Duomenų tvarkymo sutartis

This Data Processing Agreement (the "DPA") is concluded between:

• NEXT BP, a French simplified joint-stock company (SAS) with a share capital of €100, registered with the Paris Trade and Companies Register under number 920 753 233, whose registered office is at 127 rue de la Tour, 75016 Paris, France ("NEXT BP" or the "Processor"); and
• the legal entity that subscribes to Blast Audit or starts a free trial (the "Client").

It forms part of the Terms and Conditions and of the End-User License Agreement (EULA) (together, the "Principal Agreement"). It sets out the conditions under which NEXT BP processes Personal Data on behalf of the Client when it provides Blast Audit: the Excel add-in, the web dashboard, the connectors to the Client's cloud storage, the MCP server, the engagement agent, the financial statement review, the PBC request lists, analysis projects, the Blast Audit Academy and any other function of Blast Audit that NEXT BP adds and describes in this DPA (together, the "Software"). It is the contract required by Article 28 of the GDPR.

This DPA draws on the standard contractual clauses of Commission Implementing Decision (EU) 2021/915, without reproducing them where a clause so indicates: Annex 1 corresponds to their Annexes I and II, Annex 2 to their Annex III and Annex 3 to their Annex IV.

---

1. Definitions

Terms defined in the GDPR (including "Controller", "Processor", "Personal Data", "Processing", "Data Subject", "Personal Data Breach" and "Supervisory Authority") have the meaning given to them in the GDPR. In addition:

• "GDPR" means Regulation (EU) 2016/679 of 27 April 2016.
• "Data Protection Legislation" means the GDPR, French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and any other Union or Member State law on the protection of Personal Data that applies to the Processing.
• "Client Data" means the documents, files, images, audio, text, instructions, workpapers and results that the Client or its Users submit to the Software or that the Software produces from them, and the Personal Data they contain. Usage Data that identify a User are included.
• "Usage Data" means data relating to the use of the Software by Users, as described in Section 2.5. Organisation-level totals that do not identify a User, the product-analytics data referred to in Section 2.3, and the billing records of artificial-intelligence credits and of pages submitted for optical character recognition referred to in Section 2.3, are not included. The volume of credits shown per member is an indicator of the view in Section 2.5, distinct from those records.
• "Sub-processor" means any processor engaged by NEXT BP to carry out Processing of Client Data on behalf of the Client.
• "Users" means the persons whom the Client authorises to use the Software.
• "Annexes" means the four annexes to this DPA, which form part of it.

This DPA is read and interpreted in the light of the GDPR. It may not be interpreted in a way that runs counter to the rights and obligations provided for in the GDPR or in a way that prejudices the fundamental rights or freedoms of Data Subjects.

---

2. Roles and Scope

2.1 The Client is the Controller of the Personal Data contained in Client Data. It determines the purposes of the Processing and alone decides which documents its Users submit to the Software. Where the Client itself processes these data as a processor on behalf of a third party, NEXT BP acts as its sub-processor and the Client passes on to NEXT BP the instructions it receives.

2.2 NEXT BP is the Processor. It processes Client Data only to provide the Software to the Client, in accordance with this DPA.

2.3 Data outside this DPA. NEXT BP acts as an independent Controller, and not under this DPA, for the data it needs to run its own business: Users' accounts and authentication, billing, support requests, security of the service, product analytics and commercial relations. These data are described in the Privacy Policy.

Product analytics do not include the consultation of usage per member. That consultation is the Processing in Section 2.5, carried out on behalf of the Client.

Product analytics are carried out with PostHog (Annex 3, Part B). Per-member detail (name, e-mail address and the indicators in Section 2.5) and the usage events recorded on behalf of the Client, together with their aggregates, are not transmitted to PostHog. NEXT BP does transmit to PostHog, linked to the User's identifier, and regardless of the choice made in the dashboard cookie banner: one event per call to an AI model, whether operated by Microsoft (Azure OpenAI service) or by a provider chosen by the Client (Section 5.7), with, for that call, the technical identifiers of the call and of the run, the feature, the provider and the model used, the number of tokens (input, output, cache, reasoning), the duration, the status, the error category and the estimated cost; optical-character-recognition metrics (size, file type, duration, engine) and document-agent metrics (run and organisation identifiers, feature, final status, number of documents, pages, tasks, expected results and validation errors, tokens, model names, number of model calls, costs, durations); billing events; attempts to use AI chat without access and trial limits reached (daily or total limit, with its value), with the organisation identifier; e-mail metrics (delivered, opened, clicked, bounced, marked as spam, unsubscribed; subscriptions and unsubscriptions), with the delivery, campaign, action and newsletter identifiers and the timestamp; feature-flag evaluations (the flag requested and the result, with the User's identifier, the organisation identifier and, for some flags, the e-mail address); usage events from the Excel add-in (actions in the product, ratings of the assistant’s answers with the session and message identifiers, credits and response time, tool failures with the tool name and the cause, language, add-in version, Excel host and platform and, for the detection and import of DataSnipper workbooks, error code, operation, missing technical requirement, numbers of files and snips, with no file name or content) and from the administration console (pages viewed, access refusals with the identifier of the account that tried to sign in, whether the account is an administrator, calls to the API with method, status and duration, navigation performance). Those transmissions fall under this Section.

Technical metrics that contain no document content may be kept by NEXT BP for billing, quotas, security and service reliability. They are kept for the period that the Privacy Policy states for the category concerned, including for events sent to PostHog and for billing records.

2.4 Scope. This DPA is without prejudice to the obligations to which the Client is subject as Controller under the GDPR. It is not enough on its own to govern transfers outside the European Economic Area, which are covered by Section 8 and Annex 4.

2.5 Usage Data and the per-member view.

The Software records Usage Data relating to Users. Usage Data are Personal Data where they relate to an identified or identifiable person, including through a technical identifier that NEXT BP can link to that person.

