Data Processing Agreement (DPA) — PearlCount LLC — Last updated: July 2026. This Data Processing Agreement forms part of the agreement between PearlCount LLC and the customer accepting PearlCount’s Terms of Service and applies whenever PearlCount processes personal data on the Customer’s behalf. The Customer is the controller of Customer Data; PearlCount is the processor. PearlCount processes Customer Data for hosting, storing, organizing, and displaying yacht finance records; AI-assisted extraction of receipt data; reports and exports; authentication, notifications, and support. Categories of data subjects include crew, employees, contractors, owners, managers, accountants, and invited users. Personal data includes names, emails, roles, authentication data, and personal data contained in uploaded financial documents. PearlCount processes Customer Data only on documented instructions unless required by law. PearlCount binds authorized personnel to confidentiality obligations. Security measures include encryption in transit and at rest, private document storage through time-limited signed links, vessel-based separation, role-based access controls, restricted administrative tools, and exclusion of sensitive tokens from logs. Subprocessors are listed at pearlcount.com/legal/subprocessors. PearlCount will notify workspace administrators at least 14 days before adding or replacing a subprocessor that processes Customer Data. PearlCount assists with data subject requests where required. PearlCount will notify the Customer without undue delay and no later than 72 hours after becoming aware of a personal data breach affecting Customer Data. Upon termination or written request, PearlCount deletes Customer Data within 30 days, with residual backups removed within 90 days unless law requires longer retention. Customer Data is stored in the European Union, Stockholm, Sweden. Transfers outside the EU/EEA or UK use appropriate safeguards including Standard Contractual Clauses where required. PearlCount will make available information reasonably necessary to demonstrate compliance with this DPA. In case of conflict regarding personal data processing, this DPA prevails. Contact: PearlCount LLC — info@pearlcount.com.