Data Processing Agreement

1. Parties

1.1 Data Controller: The business entity or individual that registers for and uses the CariHub Platform, as identified in the account registration. The Data Controller determines the purposes and means of processing personal data through the Platform.

1.2 Data Processor: CariHub Business Link, a company registered and operating in the Republic of Trinidad and Tobago, which processes personal data on behalf of the Data Controller as described in this DPA. CariHub Business Link processes personal data solely in accordance with the Data Controller's documented instructions and the terms of this DPA.

1.3 Data Subjects: The individuals whose personal data is processed through the Platform on behalf of the Data Controller. Data Subjects typically include the Data Controller's customers, clients, patients, guests, or other individuals who interact with the Data Controller's business through the Platform (e.g., by booking appointments, providing contact information, signing consent forms, or making payments).

2. Scope and Purpose of Processing

2.1 CariHub Business Link processes personal data on behalf of the Data Controller solely for the purpose of providing the Platform and its features, which include but are not limited to:

• (a) Appointment Booking and Scheduling: Processing customer data to facilitate online booking, appointment management, waitlists, and scheduling.
• (b) Point of Sale and Payment Processing: Processing customer and transaction data to facilitate in-person and online payments through integrated payment gateways.
• (c) Customer Relationship Management (CRM): Storing and managing client profiles, communication history, preferences, and interaction records.
• (d) AI Assistant: Processing customer and business data through AI models (provided by OpenAI, Anthropic, Google, xAI, Mistral, and OpenRouter) to generate suggestions, draft communications, and provide operational insights on behalf of the Data Controller.
• (e) Marketing and Communications: Processing customer contact data to send emails (via Resend/Brevo) and SMS/WhatsApp messages (via Twilio) on the Data Controller's behalf, in accordance with the Data Controller's instructions, including, where the Business has enabled Bring Your Own Key (BYOK), through the Business's own connected Resend or Twilio account.
• (f) Events Management: Processing registration and ticketing data for events created by the Data Controller.
• (g) Gift Cards and Loyalty Programmes: Processing customer data to issue, track, and redeem digital gift cards and loyalty points.
• (h) E-Signatures: Processing data provided in electronic consent forms, waivers, and intake forms, including signature data and associated documents.
• (f) Financial Reporting: Processing transaction and financial data to generate reports, invoices, and financial summaries for the Data Controller.
• (g) Storage and Backup: Storing the Data Controller's data securely in our databases (Supabase PostgreSQL) and file storage (Cloudflare R2), including automated backups.

2.2 CariHub Business Link shall process personal data only for the specific purposes described in this DPA and shall not process personal data for any other purpose unless instructed by the Data Controller in writing or required by applicable law.

2.3 CariHub Business Link shall not: (a) process personal data in a way that is incompatible with the purposes described above; (b) sell, rent, or share personal data with third parties for their own marketing or commercial purposes; or (c) use personal data to train, fine-tune, or improve its own AI models or any third-party AI models, unless explicitly instructed by the Data Controller.

3. Processing Instructions

3.1 The Data Controller directs the processing of personal data through the Platform. CariHub Business Link shall process personal data only in accordance with the Data Controller's documented instructions, which include:

• (a) These Terms and this DPA.
• (b) The Data Controller's configuration settings within the Platform (e.g., communication preferences, data retention settings, consent configurations).
• (c) The Data Controller's actions taken through the Platform (e.g., sending communications, exporting data, generating reports).
• (d) Written instructions provided by the Data Controller to CariHub Business Link (e.g., via email to support@carihub.com or privacy@carihub.com).

3.2 If CariHub Business Link believes that any instruction from the Data Controller infringes applicable data protection law, CariHub Business Link shall promptly inform the Data Controller in writing. CariHub Business Link shall not be required to comply with any instruction that it reasonably believes would cause it to violate applicable data protection legislation.

