Data Processing Addendum (DPA)

2. Scope of Data Processing

Invincible AI may process customer data for the following purposes:

• Provisioning and operating GPU computing environments.
• Hosting and executing AI and machine learning workloads.
• Processing prompts and requests through AI inference endpoints.
• Hosting, storing, and retrieving AI models, datasets, and application files.
• Supporting customer-authorised model training and fine-tuning.
• Maintaining infrastructure security, monitoring, and service availability.
• Providing technical support, backup, and recovery services where included in the selected offering.

Invincible AI processes personal data on documented customer instructions, except where otherwise required by applicable law.

The nature, duration, and extent of processing depend on the services selected and the applicable contractual arrangements.

3. Data Ownership and Customer Control

Customers retain ownership and control of their data, AI models, datasets, prompts, applications, and generated outputs to the extent of their existing legal rights.

Invincible AI does not acquire ownership of customer content merely because it is processed or stored through our infrastructure.

Customers remain responsible for determining what data they upload, how their workloads are configured, and whether they have the necessary legal rights to process that information.

Invincible AI will process customer personal data only as required to provide the contracted services, fulfil authorised instructions, or comply with applicable legal obligations.

4. AI Model Training and Data Usage

Invincible AI recognises that customer AI workloads may contain confidential information, proprietary datasets, intellectual property, and personal data.

Unless expressly authorised by the customer or otherwise required by law:

• Customer datasets and prompts will not be used to train Invincible AI's general-purpose AI models.
• Customer content will not be used to train models for other customers.
• Customer data will not be sold to third parties.
• Customer workloads will not be accessed for unrelated commercial purposes.
• Customer content will be processed only for authorised service delivery and associated security or support purposes.

Where customers use third-party AI models or external inference providers, additional provider-specific terms and data processing arrangements may apply.

5. Data Security and Confidentiality

Invincible AI is committed to maintaining appropriate technical and organisational safeguards to protect customer personal data against unauthorised access, disclosure, alteration, loss, and destruction.

Depending on the selected infrastructure and service configuration, these safeguards may include:

• Encryption of data in transit and at rest.
• Identity and access management.
• Role-based access controls.
• Multi-factor authentication.
• Network isolation and segmentation.
• Security logging and monitoring.
• Vulnerability management and security assessments.
• Backup and disaster recovery procedures.
• Restricted administrative access.
• Confidentiality obligations for authorised personnel.

Specific security controls and responsibilities may vary between managed AI services and customer-managed GPU environments.

Invincible AI follows a shared responsibility approach under which customers remain responsible for securing their applications, credentials, operating systems, and workload configurations unless those responsibilities are expressly included in a managed service.

6. Global AI Infrastructure and Data Residency

Invincible AI provides access to distributed GPU computing and cloud infrastructure through supported data centre and infrastructure providers.

Customers may select from available geographical regions depending on the service, hardware availability, and contractual arrangements.

Where a specific data residency requirement has been contractually agreed, Invincible AI will process customer personal data in accordance with that commitment.

Cross-border transfers of personal data will be subject to applicable data protection laws and appropriate contractual or technical safeguards.

The availability of a geographical region does not automatically constitute a guarantee that all support, monitoring, backup, or related processing will occur exclusively within that region.

Any specific residency restrictions should be documented in the applicable customer agreement.

7. Third-Party Infrastructure Providers and Subprocessors

Invincible AI may engage authorised third-party service providers to deliver GPU computing, storage, networking, AI inference, monitoring, and related infrastructure services.

Where these providers process customer personal data on behalf of Invincible AI, they are treated as subprocessors.

Invincible AI will seek to ensure that applicable subprocessors are subject to appropriate confidentiality, security, and data protection obligations.

Relevant subprocessor information, including processing purposes and locations, will be made available to customers through an agreed mechanism.

Where required by applicable law or contract, customers will be informed of material changes to subprocessors and provided an opportunity to raise reasonable data protection objections.

Invincible AI remains responsible for fulfilling its contractual data processing obligations, including applicable obligations relating to authorised subprocessors.

8. Data Retention and Deletion

Customer personal data will be retained for the duration necessary to provide the contracted services and fulfil applicable legal obligations.

Upon termination or expiration of services:

• Customers may retrieve their data through available export functionality or agreed procedures.
• Customer data will be deleted in accordance with applicable service retention schedules and contractual commitments.
• Certain billing, security, audit, and legal records may be retained where required or permitted by law.
• Backup copies may remain temporarily until the applicable backup retention cycle expires.