Usage Data comprise:

• account identification data: name, e-mail address, technical account identifier, role within the Client's organisation, status as an active member, and whether the member holds a licence for the Excel add-in (yes or no);
• the following indicators, and only those indicators: date (the day, without the time) of the last activity over the last 13 months, whatever the period consulted, number of active days in the period consulted, number of documents imported, number of snips, number of matching runs, number of pages submitted for optical character recognition, number of runs of the artificial-intelligence features, and volume of credits consumed for those features, expressed in euros and as a share of the credits consumed by the organisation over the period consulted.

Last activity is the day of the last usage event: an action reported by the Excel add-in or a document import. Runs of the artificial-intelligence features and credits do not count towards it. A sheet for each member breaks those totals down by feature: number of events, runs of the artificial-intelligence features, and credits. The usage of people who have left the organisation, and usage that is not linked to any member, is added up on a single "former members" line, with no name. That line is not anonymous: when only one person has left the organisation, it shows that person's totals.

Usage Data do not include the content of the Client's documents, the names of those documents, the content of exchanges with the artificial-intelligence features, or the chronological detail of actions. The Software produces no score, no ranking and no individual performance indicator. It does not measure working time.

The per-member view is hidden by default. Only the owners and administrators of the Client's organisation can see it, and only after an owner or an administrator has turned on the organisation setting. Before turning it on, that person ticks that they have informed the members and consulted the CSE or the Betriebsrat where required. Turning the setting on records who did so and when. Only the last change to the setting is kept: each change replaces the previous one. This record is not deleted automatically when the account is closed. It is the documented instruction, within the meaning of Section 4.1, to present and export Usage Data per member. While the setting is off, the Software refuses the detail, including in response to a request. The Client may turn the setting off at any time. After the setting is turned off, the Software refuses any new request for the detail. A tab that another owner or administrator already has open keeps the figures it has already loaded, and can still export them, until it reloads the data. Per-user export files already produced on the Exports page can still be downloaded by owners and administrators until they expire, thirty (30) days after they were produced. They are then deleted.

The period consulted is chosen by the Client. It is at least twenty-eight (28) days, inclusive of both end dates, and at most the last thirteen (13) months.

The Client is the Controller of this consultation. Before turning the setting on, the Client ensures that the consultation is lawful: legal basis, prior information of the Data Subjects and, where the law that governs the Client so requires, information and consultation of staff representatives or co-determination by the competent body. The box ticked at activation does not prove that those steps took place. NEXT BP provides the Client with a notice describing the view. That notice does not discharge the Client's obligations.

NEXT BP presents and exports the per-member view on that instruction, and only on the terms above. NEXT BP does not use that view for its own purposes, in particular to evaluate a person, to prospect, to build a profile, or to train or adjust a model. Per-member detail is not transmitted to PostHog or to any other product-analytics tool, and it is not sent back to the identity directory.

An export requested by an owner or an administrator contains only the fields of the view and of the per-member sheet. The CSV file is produced in the browser. NEXT BP does not make a copy of this CSV file. The per-user export on the Exports page follows the same rules and gives the same totals, with no row per day; it is produced on NEXT BP's servers and can be downloaded by owners and administrators for 30 days, then deleted.

Raw usage events and daily aggregates per User are kept for thirteen months, plus one day of technical margin; deletion takes place each day. Daily aggregates per organisation, which are totals without a personal identifier, are kept. Records of artificial-intelligence credits and of pages submitted for optical character recognition are billing records within the meaning of Section 2.3. They keep the User's identifier for billing, refunds and tracking of the credit period. They are not limited to thirteen months. The per-member view reads them only for the period consulted, from twenty-eight days to thirteen months. The credits shown per member are an indicator of that view. Records of the execution of the artificial-intelligence features (date, feature, status, consumption, technical identifiers, storage paths, progress and error messages, technical metadata) also keep the User's identifier, with no thirteen-month limit; the per-member view reads them only for the period consulted. File names are removed from usage events, including the history. Copies that remain in backups disappear on the seven (7) day cycle in Section 7.3. The end of the contract does not trigger deletion of Usage Data within the period in Section 7.3. Raw usage events and daily aggregates per User are deleted by the thirteen-month purge. Records of credits and of pages submitted for optical character recognition remain billing records (Section 2.3). Records of the execution of the artificial-intelligence features keep the User's identifier, with no thirteen-month limit.

NEXT BP's personnel access per-member detail only to carry out a support request from the Client or to secure the service, and only to the extent necessary. They remain bound by Section 4.3.

---

3. Details of the Processing

The subject matter, nature, purpose and duration of the Processing, the types of Personal Data and the categories of Data Subjects are described in Annex 1. The Processing lasts as long as the Principal Agreement, then until Client Data are deleted or returned in accordance with Section 7.

---

4. Obligations of NEXT BP

4.1 Documented instructions. NEXT BP processes Client Data only on the documented instructions of the Client, including with regard to transfers of Personal Data to a third country or an international organisation, unless it is required to do so by Union or Member State law to which it is subject. In that case, NEXT BP informs the Client of that legal requirement before the Processing, unless that law prohibits such information on important grounds of public interest. The Principal Agreement, this DPA, the Users' actions in the Software and the settings chosen by the Client's administrators (for example, enabling a connector) constitute the Client's documented instructions. Turning on the per-member view setting in Section 2.5 is the documented instruction to present and export those data. Leaving it off is the instruction not to present them: the Software then refuses the detail. The Client may give further instructions throughout the duration of the Processing; they are always documented, for example by e-mail to privacy [at] blast-audit.com. If NEXT BP cannot carry out a further instruction with the functions of the Software, it informs the Client without delay and Section 12 applies.

4.2 Unlawful instructions. NEXT BP immediately informs the Client if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. NEXT BP may suspend the execution of that instruction until the Client confirms or amends it in writing.

