1. Definitions

For the purposes of this DPA, the following terms have the meanings set out below:

1.1 Main terms

• "Customer" means the legal entity (laboratory or company) that contracts the NohaLims Service and in respect of which the Processor processes Personal Data.
• "DPA" means this Data Processing Agreement.
• "Data Center" means the physical or virtual location where the NohaLims Service is hosted for the Customer, as agreed in the main agreement or SLA.
• "Data Protection Law" means any law or regulation applicable to the processing of Personal Data, including but not limited to Colombian Law 1581 of 2012 and its regulatory decrees.
• "Data Subject" means any identified or identifiable natural person whose Personal Data is processed by the Processor on behalf of the Customer.
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
• "Main Agreement" means the NohaLims service contract (Terms and Conditions) signed between the Customer and the Operator, to which this DPA is attached.
• "Operator" / "Processor" means the legal entity that provides the NohaLims Service and processes Personal Data on behalf of the Customer.
• "Personal Data" means any information relating to a Data Subject that is protected under Data Protection Law and is (i) entered by the Customer or its users into the Service, or (ii) derived from use of the Service, or (iii) provided to the Processor for the provision of the Service.
• "Personal Data Breach" means any (1) accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized third-party access to Personal Data, or (2) similar incident involving Personal Data, in each case for which a Controller is required under Data Protection Law to provide notice to a competent data protection authority or a Data Subject.
• "Processing" means any operation or set of operations performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• "Service" means the NohaLims platform (LIMS software) offered as SaaS, on-premise or hybrid depending on the contracted plan.
• "SCCs" means the Standard Contractual Clauses issued by the European Commission for the transfer of Personal Data to third countries. Currently deferred — see §15.
• "Sub-processor" means any Processor engaged by the Operator or its Affiliates in connection with the provision of the Service.
• "Supervisory Authority" means an independent public authority established by a Member State of the European Union pursuant to the GDPR, or the equivalent authority in another applicable jurisdiction (in Colombia, the Superintendencia de Industria y Comercio — SIC).

1.2 Derived terms

• "Affiliate" means any entity that controls, is controlled by, or is under common control with a party.
• "Authorized Affiliate" means any Affiliate of the Customer subject to Data Protection Law and authorized by the Customer to use the Service. Not applicable to this DPA version — reserved for future multi-group expansion.
• "Restricted Transfer" means a transfer of Personal Data from the Customer to the Processor, or a subsequent transfer between Processors, that would be prohibited by Data Protection Law in the absence of SCCs or other adequacy mechanism.

2. Background and scope

2.1 Applicability

This DPA applies, to the extent provided for in the Main Agreement to which it is attached, to the processing of Personal Data carried out by the Operator and its Sub-processors in connection with the provision of the Service to the Customer.

2.2 Roles

The parties acknowledge and agree that, with regard to the processing of Personal Data:

• The Customer is the Controller of Personal Data uploaded to the Service. The Customer is solely responsible for the accuracy, quality and legality of Personal Data and for the means by which it acquired such data.
• The Operator is the Processor that processes Personal Data on behalf of the Customer in accordance with the Customer's documented instructions and the terms of this DPA.
• Where the Customer acts as Processor for another Controller (e.g., when uploading end-client data of the laboratory), the Customer shall be deemed an additional and independent Controller in relation to the Operator, with the respective rights and obligations under this DPA.

2.3 Consents and authorizations

The Customer acts as single point of contact and is solely responsible for obtaining all relevant authorizations, consents and permissions for the processing of Personal Data in accordance with this DPA. The Customer's use of the Service constitutes its representation and warranty that it has obtained all necessary consents and authorizations.

2.4 GDPR compliance

Where the Customer or its Data Subjects are subject to the GDPR, the parties agree that each party will review and adopt the requirements imposed on Controllers and Processors by Articles 28 and 32 to 36 of the GDPR, as applicable to the processing of Personal Data under this DPA.

3. Processing details

Pursuant to Article 28(3) of the GDPR (when applicable) and as a general reference for any Data Protection Law, the processing details are summarized in Annex I:

The Customer may request reasonable amendments to Annex I with prior written notice, and the Operator will review such requested changes.

4. Processor obligations

4.1 Processing per instructions

The Operator shall process Personal Data only in accordance with the Customer's documented instructions. The Main Agreement, this DPA and any related SLA constitute such documented initial instructions, and each use of the Service constitutes further instructions.

The Operator shall use reasonable efforts to follow any other Customer instructions, provided such instructions are required by Data Protection Law, are technically feasible, and do not require substantial changes to the Service. If any of these exceptions apply, or if the Operator considers an instruction infringes Data Protection Law, it shall immediately notify the Customer.

