EveCritical Minerals

Data Processing Addendum

Effective date: November 3, 2026. Last updated: November 3, 2026.

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between Ventureship (“Processor”) and the customer identified in the Agreement (“Customer”) for the provision of Eve (the “Service”). It applies where Ventureship processes Customer Personal Data on behalf of Customer in the course of providing the Service. In the event of a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA controls.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement. In this DPA:

  • “Data Protection Laws” means all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), each as applicable.
  • “Customer Personal Data” means personal data contained in Customer Data that Ventureship processes on behalf of Customer.
  • “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing” and “Supervisory Authority” have the meanings given in the GDPR, and “Business,” “Service Provider” and “Consumer” have the meanings given in the CCPA.
  • “Subprocessor” means any third party engaged by Ventureship to process Customer Personal Data.
  • “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
  • “Standard Contractual Clauses” means the clauses annexed to European Commission Implementing Decision (EU) 2021/914, and “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles and scope

Customer is the Controller (or a Processor acting on behalf of a third-party Controller) and Ventureship is the Processor of Customer Personal Data. For purposes of the CCPA, Customer is a Business and Ventureship is a Service Provider.

Ventureship processes Customer Personal Data on behalf of Customer for the following purposes and in the following manner:

  • Subject matter: provision of the Service under the Agreement.
  • Duration: the term of the Agreement plus the period until deletion in accordance with Section 10.
  • Nature and purpose: hosting, storage, analysis, transmission, display and other processing necessary to provide, secure, support and improve the Service as instructed by Customer.
  • Categories of data subjects: Customer’s users, employees, contractors, business contacts, leads, counterparties and customers whose personal data Customer submits to the Service.
  • Categories of personal data: names, business contact details, job titles, company affiliations, account credentials, communications content, transaction and invoice details, and usage data.
  • Special categories: none. Customer will not submit special categories of personal data unless agreed in writing.

3. Customer instructions

Ventureship will process Customer Personal Data only on documented instructions from Customer, including as set out in the Agreement, this DPA and Customer’s configuration and use of the Service, unless required to do otherwise by applicable law, in which case Ventureship will inform Customer of that requirement before processing unless the law prohibits it. Ventureship will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

Customer is responsible for the lawfulness of its instructions, for providing any required notices and obtaining any required consents, and for the accuracy and quality of Customer Personal Data.

4. CCPA service provider obligations

Ventureship will not sell or share Customer Personal Data as those terms are defined in the CCPA; retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement or as otherwise permitted by the CCPA; retain, use or disclose it outside the direct business relationship between the parties; or combine it with personal information received from other sources except as permitted by the CCPA. Ventureship will notify Customer if it can no longer meet its obligations under the CCPA.

5. Confidentiality

Ventureship will ensure that personnel authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality and receive appropriate training on data protection.

6. Security

Ventureship will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, costs of implementation and the nature, scope, context and purposes of processing. These measures include:

  • encryption of Customer Personal Data in transit and at rest;
  • role-based access controls, least-privilege access and multi-factor authentication for administrative access;
  • logging and monitoring of access to production systems;
  • secure development practices and vulnerability management;
  • business continuity, backup and disaster recovery procedures;
  • personnel security, including confidentiality commitments and security training;
  • regular review and testing of the effectiveness of security measures.

7. Subprocessors

Customer provides general authorization for Ventureship to engage Subprocessors, such as cloud hosting providers, payment processors, communications providers and customer support tools, to process Customer Personal Data. Ventureship will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than those in this DPA, and remains liable for each Subprocessor’s performance.

Ventureship will make information about its Subprocessors available on request to privacy@ventureship.xyz and will give Customer at least thirty (30) days’ notice before engaging a new Subprocessor. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if it cannot be resolved, Customer may terminate the affected part of the Service and receive a refund of any prepaid fees for the unused period.

8. Data subject requests and assistance

Taking into account the nature of the processing, Ventureship will provide reasonable assistance to Customer, through appropriate technical and organizational measures, to respond to requests from Data Subjects to exercise their rights under Data Protection Laws. If Ventureship receives such a request directly, it will promptly redirect the Data Subject to Customer and will not respond except as instructed by Customer or required by law.

Ventureship will also provide reasonable assistance to Customer in carrying out data protection impact assessments and prior consultations with Supervisory Authorities, to the extent required by Data Protection Laws and relating to Ventureship’s processing.

9. Security incidents

Ventureship will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will include, to the extent known, the nature of the incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences and the measures taken or proposed to address it. Ventureship will take reasonable steps to contain, investigate and mitigate the incident. Notification is not an acknowledgment of fault or liability.

10. Return and deletion

Upon termination of the Agreement, Ventureship will, at Customer’s election, make Customer Personal Data available for export for thirty (30) days and thereafter delete it, including copies, within ninety (90) days, except to the extent retention is required by law. Data retained in backups will be deleted in accordance with standard backup rotation and protected in accordance with this DPA until deletion.

11. Audits

Ventureship will make available to Customer information reasonably necessary to demonstrate compliance with this DPA. Upon reasonable written request no more than once per year, Ventureship will respond to security questionnaires and provide relevant summaries of security assessments. Where Data Protection Laws require it and the information provided is insufficient, Customer may conduct an audit on at least thirty (30) days’ notice, during business hours, at Customer’s expense, subject to reasonable confidentiality and security requirements and without access to other customers’ data.

12. International transfers

Ventureship may transfer and process Customer Personal Data outside the country in which it was collected, including in the United States. To the extent Customer Personal Data originating in the European Economic Area, Switzerland or the United Kingdom is transferred to a country that has not been found to provide an adequate level of protection, the parties agree that the Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor, as applicable) and, for UK transfers, the UK Addendum, are incorporated by reference, with Customer as data exporter and Ventureship as data importer. For these purposes: the optional docking clause applies; general written authorization applies to Subprocessors with the notice period in Section 7; the governing law and forum are those of Ireland; and the annexes are completed with the information in Sections 2 and 6 of this DPA. For Swiss transfers, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

13. Liability

Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent such limitations are not permitted by Data Protection Laws.

14. Term and general

This DPA remains in effect for as long as Ventureship processes Customer Personal Data on behalf of Customer. Ventureship may update this DPA to reflect changes in Data Protection Laws or the Service, provided updates do not materially reduce the protection of Customer Personal Data. This DPA is governed by the law governing the Agreement, except where Data Protection Laws or the Standard Contractual Clauses require otherwise.

15. Contact

Questions about this DPA or requests for a countersigned copy can be sent to privacy@ventureship.xyz. Legal notices should be sent to legal@ventureship.xyz.

Data Processing Addendum | Eve