4.3 Confidentiality. NEXT BP ensures that persons authorised to process Client Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access Client Data only to the extent strictly necessary to provide the Software, to answer a support request from the Client, or to handle an incident.

4.4 Sub-processors.

(a) General authorisation. The Client gives NEXT BP a general written authorisation to engage Sub-processors. The Sub-processors engaged on the date of this DPA are listed in Part A of Annex 3, which constitutes NEXT BP's dated sub-processor list.

(b) Obligations of Sub-processors. NEXT BP engages each Sub-processor by way of a contract that imposes on it, in substance, the same data protection obligations as those imposed on NEXT BP under this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. NEXT BP ensures that each Sub-processor complies with these obligations. NEXT BP remains fully liable to the Client for the performance of its Sub-processors' obligations and informs the Client of any failure by a Sub-processor to fulfil its contractual obligations of which NEXT BP is aware.

(c) Changes. NEXT BP informs the Client of any intended addition or replacement of a Sub-processor at least thirty (30) days before it takes effect, by e-mail to the address of the Client's account owner and by publishing an updated, dated Annex 3. The notice states the name of the Sub-processor, its role, the location of the Processing and the transfer mechanism.

(d) Objection. Within this thirty-day period, the Client may object to the change in writing to privacy [at] blast-audit.com, on reasonable grounds relating to the protection of Personal Data. NEXT BP and the Client then seek a solution in good faith, for example a configuration in which the new Sub-processor does not process the Client's data. If no solution is found before the change takes effect, the Client may terminate the affected subscription, without penalty, with effect on the date of the change. The Client is then entitled to the refund provided for in Section 12.5.

(e) Copies of contracts. At the Client's request, NEXT BP provides a copy of the applicable contract concluded with a Sub-processor, in the version in force, and of any amendments to it, including where that contract consists of the standard terms the Sub-processor publishes. NEXT BP may redact trade secrets and other confidential information, including Personal Data.

(f) Disappearance of NEXT BP. NEXT BP uses the standard terms of its Sub-processors and cannot have a clause added to them for the Client's benefit. If NEXT BP has factually disappeared, has ceased to exist in law or has become insolvent, the Client may ask the administrator or liquidator to delete or return Client Data; Client Data remain subject to the retention periods in Annex 1.

(g) Urgent replacement. Where a Sub-processor stops its service or puts the security of Client Data at risk, NEXT BP may replace it with shorter notice. No Client Data are transmitted to the new Sub-processor before the Client is informed. The Client then has the rights in Section 4.4(d) for thirty (30) days. If the Client objects, NEXT BP stops transmitting Client Data through that Sub-processor for that Client.

4.5 Security. NEXT BP implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. NEXT BP may change these measures provided that the overall level of protection is not reduced.

4.6 Requests from Data Subjects. Taking into account the nature of the Processing, NEXT BP assists the Client by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests from Data Subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). If NEXT BP receives such a request directly, it forwards it to the Client without undue delay and does not respond to it itself, except to tell the Data Subject that the request has been forwarded. In an analysis project, the Software cannot erase one person inside a source: NEXT BP can carry out an erasure request about that person only by deleting that source, which remains possible while no dataset has been built from it, or by deleting the project; the Client may then import a redacted version of the source. Copies in backups disappear under Section 7.3, and requests and responses that Microsoft temporarily stores for abuse monitoring are not covered (Section 5.4).

4.7 Data protection impact assessment and prior consultation. Taking into account the nature of the Processing and the information available to it, NEXT BP assists the Client in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR. In particular, it provides the Client, on request, with the information the Client needs to carry out a data protection impact assessment (description of the Processing, data flows, Sub-processors, retention periods, security measures) and assists it in any prior consultation of the CNIL or of another competent Supervisory Authority. NEXT BP informs the Client without delay if it becomes aware that Personal Data it processes on the Client's behalf are inaccurate or have become outdated. For Usage Data, this assistance includes the description of the data, the access rights, the retention periods and the setting in Section 2.5, which the Client may add to its file. NEXT BP does not decide for the Client whether a data protection impact assessment is required, and it does not carry one out in the Client's place.

4.8 Personal Data Breaches.

(a) NEXT BP notifies the Client of any Personal Data Breach affecting Client Data without undue delay and within 48 hours after becoming aware of it, by e-mail to the address of the Client's account owner.

(b) The notification contains, to the extent known at that time: the nature of the breach, including, where possible, the categories and approximate number of Data Subjects and of records concerned; the name and contact details of NEXT BP's contact point (privacy [at] blast-audit.com); the likely consequences of the breach; and the measures taken or proposed by NEXT BP to address the breach and mitigate its possible adverse effects. Where all the information cannot be provided at the same time, NEXT BP provides it in phases, without further undue delay.

(c) NEXT BP cooperates with the Client so that the Client can notify the Supervisory Authority and, where required, the Data Subjects. NEXT BP does not make these notifications on the Client's behalf unless the Client instructs it to do so in writing.

(d) Where a Personal Data Breach concerns data processed by the Client itself, for example after a User's account has been compromised, NEXT BP assists the Client, taking into account the nature of the Processing and the information available to it, in notifying the Supervisory Authority, gathering the information required by Article 33(3) of the GDPR and, where required, communicating the breach to the Data Subjects.

4.9 Information. The parties are able to demonstrate compliance with this DPA. NEXT BP deals promptly and adequately with the Client's inquiries about the Processing of Client Data and answers them within ten (10) business days. It makes available to the Client all information necessary to demonstrate compliance with Article 28 of the GDPR and with this DPA, under the conditions of Section 6. It makes this information, including the results of any audit, available to the competent Supervisory Authority on request.

---

5. Artificial Intelligence

5.1 No training. NEXT BP does not use Client Data to train, fine-tune or otherwise improve any artificial intelligence or machine learning model, whether its own or a third party's.

