and is not listed in Annex 3. The Client is responsible for checking that this contract meets Article 28 GDPR and, where data is transferred, Chapter V. Sections 5.2 to 5.4 do not apply to those requests; Section 5.1 still binds NEXT BP. The Client may remove its key at any time; later requests go back to the providers in Annex 3.

---

6. Audits

6.1 Documentation first. On request, NEXT BP provides the Client with the documentation that demonstrates its compliance: this DPA and its Annexes, answers to a reasonable security questionnaire, the certificates and reports that NEXT BP holds on the date of the request (Annex 2), and the certifications and reports that Microsoft makes available for its hosting services (SOC 3 report and ISO certificates published on the Microsoft Service Trust Portal). The SOC 2 Type 2 report is confidential: NEXT BP provides it to the Client and to the Client's auditors under a confidentiality undertaking.

6.2 On-site audit. If the Client reasonably considers that this documentation is not sufficient to demonstrate compliance with this DPA, it may carry out, itself or through an independent auditor bound by confidentiality who is not a competitor of NEXT BP, an on-site audit or an audit by remote access, at most once per twelve-month period, with at least thirty (30) days' written notice. The scope, date and duration are agreed in advance. The audit takes place during business hours, without unreasonably disrupting NEXT BP's activity and without access to the data of other clients or to the facilities of Sub-processors, which are covered by their own audit reports.

6.3 Additional audits. The limit of one audit per year does not apply to an audit required by a Supervisory Authority, to an audit carried out following a Personal Data Breach affecting Client Data, or to an audit justified by serious indications that NEXT BP does not comply with this DPA, which the Client substantiates in writing. A single Personal Data Breach, or a single set of indications, justifies only one additional audit. For an audit required by a Supervisory Authority or carried out following a Personal Data Breach, the notice period is reduced to ten (10) business days; for an audit justified by serious indications, the notice period in Section 6.2 applies.

6.4 Costs. Each party bears its own costs. The time that NEXT BP spends on audits beyond two (2) business days per twelve-month period is chargeable at a reasonable rate stated before the service. A disagreement on that rate does not prevent the audit. The Client bears the costs of the audit and of its auditor, unless the audit establishes a serious breach by NEXT BP of its obligations under this DPA; NEXT BP then bears the reasonable costs of the audit, within the cap in Section 11.2 of the Terms and Conditions, and does not charge for its time. NEXT BP remedies any breach identified without undue delay.

---

7. End of Processing: Return and Deletion

7.1 Data already deleted during the subscription. Most Client Data are deleted during the subscription in accordance with the retention periods in Annex 1: document content submitted for OCR or analysis is deleted at most 24 hours after upload, from the copies that NEXT BP controls. The content of an Excel agent conversation, including the names and text of the workbook's documents that the add-in sends for it, is deleted at most 24 hours after it reaches NEXT BP's servers, from the copies that NEXT BP controls, and database backups keep it up to seven (7) more days (Section 7.3). If a deletion fails, it is retried and takes place as soon as possible. The content of an engagement of the engagement agent, of a financial statement review, of a PBC request list or of an analysis project does not follow this period: it follows the period that Annex 1 sets for it. Requests and responses that Microsoft temporarily stores for abuse monitoring are not covered (Section 5.4). Workbooks remain in the Client's own Excel files; the cell ranges that a User sends to an analysis project (workbook snapshots) are copied into that project and follow its retention period.

7.2 Export. Until the end of the Principal Agreement, the Client can export the data that NEXT BP still holds, in particular engagements of the engagement agent, the files of PBC request lists and analysis projects, from the Software, subject to what follows. A new export of an engagement, an analysis project or a financial statement review may be refused during the last day before its deletion; an export that is already ready can still be downloaded until that deletion. Only a closed financial statement review can be exported, by a member with full access. The export of a review contains the documents' files and their prepared PDFs that NEXT BP still keeps, and a manifest that lists every document. The export contains neither the annotations, nor the comments, nor the checklists with their answers and verdicts, nor the analysis settings, nor the findings sent to Excel.

