Data Processing Agreement

Version v5.5 dated 11 October 2026.

Provider: LYNX AI limited liability company (LYNX AI LLC), Tax ID (STIR) 313122838, registered address: Republic of Uzbekistan, Tashkent city, Chilanzar district, Qozirobod MFY, Choʻponota koʻchasi, 10b-uy. Website: https://lynx-ai.uz/. Platform: https://crm.lynx-ai.uz/. Contact address: contact@lynx-ai.uz. Phone: +998 33 769 69 09. Registration details are set out in the Provider Details (in Uzbek).

This document is drawn up in the Uzbek and Russian languages; both texts are equally authoritative, and the rule for discrepancies is set out in the User Agreement (section "Governing law, language and disputes"). This English text is a translation.

1. Subject matter, application and roles

1.1. This Agreement governs the processing of personal data on the Client's instruction in connection with the use of the Service and forms part of the contractual terms accepted under all plans and under Enterprise terms. It applies wherever processing is entrusted, without a separate purchase or signature. With respect to such processing, its specific provisions take precedence over the general commercial terms. Additional individual terms may be established only by Enterprise terms; they do not override this Agreement, the statutory rights of data subjects or mandatory protection requirements. The applicable version is determined by the User Agreement (section "Changes and notices"). Obligations relating to protection, confidentiality and completion of processing remain in force until fulfilled, regardless of the termination of access. Capitalised terms have the meanings given to them in the User Agreement (section "Terms and subject matter").

1.2. The Client is the owner and/or the operator of the personal data database containing the personal data that it entrusts for processing, determines the purposes, the scope of data, the grounds and the periods of processing, and entrusts the processing to the Provider as a third party within the limits of this Agreement. The Provider processes such data only on the Client's instruction and only for the purposes for which it was collected. An organisation acts through its authorised representative. With respect to data of user accounts, payments, support and security, the Provider is the owner and the operator and processes such data in accordance with the Privacy Policy. This does not give the Provider any right to dispose of the Client's database at its own discretion.

2. Scope of the instruction

2.1. The instruction covers the selected features of text agents and Lynx Voice voice assistants, enquiry management, collaboration, tools for working with text and audio, automation, connection of other services and quality analysis. Data is processed to perform the Client's lawful tasks and to provide the selected software features.

2.2. Within the selected features, the following are permitted: receipt, organisation, storage, retrieval, transformation, speech recognition and synthesis, analysis, generation of Outputs, provision of authorised access, transfer via permitted routes, export, restriction and destruction of data. The instruction is defined by the contract, the Order, the settings and the tasks set by authorised persons.

2.3. The data may relate to the Client's customers and prospective customers, Interlocutors, employees, representatives, conversation participants and authors of materials. It includes contacts, identifiers, correspondence, audio, transcripts, documents, customer information, processing tasks and results, and necessary service information. Specially regulated data may be processed only where the necessary grounds and agreed conditions are in place. The Provider does not process biometric data: voice copies are not created, voice characteristics are not extracted from recordings or stored, and voice is not used to establish a person's identity.

3. Obligations of the Client

3.1. The Client ensures the lawfulness of obtaining and using the data, the necessary consents and notices, and the rights to materials, to the recording of conversations and to the reproduction of voices. The Client is responsible for the authority of Client Users, the permissibility of communications and compliance with the rules of connected channels. The existence of a technical capability does not confirm that a task is lawful. By transferring conversation recordings to the Service from its own or connected systems, or by uploading them manually, the Client confirms that the conversation participants have been notified of the recording and of its subsequent processing, including automatic transcription and assessment, and that a ground provided for by legislation exists for transferring the recordings to the Provider.

3.2. The Client transfers the necessary volume of data, sets permissible periods and access rights, and checks the results of processing. Material actions and legally significant decisions concerning the rights and freedoms of a person require appropriate oversight. Unlawful instructions, deceptive impersonation and circumvention of the restrictions of a data source are prohibited.