5.2 AI providers. Except where the Client uses its own API key (Section 5.7), the AI models that process Client Data are operated by Microsoft (Azure OpenAI, the Azure AI service in the EU Data Zone that checks the engagement agent's and the Excel agent's results tables, Azure AI Content Understanding, Azure AI Speech) under Microsoft's data protection terms, under which Microsoft does not use Client Data to train generative AI foundation models without documented instructions from NEXT BP, and NEXT BP gives no such instructions. NEXT BP will engage no other AI model provider without imposing the same prohibition on training models with Client Data, and only in accordance with Section 4.4. Reading of scanned pages. When it happens, the reading of a page by NEXT BP's Standard OCR, software that NEXT BP operates itself, runs in the Microsoft Azure environment that hosts the application (Annex 3), in the same region; no separate OCR provider performs that reading. Standard OCR does not read every page. Azure AI Content Understanding reads each scanned page for which the result delivered to the Client does not come from Standard OCR, including pages read again automatically or at a User's request, all pages of an organisation that is not in the Standard OCR rollout, all pages of a region where it is not available and all pages sent by a version of the add-in that does not support it. Azure AI Content Understanding may also read pages that Standard OCR reads, in particular while Standard OCR is being evaluated. Where the Client uses its own Azure key (Section 5.7), every scanned page is read by the advanced reading, with the Client's key, under the Client's Azure contract.

5.3 No storage of requests for later retrieval. Requests sent to Azure OpenAI carry the store:false parameter: the service does not keep the prompts or the responses for later retrieval. NEXT BP does not use the stored completions, assistants, files, vector stores, batch or fine-tuning features of Azure OpenAI. The abuse monitoring in Section 5.4 does, however, lead Microsoft to temporarily store all requests and all responses.

5.4 Abuse monitoring by Microsoft. Microsoft temporarily stores all requests sent to Azure OpenAI and all responses, to monitor for and prevent abusive or harmful uses or outputs of the service (abuse monitoring). Microsoft's contract sets no duration for this storage. Only data that has triggered its automated systems may be reviewed by authorised Microsoft employees; for EU Data Boundary deployments, those employees are located in the European Economic Area. Microsoft's terms (Privacy & Security Terms) also allow its personnel located outside the EU Data Boundary to access data processing systems inside it remotely, as necessary to operate, troubleshoot, support and secure its services. Microsoft does not use this content to train generative AI foundation models without its customer's documented instructions, and NEXT BP gives no such instructions (Section 5.2). On 2 October 2026, NEXT BP applied for modified abuse monitoring, which removes this storage; Microsoft refused it on 4 October 2026, as it reserves it for customers managed by its account teams. This storage therefore takes place. Microsoft may also temporarily store, for abuse monitoring, the requests sent to the Azure AI service in the EU Data Zone that checks results tables (Section 5.2) and that service's responses; Microsoft has given NEXT BP no commitment on how long it keeps them. For this service too, only data that triggered Microsoft's automated systems may be reviewed by authorized Microsoft employees, located in the European Economic Area for a deployment within the EU Data Boundary, and Microsoft does not use this content to train generative AI foundation models without NEXT BP's documented instructions, which NEXT BP does not give. This service runs on a model version that Microsoft offers as a preview: Microsoft's terms for Azure previews apply to it, and Microsoft may apply to previews privacy and security measures that are lesser than or different from those this Section describes, including other abuse-monitoring practices. Microsoft makes no EU Data Boundary commitment for previews: the Microsoft employees who review this service's data are therefore not necessarily located in the European Economic Area. For either service, Microsoft's contract only sets a latest deletion: after NEXT BP's Azure subscription ends, Microsoft keeps this data for ninety (90) days in a limited-function account, then deletes it within the following ninety (90) days. That subscription is NEXT BP's: the end of a Client's Principal Agreement does not end it.

5.5 Web search. The Excel agent can propose a web search. The search query, written by the model, is shown to the User, and it is sent to Exa (Annex 3) only if the User approves it. The query may contain names or amounts taken from Client Data. Web search is not offered in a conversation once it has used document analysis features.

5.6 No automated decision. The Software produces suggestions (extracted values, answers, classifications, matches) linked to the words of the source document so that the User can check them. It makes no decision producing legal effects concerning Data Subjects or similarly significantly affecting them: the Client and its Users validate each result and remain responsible for their conclusions. In an analysis project, the project's AI assistant proposes analysis recipes and packs: none runs without the approval of a User with full access to the project (a User with read-only access cannot give it), and the results are computed by the Software's analysis engine, not by the AI model.

5.7 Provider chosen by the Client. When the Client saves in the Software an API key of an AI or OCR provider with which it has contracted itself, the requests concerned are sent to that provider, under the Client's account and on the terms the Client accepted. That provider is chosen by the Client and bound to it by its own contract: it is not a Sub-processor of NEXT BP and is not listed in Annex 3. The Client is responsible for checking that this contract meets Article 28 GDPR and, where data is transferred, Chapter V. Sections 5.2 to 5.4 do not apply to those requests; Section 5.1 still binds NEXT BP. The Client may remove its key at any time; later requests go back to the providers in Annex 3.

---

6. Audits

6.1 Documentation first. On request, NEXT BP provides the Client with the documentation that demonstrates its compliance: this DPA and its Annexes, answers to a reasonable security questionnaire, NEXT BP's ISO/IEC 27001:2022 certificate and SOC 2 Type 2 report (Annex 2), and the certifications and reports that Microsoft makes available for its hosting services (SOC 3 report and ISO certificates published on the Microsoft Service Trust Portal). The SOC 2 Type 2 report is confidential: NEXT BP provides it to the Client and to the Client's auditors under a confidentiality undertaking.