4.2 Processing required by law

The Operator may process Personal Data where required by applicable law. In such case, the Operator shall inform the Customer of the legal requirement before processing, unless otherwise prohibited by law.

4.3 Personnel confidentiality

To process Personal Data, the Operator and its Sub-processors shall only grant access to authorized personnel who have committed to maintain the confidentiality of such Personal Data, whether through a written confidentiality agreement or equivalent legal obligation.

4.4 Cooperation

At the Customer's written request, the Operator shall reasonably cooperate with the Customer in:

• Handling requests from Data Subjects or regulatory authorities regarding the processing of Personal Data or any Personal Data Breach.
• Conducting Data Protection Impact Assessments (DPIAs) or prior consultations with Supervisory Authorities when required by Data Protection Law.

Any costs arising from such additional assistance shall be the responsibility of the Customer, except when directly resulting from an Operator breach.

5. Security measures

5.1 Implementation

The Operator and its Sub-processors have implemented and will apply the technical and organizational measures (TOMs) described in Annex II. The Customer has reviewed such measures and agrees that they are appropriate for the Service, taking into account the state of the art, implementation costs, and the nature, scope, context and purpose of processing.

5.2 Modification of measures

The Operator may modify the TOMs at any time without notice, so long as it maintains a comparable or better level of security. Individual measures may be replaced by new measures that serve the same purpose without diminishing the level of security.

6. Personal Data Breach

6.1 Notification without undue delay

The Operator shall notify the Customer without undue delay after becoming aware of any Personal Data Breach. The notification shall contain, to the extent information is available:

• Nature of the breach (categories and approximate volume of Personal Data affected).
• Name and contact details of the data protection responsible or contact point.
• Likely consequences of the breach.
• Measures taken or proposed to remedy the breach and mitigate its effects.

6.2 Staged timeline

Where complete information is not available at the time of initial notification, the Operator may provide it in phases as it becomes available.

6.3 Identification and remediation

The Operator shall make reasonable efforts to identify the cause of the Personal Data Breach and take such measures as it deems necessary and reasonable to remediate it, to the extent remediation is within its reasonable control. The obligations herein shall not apply to incidents caused by the Customer or its authorized users.

6.4 Limitation

Any notification by the Operator to the Customer shall not be interpreted or construed as an admission of fault or liability by the Operator.

7. Data Subject Rights

7.1 Notification of Data Subject Requests

The Operator shall notify the Customer without undue delay if it receives a request from a Data Subject to exercise their rights of access, rectification, restriction of processing, erasure, data portability, objection to processing, or their right not to be subject to an automated individual decision-making (collectively, "Data Subject Request"). The Operator shall not respond to such request without the Customer's prior written consent, except to confirm to the Data Subject that the request relates to the Customer.

7.2 Assistance to Customer

Taking into account the nature of processing, the Operator shall assist the Customer by appropriate technical and organizational measures, insofar as possible, for the fulfilment of the Customer's obligation to respond to Data Subject Requests. To the extent the Customer, in its use of the Service, does not have the ability to address a Data Subject Request, the Operator shall provide commercially reasonable efforts to assist the Customer, provided the Data Subject Request is required under applicable Data Protection Law.

7.3 Costs

Any costs arising from such additional assistance shall be the responsibility of the Customer, to the extent legally permitted.

8. Sub-processors

8.1 Current list and flow-through liability

The current list of authorized Sub-processors is described in Annex III. The Operator shall be liable for the acts and omissions of its Sub-processors to the same extent as it would be liable if performing the services of each Sub-processor directly under the terms of this DPA.

The Operator or one of its Affiliates or contractors has entered, or will enter, into a written agreement with each Sub-processor containing data protection obligations no less protective than those set forth in this DPA.

8.2 Notification of new Sub-processors

The Operator's use of Sub-processors is at its discretion, provided that:

• The Operator informs the Customer at least 30 days in advance of any intended additions or replacements to the list of Sub-processors, including name, address and role of the new Sub-processor.
• The Customer may object to such changes per section 8.3.

8.3 Right to object and termination without penalty

If the Customer has a legitimate reason under Data Protection Law to object to the new Sub-processor's processing of Personal Data, the Customer may terminate its subscription to the affected Service by providing written notice to the Operator. Such termination:

• Shall take effect at the time determined by the Customer, no later than 30 days from the date of the Operator's notice informing of the new Sub-processor.
• Shall be deemed without fault by either party.
• Shall be subject to the return terms of the Main Agreement (without penalty to the Customer).