3.3. The Client ensures a ground for entrusting processing to the Provider and to the persons engaged by the Provider under section 5: the written consent, including in electronic form, of the data subject, the performance of a contract between the Client and the data subject, or another ground provided for by legislation, including for computing operations outside the Republic of Uzbekistan under section 6. The Client notifies data subjects in writing of the purposes of processing and of their rights when the data is included in the database, and of the transfer of data to a third party within the period established by legislation, where such notice is mandatory, and states in the notice that processing on its instruction may be carried out by a software platform provider.

3.4. Upon the Provider's reasoned request, the Client provides, within five working days, information confirming the legal grounds for processing and the notification of data subjects, to the extent necessary to verify the specific event. Until such information is provided, the Provider may suspend the affected mailing, campaign or feature.

3.5. To notify Interlocutors, the Client may use the template set out in the annex to this Agreement, supplemented with its own details. Use of the template does not release the Client from verifying that the template is sufficient for its activities. Where the ground for entrusting processing is consent, the Client obtains written consent, including in electronic form, in a manner that makes it possible to confirm that the consent has been obtained, and keeps evidence of it; continuing the dialog does not constitute such consent.

4. Obligations of the Provider

4.1. The Provider follows the Client's documented lawful instructions and does not use entrusted data beyond them, except for processing that is mandatory under law. If an instruction appears to be unlawful, the Provider informs the Client accordingly and may suspend the affected operation. The Provider informs the Client of a lawful requirement for additional processing, unless such notice is prohibited.

4.2. The Provider limits access to what is necessary for work purposes, ensures the confidentiality of the persons granted access and applies proportionate protective measures. Entrusted data is not sold and is not used by the Provider for its own advertising profiling. It is not used to train the Provider's models; such use is possible only under Enterprise terms and with the consent of the data subjects for that purpose. Clause 4.3 applies to Platform Data. Prohibitions imposed by law, the data source and the connected platform continue to apply regardless of any authorisation given by the Client.

4.3. When processing Platform Data received through Meta Channels, the Provider:

(a) processes it only on the instruction of the Client that connected the channel and only to provide that Client with the selected features, and does not use it for its own purposes or for the purposes of other persons;

(b) processes the data of each Client separately from the data of other Clients;

(c) does not sell, license or buy Platform Data and transfers it only to the Client, to persons engaged by the Provider to perform the instruction, to persons to whom the Client has expressly instructed a transfer within the limits permitted by Meta's terms, and in the cases provided for by law;

(d) does not use Platform Data, including depersonalised and aggregated data and information derived from it, to create, train or improve artificial intelligence models; processing of a message by a model when performing a task of the Client does not constitute training;

(e) destroys Platform Data as soon as reasonably practicable where it is no longer needed to perform the instruction, after the channel is disconnected or the Client's access ends, at Meta's demand, on the Client's instruction or at a user's request in accordance with clause 4.4, and in other cases provided for by law, unless the law requires its retention; where retention is mandatory, the Provider keeps a record of the ground for retention;

(f) informs the Client without delay of any communications received from Meta concerning requests of data subjects;

(g) notifies Meta of security incidents affecting Platform Data and of Platform Data received in error, in the manner and within the periods established by Meta's terms and by law, and provides Meta with the information, confirmations and opportunity to inspect the processing of Platform Data that are provided for by Meta's terms, without disclosing the data of other Clients beyond what is necessary.

4.4. The Client instructs the Provider to fulfil requests received by the Provider from Interlocutors, including users of Meta Channels, for the destruction of their data received through connected channels. The Provider notifies the Client of the request no later than the next working day and destroys the data within the periods established by the Privacy Policy (section "Retention and destruction"), unless within that period the Client informs the Provider of a legal obligation to retain the relevant information. The Provider sends the notice of destruction to the data subject on behalf of the Client.

