ChainZap Pilot Data Annex

Version: v1.1 — Pre-Incorporation
Last updated: 7 October 2026
Effective date: [TO BE COMPLETED]

This Pilot Data Annex (“Annex”) supplements the applicable ChainZap Payout Control Pilot Agreement (“Pilot Agreement”) where the Pilot dataset contains personal data or where applicable law otherwise requires data-processing terms.

If there is a conflict concerning processing of personal data, this Annex controls over the Pilot Agreement and incorporated Business Terms for that subject matter.

1. Parties and Application

Service Provider / ChainZap: [TO BE COMPLETED]
Customer: [TO BE COMPLETED]

This Annex applies only to personal data processed by ChainZap on behalf of the Customer for the Pilot.

The Parties’ privacy roles are determined by the factual processing relationship and applicable law. Where ChainZap processes personal data solely on the Customer’s documented instructions for the Pilot, the Customer acts as controller/business or equivalent role and ChainZap acts as processor/service provider or equivalent role, to the extent applicable.

Nothing in this Annex assigns a legal role contrary to the actual processing activities or applicable law.

2. Pilot Data Specification

Before transfer, the Parties will identify the agreed Pilot dataset and whether it relates to payouts to natural persons.

The Pilot should use the minimum data reasonably necessary for Payout Control.

The initial standard scope is official USDT/TRON. The minimum execution-check package and the treatment of missing historical context are specified in the Pilot Agreement. Sending-wallet data is optional unless sender verification is agreed. Direct identifiers are not required for the standard workflow.

Expected fields may include:

• pseudonymous obligation or business reference;
• wallet address or expected recipient address;
• expected amount;
• asset/token;
• network;
• execution/attempt reference;
• transaction hash;
• provider or wallet-export status;
• timestamps;
• other specifically agreed operational fields.

The Customer should not provide names, email addresses, phone numbers, government identifiers, bank-account details, KYC documents or other direct identifiers unless they are specifically required for the agreed Pilot and documented before transfer.

Private keys, seed phrases and transaction-signing credentials must never be provided.

Pseudonymised data may remain personal data where a natural person can be identified directly or indirectly.

3. Subject Matter, Nature and Purpose

Subject matter: historical analysis of an agreed stablecoin payout workflow.

Nature of processing: receipt, storage, validation, normalization, matching, reconciliation, allocation, analysis, exception detection, generation of operational states and evidence, analyst-assisted review, reporting, security and deletion.

Purpose: to perform and evaluate the Payout Control Pilot described in the Pilot Agreement.

ChainZap will not process Pilot personal data for advertising, unrelated profiling, sale of personal data or cross-customer decision-making.

4. Duration

Processing under this Annex begins when ChainZap first receives Pilot personal data and continues until the data is returned or deleted in accordance with the Pilot Agreement and this Annex.

Unless otherwise agreed, active copies of Customer-provided Pilot personal data will be deleted within 30 days after completion or termination of the Pilot.

Backups may persist until overwritten in the ordinary backup cycle and remain subject to this Annex while retained.

5. Categories of Data Subjects

Depending on the Customer’s workflow, data subjects may include:

• individual affiliates;
• creators;
• contractors;
• individual merchants;
• customers or counterparties receiving payouts;
• Customer personnel whose identifiers appear in operational records.

The Customer will identify any materially different category before transfer.

6. Categories of Personal Data

Depending on the agreed dataset, personal data may include:

• pseudonymous internal identifiers;
• blockchain wallet addresses;
• transaction hashes and associated public blockchain activity;
• payout amounts, assets and timestamps;
• execution/attempt references;
• provider-status information;
• associations between the above information and a Customer business obligation.

Direct identifiers and sensitive/special-category data are outside the standard Pilot scope unless expressly agreed in writing.

7. Customer Instructions

ChainZap will process personal data only:

• on documented Customer instructions contained in the Pilot Agreement, this Annex and agreed data specification;
• as reasonably necessary to perform and secure the Pilot;
• where required by applicable law.

If ChainZap reasonably believes an instruction violates applicable data-protection law, it may suspend the affected processing and notify the Customer where legally permitted.

The Customer is responsible for the lawfulness of its instructions and for having an appropriate legal basis to provide the data to ChainZap for the Pilot.

8. Confidentiality

ChainZap will ensure that persons authorized to process Pilot personal data are subject to appropriate confidentiality obligations.

Customer-specific associations between business obligations and public blockchain activity remain confidential even where the underlying blockchain transaction is publicly visible.

9. Security

ChainZap will maintain reasonable technical and organisational measures appropriate to the Pilot data and risks.

Such measures may include, as appropriate:

• access controls;
• tenant/environment separation;
• credential protection;
• logging and monitoring;
• minimisation of raw identifiers in logs;
• secure transfer mechanisms;
• retention/deletion controls;
• measures intended to prevent unauthorized disclosure or alteration.

The standard Pilot does not require private keys, seed phrases, signing credentials or production execution credentials.

No system can guarantee absolute security.

10. Security Incidents

ChainZap will notify the Customer without undue delay after becoming aware of a confirmed security incident materially affecting Pilot personal data.

The notice will include information reasonably available to ChainZap that is relevant to the Customer’s assessment and response.

ChainZap will reasonably cooperate with the Customer in investigating and responding to the incident, subject to the agreed Pilot scope and applicable law.

