Personal Data Protection Addendum (DPA)

Addendum to the Services Agreement — OSAMMVC Virtual Office

This is an English translation provided for reference. In case of any discrepancy, the Spanish-language version prevails.

Version 1.0 — In force since August 1, 2026. This Addendum supplements —and, in matters of personal data protection, prevails over— the Services Agreement (Villa Constitución, 01/09/2025) and the Confidentiality Agreement (Villa Constitución, 01/06/2023) executed between the parties.

Parties

• Data controller: OBRA SOCIAL ASOCIACIÓN MUTUAL METALÚRGICA VILLA CONSTITUCIÓN ("OSAMMVC" / "the Controller"), CUIT 30-70923882-1, with registered office at María Perrisol 615, Villa Constitución, Province of Santa Fe.
• Data processor: P Y P TECHNOLOGIES S.R.L. ("PyP" / "the Processor"), with registered office at Av. San Martín 290, Arroyo Seco, Province of Santa Fe.

Recitals

Whereas OSAMMVC has entrusted PyP with the development and operation of the Virtual Office ("the OV") in accordance with the Services Agreement; whereas in the context of said provision PyP accesses and processes personal data of data subjects (members and their family groups, employers, providers and staff) on behalf of OSAMMVC; and whereas it is appropriate to regulate such processing in accordance with the Argentine Personal Data Protection Act No. 25,326 (Ley 25.326), its implementing Decree 1558/2001 and the provisions of the Access to Public Information Agency (AAIP).

1. Purpose and regulatory framework

The purpose of this Addendum is to establish the obligations of PyP, in its capacity as data processor (Section 25, Ley 25.326), with respect to the personal data it processes on behalf of OSAMMVC in the operation of the OV, ensuring compliance with Ley 25.326, in particular its Sections 9 (security), 10 (confidentiality) and 25 (provision of services), and other applicable regulations.

2. Definitions

• Personal data / sensitive data: in accordance with Section 2 of Ley 25.326. Health-related data processed in the OV (appointments, orders/authorizations, services, consumption) are considered sensitive data.
• Data subject: person to whom the data refers (member, dependent family member, employer, provider, user).
• Sub-processor: third party that processes data on behalf of PyP for the provision of the Service.
• Security incident: any breach of security that results in the destruction, loss, alteration or unauthorized access/disclosure of personal data.

3. Roles of the parties

OSAMMVC is the Controller and decides on the purposes and means of processing. PyP is the Processor and processes the data solely on behalf of and according to the instructions of OSAMMVC. This Addendum does not transfer to PyP the ownership or the primary responsibility over the data.

4. Scope, nature and purpose of processing

• Nature: operation of the EasyBot platform (a PyP product) that supports the OV in its web versions and mobile apps (iOS/Android), including the WhatsApp Cloud API messaging channel linked to the OSAMMVC Business portfolio on Meta.
• Purposes: membership verification; management of appointments, orders and authorizations; digital membership card; processing of payments and refunds; sending of notifications (push and WhatsApp); support; security; and compliance with legal obligations.
• Categories of data: identification and contact data, member number, health data (sensitive), payment data (through Mercado Pago) and technical/usage data.
• Categories of data subjects: members and family group, employers, providers and authorized staff.

5. Instructions of the Controller

PyP shall process the data exclusively in accordance with the documented instructions of OSAMMVC and with the provisions of this Addendum. PyP shall not process or use the data for its own purposes or purposes unrelated to the provision, nor shall it transfer them to third parties except by instruction of OSAMMVC or legal obligation. If PyP considers that an instruction infringes the data protection regulations, it shall inform OSAMMVC.

6. Confidentiality and duty of secrecy

PyP and all of its personnel with access to the data are bound by professional secrecy (Section 10, Ley 25.326), an obligation that subsists even after the relationship with OSAMMVC has ended. PyP guarantees that the persons authorized to process the data have committed to confidentiality. This obligation supplements the Confidentiality Agreement in force between the parties.

7. Security measures (Section 9)

PyP shall implement and maintain technical and organizational measures appropriate to the sensitive nature (health data) of the information, including, at a minimum: encryption in transit; access control based on roles and permissions; user authentication; logging/traceability of operations; backups and recovery procedures; and security updates.

Interpretive clarification: the liability limitation/exemption clauses of the Services Agreement (in particular its SEVENTH clause) do not exempt PyP from compliance with the personal data security and protection obligations established in this Addendum and in Ley 25.326.