4.5. Persons engaged by the Provider to process Platform Data undertake in writing to process it only on the Provider's instruction for the purpose of performing the Client's instruction, not to use it for their own purposes, to impose the same obligations on their own contractors and to destroy the data upon completion of processing. The Provider provides Meta with a list of such persons at Meta's request.

5. Engagement of other persons

5.1. The Client authorises the Provider to engage persons providing infrastructure and data storage, computing operations, software components, message delivery, security, support and payments, to the extent necessary to perform the instruction. Their processing is limited to permitted purposes and to terms of confidentiality, protection and destruction. The Client's authorisation does not replace the data subject's consent or any other ground required for entrusting processing and transferring data. Engagement of another person does not terminate the Provider's own obligations.

5.2. Information about specific recipients is provided to the extent provided for by law, the terms of the connected platform or Enterprise terms. The parties ensure mandatory notices to data subjects, including written notice of the purposes and rights when data is included in a database and of a transfer to a third party within three days, where such notice is required. The responsible participant and the method of notification are determined taking into account the actual roles of the parties; a communication to the Client does not replace mandatory notice to the data subject.

5.3. Connected services may process data independently under their own rules. Their role is determined separately. Additional prior approval of engaged persons applies where it is required by law or by expressly agreed Enterprise terms. Those terms do not exclude mandatory disclosure of information and notices under other plans. Webhook recipients, the Client's own programs, models and other systems that the Client connects to the Service at its own choice and under its own contract with their owners act on behalf of the Client and are not persons engaged by the Provider. Data is transferred to such systems on the Client's instructions, and the Client ensures the lawful ground for such transfer. This rule does not apply to persons engaged by the Provider itself to perform the contract.

6. Place of storage and processing

6.1. Entrusted data, including backups and logs, is stored on servers located in the Republic of Uzbekistan. The Provider does not place storage facilities, databases or backups of entrusted data outside the Republic of Uzbekistan.

6.2. The Client instructs the Provider to transfer to persons performing certain computing operations outside the Republic of Uzbekistan (text processing by artificial intelligence models, speech recognition and speech synthesis) only the data necessary to perform the selected feature, on the terms of the Privacy Policy (section "Place of storage and processing"). The Provider ensures such terms through contracts with those persons. Transfer to states not included in the list of states ensuring equal protection of the rights of data subjects takes place only where the conditions established by legislation for such transfer have been met; the data subject's consent does not replace those conditions.

6.3. At the Client's request, the Provider provides the Client with the information necessary to inform data subjects and to obtain consents: the scope of the data transferred, the categories of recipients and the states in which processing takes place.

6.4. If the necessary conditions are not ensured for a particular feature, the Provider does not perform the relevant operation outside the Republic of Uzbekistan. The Client may not override the restrictions of this section through its settings or tasks.

6.5. External platforms connected by the Client process data under their own rules, including outside the Republic of Uzbekistan. By connecting such a platform, the Client instructs the Provider to transfer to it the data necessary for the operation of the channel and ensures a lawful ground for such transfer, including a ground for cross-border transfer where one is required.

6.6. When Meta Channels are used, messages are transmitted through Meta's infrastructure, which processes them under Meta's terms, including outside the Republic of Uzbekistan.

7. Protective measures and security incidents

7.1. The Provider applies legal, organisational and technical measures to protect entrusted data, taking into account its nature and the risk; in particular, the Provider:

(a) designates the employees permitted to access the data and terminates their access no later than the last working day upon termination of employment or a change of duties;

(b) applies identification and authentication of users;

(d) transmits data over secure communication channels and applies encryption in storage;

(e) ensures integrity control and recovery of data after failures;

(f) establishes a procedure for blocking and destroying data at the data subject's demand.

7.2. The Provider notifies the Client of a security incident affecting the Client's data without undue delay and in any event no later than 24 hours after its detection. If a leak is detected in the course of a transfer of data for processing outside the Republic of Uzbekistan performed by the Provider, the Provider also reports it to the authorised state body within 24 hours of its detection and, within 72 hours, provides that body with information on its causes and the measures taken, informing the Client at the same time.