6.2 On-site audit. If the Client reasonably considers that this documentation is not sufficient to demonstrate compliance with this DPA, it may carry out, itself or through an independent auditor bound by confidentiality who is not a competitor of NEXT BP, an on-site audit or an audit by remote access, at most once per twelve-month period, with at least thirty (30) days' written notice. The scope, date and duration are agreed in advance. The audit takes place during business hours, without unreasonably disrupting NEXT BP's activity and without access to the data of other clients or to the facilities of Sub-processors, which are covered by their own audit reports.

6.3 Additional audits. The limit of one audit per year does not apply to an audit required by a Supervisory Authority, to an audit carried out following a Personal Data Breach affecting Client Data, or to an audit justified by serious indications that NEXT BP does not comply with this DPA, which the Client states in writing. For these audits, the notice period is reduced to ten (10) business days.

6.4 Costs. Each party bears its own costs. The Client bears the costs of the audit and of its auditor, unless the audit reveals a material breach by NEXT BP of its obligations under this DPA, in which case NEXT BP bears the reasonable costs of the audit. NEXT BP remedies any breach identified without undue delay.

---

7. End of Processing: Return and Deletion

7.1 Data already deleted during the subscription. Most Client Data are deleted during the subscription in accordance with the retention periods in Annex 1: document content submitted for OCR or analysis is deleted at most 24 hours after upload, from the copies that NEXT BP controls. The content of an Excel agent conversation is deleted at most 24 hours after it reaches NEXT BP's servers, from the copies that NEXT BP controls, and database backups keep it up to seven (7) more days (Section 7.3). The content of an engagement of the engagement agent, of a financial statement review, of a PBC request list or of an analysis project does not follow this period: it follows the period that Annex 1 sets for it. Requests and responses that Microsoft temporarily stores for abuse monitoring are not covered (Section 5.4). Workbooks remain in the Client's own Excel files; the cell ranges that a User sends to an analysis project (workbook snapshots) are copied into that project and follow its retention period.

7.2 Export. Until the end of the Principal Agreement, the Client can export the data that NEXT BP still holds, in particular engagements of the engagement agent, the files of PBC request lists and analysis projects, from the Software, subject to what follows. A new export of an engagement, an analysis project or a financial statement review is refused when its deletion is due less than one (1) day later; an export that is already ready can still be downloaded until that deletion. Only a closed financial statement review can be exported, by a member with full access. The export of a review contains the documents' files and their prepared PDFs that NEXT BP still keeps, and a manifest that lists every document. The export contains neither the annotations, nor the comments, nor the checklists with their answers and verdicts, nor the analysis settings, nor the findings sent to Excel.

7.3 Deletion. At the end of the Principal Agreement, NEXT BP deletes all Client Data within thirty (30) days, unless the Client asks, within that period, for the return of data still held; NEXT BP then returns them in a structured, commonly used format and deletes them afterwards. This Section also applies to engagements, financial statement reviews, PBC request lists and analysis projects still open at the end of the Principal Agreement. Copies in database backups disappear when the backups expire, within seven (7) days after deletion. NEXT BP keeps no copy, unless Union or Member State law requires storage of the Personal Data. The requests and responses that Microsoft temporarily stores for abuse monitoring (Section 5.4) are subject to Microsoft's terms; they are not covered by the deletion within thirty (30) days above, because NEXT BP cannot delete them for each Client; Microsoft's contract sets no duration for this storage, only a latest deletion after NEXT BP's Azure subscription ends (Section 5.4).

7.4 Certificate. On request, NEXT BP provides the Client with a written certificate of deletion.

---

8. Transfers Outside the European Economic Area

8.1 Client Data are hosted and processed within the European Union, except for the transfers described in Annex 4. By accepting this DPA, the Client instructs NEXT BP to carry out these transfers. NEXT BP makes no other transfer to a third country or an international organisation, except on the documented instructions of the Client or to fulfil a requirement of Union or Member State law to which it is subject, and always in accordance with Chapter V of the GDPR.

8.2 Where a Sub-processor is located outside the European Economic Area, or may access data from outside it, the transfer is covered by the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework for certified recipients, or by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914. Annex 4 sets out the mechanism used for each recipient. The Client can obtain a copy of these safeguards by writing to privacy [at] blast-audit.com.

---

9. Obligations of the Client

9.1 The Client ensures that the Processing it entrusts to NEXT BP has a legal basis and that the Data Subjects have received the information required by Articles 13 and 14 of the GDPR.

9.2 The Client submits to the Software only the documents necessary for its assignments. The documents processed may incidentally contain special categories of Personal Data or data relating to criminal convictions and offences (for example, a sick-leave line on a payslip or a court decision in a litigation file). The Client remains responsible for deciding to submit them; NEXT BP applies to them the additional safeguards described in Annex 1.

9.3 The Client's instructions comply with Data Protection Legislation. The Client designates its account owner as NEXT BP's contact for this DPA and keeps that person's e-mail address up to date in the Software.

---

10. Liability

Each party is liable for the damage it causes in breach of this DPA under the conditions and within the limits of the Principal Agreement, including the specific cap for breaches of data protection obligations set out in Section 11 of the Terms and Conditions. These limits do not apply to the rights of Data Subjects under Article 82 of the GDPR, nor to administrative fines imposed on a party, which remain borne by that party.

---

11. Precedence, Term and Governing Law

11.1 Precedence. In the event of a conflict between this DPA and any provision of another agreement between the parties, whether concluded before or after this DPA, including the Terms and Conditions, the EULA and any order form or quote, the DPA prevails for everything relating to the Processing of Personal Data. A provision that gives Personal Data greater protection is not a conflict.

11.2 Term. This DPA applies from the Client's acceptance of the Terms and Conditions, including at the start of a free trial, and remains in force as long as NEXT BP processes Client Data.

11.3 Signature. A version of this DPA signed by NEXT BP can be obtained on request at privacy [at] blast-audit.com.

11.4 Language. This DPA is published in French, English and Spanish. In the event of a discrepancy, the French version prevails.