7.3 Deletion. At the end of the Principal Agreement, NEXT BP deletes the Client Data within thirty (30) days, unless the Client asks, within that period, for the return of data still held; NEXT BP then returns them in a structured, commonly used format and deletes them afterwards. This Section also applies to engagements, financial statement reviews, PBC request lists and analysis projects still open at the end of the Principal Agreement. If a deletion fails, it is retried and takes place as soon as possible. Copies in database backups disappear when the backups expire, within seven (7) days after deletion. NEXT BP keeps no copy of Client Data beyond the cases provided for in Annex 1, unless Union or Member State law requires storage of the Personal Data. This Section does not cover the data that NEXT BP processes as controller (Section 2.3). The deletion includes raw usage events, daily aggregates per User and per organisation and records of the execution of the artificial-intelligence features (Section 2.5). Records of artificial-intelligence credits and of pages submitted for optical character recognition, billing records within the meaning of Section 2.3, are kept; the User's identifier is removed from them at the deletion. The record of the last change to the per-member view setting is kept for five (5) years after the end of the Principal Agreement, as evidence of the Client's instruction, and then deleted (Section 2.5). The requests and responses that Microsoft temporarily stores for abuse monitoring (Section 5.4) are subject to Microsoft's terms; they are not covered by the deletion within thirty (30) days above, because NEXT BP cannot delete them for each Client; Microsoft's contract sets no duration for this storage, only a latest deletion after NEXT BP's Azure subscription ends (Section 5.4).

7.4 Certificate. On request, NEXT BP provides the Client with a written certificate of deletion.

---

8. Transfers Outside the European Economic Area

8.1 Client Data are hosted and processed within the European Union, except for the transfers described in Annex 4. By accepting this DPA, the Client instructs NEXT BP to carry out these transfers. NEXT BP makes no other transfer to a third country or an international organisation, except on the documented instructions of the Client or to fulfil a requirement of Union or Member State law to which it is subject, and always in accordance with Chapter V of the GDPR.

8.2 Where a Sub-processor is located outside the European Economic Area, or may access data from outside it, the transfer is covered by the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework for certified recipients, or by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914. Annex 4 sets out the mechanism used for each recipient. The Client can obtain a copy of these safeguards by writing to privacy [at] blast-audit.com.

---

9. Obligations of the Client

9.1 The Client ensures that the Processing it entrusts to NEXT BP has a legal basis and that the Data Subjects have received the information required by Articles 13 and 14 of the GDPR.

9.2 The Client submits to the Software only the documents necessary for its assignments. The documents processed may incidentally contain special categories of Personal Data or data relating to criminal convictions and offences (for example, a sick-leave line on a payslip or a court decision in a litigation file). The Client remains responsible for deciding to submit them; NEXT BP applies to them the additional safeguards described in Annex 1.

9.3 The Client's instructions comply with Data Protection Legislation. The Client designates its account owner as NEXT BP's contact for this DPA and keeps that person's e-mail address up to date in the Software.

---

10. Liability

Each party is liable for the damage it causes in breach of this DPA under the conditions of Section 11 of the Terms and Conditions and within the cap in Section 11.2 of the Terms and Conditions, which is common to the Terms and Conditions, the EULA and this DPA. These limits cannot be invoked against Data Subjects exercising their rights under Article 82 of the GDPR. As between the parties, they apply, including to the right of recourse under Article 82(5) of the GDPR. Each party bears the administrative fines imposed on it. The force majeure clause in Section 5 of the Terms and Conditions applies to this DPA; it does not derogate from the obligations that the GDPR places on the parties.

---

11. Precedence, Term and Governing Law

11.1 Precedence. In the event of a conflict between this DPA and any provision of another document or agreement between the parties, whether earlier or later than this DPA, including the Terms and Conditions, the EULA and any order form or quote, the DPA prevails for everything relating to the Processing of Personal Data, including where the other provision would be more protective. An additional guarantee binds NEXT BP only if this DPA or an amendment signed by both parties provides for it.

11.2 Term. This DPA applies from the Client's acceptance of the Terms and Conditions, including at the start of a free trial, and remains in force as long as NEXT BP processes Client Data.

11.3 Signature. A version of this DPA signed by NEXT BP can be obtained on request at privacy [at] blast-audit.com.

11.4 Language. This DPA is published in French, English and Spanish. In the event of a discrepancy, the French version prevails.

11.5 Governing law. This DPA is governed by French law. Any dispute relating to it falls within the jurisdiction of the courts designated in the Terms and Conditions.

11.6 Amendment. NEXT BP may amend this DPA on the following terms. Each published version bears its date. NEXT BP keeps a dated history of the versions. An earlier version can be obtained on request at privacy [at] blast-audit.com.

(a) Sub-processors. The addition or replacement of a Sub-processor is governed by Section 4.4 alone, including the thirty (30) days' notice by e-mail to the account owner and the right to object in Section 4.4(d). The rules in paragraphs (b), (c) and (d) do not apply to that addition or replacement.