3.3 The Data Controller acknowledges and agrees that CariHub Business Link is not responsible for determining the lawfulness of the processing or the Data Controller's compliance with data protection laws. The Data Controller is solely responsible for:

• (a) Ensuring that it has a valid legal basis for processing personal data through the Platform (e.g., consent, contract, legitimate interest, legal obligation).
• (b) Providing appropriate privacy notices to Data Subjects.
• (c) Obtaining and recording valid consent where required.
• (d) Ensuring that personal data provided to the Platform is accurate and up to date.
• (e) Responding to Data Subject rights requests (with assistance from CariHub Business Link as described in Section 7).
• (f) Conducting Data Protection Impact Assessments (DPIAs) where required.
• (g) Appointing a Data Protection Officer where required by applicable law.
• (h) Where the Business has enabled Bring Your Own Key (BYOK) under Section 4.6, entering into and maintaining an appropriate data processing agreement with each BYOK provider (e.g., the Resend Data Processing Agreement, the Twilio Data Processing Agreement) covering the personal data transmitted to that provider through the BYOK routing, and ensuring the Business's instructions, retention, breach-notification, and data-deletion obligations flow down to that provider.

4. Sub-Processor List and Approval

4.1 CariHub Business Link engages the following sub-processors to assist in providing the Platform. Each sub-processor has been vetted for appropriate security and data protection practices, and CariHub Business Link has entered into data processing agreements with each sub-processor that include obligations equivalent to those in this DPA. The full, up-to-date sub-processor list — including the categories of personal data processed, the purpose of processing, the location of processing, and the transfer-mechanism relied upon for cross-border transfers — is maintained at carihub.com/legal/sub-processors and is incorporated into this DPA by reference. The summary table below is provided for convenience but the canonical list is the one published at /legal/sub-processors.

4.2 Sub-Processor Approval. The Data Controller approves the engagement of the sub-processors listed in Section 4.1 by accepting this DPA. For the avoidance of doubt, the sub-processors listed in Section 4.1 are approved as of the date of this DPA.

4.1.1 Multiple Active Payment Gateways (v1.4.0). The Platform may have multiple payment gateway sub-processors (Stripe, PayPal, Fygaro, LuniPay, PayWise) active simultaneously at the platform level. There is no mutual exclusivity — activating one gateway does not deactivate the others. A subscriber chooses their preferred gateway at subscription checkout from among the platform-activated options. All active payment gateway sub-processors process payment-method tokens under the same PCI DSS SAQ A scope described in Section 5.1(e) — the subscriber's gateway choice does not change the data categories processed, the purpose of processing, the location of processing, or the cross-border transfer mechanism for any individual sub-processor. Each gateway sub-processor's transfer mechanism is documented in the cross-border transfer routes in Section 4.8. The Data Controller's approval under Section 4.2 extends to ALL payment gateway sub-processors listed in Section 4.1 regardless of how many are simultaneously active at any given time — no separate approval is required when the platform activates an additional gateway that is already listed in Section 4.1.

4.3 Changes to Sub-Processors. CariHub Business Link may update the list of sub-processors from time to time. Where CariHub Business Link intends to add or replace a sub-processor, it will:

• (a) Notify the Data Controller at least thirty (30) days in advance of the change by email to the address associated with the account.
• (b) Provide details of the new or replacement sub-processor, including the sub-processor's name, location, and purpose of processing.
• (c) Allow the Data Controller thirty (30) days to object to the change in writing to privacy@carihub.com.

4.4 Objection to Sub-Processor Changes. If the Data Controller objects to a sub-processor change on reasonable data protection grounds, the parties will discuss the objection in good faith. If the parties cannot reach agreement, the Data Controller may, as a last resort, terminate the affected services with thirty (30) days' written notice without penalty, provided that the termination relates solely to the sub-processor change.

4.5 Sub-Processor Obligations. CariHub Business Link ensures that each sub-processor:

• (a) Is bound by a written agreement that imposes data protection obligations no less protective than those in this DPA.
• (b) Processes personal data only in accordance with the Data Controller's documented instructions.
• (c) Implements appropriate technical and organisational security measures.
• (d) Assists CariHub Business Link in fulfilling its obligations under this DPA, including data breach notification and Data Subject rights requests.
• (e) Deletes or returns personal data upon termination of the sub-processing arrangement.