11.5 Governing law. This DPA is governed by French law. Any dispute relating to it falls within the jurisdiction of the courts designated in the Terms and Conditions.

11.6 Amendment. NEXT BP may amend this DPA on the following terms. Each published version bears its date. NEXT BP keeps a dated history of the versions. An earlier version can be obtained on request at privacy [at] blast-audit.com.

(a) Sub-processors. The addition or replacement of a Sub-processor is governed by Section 4.4 alone, including the thirty (30) days' notice by e-mail to the account owner and the right to object in Section 4.4(d). The rules in paragraphs (b), (c) and (d) do not apply to that addition or replacement.

(b) Reduction of protection. Any other amendment that reduces the protection of Client Data, including the lengthening of a retention period already set out in Annex 1, is notified by e-mail to the account owner at least thirty (30) days before the proposed date. It takes effect for the Client only with the Client's written agreement. Without that agreement, it does not apply to the Client: the earlier version continues to govern the Processing. Acceptance under paragraph (d) constitutes that written agreement.

(c) Other amendments. Any other amendment takes effect on publication of the updated DPA, which bears its date, except where NEXT BP submits that version for acceptance under paragraph (d). NEXT BP informs the Client by e-mail to the account owner or in the Software no later than that date. The addition of a function of the Software that the Client chooses to use falls under this paragraph where the updated DPA describes that function, its purpose and its retention period in Annex 1 and, where the function processes categories that are not yet listed there, those categories of Personal Data and of Data Subjects, and where it does not reduce the protection of Client Data already processed. If it reduces that protection, paragraph (b) applies. If it adds or replaces a Sub-processor, Section 4.4 applies. A clarification that does not change the meaning also falls under this paragraph, as does an amendment required by law or by a supervisory authority, even if it reduces the protection. An update of Annex 2 that does not reduce the overall level of protection is governed by Section 4.5 and takes effect under this paragraph.

(d) Acceptance in the Software. NEXT BP may submit a version of this DPA to the Client for acceptance in the Software. The owner or an administrator of the Client's organisation accepts it for the organisation, with no imposed delay; that acceptance binds the Client, and the Software records its author and its date. A version submitted for acceptance governs the Processing of Client Data from that acceptance; until then, the earlier version continues to govern it. This option does not apply to the addition or replacement of a Sub-processor. This version, dated 21 October 2026, is submitted for that acceptance; for a Client bound by an earlier version that has not accepted it, it applies at the latest on 21 November 2026, thirty days after the notice NEXT BP sent it by e-mail under Section 11.6 of that earlier version.

---

12. Non-compliance with the DPA and termination

12.1 Suspension. Without prejudice to the GDPR, if NEXT BP breaches its obligations under this DPA, the Client may instruct it in writing to suspend the Processing of Client Data until it complies or until termination. NEXT BP promptly informs the Client if it is unable to comply with this DPA, for whatever reason.

12.2 Termination by the Client. The Client may terminate the Principal Agreement, insofar as it concerns the Processing of Personal Data, by e-mail to privacy [at] blast-audit.com, with immediate effect, if:

(a) the Processing has been suspended under Section 12.1 and compliance with this DPA is not restored within a reasonable time and in any event within one month of the suspension;

(b) NEXT BP is in substantial or persistent breach of this DPA or of its obligations under the GDPR;

(c) NEXT BP fails to comply with a binding decision of a competent court or of the competent Supervisory Authority regarding its obligations under this DPA or the GDPR.

The thirty-day cure period in Section 13.3 of the Terms and Conditions and Section 8.2 of the EULA does not apply to these cases.

12.3 Termination by NEXT BP. NEXT BP may terminate the Principal Agreement, insofar as it concerns the Processing of Personal Data, where, after NEXT BP has informed the Client that an instruction infringes Data Protection Legislation (Section 4.2), the Client maintains that instruction.

12.4 After termination. Section 7 applies.

12.5 Refund. Where the Client terminates under Section 4.4(d) or Section 12.2, NEXT BP refunds the portion of the subscription fees paid in advance that covers the period remaining after the effective date of termination, calculated pro rata by the number of days. The refund is made within thirty (30) days of the effective date, to the payment method used. It is without prejudice to the Client's other rights and remedies.

---

Annex 1 — Description of the Processing

Parties. Controller: the Client, identified by the information it provides when it signs up and subscribes. Contact person: the account owner, at the e-mail address recorded in the Software, or the person the Client designates at privacy [at] blast-audit.com; data protection officer: the one the Client indicates, if any. Date of accession: date of acceptance of the Terms and Conditions. Processor: NEXT BP, French simplified joint-stock company (société par actions simplifiée, SAS), 127 rue de la Tour, 75016 Paris, France, RCS Paris 920 753 233. Contact person: the president of NEXT BP, privacy [at] blast-audit.com. NEXT BP has not designated a data protection officer.

Categories of Data Subjects. Natural persons whose data appear in the documents the Client submits, including the ledgers and other data exports imported into an analysis project, and the workbook ranges sent to it from Excel: officers, employees, shareholders, customers, suppliers and other counterparties of the entities the Client audits or advises, bank account holders, signatories. The Client's Users are also Data Subjects in respect of Usage Data, even where no document names them, including former members for the retention period in Section 2.5, and in respect of their progress in the Blast Audit Academy. They are also Data Subjects where their name or their actions appear in Client Data, for example in an engagement's task log, in the journal of an analysis project, which names the member who ran each step or approved a run proposed by the assistant, or in a financial statement review: the review's members and their access, documents added or removed, annotations, comments and their replies, checklists and the AI's answers, reviewers' verdicts, analysis settings and findings sent to Excel. Recipients of a PBC request list are also Data Subjects: the persons, at the Client's clients or elsewhere, to whom a User sends requests for documents, and the colleagues to whom they hand a request. Persons whose data appear in the files these recipients send are Data Subjects on the same basis as those of the documents the Client submits.