(b) Reduction of protection. Any other amendment that reduces the protection of Client Data, including the lengthening of a retention period already set out in Annex 1, is notified by e-mail to the account owner at least thirty (30) days before it takes effect. The Client may object in writing to privacy [at] blast-audit.com before that date; the parties then seek a solution in good faith and, failing agreement, the Client may terminate the subscription concerned, free of charge, before the effective date, with the refund provided for in Section 12.5. Otherwise, the amendment applies to the Client on its effective date. Acceptance under paragraph (d) constitutes agreement.

(c) Other amendments. Any other amendment takes effect on publication of the updated DPA, which bears its date, except where NEXT BP submits that version for acceptance under paragraph (d). NEXT BP informs the Client by e-mail to the account owner or in the Software no later than that date. The addition of a function of the Software that the Client chooses to use falls under this paragraph where the updated DPA describes that function, its purpose and its retention period in Annex 1 and, where the function processes categories that are not yet listed there, those categories of Personal Data and of Data Subjects, and where it does not reduce the protection of Client Data already processed. If it reduces that protection, paragraph (b) applies. If it adds or replaces a Sub-processor, Section 4.4 applies. A clarification that does not change the meaning also falls under this paragraph, as does an amendment required by law or by a supervisory authority, even if it reduces the protection. An update of Annex 2 that does not reduce the overall level of protection is governed by Section 4.5 and takes effect under this paragraph.

(d) Acceptance in the Software. NEXT BP may submit a version of this DPA to the Client for acceptance in the Software. The owner or an administrator of the Client's organisation accepts it for the organisation, with no imposed delay; that acceptance binds the Client, and the Software records its author and its date. A version submitted for acceptance governs the Processing of Client Data from that acceptance; until then, the earlier version continues to govern it. This option does not apply to the addition or replacement of a Sub-processor. This version, dated 31 October 2026, is submitted for that acceptance. For a Client that has not accepted it, the version of 21 October 2026 continues to govern the Processing, under the conditions of its own Section 11.6.

---

12. Non-compliance with the DPA and termination

12.1 Suspension. Without prejudice to the GDPR, if NEXT BP breaches its obligations under this DPA, the Client may instruct it in writing to suspend the Processing of Client Data until it complies or until termination. NEXT BP promptly informs the Client if it is unable to comply with this DPA, for whatever reason.

12.2 Termination by the Client. The Client may terminate the Principal Agreement, insofar as it concerns the Processing of Personal Data, by e-mail to privacy [at] blast-audit.com, with immediate effect, if:

(a) the Processing has been suspended under Section 12.1 and compliance with this DPA is not restored within a reasonable time and in any event within one month of the suspension;

(b) NEXT BP is in substantial or persistent breach of this DPA or of its obligations under the GDPR, and has not remedied it within thirty (30) days of a written formal notice from the Client, unless the breach cannot be remedied;

(c) NEXT BP fails to comply with a binding decision of a competent court or of the competent Supervisory Authority regarding its obligations under this DPA or the GDPR.

The cure period in case (b) replaces, for these cases, the one in Section 13.3 of the Terms and Conditions and in Section 8.2 of the EULA.

12.3 Termination by NEXT BP. NEXT BP may terminate the Principal Agreement, insofar as it concerns the Processing of Personal Data, where, after NEXT BP has informed the Client that an instruction infringes Data Protection Legislation (Section 4.2), the Client maintains that instruction.

12.4 After termination. Section 7 applies.

12.5 Refund. Where the Client terminates under Section 4.4(d) or Section 12.2, or else under Section 11.6(b), NEXT BP refunds the portion of the subscription fees paid in advance that covers the period remaining after the effective date of termination, calculated pro rata by the number of days. The refund is made within thirty (30) days of the effective date, to the payment method used. It is the financial consequence of the termination itself and is not added to damages for the termination alone.

---

Annex 1 — Description of the Processing

Parties. Controller: the Client, identified by the information it provides when it signs up and subscribes. Contact person: the account owner, at the e-mail address recorded in the Software, or the person the Client designates at privacy [at] blast-audit.com; data protection officer: the one the Client indicates, if any. Date of accession: date of acceptance of the Terms and Conditions. Processor: NEXT BP, French simplified joint-stock company (société par actions simplifiée, SAS), 127 rue de la Tour, 75016 Paris, France, RCS Paris 920 753 233. Contact person: the president of NEXT BP, privacy [at] blast-audit.com. NEXT BP has not designated a data protection officer.