Specific retention periods, export windows, and deletion timelines will be governed by the relevant customer agreement or service documentation.

9. Personal Data Breaches and Incident Management

Invincible AI maintains procedures intended to identify, investigate, contain, and respond to security incidents involving customer personal data.

Where a confirmed personal data breach affects information processed on behalf of a customer, Invincible AI will notify the affected customer without undue delay and within any shorter period required by applicable law or contractual commitments.

Where reasonably available, the notification may include the nature of the incident, affected information, potential impact, and mitigation measures.

Invincible AI will cooperate with customers in meeting applicable breach notification obligations.

Report Security Incidents

ciso@invincibleocean.com

10. Customer Rights and Data Protection Requests

Customers remain responsible for managing personal data rights requests where they act as the relevant data controller or data fiduciary.

Invincible AI will provide reasonable assistance, taking into account the nature of the processing and the information available to it, with requests concerning:

• Access to personal data.
• Correction of inaccurate information.
• Deletion of personal data.
• Withdrawal of consent.
• Restriction or objection to processing, where applicable.
• Data portability, where legally available.
• Other rights provided by applicable data protection laws.

Where Invincible AI receives a request relating to personal data controlled by an enterprise customer, it may direct the requester to that customer or notify the customer, subject to applicable law.

11. Applicable Data Protection Laws

Invincible AI seeks to comply with data protection laws applicable to its processing activities, including, where relevant:

• India: The Digital Personal Data Protection Act, 2023, and applicable rules and provisions in force.
• United Arab Emirates: Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data and applicable implementing requirements.
• European Economic Area: The General Data Protection Regulation (GDPR), where applicable.

Other national or regional data protection laws may apply depending on customer location, processing activities, and infrastructure deployment.

Where legally required, the parties will implement additional contractual safeguards, including appropriate international data transfer agreements.

This DPA does not replace mandatory Standard Contractual Clauses or other legally required transfer instruments.

12. Legacy Invincible Ocean API Business and Finii Platform

Invincible AI previously operated under the Invincible Ocean brand, providing enterprise API-based solutions for digital onboarding, Know Your Customer (KYC), identity verification, authentication, and related verification services.

Effective 1 July 2026, Invincible Ocean limited its legacy API operations and initiated a planned phased discontinuation of its traditional verification API business.

The Company has stopped accepting new customers for its legacy digital onboarding, KYC, and verification API services.

Existing customers with active contractual arrangements continue to be supported through the Finii platform, subject to their existing agreements and applicable service terms.

Personal data associated with these legacy services remains subject to applicable contractual, confidentiality, security, and data protection obligations.

The transition to Invincible AI does not automatically authorise the transfer, reuse, or processing of legacy customer data for unrelated AI infrastructure services or model training.

Any migration or transfer of personal data to a different legal entity or service provider will be subject to applicable legal requirements and appropriate contractual arrangements.

13. Compliance, Audits and Security Assurance

Invincible AI will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA.

Subject to applicable confidentiality and security requirements, such information may include relevant security documentation, independent assessment reports, and details of technical and organisational controls.

Where required by law or agreed contractually, customers may request additional compliance information or verification.

Audit requests will be managed in a manner that protects the security, confidentiality, and operational integrity of shared infrastructure and other customer environments.

14. Limitation of Liability

Each party remains responsible for its respective obligations under applicable data protection laws and customer agreements.

Liability arising under this DPA will be governed by the applicable Terms of Service or enterprise agreement, subject to mandatory legal requirements.

Nothing in this DPA excludes or limits liability that cannot lawfully be excluded.

15. Changes to This DPA

Invincible AI may update this DPA to reflect changes in technology, infrastructure, legal requirements, or business operations.

Material changes affecting existing contractual data protection obligations will be handled in accordance with applicable agreements and laws.

The latest published version will be available on our website.

Changes to an executed or otherwise binding DPA will take effect only in accordance with the applicable agreement and legal requirements.

16. Contact Information and Legal Notices

For questions regarding this DPA, contractual arrangements, or formal legal notices, please contact:

Invincible AI

Website: https://www.invincibleai.ai

Legal Notices and General Enquiries

contact@invincibleai.ai

Office of the Chief Information Security Officer (CISO)

Security, Privacy and Data Protection

ciso@invincibleocean.com

All formal notices concerning this DPA should be directed to contact@invincibleai.ai, unless the applicable customer agreement requires another method.

For security incidents, privacy concerns, and data protection requests, please contact ciso@invincibleocean.com.

Invincible AI is part of the Invincible Intelligence Group technology ecosystem.