4.6 Business-Connected (BYOK) Sub-Processors. The Platform offers an optional feature known as Bring Your Own Key (BYOK), whereby the Business may connect its own third-party communication provider account (Resend for email, Twilio for SMS and WhatsApp) to the Platform so that outbound messages route through the Business's own provider account rather than the shared sub-processor accounts listed in Section 4.1. The following terms apply to BYOK providers:

• (a) Contracting Party. Where the Business connects its own Resend or Twilio account, that provider ("BYOK Provider") is a sub-processor engaged by the Business (Data Controller), NOT by CariHub Business Link. The BYOK Provider contracts directly with the Business under the Business's own agreement with that provider. CariHub Business Link has no contract with the Business's BYOK Provider and is not a party to that relationship.
• (b) Business Warranty. The Business warrants that, before enabling BYOK for any channel, it has entered into an appropriate data processing agreement with its BYOK Provider (e.g., the Resend DPA, the Twilio DPA) that imposes data protection obligations no less protective than those imposed on CariHub Business Link under this DPA, and that the BYOK Provider's terms permit the transmission of personal data to and processing by the BYOK Provider on the Business's behalf.
• (c) Scope of CariHub Business Link' Sub-Processor Obligations. CariHub Business Link' obligations under Section 4.5 (Sub-Processor Obligations) do NOT extend to BYOK Providers. CariHub Business Link does not vet, approve, monitor, or audit the Business's BYOK Provider, and is not responsible for the BYOK Provider's security practices, data retention, breach notification procedures, sub-processing chain, or compliance with applicable data protection law.
• (d) Business Responsibility for BYOK Provider. The Business is solely responsible for the BYOK Provider's security, breach notification, and data-deletion practices, including: (i) conducting due diligence on the BYOK Provider before connection; (ii) configuring the BYOK Provider account in accordance with the BYOK Provider's requirements (e.g., verifying a sending domain with Resend, configuring WhatsApp Business sender eligibility with Twilio); (iii) monitoring the BYOK Provider's service for outages, suspension, or terms changes; (iv) notifying CariHub Business Link and affected Data Subjects of any breach at the BYOK Provider; and (v) ensuring deletion or return of personal data held by the BYOK Provider upon termination of the BYOK arrangement.
• (e) CariHub's Limited Role. Where BYOK is active, CariHub Business Link' role is limited to: (i) transmitting the message content and recipient data to the BYOK Provider's API on the Business's behalf at send time; (ii) storing the Business's BYOK API credentials (Resend API key, Twilio account SID and auth token) encrypted at rest using AES-256-GCM with the platform's AI_ENCRYPTION_KEY, and transmitting those credentials to the BYOK Provider only at the moment of sending or webhook verification; (iii) receiving bounce, complaint, delivery, and inbound-message webhooks from the Business's BYOK Provider account and acting on them (per-business suppression-list writes, delivery-status updates) in accordance with the Business's instructions. CariHub does not store, copy, or retain personal data transmitted to the BYOK Provider beyond what is necessary for the Platform's own audit-log, suppression-list, and CommunicationLog records.
• (f) Credential Confidentiality. BYOK API credentials are never displayed in plaintext after saving, never logged in plaintext in application logs or audit logs, and never transmitted to any party other than the BYOK Provider's own API endpoint. Only the last four characters of a credential (e.g., API key last-4, account SID last-4) are surfaced in the Platform UI for identification.
• (g) Routing Switch. The Business may flip outbound email routing between the Platform's shared Resend account and the Business's own BYOK Resend account at any time without disconnecting the BYOK configuration. The routing selection is stored on the BYOK configuration row and applies only to the Business's outbound email; it does not affect SMS, WhatsApp, or other channels.
• (h) Force-Fallback. CariHub Business Link may, at its sole discretion, force-fallback outbound routing from the BYOK Provider to the Platform's shared account (or suspend BYOK routing entirely) if: (i) the Business's BYOK credentials fail authentication; (ii) the Business's BYOK Provider account is suspended, throttled, or terminated; (iii) the plan feature gating the BYOK channel is downgraded or removed; or (iv) CariHub Business Link reasonably believes continued BYOK routing would violate applicable law, this DPA, or the BYOK Provider's acceptable use policy. CariHub Business Link will use reasonable efforts to notify the Business of any forced fallback.
• (i) Quota and Policy Gates Still Apply. BYOK sends are exempt from the Platform-wide send-limit counter (which protects the Platform's shared sub-processor quota), but the Business's plan-tier communication quota and the Platform's policy gates (consent, suppression list, quiet-hours) remain enforced upstream of the BYOK routing decision. BYOK does not exempt the Business from any consent, frequency-cap, or suppression obligation under this DPA, the Acceptable Use Policy, or applicable law.
• (j) Indemnity. The Business agrees to indemnify and hold harmless CariHub Business Link from any claim, loss, fine, or expense arising from the Business's BYOK Provider's acts or omissions, including data breach, AUP violation, regulatory action, or carrier suspension, except to the extent directly caused by CariHub Business Link' breach of this DPA.