Categories of Personal Data. Identification and contact data; professional data (position, employer); financial and banking data (account numbers, balances, transactions, accounting entries with their accounts and descriptions, invoices, payments); payroll and human resources data appearing on payslips and payroll records, which may include the social security number; tax data; contractual data; signatures; any other data contained in the documents submitted and in the workbook ranges sent to an analysis project; the content of a financial statement review: the text that OCR reads in its documents, annotations, comments and their replies, checklists, the AI's answers with the passages they cite, reviewers' verdicts and their notes, analysis settings (including the dictionary and the ignore list of the language check) and findings sent to Excel; the identity of members recorded in a review, with the date of each act: the review's members, their access level (read or full) and the member who added them; the member who creates the review; the member who closes it; the member who adds or removes a document, or runs its reading again; the member who creates an annotation and the member who last modifies it; the member who creates a comment and the member who last modifies it; the author of a reply; the member who imports a checklist; the member who runs the AI on it; the member whose session records an answer of the AI; the author of a verdict; the last member who modifies the analysis settings; the member who sends findings to Excel; the member who requests an export; the name or e-mail address shown on a comment, a reply or a reviewer's verdict, which the checklist sheets sent to Excel repeat; in an analysis project, the identity of the member who ran each step of the analysis journal or approved a run proposed by the assistant; voice recordings of Users when they use voice input, and the resulting transcripts. Usage Data as defined in Section 2.5: name, e-mail address, technical account identifier, role, active-member status, whether the member holds a licence for the Excel add-in (yes or no), the usage and consumption indicators listed in that Section, and the breakdown by feature. The usage of former members, and usage that is not linked to any member, appears only on a "former members" line with no name. That line is not anonymous: when only one person has left the organisation, it shows that person's totals. For a PBC request list: the requests; the e-mail address and language of each recipient; the record of their actions through their link, with the date (link opened, recorded at most once a day; file sent or withdrawn; message; request handed to a colleague); their messages; the reasons they give when they have nothing to send; the files they send and their content; the results of the AI checks on those files, where the Client has set questions for them (the answers, with the passages cited); the identity of the member who sent each request. Conventions that the agent retains at a User's request, where the Client's organisation has turned them on. The Client's procedures, their versions, the conversations used to write them and the update proposals. Name and identifier of the workbooks open in the Excel add-in, which the add-in reports to the MCP server. Users' progress in the Blast Audit Academy: lessons and paths completed, with their date, and answers to exercises and quizzes, with their score.

Special categories of data and data relating to offences. Not sought. They may be present incidentally in documents, annotations, comments, reviewers' notes, checklists, the AI's answers, messages or the reason a recipient gives when they have nothing to send (for example, health data on a payslip, trade union dues or a court decision). Additional safeguards: processing limited to the task requested by the User; retention limited to the periods below; access by NEXT BP personnel limited to the cases in Section 4.3; the measures of Annex 2.

Frequency. Continuous, at each action of a User, of the engagement agent, of the assistant of an analysis project or of a recipient of a PBC request list.

Nature of the Processing. Receipt, hosting, optical character recognition (OCR), analysis by AI models, extraction of values, answers to questions about documents, checking of the results tables of the engagement agent and the Excel agent before delivery, classification, matching between workpapers and documents, web search approved by the User, transcription of voice input, display, export and deletion. In analysis projects: import of data sources and building of datasets, execution of analysis recipes, packs and scripts in an isolated execution environment (sandbox) described in Annex 2, replay of the analysis journal, and proposals of the project's AI assistant, which run only after the approval of a User with full access to the project; at each read, the assistant receives from the project only the names and columns of sources and datasets, row counts, totals and at most 20 sample rows; the assistant also receives the Users' messages and the history of its conversation, which may repeat those extracts. For PBC request lists: sending the requests, the reminders and new links by e-mail to the recipients the Users designate and to the colleagues to whom a recipient hands a request, receiving the recipients' files and messages, antivirus analysis of each file before it can be used, and copying accepted files into an engagement or importing them into a workbook at a User's request. Search of the SharePoint of the Client's organisation, at an administrator's request, through the Microsoft 365 Copilot retrieval service (Microsoft Graph) and with that administrator's Microsoft 365 connection: Microsoft processes the query under the Client's Microsoft 365 contract, and the Software displays at most 10 extracts, with their title and author, without keeping them. Building per-User usage indicators and, where the Client turns on the setting in Section 2.5, presenting those indicators to the owners and administrators of its organisation, and exporting those indicators (in the browser or through the Exports page). Presenting to the owners and administrators of the Client's organisation the progress of its Users in the Blast Audit Academy.

Purpose. To provide the functions of the Software that the Users request: reading and analysing audit documents, extracting values into workpapers, linking each value to its source, carrying out the tasks of the engagement agent and the Client's procedures, keeping the financial statement reviews and the work their members do in them, answering a review's checklists with AI and sending the review's findings to Excel, collecting through the PBC request lists the documents that Users request from their clients or from other persons, and copying them into an engagement or importing them into a workbook, analysing, in analysis projects, the ledgers and other data exports that Users import into them, importing files from the Client's own cloud storage (Google Drive, Microsoft 365) and searching its SharePoint, answering requests from the AI assistants that the Client connects to the MCP server, and training Users in the Blast Audit Academy. Where the Client turns on the setting in Section 2.5, to present and export Usage Data per member to the owners and administrators of its organisation.

Duration of the Processing. The term of the Principal Agreement, then until Client Data are deleted or returned under Section 7; for each category of data, the retention periods below apply.

Retention.

Annex 2 — Technical and Organisational Measures

Hosting and location. The application, databases and file storage are hosted on Microsoft Azure in the France Central region (Paris). The archive of the Azure platform's activity logs is geo-replicated to the France South region (Marseille); Client files are not. AI processing and the advanced reading of scanned pages (Section 5.2) run on Microsoft resources in the Sweden Central region, in the European Union Data Zone. The standard reading of a scanned page, when it happens, is performed by software that NEXT BP operates itself, in the Microsoft Azure environment that hosts the application and in the same region; no separate OCR provider is involved.