Within the 30-day period, the parties may discuss in good faith a resolution to the objection, without extending the termination period or affecting the Operator's right to use the new Sub-processor after that period.

8.4 Emergency replacement

The Operator may replace a Sub-processor without prior notice where the reason for the change is outside its reasonable control and prompt replacement is required for security or other urgent reasons. In such case, the Operator shall inform the Customer of the replacement as soon as possible following its appointment.

8.5 Sub-processor auditing

The Operator shall evaluate the security, privacy and confidentiality practices of a Sub-processor prior to selection to establish that it is capable of providing the level of Personal Data protection required by this DPA.

9. International transfers

9.1 Default location

By default, data is stored and processed on Google Cloud Platform, southamerica-east1 region (São Paulo, Brazil). This location meets data residency requirements for LATAM clients and keeps data within a geographically close block to the Customer.

9.2 SCCs for GDPR

Where the Customer or a Data Subject is subject to the GDPR and Personal Data is transferred to a country outside the European Economic Area, Switzerland, the United Kingdom or any country recognized by the European Commission as having an adequate level of protection, the parties shall enter into the Standard Contractual Clauses pursuant to European Commission Implementing Decision (EU) 2021/914 (or the version in force at the time of transfer).

9.3 Notification of location changes

The Operator shall notify the Customer at least 30 days in advance if the storage location changes. The Customer may object in writing within 15 days; in such case an alternative will be sought or the contract terminated without penalty.

9.4 Transfer details

Details of international transfers performed under this DPA, including source country, destination country and applicable legal mechanism, are described in Annex IV.

10. Audit

10.1 Right to audit without cause

The Customer may audit the Operator once (1) every twelve (12) months without justified cause, with prior written notice of at least sixty (60) days. The audit shall be limited to a maximum of three (3) business days, unless applicable Data Protection Law or a competent authority requires otherwise.

10.2 Audit with justified cause

The Customer may audit the Operator with justified cause (e.g., reported breach, founded suspicion) at any time, with prior notice of seven (7) days. The audit may be performed by the Customer or by an independent third party agreed by both parties.

10.3 Frequency and scope

The frequency and scope of audits shall be mutually agreed between the parties acting reasonably and in good faith. If more than one Controller whose Personal Data is processed by the Operator requires an audit, the Customer shall make all reasonable efforts to combine them and avoid multiple audits.

10.4 Cost of audits

The Customer shall bear the costs of any audit, unless the audit reveals a material breach by the Operator of this DPA, in which case the Operator shall bear the cost of remedying the breach and the reasonable expenses of the audit.

10.5 Third-party certifications

Upon the Customer's written request, the Operator shall provide a copy of its most recent third-party audits or certifications (when existing, e.g., SOC 2, ISO 27001) related to the processing of Customer Personal Data, or summaries thereof, to the extent the Operator generally makes them available to its customers.

10.6 Audit confidentiality

Any information provided by the Operator and/or audits performed under this section are subject to the confidentiality obligations of the Main Agreement.

11. Return and deletion of data

11.1 Access during subscription

While the Customer maintains its subscription to the Service, it shall have access to its Personal Data stored or hosted by the Operator or its Sub-processors, per the Main Agreement terms.

11.2 Return and deletion upon termination

The Operator shall return Personal Data to the Customer and, to the extent permitted by applicable law, delete Personal Data within a reasonable time per Data Protection Law, unless applicable law requires retention. Specifically:

• 30 days from termination to deliver to the Customer a complete copy of their data (pg_dump + CSV per table + ZIP with all generated CoA).
• 30 additional days (60 total) to delete the data from Operator servers.
• Up to 30 additional days to delete data from backups, in the normal rotation cycle.
• Delivery of a signed deletion certificate by the Operator.

11.3 Post-termination retention

Default: zero retention. Exception: if local law requires retaining data for a determined period (e.g., CoA retention for 5 years, accounting records for 5 years per Colombian regulations), the minimum necessary shall be retained for the legal period, with read-only access for the original Customer if requested.

11.4 Delivery format

• Complete database: pg_dump in custom format.
• CoA PDFs: ZIP organized by year/month.
• Auxiliary tables (catalogs, audit trail, reports): CSV with headers.
• Documentation: PDF with the table-to-field map for the Customer to understand the dump.

12. Records of Processing

Each party is responsible for its own compliance with its documentation requirements, in particular maintaining records of processing where required under Data Protection Law.

Each party shall reasonably assist the other party in its documentation requirements, including providing information the other party needs from it in a reasonably requested manner, to enable the other party to comply with any obligations relating to maintaining records of processing.