4.7 Data Categories Processed. For the avoidance of doubt, the principal categories of personal data that CariHub Business Link processes on behalf of the Data Controller through the Platform are:

4.8 Cross-Border Data Transfers. The Data Controller acknowledges that some of the sub-processors listed in Section 4.1 are located outside the Caribbean region, primarily in the United States and the European Union. Where personal data is transferred outside of Trinidad and Tobago or the Data Controller's home jurisdiction, CariHub Business Link ensures that such transfers are carried out with appropriate safeguards as follows:

• (a) Standard Contractual Clauses (SCCs). CariHub Business Link has executed Standard Contractual Clauses (the European Commission's 2021 modules, where applicable to the controller/processor roles of each transfer) with each sub-processor that receives personal data from EU/UK or Trinidad and Tobago data subjects. Copies of the executed SCCs are available on request from privacy@carihub.com, subject to applicable confidentiality obligations.
• (b) Trinidad and Tobago Data Protection Act 2011. CariHub Business Link processes personal data in compliance with the Data Protection Act, 2011 (Act No. 12 of 2011) of the Republic of Trinidad and Tobago, including the cross-border transfer restrictions in sections 17–20. Where the Act has not been fully brought into force, CariHub Business Link extends the rights described in Section 7 (Data Subject Rights Assistance) to Trinidad and Tobago data subjects as a matter of company policy.
• (c) Specific transfer routes. The principal cross-border transfer routes are: (i) Stripe, Inc. (United States) — payment-method tokens, never PAN/CVV; (ii) PayPal Holdings, Inc. (United States) — payment-method references, never PAN/CVV; (iii) Supabase Inc. (United States, with EU-region database hosting available) — all data categories at rest in the PostgreSQL database; (iv) Google LLC (United States) — name, email, and profile photo URL via OAuth ("Sign in with Google"); and (v) the AI providers listed in Section 4.1 (United States and France) — usage data and AI query content.
• (d) Adequacy decisions. Where the receiving country has been deemed to provide an adequate level of data protection by the relevant data protection authority, CariHub Business Link may transfer data based on that adequacy decision.
• (e) BYOK transfers. Where the Business has enabled BYOK under Section 4.6, cross-border transfers to the Business's BYOK provider are governed by the Business's own transfer arrangement with that provider (e.g., the Resend DPA, the Twilio DPA, including any SCCs the Business has executed). CariHub Business Link is not responsible for the lawfulness of the Business's international transfer arrangement with its BYOK provider.