7.3. The notice includes the known circumstances and the measures taken; further details are provided as they are established. Missing information does not delay a mandatory notification. The parties cooperate in remedying the incident and in giving mandatory notifications. Giving a notice does not constitute an admission of breach of contract, fault or liability.

8. Data subject requests and inspections

8.1. The Provider forwards to the Client a data subject's request relating to entrusted processing no later than the next working day after its receipt, unless the Provider is obliged to fulfil it itself, and provides the assistance necessary to fulfil a lawful demand within the prescribed period. The Client informs the Provider of its decision on the request in time to allow compliance with the periods established by legislation. Forwarding the request and interaction between the parties do not extend the statutory period for fulfilling it.

8.2. The Provider provides the Client with the information necessary for registration of the personal data database in the manner established by legislation, where such registration is mandatory, and for responding to the authorised state body, namely information about the place of storage, the scope of the data processed and the protective measures taken. The Client ensures the registration of its database.

8.3. The parties provide information and confirmations to competent authorities to the extent mandatory. An additional contractual audit and its conditions may be agreed in Enterprise terms, unless a right to such an audit is provided for by law. Statutory rights to obtain information, to a mandatory inspection and to necessary assistance apply under all plans. Protection of the interests of other Clients and of confidential information does not prevent a mandatory lawful inspection.

9. Periods and completion of processing

9.1. Data is processed for the term of the instruction and only for the necessary period of completion or mandatory retention. Settings do not permit retention without a lawful purpose. Requirements for earlier destruction take precedence over the subscription period, the export period or the period for cancelling account deletion.

9.2. Upon completion of the instruction, the Provider ceases ordinary processing and follows permissible instructions to destroy or return the data within the limits of the contract and the law. Mandatory destruction, correction or restriction of access is carried out within the periods established by legislation and the Privacy Policy (section "Retention and destruction"); an instruction of the Client received after such period has begun does not extend it. Where a particular category must be retained by law, its use and access to it are restricted.

9.3. Backups are stored in the Republic of Uzbekistan in encrypted form, are not available for ordinary use and are overwritten according to the cycle specified in the Privacy Policy (section "Retention and destruction"). Data subject to destruction is not restored from backups; when a backup is restored, completed destructions are reapplied. Depersonalisation instead of destruction is used only in the cases provided for by legislation.

10. Liability and communications

10.1. Each party is liable for its own part of the processing. The Provider is not liable for the consequences of processing carried out in accordance with the Client's documented instructions, except where the Provider has breached its obligations under this Agreement or has failed to inform the Client of the manifest unlawfulness of an instruction of which it ought to have known. Claims between the parties relating to processing are governed by the User Agreement (section "Liability"), including the limitation of liability and compensation for third-party claims, to the extent permitted by law. These terms do not limit the rights of data subjects or the powers of competent authorities. Communications are sent to contact@lynx-ai.uz and to the Client's agreed contact; the parties keep their contact details up to date.

10.2. This Agreement is amended in the manner established by the User Agreement (section "Changes and notices"). Clarification of technical measures within existing obligations does not change the purposes of the instruction and does not authorise new operations requiring a separate legal ground.

Annex. Template notice to an Interlocutor

"Your messages and voice enquiries are processed by [Client name] using a software assistant in order to respond to your enquiry and to serve you. The data is processed on the instruction of [Client name] by a software platform provider. The data is stored in the Republic of Uzbekistan; speech recognition and synthesis, as well as text processing, may be performed outside the Republic of Uzbekistan without storage facilities or backups of the data being placed outside it. [Where recording takes place: The conversation is being recorded.] You have the right to obtain information about the processing of your data, to require its correction or destruction and to withdraw your consent by contacting [Client contact]. If you agree to such processing, [press 'I agree' / answer 'Yes']. You may at any time ask to be connected to an employee. More information: [link to the Client's policy]."

The template does not apply to biometric data, special categories of personal data or data of minors.