Categories of Data Subjects. Natural persons whose data appear in the documents the Client submits, including the ledgers and other data exports imported into an analysis project, and the workbook ranges sent to it from Excel: officers, employees, shareholders, customers, suppliers and other counterparties of the entities the Client audits or advises, bank account holders, signatories. The Client's Users are also Data Subjects in respect of Usage Data, even where no document names them, including former members for the retention period in Section 2.5, and in respect of their progress in the Blast Audit Academy. They are also Data Subjects where their name or their actions appear in Client Data, for example in an engagement's task log, in the journal of an analysis project, which names the member who ran each step or approved a run proposed by the assistant, or in a financial statement review: the review's members and their access, documents added or removed, annotations, comments and their replies, checklists and the AI's answers, reviewers' verdicts, analysis settings and findings sent to Excel. Recipients of a PBC request list are also Data Subjects: the persons, at the Client's clients or elsewhere, to whom a User sends requests for documents, and the colleagues to whom they hand a request. Persons whose data appear in the files these recipients send are Data Subjects on the same basis as those of the documents the Client submits.

Categories of Personal Data. Identification and contact data; professional data (position, employer); financial and banking data (account numbers, balances, transactions, accounting entries with their accounts and descriptions, invoices, payments); payroll and human resources data appearing on payslips and payroll records, which may include the social security number; tax data; contractual data; signatures; any other data contained in the documents submitted and in the workbook ranges sent to an analysis project; the content of a financial statement review: the text that OCR reads in its documents, annotations, comments and their replies, checklists, the AI's answers with the passages they cite, reviewers' verdicts and their notes, analysis settings (including the dictionary and the ignore list of the language check) and findings sent to Excel; the identity of members recorded in a review, with the date of each act: the review's members, their access level (read or full) and the member who added them; the member who creates the review; the member who closes it; the member who adds or removes a document, or runs its reading again; the member who creates an annotation and the member who last modifies it; the member who creates a comment and the member who last modifies it; the author of a reply; the member who imports a checklist; the member who runs the AI on it; the member whose session records an answer of the AI; the author of a verdict; the last member who modifies the analysis settings; the member who sends findings to Excel; the member who requests an export; the name or e-mail address shown on a comment, a reply or a reviewer's verdict, which the checklist sheets sent to Excel repeat; in an analysis project, the identity of the member who ran each step of the analysis journal or approved a run proposed by the assistant; voice recordings of Users when they use voice input, and the resulting transcripts. Usage Data as defined in Section 2.5: name, e-mail address, technical account identifier, role, active-member status, whether the member holds a licence for the Excel add-in (yes or no), the usage and consumption indicators listed in that Section, and the breakdown by feature. The usage of former members, and usage that is not linked to any member, appears only on a "former members" line with no name. That line is not anonymous: when only one person has left the organisation, it shows that person's totals. For a PBC request list: the requests; the e-mail address and language of each recipient; the record of their actions through their link, with the date (link opened, recorded at most once a day; file sent or withdrawn; message; request handed to a colleague); their messages; the reasons they give when they have nothing to send; the files they send and their content; the results of the AI checks on those files, where the Client has set questions for them (the answers, with the passages cited); the identity of the member who sent each request. Conventions that the agent retains at a User's request, where the Client's organisation has turned them on. The Client's procedures, their versions, the conversations used to write them and the update proposals. Name and identifier of the workbooks open in the Excel add-in, which the add-in reports to the MCP server. Users' progress in the Blast Audit Academy: lessons and paths completed, with their date, and answers to exercises and quizzes, with their score.

Special categories of data and data relating to offences. Not sought. They may be present incidentally in documents, annotations, comments, reviewers' notes, checklists, the AI's answers, messages or the reason a recipient gives when they have nothing to send (for example, health data on a payslip, trade union dues or a court decision). Additional safeguards: processing limited to the task requested by the User; retention limited to the periods below; access by NEXT BP personnel limited to the cases in Section 4.3; the measures of Annex 2.

Frequency. Continuous, at each action of a User, of the engagement agent, of the assistant of an analysis project or of a recipient of a PBC request list.