5. Security Measures

CariHub Business Link implements and maintains robust technical and organisational security measures to protect the personal data processed under this DPA. These measures are designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

5.1 Encryption

• (a) Encryption at Rest: All personal data stored in our PostgreSQL databases (hosted on Supabase) is encrypted at rest using AES-256-GCM encryption. Database backups are also encrypted at rest.
• (b) Encryption in Transit: All data transmitted between users and the Platform is encrypted using TLS 1.3 (Transport Layer Security). Internal communications between Platform components also use TLS encryption.
• (c) File Storage Encryption: All files stored in Cloudflare R2 (images, documents, media) are encrypted at rest using server-side encryption (AES-256).
• (d) API Key and Credential Encryption: Sensitive credentials, including payment gateway API keys and AI provider keys, are encrypted at rest using AES-256-GCM with hardware-backed key management.
• (e) Payment Token Encryption and PCI DSS SAQ A: CariHub does not store, process, or transmit primary account numbers (PANs / full card numbers), card-security codes (CVV), or magnetic-stripe data. All card-data capture is performed on the gateway's PCI-DSS-certified infrastructure (Stripe Hosted Checkout, PayPal Smart Buttons, Fygaro Hosted Page). CariHub stores only gateway-issued payment-method tokens (which are opaque references that cannot be used to retrieve the underlying card data), card-brand and last-four digits (for display), and token expiry. CariHub completes an annual PCI DSS Self-Assessment Questionnaire A (SAQ A) under PCI DSS v4.0.1, the lightest compliance tier, which applies where all cardholder-data functions are fully outsourced to PCI-DSS-compliant third parties and the merchant stores no card data itself. Manual bank transfer receipt files (uploaded images and PDFs) are stored in encrypted object storage at rest (AES-256-GCM, server-side encryption).

5.2 Access Controls

• (a) Role-Based Access Control (RBAC): Access to personal data is restricted based on job role and function. Personnel are granted the minimum level of access necessary to perform their duties (principle of least privilege).
• (b) Authentication: All access to production systems requires strong authentication, including passwords meeting minimum complexity requirements and, for administrative access, multi-factor authentication (MFA).
• (c) Tenant Isolation: In the multi-tenant Platform, each business's data is logically isolated. Database-level row-level security (RLS) policies ensure that each business can only access its own data.
• (d) API Access Control: API access is controlled through authentication tokens with scoped permissions. Rate limiting is enforced to prevent abuse.
• (e) Access Reviews: Access rights are reviewed at least quarterly, and access is promptly revoked when personnel no longer require it (e.g., upon role change or termination).

5.3 Audit Logging

• (a) Comprehensive Logging: All access to personal data, including reads, writes, updates, and deletions, is logged with the identity of the user, the timestamp, the action performed, and the data affected.
• (b) Log Retention: Audit logs are retained for a minimum of two (2) years.
• (c) Log Protection: Audit logs are stored in a secure, append-only system that prevents tampering or deletion.
• (d) Regular Review: Audit logs are regularly reviewed for unauthorised access, anomalous patterns, and security incidents.

5.4 Vulnerability Management

• (a) Regular Assessments: We conduct regular vulnerability assessments and penetration testing of the Platform, at least annually and after any significant change to the infrastructure or application.
• (b) Dependency Management: We monitor and promptly update third-party dependencies (libraries, frameworks, and packages) to address known security vulnerabilities.
• (c) Bug Bounty Programme: We maintain a vulnerability disclosure programme to encourage responsible reporting of security issues by external researchers.
• (d) Incident Response: We maintain a documented incident response plan that defines roles, responsibilities, and procedures for detecting, containing, investigating, and remediating security incidents.

5.5 Infrastructure Security

• (a) Cloud Infrastructure: The Platform is hosted on Vercel and uses Supabase for database services, both of which maintain SOC 2 Type II certification or equivalent security certifications.
• (b) DDoS Protection: The Platform is protected by Cloudflare's DDoS mitigation and web application firewall (WAF).
• (c) Network Segmentation: Production environments are segmented from development and testing environments.
• (d) Secure Development: We follow secure software development lifecycle (SDLC) practices, including code reviews, static analysis, and automated security testing in our CI/CD pipeline.

