Data Processing Agreement ("DPA")

Effective Date: 26 October 2025

This Data Processing Agreement ("DPA") forms part of the Agreement between Global Family Enterprise Advisors Pte Ltd ("FAB LEARNING," "Processor") and the Customer ("Controller").

1 . Definitions

• "Approved Subprocessors" means the subprocessors listed at FAB LEARNING Subprocessors List.
• "Customer Personal Data" means Personal Data processed by FAB LEARNING on behalf of Customer.

2. Roles & Responsibilities
Customer is the Data Controller. FAB LEARNING is the Data Processor. We will process Customer Personal Data only on your documented instructions as set out in the Agreement and this DPA.

3. Our Obligations
We shall implement appropriate security measures, ensure confidentiality, notify you of Personal Data Breaches, and provide reasonable assistance.

4. Processing Instructions & Liability
The Supplier will only process Personal Data upon documented instructions from the Customer.

5. Sub-processors
Customer provides prior general written authorization for FAB LEARNING to engage the Approved Sub-processors. We will notify Customer of any intended changes; Customer may object in writing within 15 business days based on reasonable data protection grounds.

6. International Transfers
Customer Personal Data is hosted in Singapore.

7. Data Retention & Deletion
7.1. FAB LEARNING will not retain Customer Personal Data longer than necessary to fulfil the purposes for which it was collected.
7.2. The specific retention periods for different categories of data are detailed in FAB LEARNING's Privacy Notice. Upon termination of the Agreement, at Customer's election, we will return or delete the data, except for data we are obligated to retain for the following purposes:
(a) Financial and Transaction Records: Retained for 7 years from the end of the financial year to comply with Singapore law.
(b) User Account and Assessment Data: Retained for up to 7 years from account termination to respond to inquiries, maintain record continuity, and for purposes of audit, compliance, or the defense of legal claims.
7.3. Once the retention period expires, we will securely delete or anonymize the Customer Personal Data.

8. Audit Rights
We will provide information necessary to demonstrate compliance. Upon 30 days' written notice, we will permit audits at reasonable intervals.

9. Governing Law
This DPA is governed by the laws of Singapore.

APPENDIX 1 - DETAILS OF PROCESSING

A. List of Parties

• Data Exporter (Controller): The Customer, with contact details as provided in their account.
• Data Importer (Processor): Global Family Enterprise Advisors Pte Ltd, 14 Wilmonar Avenue, Singapore 588044.
• Data Protection Officer: George, george@fab-learning.com.

B. Description of Processing

1. Categories of Data Subjects: Family members, shareholders, advisors, and employees of the Customer's clients.
2. Categories of Personal Data: Identity, contact, profile, business data, and sensitive assessment data (answers on family dynamics and business strategy).
3. Purpose: To enable the Customer to provide family business evaluation and advisory services using the FAB LEARNING platform.
4. Duration of Processing: For the subscription term. For retention periods post-termination, refer to Section 7 of this DPA.
5. Sub-processor Transfers: As described on the FAB LEARNING Subprocessor list.

APPENDIX 2 - TECHNICAL & ORGANISATIONAL MEASURES

• Encryption: Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Access Controls: Principles of least privilege and role-based access control are enforced. Multi-factor authentication (MFA) is required for administrative access.
• Infrastructure Security: Data is hosted on Linode's secure server infrastructure in Singapore.
• Security Management: We maintain internal security policies and conduct regular vulnerability scanning.