Nature of the Processing. Receipt, hosting, optical character recognition (OCR), analysis by AI models, extraction of values, answers to questions about documents, checking of the results tables of the engagement agent and the Excel agent before delivery, classification, matching between workpapers and documents, web search approved by the User, transcription of voice input, display, export and deletion. For each Excel agent conversation: receipt of the name of each document saved in the workbook and of the text that OCR read in it, retention of that text with the content of the conversation, and listing, searching and reading of those documents on NEXT BP's servers. In analysis projects: import of data sources and building of datasets, execution of analysis recipes, packs and scripts in an isolated execution environment (sandbox) described in Annex 2, replay of the analysis journal, and proposals of the project's AI assistant, which run only after the approval of a User with full access to the project; at each read, the assistant receives from the project only the names and columns of sources and datasets, row counts, totals and a few sample rows; the assistant also receives the Users' messages and the history of its conversation, which may repeat those extracts. For PBC request lists: sending the requests, the reminders and new links by e-mail to the recipients the Users designate and to the colleagues to whom a recipient hands a request, receiving the recipients' files and messages, antivirus analysis of each file before it can be used, and copying accepted files into an engagement or importing them into a workbook at a User's request. Search of the SharePoint of the Client's organisation, at an administrator's request, through the Microsoft 365 Copilot retrieval service (Microsoft Graph) and with that administrator's Microsoft 365 connection: Microsoft processes the query under the Client's Microsoft 365 contract, and the Software displays extracts, with their title and author, and is designed not to keep them. Building per-User usage indicators and, where the Client turns on the setting in Section 2.5, presenting those indicators to the owners and administrators of its organisation, and exporting those indicators (in the browser or through the Exports page). Presenting to the owners and administrators of the Client's organisation the progress of its Users in the Blast Audit Academy, including each User's best quiz score. Re-reading of pages by Standard OCR to measure the quality of the reading (Section 5.2).

Purpose. To provide the functions of the Software that the Users request: reading and analysing audit documents, including, by the Excel agent, the documents saved in a workbook, extracting values into workpapers, linking the values to their source where possible, carrying out the tasks of the engagement agent and the Client's procedures, keeping the financial statement reviews and the work their members do in them, answering a review's checklists with AI and sending the review's findings to Excel, collecting through the PBC request lists the documents that Users request from their clients or from other persons, and copying them into an engagement or importing them into a workbook, analysing, in analysis projects, the ledgers and other data exports that Users import into them, importing files from the Client's own cloud storage (Google Drive, Microsoft 365) and searching its SharePoint, answering requests from the AI assistants that the Client connects to the MCP server, and training Users in the Blast Audit Academy. To measure and maintain the quality of the reading provided to the Client (Section 5.2). Where the Client turns on the setting in Section 2.5, to present and export Usage Data per member to the owners and administrators of its organisation.

Duration of the Processing. The term of the Principal Agreement, then until Client Data are deleted or returned under Section 7 and, for the per-member view setting record alone, five (5) years after the end of the Principal Agreement (Section 2.5); for each category of data, the retention periods below apply.

Retention.

The periods below are maximum periods. If a deletion fails, or if processing still under way holds it back, it is retried and takes place as soon as possible.

Annex 2 — Technical and Organisational Measures

Hosting and location. The application, databases and file storage are hosted on Microsoft Azure in the France Central region (Paris). The archive of the Azure platform's activity logs is geo-replicated to the France South region (Marseille); Client files are not. AI processing and the advanced reading of scanned pages (Section 5.2) run on Microsoft resources in the Sweden Central region, in the European Union Data Zone. The standard reading of a scanned page, when it happens, is performed by software that NEXT BP operates itself, in the Microsoft Azure environment that hosts the application and in the same region; no separate OCR provider is involved.

Execution sandboxes. The scripts that the engagement agent, the Excel agent and analysis projects run are executed in isolated execution environments, hosted on Microsoft Azure, designed to have neither outbound network access nor access to the application's secrets. Each run of an analysis project (recipe, pack, script or replay) takes place in its own environment, deleted after the run. The Software is designed so that only a User with full access to the project can import a source into it, launch a run or approve a proposal of the assistant. The analysis journal is designed so that an entry modified or removed is detected when it is verified.

Physical security. Client Data are hosted in Microsoft Azure data centres, whose physical security is covered by Microsoft's certifications and reports (Section 6.1).

Encryption. Data are encrypted in transit with TLS (version 1.2 or higher) between the Software, NEXT BP's servers and the Sub-processors. Databases, file storage and backups are encrypted at rest by Microsoft Azure with keys managed by Microsoft. The access tokens of the Google Drive and Microsoft 365 connectors are additionally encrypted by the application before they are stored.