5.6 Personnel Security

• (a) All personnel with access to personal data undergo background checks to the extent permitted by applicable law.
• (b) All personnel receive data protection and security training upon hire and at least annually thereafter.
• (c) All personnel are bound by confidentiality agreements that survive the termination of their employment or engagement.

6. Data Breach Notification

6.1 CariHub Business Link shall notify the Data Controller without undue delay and in any event within seventy-two (72) hours after becoming aware of a personal data breach involving personal data processed under this DPA, unless the breach is unlikely to result in a risk to the rights and freedoms of Data Subjects.

6.2 The notification to the Data Controller shall include, to the extent possible, the following information:

• (a) A description of the nature of the breach, including where possible:
• The categories and approximate number of Data Subjects concerned.
• The categories and approximate number of personal data records concerned.
• (b) The name and contact details of CariHub Business Link' Data Protection Officer or other contact point from whom more information can be obtained (privacy@carihub.com).
• (c) A description of the likely consequences of the personal data breach.
• (d) A description of the measures taken or proposed to be taken by CariHub Business Link to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

6.3 If it is not possible to provide all of the information described in Section 6.2 at the time of the initial notification, CariHub Business Link shall provide the information in phases without further undue delay as it becomes available.

6.4 Cooperation. CariHub Business Link shall cooperate with the Data Controller and provide reasonable assistance to the Data Controller in:

• (a) Investigating the breach and its impact.
• (b) Notifying affected Data Subjects, where required by applicable law and the Data Controller determines such notification is necessary.
• (c) Preparing and submitting any required notifications to data protection authorities or commissioners.
• (d) Implementing remedial measures to prevent future breaches.

6.5 CariHub Business Link shall document all personal data breaches, including the facts relating to the breach, its effects, and the remedial action taken, regardless of whether notification is required. This documentation shall be made available to the Data Controller upon request.

6.6 CariHub Business Link shall not notify any Data Subject directly about a personal data breach unless: (a) required to do so by applicable law; or (b) instructed to do so by the Data Controller, in which case CariHub Business Link shall comply with the Data Controller's instructions regarding the content and timing of the notification.

7. Data Subject Rights Assistance

7.1 Taking into account the nature of the processing, CariHub Business Link shall assist the Data Controller in fulfilling its obligations to respond to Data Subject rights requests ("DSARs"), including but not limited to requests for:

• (a) Access to personal data.
• (b) Rectification of inaccurate or incomplete personal data.
• (c) Erasure of personal data ("right to be forgotten").
• (d) Restriction of processing.
• (e) Data portability.
• (f) Objection to processing.
• (g) Withdrawal of consent.

7.2 Upon receiving a DSAR from a Data Subject (either directly or forwarded by the Data Controller), CariHub Business Link shall:

• (a) Promptly verify the identity of the Data Subject making the request, to the extent verification is possible based on the information available to CariHub Business Link.
• (b) Forward the request to the Data Controller without undue delay, identifying it as a Data Subject rights request.
• (c) Provide the Data Controller with the personal data in its possession that is relevant to the request, in a structured, commonly used, and machine-readable format (such as JSON or CSV), to the extent technically feasible.
• (d) Assist the Data Controller in responding to the request within the applicable legal timeframe (typically thirty (30) days).

7.3 CariHub Business Link shall not respond directly to a DSAR from a Data Subject without the Data Controller's instructions, unless required to do so by applicable law. The Data Controller remains responsible for the overall response to the Data Subject.

7.4 CariHub Business Link shall implement technical measures that enable the Data Controller to access, correct, export, and delete personal data of their Data Subjects directly through the Platform's dashboard and data export features.

7.5 CariHub Business Link may charge the Data Controller a reasonable fee for providing assistance with complex or burdensome DSARs that require significant resources beyond routine data export functionality. Any such fees will be communicated to the Data Controller in advance.