Execution sandboxes. The scripts that the engagement agent, the Excel agent and analysis projects run are executed in isolated Microsoft Azure sessions (Azure Container Apps), in the organisation's region (France Central), with no outbound network access and no access to the application's secrets. Each run of an analysis project (recipe, pack, script or replay) takes place in its own session, deleted after the run. Only a User with full access to the project can import a source into it, launch a run or approve a proposal of the assistant. The analysis journal is chained: each entry carries the fingerprint of the previous one, so that an entry modified or removed is detected when the journal is verified.

Physical security. Client Data are hosted in Microsoft Azure data centres, whose physical security is covered by Microsoft's certifications and reports (Section 6.1).

Encryption. Data are encrypted in transit with TLS (version 1.2 or higher) between the Software, NEXT BP's servers and the Sub-processors. Databases, file storage and backups are encrypted at rest by Microsoft Azure with keys managed by Microsoft. The access tokens of the Google Drive and Microsoft 365 connectors are additionally encrypted by the application before they are stored.

Pseudonymisation. The Software must read document content to provide its functions and does not pseudonymise it; it limits its retention to the periods in Annex 1.

Isolation and access control. Each organisation's data are logically separated and every request is checked against the User's organisation and rights. Users authenticate through WorkOS, with single sign-on (SAML or OpenID Connect) available for organisations that use it. Access to production systems is limited to the named NEXT BP personnel who need it.

Key and secret management. Application secrets and keys are kept in the secret stores of Microsoft Azure (Container Apps secrets and Azure Key Vault), not in the application sources. Connector tokens are encrypted with a key reserved for that purpose.

System configuration. The infrastructure is described with Terraform and each change is reviewed before it is deployed.

Minimisation and deletion. Document content is kept only for the periods in Annex 1 and is deleted by automated purges, which retry any deletion that fails. Requests to Azure OpenAI are sent with store:false (Section 5.3); Microsoft does, however, temporarily store all requests and all responses for abuse monitoring (Section 5.4).

Portability and erasure. Export from the Software (Section 7.2), automated deletion according to the periods in Annex 1, and deletion or return at the end of the contract (Section 7.3).

Data quality. Each result is linked to its source in the document so that the User can check it (Section 5.6).

Logs and telemetry. Operational logs and error reports are designed not to contain document content; logs are kept 30 days. Product analytics record events without document content and without the per-member detail in Section 2.5.

Backups and continuity. Databases are backed up automatically and backups are kept 7 days, which allows a restore after an incident.

Vulnerability management. NEXT BP publishes a vulnerability disclosure policy (security [at] blast-audit.com), keeps its dependencies up to date and fixes vulnerabilities according to their severity.

Incident handling. Incidents are handled by NEXT BP, which notifies the Client of Personal Data Breaches under Section 4.8.

Governance. The president of NEXT BP is responsible for security and data protection.

Certifications. NEXT BP holds an ISO/IEC 27001:2022 certificate for Blast Audit (design, development, operations and support), issued on 27 August 2026 by Sensiba Australia Pty Ltd. It also has a SOC 2 Type 2 report on Blast Audit (NEXT BP's Software as a Service System): Sensiba examined its controls against the Trust Services Criteria for Security, Availability and Confidentiality over the period from 1 March 2026 to 31 May 2026, and signed its opinion on 4 June 2026. Both are provided on request (Section 6.1). For hosting, NEXT BP also relies on Microsoft Azure's certifications.

Annex 3 — Sub-processors

List dated October 21, 2026.

A. Sub-processors (Client Data)

Changes are announced under Section 4.4.

Subject matter, nature and duration. The subject matter and nature of the Processing are set out in the "Service" and "Personal data" columns. Each Sub-processor processes Client Data for the term of the Principal Agreement, within the retention periods of Annex 1, except: Azure OpenAI, which does not keep requests or responses for later retrieval (Section 5.3) but temporarily stores all of them for abuse monitoring, for a duration Microsoft's contract does not set (Section 5.4); the Azure AI service in the EU Data Zone, whose requests and responses Microsoft may temporarily store for abuse monitoring, with no commitment from Microsoft on how long (Section 5.4); Azure AI Content Understanding, whose results are deleted once read and at most 24 hours after the operation is created. For Azure OpenAI and for the Azure AI service in the EU Data Zone, Section 5.4 states who at Microsoft may review these requests and responses, and when Microsoft deletes them at the latest.

B. Other providers of NEXT BP (Section 2.3), for information

These providers process the data for which NEXT BP acts as Controller (Section 2.3). They are not Sub-processors within the meaning of this DPA.

Annex 4 — Transfers Outside the European Economic Area

A. Client to NEXT BP. The Client and NEXT BP are established in the European Union; the communication of Client Data to NEXT BP is not a transfer to a third country. If the Client is established outside the European Economic Area, the parties agree on the appropriate safeguards before any Processing.

B. NEXT BP to Sub-processors and other providers. For each Sub-processor or other provider in Annex 3 that is established in the United States or may access data from there:

• if it is certified under the EU-U.S. Data Privacy Framework, the transfer is based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023;
• otherwise, or in addition, the transfer is governed by the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Three (processor to processor) for Client Data, incorporated into the Sub-processor's data processing agreement. Where NEXT BP acts as Controller (Section 2.3), Module Two (controller to processor) applies.

C. Supplementary measures. Data are encrypted in transit and at rest; Client Data hosted by NEXT BP remain in the European Union; only the data necessary for each service are sent to the Sub-processor.

D. Copy. The Client can obtain a copy of the safeguards applicable to a Sub-processor by writing to privacy [at] blast-audit.com.