8. Data hosting and international transfers

The health data and other personal data of members reside in OSAMMVC's infrastructure, with which the EasyBot platform integrates to operate the OV.

The EasyBot platform and its processing components may operate on infrastructure owned by PyP or by third parties subcontracted by PyP (clause 9). In all cases, such infrastructure is located in Argentine territory, corresponds to companies that operate in accordance with current legislation, and maintains adequate levels of cybersecurity and backups.

The only interactions that may involve processing outside Argentina are limited and functional: (i) Mercado Pago (payments/refunds); (ii) push notifications via Google (FCM) and Apple (APNs), limited to a device identifier and the notice content, without health data; and (iii) Meta's WhatsApp Cloud API channel (clause 10). In all cases, the safeguards of Ley 25.326 and the AAIP apply.

9. Sub-processors

OSAMMVC authorizes PyP to resort to the following sub-processors for the provision of the Service, with PyP undertaking to impose on them data protection obligations equivalent to those of this Addendum and to be liable for their actions:

PyP shall inform OSAMMVC of any addition or replacement of sub-processors with reasonable advance notice, with OSAMMVC being able to object to it on well-founded data protection grounds.

10. WhatsApp / Meta channel

The messaging channel operates on WhatsApp Cloud API linked to the OSAMMVC Business portfolio on Meta. PyP, through EasyBot, guarantees:

• Compliance with Meta's policies and regulations for the handling of information and the sending of messages (approved templates).
• The onboarding of conversations with the consent of the user and unsubscribe (opt-out) mechanisms when the user so requires.
• The complete and automatic deletion of visitors' conversations when they request it.

The processing in this channel is limited to the notification and service purposes described, in accordance with the data subject's consent.

11. Assistance with the rights of data subjects

PyP shall assist OSAMMVC, through reasonable technical and organizational measures, in handling requests for the exercise of the rights of access, rectification, updating and deletion (Sections 14 to 16, Ley 25.326). Any request that a data subject addresses directly to PyP shall be referred to OSAMMVC without delay.

12. Notification of security incidents

PyP shall notify OSAMMVC without undue delay and no later than within 48 hours of having become aware of a security incident affecting personal data, providing the available information on its nature, categories and volume of affected data, possible consequences and measures adopted or proposed, so that OSAMMVC can comply with the obligations and notifications that may apply before the AAIP and the data subjects.

13. Return or destruction of the data

Upon termination of the provision for any reason, PyP shall, at OSAMMVC's choice, return or destroy the personal data processed and delete the existing copies, except for a legal retention obligation. To that end, PyP shall issue, at OSAMMVC's request, a certificate of destruction/return. This obligation is independent of the restitution of equipment delivered on loan (comodato) provided for in the Services Agreement.

14. Cooperation, audit and AAIP

PyP shall make available to OSAMMVC the information reasonably necessary to demonstrate compliance with this Addendum and shall cooperate with the audits or inspections that OSAMMVC or the AAIP may order, within reasonable parameters of confidentiality and security.

15. Processor's Data Protection Officer / Delegate

PyP designates as Data Protection Officer (DPO) —point of contact in matters of personal data protection— David Jesús Piccinini, DNI 36.187.961, Argentine citizen, co-founder, CEO and managing partner of P Y P TECHNOLOGIES S.R.L. as set forth in its articles of incorporation. DPO / Data Protection Office contact: privacy@pyptechnologies.com.ar.

16. Term

This Addendum enters into force on the date of its signature and remains in force as long as the Services Agreement subsists and/or any processing of data on behalf of OSAMMVC continues. The obligations of confidentiality, secrecy and security subsist after termination in accordance with the law and the agreements between the parties.

17. Precedence and integration

In all matters relating to personal data protection, this Addendum prevails over the Services Agreement and the Confidentiality Agreement. In all other respects, said agreements retain full force. The possible invalidity of a clause shall not affect the validity of the rest.

18. Applicable law and jurisdiction

This Addendum is governed by the laws of the Argentine Republic. For any dispute, the parties submit to the ordinary jurisdiction of the city of Villa Constitución, Province of Santa Fe, to the exclusion of any other, in line with the agreements it integrates.

This Addendum forms an integral part of the Services Agreement executed between OSAMMVC and P Y P TECHNOLOGIES S.R.L. and is executed between the parties in the City of Villa Constitución, Province of Santa Fe.