11. Subprocessors

ChainZap may use subprocessors reasonably necessary to provide infrastructure, security, blockchain/data access or other technical functions required for the Pilot.

The Customer gives general authorization to engage the subprocessors listed before transfer. ChainZap will notify the Customer of any intended addition or replacement before the change takes effect; the Customer may object on reasonable data-protection grounds, in which case the Parties will discuss in good faith and either Party may terminate the affected Pilot processing.

ChainZap will impose on each subprocessor data-protection obligations no less protective than this Annex and remains liable to the Customer for each subprocessor’s performance of those obligations.

A current list of material subprocessors relevant to the Pilot, including relevant processing locations where required, will be provided or referenced before transfer.

12. AI Processing

Customer-specific Pilot personal data will not be submitted to an AI provider for general-purpose model training.

If an AI service is used to process Pilot personal data, ChainZap will use contractual terms and settings reasonably intended to prevent the provider from using that data to train general-purpose models, unless the Customer expressly agrees otherwise.

Where AI is not required for the agreed Pilot workflow, ChainZap may perform the Pilot without submitting Customer-specific Pilot data to an AI model.

The current standard payout batch engine does not require Ask ChainZap or an LLM. Any separately proposed AI processing of Customer-specific Pilot data must be documented before it begins, including the provider, fields sent, minimisation measures and applicable data handling.

AI-generated text, if any, does not replace the underlying structured evidence or operational state.

13. Data Subject Requests

Taking into account the nature of the processing, ChainZap will provide reasonable assistance to the Customer with requests by data subjects to exercise applicable privacy rights, where the Customer cannot reasonably fulfil the request without ChainZap’s assistance.

ChainZap will not independently respond to a data subject on the Customer’s behalf unless instructed or legally required.

14. Regulatory and Compliance Assistance

Taking into account the nature of the Pilot and information available to ChainZap, ChainZap will provide reasonable assistance required by applicable data-protection law in relation to:

• security of processing;
• security incidents;
• legally required data-protection assessments;
• regulator enquiries relating to ChainZap’s processing for the Pilot.

Any material assistance outside the agreed Pilot scope may be subject to reasonable additional terms where permitted by law.

15. Return and Deletion

At the end of the Pilot, ChainZap will, at the Customer’s choice, return agreed Customer Data or Deliverables and delete active copies of Pilot personal data, subject only to retention required by applicable law.

Unless otherwise agreed, active copies of Pilot personal data will be deleted within 30 days after Pilot completion or termination.

ChainZap may retain Pilot personal data only where retention is required by applicable law, and only for as long as required, subject to this Annex.

Backups may persist until overwritten in the ordinary backup cycle where immediate deletion is not technically practicable, provided the retained data remains protected under this Annex and is not actively processed except where required by applicable law.

Third-party data may be subject to separate lawful retention restrictions, which will not expand ChainZap’s rights to retain Customer personal data.

16. Audit and Information Rights

ChainZap will make available information reasonably necessary to demonstrate compliance with this Annex to the extent required by applicable law.

Where applicable law grants the Customer audit rights, the Parties will first seek to satisfy those rights through available documentation, questionnaires, reports or other proportionate evidence.

Any on-site or intrusive audit will be subject to reasonable notice, confidentiality, security safeguards and scope limitations, except where a regulator or applicable law requires otherwise.

17. International Transfers

The Parties will not rely on this Annex alone where applicable law requires a specific mechanism for international transfer of personal data.

Before a transfer requiring additional safeguards begins, the Parties will implement the legally required transfer mechanism, which may include applicable standard contractual clauses, addenda or other recognized safeguards.

The required mechanism depends on the Customer’s jurisdiction, the ChainZap contracting entity, hosting/data locations and applicable law.

18. No Cross-Customer Use

Pilot personal data, Customer-specific obligations, attempts, counterparties, amounts and outcomes will not be disclosed to another customer or used to make decisions for another customer except under a separate written agreement with the Customer and where permitted by applicable law.

On the Customer’s instruction given by Section 3 of this Annex, ChainZap may anonymise Pilot data to generate Service Data as defined in the Business Terms, including aggregated Pilot metrics, provided that the resulting information does not relate to an identified or identifiable natural person and no Customer-specific obligations, counterparties, amounts or outcomes can reasonably be derived from it.

Once data has been validly anonymised so that it no longer constitutes personal data under applicable law, use of that anonymised Service Data remains subject to the Business Terms and applicable confidentiality obligations.

19. Order of Precedence

For personal-data processing covered by this Annex, the order of precedence is:

1. any mandatory transfer mechanism or data-protection clause that expressly states it prevails;
2. this Pilot Data Annex;
3. the Pilot Agreement;
4. the incorporated ChainZap Business Terms.

20. Changes

Any material change to the Pilot processing purpose, categories of personal data, categories of data subjects or subprocessors that requires Customer authorization under applicable law will be addressed before the changed processing begins.

21. Signatures

ChainZap / Service Provider

Legal name: [TO BE COMPLETED]
Name of signatory: [TO BE COMPLETED]
Title/capacity: [TO BE COMPLETED]
Date: [TO BE COMPLETED]
Signature: __________________________

Customer

Legal name: [TO BE COMPLETED]
Name of signatory: [TO BE COMPLETED]
Title/capacity: [TO BE COMPLETED]
Date: [TO BE COMPLETED]
Signature: __________________________