7.6 Records of Processing Activities (RoPA). The Processor maintains records of processing activities carried out on behalf of the Controller in accordance with Article 30 of the GDPR. These records include: the purposes of processing, the categories of data subjects and personal data, the categories of recipients, details of transfers to third countries, and the envisaged time limits for erasure. The Processor shall make these records available to the Controller upon reasonable request and to supervisory authorities upon direct request.

7.7 Data Protection Officer (DPO). The Processor has appointed a Data Protection Officer who serves as the point of contact for data protection matters. The DPO may be contacted at dpo@carihub.caribbean. The DPO is responsible for monitoring compliance with the GDPR and applicable Caribbean data protection law, advising on data protection impact assessments, and cooperating with supervisory authorities. The Controller may contact the DPO regarding any issues related to this Addendum or the processing of Controller Personal Data.

7.8 Data Protection Impact Assessment (DPIA). The Processor shall provide reasonable assistance to the Controller in conducting data protection impact assessments as required by Article 35 of the GDPR, taking into account the nature of processing and information available to the Processor. The Processor shall make available its own DPIAs, where applicable, upon reasonable request.

8. Audit Rights

8.1 The Data Controller (or an independent third-party auditor appointed by the Data Controller and bound by appropriate confidentiality obligations) shall have the right to audit CariHub Business Link' compliance with this DPA, subject to the following conditions:

• (a) Notice: The Data Controller must provide at least thirty (30) days' prior written notice of any audit, specifying the scope, timing, and auditors involved.
• (b) Scope: Audits shall be limited to the processing of the Data Controller's personal data and CariHub Business Link' compliance with this DPA. Audits shall not extend to CariHub Business Link' proprietary source code, trade secrets, or the personal data of other customers.
• (c) Frequency: Routine audits shall not occur more than once per calendar year, unless a data breach or other material compliance concern has been identified.
• (d) Cost: The Data Controller shall bear its own costs of conducting the audit. If the audit reveals a material breach of this DPA by CariHub Business Link, CariHub Business Link shall reimburse the Data Controller for reasonable audit costs.
• (e) Confidentiality: The Data Controller and its auditors shall maintain the confidentiality of all information obtained during the audit and shall not disclose such information to any third party without CariHub Business Link' prior written consent, except as required by law.

8.2 Alternative Compliance Evidence. As an alternative to a direct audit, CariHub Business Link may provide evidence of its compliance through:

• (a) SOC 2 Type II audit reports or equivalent security certification reports.
• (b) Penetration testing reports (with sensitive details redacted).
• (c) Certifications from reputable third-party security assessors.
• (d) Responses to a detailed security questionnaire.

The Data Controller acknowledges that such evidence may be provided in lieu of a direct audit and may contain redactions to protect confidential information and the security of the Platform.

8.3 Regulatory Audits. Nothing in this Section shall prevent a competent data protection authority or commissioner from exercising its statutory audit and inspection rights.

9. Data Return and Deletion on Termination

9.1 Upon termination or expiration of the Terms, or upon the Data Controller's written request, CariHub Business Link shall, at the Data Controller's choice:

• (a) Data Return: Return all personal data processed on behalf of the Data Controller to the Data Controller in a structured, commonly used, and machine-readable format (such as JSON or CSV); and/or
• (b) Data Deletion: Delete all personal data processed on behalf of the Data Controller from CariHub Business Link' systems and those of its sub-processors.

9.2 Data Export Period. The Data Controller may request a complete data export at any time during the term of the agreement and for up to thirty (30) days following termination. The data export will include:

• All business data (profiles, settings, configurations).
• All client/customer records and contact information.
• All appointment and booking history.
• All transaction and payment records.
• All communications (sent and received).
• All uploaded files, images, and documents stored in Cloudflare R2.
• All e-signature records and signed documents.
• All gift card and loyalty programme data.
• All review and rating data.
• All report data and financial records.