Pseudonymisation. The Software must read document content to provide its functions and does not pseudonymise it; it limits its retention to the periods in Annex 1.

Isolation and access control. Each organisation's data are logically separated, and the Software is designed to check every request against the User's organisation and rights. Users authenticate through WorkOS, with single sign-on (SAML or OpenID Connect) available for organisations that use it. Access to production systems is limited to the NEXT BP personnel who need it.

Key and secret management. Application secrets and keys are kept out of the source code. Connector tokens are encrypted with a key reserved for that purpose.

System configuration. Change management for the infrastructure, with review of changes.

Minimisation and deletion. Document content is kept only for the periods in Annex 1 and is deleted by automated purges, which retry any deletion that fails. Azure OpenAI is configured not to keep requests for later retrieval (Section 5.3); Microsoft does, however, temporarily store all requests and all responses for abuse monitoring (Section 5.4).

Portability and erasure. Export from the Software (Section 7.2), automated deletion according to the periods in Annex 1, and deletion or return at the end of the contract (Section 7.3).

Data quality. The Software is designed to link, where possible, each result to its source in the document so that the User can check it (Section 5.6).

Logs and telemetry. Operational logs and error reports are designed not to contain document content; logs are kept for the period set in Annex 1. Product analytics record events without document content and without the per-member detail in Section 2.5.

Backups and continuity. Databases are backed up automatically and backups are kept for the period set in Annex 1, which allows a restore after an incident.

Vulnerability management. NEXT BP publishes a vulnerability disclosure policy (security [at] blast-audit.com), keeps its dependencies up to date and addresses vulnerabilities according to their severity.

Incident handling. Incidents are handled by NEXT BP, which notifies the Client of Personal Data Breaches under Section 4.8.

Governance. The president of NEXT BP is responsible for security and data protection.

Certifications. As at the date of this DPA, NEXT BP holds an ISO/IEC 27001:2022 certificate for Blast Audit (design, development, operations and support) and a SOC 2 Type 2 report on Blast Audit, covering the Trust Services Criteria for Security, Availability and Confidentiality. On request, it provides the certificates in force and its most recent reports, under a confidentiality agreement (Section 6.1). For hosting, NEXT BP also relies on Microsoft Azure's certifications.

Annex 3 — Sub-processors

List dated October 28, 2026.

A. Sub-processors (Client Data)

Changes are announced under Section 4.4.

Subject matter, nature and duration. The subject matter and nature of the Processing are set out in the "Service" and "Personal data" columns. Each Sub-processor processes Client Data for the term of the Principal Agreement, within the retention periods of Annex 1, except: Azure OpenAI, which does not keep requests or responses for later retrieval (Section 5.3) but temporarily stores all of them for abuse monitoring, for a duration Microsoft's contract does not set (Section 5.4); the Azure AI service in the EU Data Zone, whose requests and responses Microsoft may temporarily store for abuse monitoring, with no commitment from Microsoft on how long (Section 5.4); Azure AI Content Understanding, whose results are deleted once read and at most 24 hours after the operation is created. For Azure OpenAI and for the Azure AI service in the EU Data Zone, Section 5.4 states who at Microsoft may review these requests and responses, and when Microsoft deletes them at the latest.

B. Other providers of NEXT BP (Section 2.3), for information

These providers process the data for which NEXT BP acts as Controller (Section 2.3). They are not Sub-processors within the meaning of this DPA.

Annex 4 — Transfers Outside the European Economic Area

A. Client to NEXT BP. The Client and NEXT BP are established in the European Union; the communication of Client Data to NEXT BP is not a transfer to a third country. If the Client is established outside the European Economic Area, the parties agree on the appropriate safeguards before any Processing.

B. NEXT BP to Sub-processors and other providers. For each Sub-processor or other provider in Annex 3 that is established in the United States or may access data from there:

• if it is certified under the EU-U.S. Data Privacy Framework, the transfer is based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023;
• otherwise, or in addition, the transfer is governed by the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Three (processor to processor) for Client Data, incorporated into the Sub-processor's data processing agreement. Where NEXT BP acts as Controller (Section 2.3), Module Two (controller to processor) applies.

C. Supplementary measures. Data are encrypted in transit and at rest; Client Data hosted by NEXT BP remain in the European Union; only the data necessary for each service are sent to the Sub-processor.

D. Copy. The Client can obtain a copy of the safeguards applicable to a Sub-processor by writing to privacy [at] blast-audit.com.