13. NohaLims differentiating commitments

In addition to the legal obligations described in this DPA, the Operator assumes the following operational commitments that constitute differentiating advantages of the NohaLims Service:

13.1 Physical single-tenant

Each Customer has its own NohaLims instance with its own dedicated PostgreSQL database. Database is not shared between Customers. Implication: there is no risk of cross-tenant leakage because there are no shared tenants at database level.

13.2 Guided onboarding (duration by plan)

During the first days after Service activation — 30 days for the Monthly Plan, 40 days for the 6-month Plan and 60 days for the 12-month Plan — the Operator will provide:

• 60-minute kick-off call to configure test catalog, logo, users and first trial test.
• Proactive daily WhatsApp check-in during the first week.
• Priority support with reduced response SLA (≤ 8 business hours for critical tickets).
• Wrap-up call at the end of the onboarding period to review usage and showcase advanced features.

13.3 Migration from Excel/legacy LIMS

The Operator shall assist the Customer in bulk migration of data from spreadsheets or legacy LIMS, through:

• Validated CSV import templates for test catalog, clients and results.
• Pre-validation of files before final import.
• Assisted initial import with post-import verification.
• No additional cost within the contracted plan scope.

13.4 DIAN electronic invoicing

For Colombian Customers, the Operator issues electronic invoicing per DIAN (Dirección de Impuestos y Aduanas Nacionales) regulations. Invoices are sent to the registered billing email and available for download from the Customer portal.

14. Limitation of liability

14.1 Reference to Main Agreement

The limitation of liability established in section 12 of the Terms and Conditions (Main Agreement) applies fully to this DPA. The Operator's total liability to the Customer for any claim arising from this DPA is limited to the amount effectively paid by the Customer in the 12 months preceding the event giving rise to liability.

14.2 Exclusions

The Operator does NOT cover, and therefore shall not be liable for:

• Indirect damages, lost profits, loss of business opportunity.
• Data loss caused by Service misuse by the Customer or its authorized users.
• Damages from inability to use the Service due to force majeure.
• Regulatory fines imposed on the Customer for non-compliance with their own sector regulations.

14.3 Compliance costs

To the extent permitted by Data Protection Law, compliance by the Customer and its Affiliates with the provisions of this DPA shall not generate additional cost to the Operator beyond the contracted plan.

15. Future geographic expansion

15.1 Currently covered country

15.2 Planned countries (reserved)

The following countries are identified for future expansion. Each will require a specific Addendum with its regulation, local authority, data subject rights and international transfer rules:

• Mexico — LFPDPPP / INAI
• Peru — Law 29733
• Chile — Law 19.628 (modified by Law 21.719)
• Brazil — LGPD / ANPD
• Argentina — Law 25.326
• Ecuador — LOPDP
• European Union / UK / Switzerland — GDPR + SCCs (Annex V when enabled)
• United States — CCPA / CPRA (if applicable to California residents)

16. General Terms

16.1 Governing law

This DPA is governed by the laws of the Republic of Colombia, in particular by Law 1581/2012 and its regulatory decrees.

16.2 Jurisdiction

Any dispute arising from this DPA shall first be resolved through extrajudicial conciliation before a recognized center in Bogotá D.C. If unsuccessful, the parties submit to the civil courts of Bogotá D.C., Colombia.

16.3 Changes in Data Protection Laws

Either party may, by giving at least 30 days written notice to the other party, propose variations to this DPA or to the SCCs (when applicable) necessary to address the requirements of any Data Protection Law or of a competent authority. Variations shall be mutually agreed and in writing.

16.4 Notices

All notices required under this DPA shall be provided pursuant to the Main Agreement terms, to the email addresses registered between the parties.

16.5 Assignment

Without the Operator's prior written consent, the Customer may not assign or transfer this DPA (or any of its rights or obligations) to any third party. Any assignment in violation of this clause shall be void.

16.6 Force majeure

Each party shall be excused from performance for any period during which, and to the extent that, such party or any subcontractor is prevented from performing any obligation or service, in whole or in part, as a result of causes beyond its reasonable control, and without its fault or negligence, including without limitation: acts of God, strikes, lockouts, riots, acts of terrorism or war, epidemics, communication line failures and power failures.

16.7 Severability

If any word, phrase, clause, section, article or other provision of this DPA is adjudicated or otherwise found to be against public policy, void or unenforceable, such provision shall be modified or amended to (i) make this DPA valid and enforceable, and (ii) continue to reflect the original intent of the parties. If the provision cannot be modified, the remainder of this DPA shall remain in full force.