9.3 Deletion Timeline. If the Data Controller requests deletion (or does not request a data export within thirty (30) days of termination), CariHub Business Link shall:

• (a) Delete all personal data from active production systems within thirty (30) days of the request or the end of the data export period.
• (b) Delete all personal data from backup systems within ninety (90) days of the request, or within one standard backup rotation cycle, whichever is shorter, but in no event exceeding one hundred and eighty (180) days.
• (c) Use reasonable efforts to cause its sub-processors to delete all personal data within the same timelines.

9.4 Certification of Deletion. Upon the Data Controller's written request made within sixty (60) days of the data export period, CariHub Business Link shall provide written confirmation ("Certificate of Deletion") that:

• (a) All personal data has been deleted from active production systems.
• (b) All personal data has been deleted from backup systems (or will be deleted within the standard backup rotation cycle).
• (c) CariHub Business Link has directed all relevant sub-processors to delete the personal data.
• (d) All physical copies of personal data (if any) have been securely destroyed.

9.5 Residual Data. Notwithstanding the foregoing, CariHub Business Link may retain:

• (a) Anonymised and aggregated data that can no longer be attributed to an identifiable Data Subject or Data Controller, which CariHub Business Link may use for analytics, product improvement, and security purposes.
• (b) Records of processing activities required for legal compliance, auditing, or to establish, exercise, or defend legal claims, for the minimum period required by applicable law.
• (c) Log entries and metadata in backup systems that are overwritten in the ordinary course of business and are not reasonably accessible.

9.6 Legal Hold. If CariHub Business Link is required by law, regulation, or legal process to retain personal data that would otherwise be deleted, CariHub Business Link shall notify the Data Controller (to the extent legally permitted) and retain only the minimum data necessary for the minimum period required.

10. Liability Allocation

10.1 Each party's liability to the other under this DPA shall be subject to the Limitation of Liability provisions in the Terms of Service, which are incorporated herein by reference.

10.2 Nothing in this DPA shall limit or exclude either party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any liability that cannot be limited or excluded by applicable law.

10.3 The Data Controller acknowledges and agrees that CariHub Business Link is providing the Platform and processing personal data in accordance with the Data Controller's instructions. CariHub Business Link shall not be liable for any damages, losses, or claims arising from the Data Controller's:

• (a) Unlawful processing of personal data.
• (b) Failure to obtain necessary consents or provide required privacy notices.
• (c) Provision of inaccurate, incomplete, or unlawful data to the Platform.
• (d) Instructions that cause CariHub Business Link to violate applicable data protection law (provided that CariHub Business Link has notified the Data Controller of the concern in accordance with Section 3.2).

10.4 CariHub Business Link shall be liable to the Data Controller for damages directly caused by CariHub Business Link' breach of this DPA or its failure to implement appropriate security measures, subject to the liability cap in the Terms of Service.

11. Term and Duration

11.1 This DPA takes effect on the date the Data Controller accepts the Terms of Service and continues for the duration of the Data Controller's use of the Platform.

11.2 Upon termination of the Terms, the provisions of this DPA that relate to the return or deletion of personal data (Section 9), data breach notification (Section 6), and liability (Section 10) shall survive and remain in effect until all personal data has been returned or deleted in accordance with Section 9.

11.3 This DPA shall automatically terminate upon the termination of the Terms of Service, without affecting the surviving obligations described in Section 11.2.

12. Governing Law

12.1 This DPA shall be governed by and construed in accordance with the laws of the Republic of Trinidad and Tobago, without regard to its conflict of laws principles.

12.2 Any dispute arising out of or relating to this DPA shall be subject to the dispute resolution provisions set out in the Terms of Service, including the requirement for informal resolution and, if necessary, binding arbitration in Trinidad and Tobago.

13. Contact Information

For all matters relating to this Data Processing Agreement, including sub-processor inquiries, data breach notifications, DSARs, and audit requests, please contact:

Data Protection Officer

CariHub Business Link (Operator of CariHub)

• Email: privacy@carihub.com
• General Support: support@carihub.com
• Website: carihub.com

By using the CariHub Platform, the Data Controller acknowledges that it has read, understood, and agrees to be bound by the terms of this Data Processing Agreement.