Data Processing Agreement (DPA)

Effective Date: 19 October 2026

This Data Processing Agreement ("Agreement") forms part of the contract between Neptunes Solutions Limited ("Processor") and the customer ("Controller") for the provision of Momentrax services.

1. Definitions

• Controller: The entity determining purposes of data processing
• Processor: Neptunes Solutions Limited
• Personal Data: Any information relating to an identifiable person

2. Scope of Processing

The Processor shall process personal data solely for the purpose of providing the contracted SaaS services.

3. Processor Obligations

• Process data only on documented instructions
• Ensure confidentiality of authorized personnel
• Implement appropriate technical and organizational safeguards
• Assist with data subject requests where applicable

4. Data Security

Measures include access control, encryption in transit, audit logging, and regular backups.

5. Sub-processors

The Controller authorizes the use of sub-processors for hosting, communications, and payment services, subject to equivalent data protection obligations.

6. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.

7. Data Retention & Deletion

Upon termination, personal data shall be deleted or returned unless retention is required by law.

8. Governing Law

This Agreement is governed by the laws of Uganda, without prejudice to mandatory EU GDPR provisions where applicable.