16.8 No waiver

A waiver of any breach of this DPA is not deemed a waiver of any other breach. No waiver shall be effective unless in writing.

16.9 Cross-default

Any material breach of this DPA by either party shall constitute a material breach of the Main Agreement, and the consequences provided in the Main Agreement shall apply accordingly.

16.10 Entire agreement

This DPA, including all its annexes, contains the entire agreement between the parties regarding its subject matter and supersedes all prior oral and written communications between the parties on the same. This DPA may only be amended in writing signed by both parties.

16.11 Termination

The parties agree that this DPA shall terminate automatically upon termination of the Main Agreement, for any cause. Any obligation imposed on the Customer or the Operator under this DPA in relation to the processing of Personal Data shall survive termination or expiration of this DPA.

16.12 Order of precedence

In case of conflict between this DPA and the Main Agreement regarding the processing of Personal Data, this DPA shall prevail. In all other matters, the Main Agreement shall prevail.

Annexes

Annex I — Processing details

I.1 Subject matter

Provision of the NohaLims Service and related technical support to the Customer.

I.2 Duration of processing

The term of the Main Agreement plus the period from its expiration until deletion of all Customer data per this DPA.

I.3 Nature and purpose

The Operator shall process Customer Personal Data (and the data of the Customer's end clients that it uploads to the Service) for the following purposes:

• Provision of the contracted LIMS Service (sample management, tests, CoA, dashboards).
• Technical support and customer service.
• Billing and tax compliance.
• Product improvement through aggregated and anonymized analysis (without identifying individual Customers).
• Compliance with Operator's legal obligations.

I.4 Categories of Data Subjects

Unless otherwise indicated by the Customer, Personal Data processed relates to the following categories of Data Subjects:

• Customer's employees.
• Customer's contractors.
• Customer's end clients (samples delivered to the laboratory).
• Patients or third parties whose data is uploaded by the Customer per the laboratory's nature.
• Other individuals whose Personal Data the Customer stores in the Service.

I.5 Categories of Personal Data

Personal Data processed may include, without limitation:

• Names
• Phone numbers
• Email addresses
• Time zones
• Physical addresses
• System access/usage/authorization data
• Company name
• Contract data
• Billing data
• Bank account data (excluding card data, processed by payment Sub-processor)
• Analytical results and associated samples

I.6 Special categories of data

Unless expressly agreed and a specific DPA, the Operator does NOT process special categories of data per GDPR Art. 9 (racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sex life or sexual orientation data).

I.7 Processing operations

Main processing operations performed include:

• Collection and registration of Customer and end-client data.
• Storage in dedicated PostgreSQL database.
• Organization and structuring per the LIMS data model.
• Query and retrieval by Customer authorized users.
• Generation of reports and certificates (CoA).
• Cryptographic digital signature of critical operations.
• Automated backups.
• Deletion upon Service termination.

Annex II — Technical and Organizational Measures (TOMs)

The Operator and its Sub-processors have implemented the following measures, which may be updated maintaining a comparable or superior security level.

II.1 Technical measures

II.2 Organizational measures

• Least privilege policy: each user accesses only what is necessary for their function.
• Personnel confidentiality: signed commitments by those accessing data.
• Documented security incident management procedure.
• Breach response plans with 72h Customer notification (aligned with GDPR Art. 33).

II.3 What is NOT covered in the current phase

The Operator declares that in the current phase it does NOT have ISO 27001 nor SOC 2. The infrastructure follows best practices but no formal independent certifications. If the Customer requires formal certifications, it must be escalated to a specific enterprise agreement with HSM for PKI, annual external audit and annual pen-testing.

Annex III — Authorized Sub-processors

Current list of third parties processing Personal Data on behalf of the Operator:

Each Sub-processor has signed a data processing agreement with the Operator with obligations equivalent to those of this DPA.

Annex IV — International transfers

Detail of international transfers performed under this DPA:

IV.1 Location changes

The Operator shall notify the Customer 30 days in advance of any change in storage location. The Customer may object in writing within 15 days; in such case an alternative will be sought or the contract terminated without penalty.

Annex V — Standard Contractual Clauses (SCCs) — DEFERRED

Annex VI — Country Addenda — DEFERRED

Changelog v1 → v2

Main changes incorporated in this version 2.0 relative to the previous v1.0:

17. Contact

For matters related to this DPA:

• DPA email: contacto@nohalims.com
• Breach notification: contacto@nohalims.com
• Legal email: contacto@nohalims.com
• Colombian Supervisory Authority: Superintendencia de Industria y Comercio (SIC) — www.sic.gov.co
• Address: Bogotá D.C., Colombia