MAGNAVIS Data Processing Addendum Notice

Version 1.2 — Effective September 15, 2026

This online notice describes terms that must govern when MAGNAVIS, offering MAGNAVIS under its current product name, processes personal data for a customer under an applicable agreement. It is not a substitute for the completed, signed or incorporated DPA schedules, transfer clauses, and security measures required before paid or EU/UK processing.

1. Instructions and roles

When an applicable DPA is completed, the customer must identify its controller or responsible-business role and appoint MAGNAVIS as processor or service provider for covered Customer Data. Covered processing must be limited to providing and securing the Service, following documented lawful instructions, complying with law, and performing the applicable agreement.

2. Confidentiality, security, and assistance

Before applicable paid or restricted processing begins, authorized personnel must be bound by appropriate confidentiality duties, required technical and organizational measures must be documented and verified, and the applicable agreement must define assistance for data-subject requests, security incidents, assessments, and regulator inquiries.

3. Subprocessors

A provider may process covered Customer Data only after required approval, disclosure, and data-protection terms are complete for the applicable environment. Customer authorization, notice, objection, and emergency-change rights must be stated in the applicable completed DPA.

4. Locations and restricted transfers

Processing locations depend on hosting region, enabled features, support access, and approved providers. Any applicable EU Standard Contractual Clauses and UK Addendum or IDTA, including annexes and transfer assessment, must be completed before restricted processing begins. A vendor certification or regional option may be relied upon only after account-specific verification.

5. Compliance information

For applicable paid or restricted processing, the completed DPA must state how MAGNAVIS will provide information and audit cooperation required by law, including scope, confidentiality, frequency, security restrictions, timing, and costs. No independent report or certification is represented as current by this notice.

6. Return and deletion

For covered Customer Data, the completed DPA must define return, deletion, legal-hold exceptions, backup handling, and any agreed certificate. No automated deletion, backup timeline, or deletion certificate is represented unless separately configured, documented, and verified.

7. Contact

Send data-processing requests to info@middletonadvisorygroup.com. Contract customers should identify their authorized privacy contact and tenant.