This Data Processing Agreement (“Agreement”) is entered into between:

a) the professional entity identified in the Order, in the quotation or in the customer account, which determines the purposes and means of the processing of the personal data contained in the Materials (“Controller” or “Client”);

and

b) Battaglia Alessandro – sole proprietorship, registered office at Viale Paolo Onorato Vigliani 17, 20148 Milan (MI), Italy, VAT number 14248220965, tax code and Companies' Register registration number BTTLSN95E03F205E, REA MI – 2769967, PEC alessandro.battaglia@pec.fiscozen.it, privacy and data breach e-mail a.battaglia@dentalphotovideo.it (“Processor” or “Supplier”).

Dental Photo & Video is the trade name used by the Processor and does not constitute a separate legal entity.

This Agreement applies whenever the Processor processes personal data on behalf of the Controller in performing photographic, video, audio or audiovisual post-production services, including the ancillary activities of receipt, temporary storage, processing and delivery.

2. Subject matter, duration, nature and purpose of the processing

The Processor processes personal data solely to perform the Services requested by the Controller and in accordance with the documented instructions contained in the Order, the Brief, the quotation, written communications and this Agreement.

The operations may include:

• receipt and download of the Materials; • technical verification, organisation and selection of files; • temporary copying onto working systems; • video and audio editing; • color correction and color grading; • photo retouching; • audio synchronisation, cleaning and processing; • blurring or reduction of identifying elements upon specific instruction; • export, compression and format conversion; • delivery of the Final Files and, where provided for, of the Project Files; • temporary storage, operational backup, restoration and deletion.

The processing lasts for the time necessary to perform the Service and for the retention period set out in this Agreement, which is normally six months from final delivery, unless one or more extended retention periods of a further 12 months have been purchased by the Controller, including at a later time provided the files have not already been deleted, or the Controller has issued a different documented instruction.

The Processor does not independently determine any further purposes and does not use the data for profiling, advertising, model training, facial recognition, biometric identification, research, portfolio purposes or any other purposes of its own.

3. Categories of data subjects

The categories of data subjects may include:

• adult patients; • minor patients; • persons exercising parental responsibility or guardians; • dentists, physicians, hygienists, assistants and other healthcare personnel; • the Controller's employees, collaborators and contact persons; • speakers, participants and staff attending courses, events, trade fairs, congresses or live surgery sessions; • other persons incidentally filmed or recorded in the Materials.

4. Categories of personal data

The data processed may include:

• identification and contact details; • images of the face, body, mouth, teeth and oral cavity; • video and photographic recordings; • voice and audio recordings; • names, qualifications, signatures, codes or references appearing in the Materials; • X-rays, scans, reports, screenshots and clinical documentation; • information relating to procedures, diagnoses, conditions, treatments or healthcare procedures; • technical data and file metadata; • information relating to minors; • other information strictly necessary to perform the Service.

The Materials may contain special categories of data within the meaning of Article 9 GDPR, in particular data concerning health.

Images are not processed by the Processor as biometric data for the purpose of unique identification and are not subjected to biometric recognition systems.

5. Obligations and warranties of the Controller

The Controller warrants and undertakes to:

• determine the purposes and legal bases of the processing; • provide data subjects with the required privacy notices; • obtain, where necessary, consents, authorisations, releases and the assent of persons exercising parental responsibility; • verify the lawfulness of the recording, transmission, processing and subsequent publication of the Materials; • send only data that is adequate, relevant and limited to what is necessary; • anonymise or pseudonymise the Materials when identification is not necessary; • remove names, medical records, screenshots and documents that are not indispensable; • issue lawful, clear and documentable instructions; • retain an independent copy of the original Materials; • promptly communicate any rectifications, restrictions, withdrawals or requests from data subjects; • not request the Processor to carry out processing incompatible with the GDPR or other applicable law.

The Controller remains responsible for decisions relating to the publication, dissemination, communication and use of the Final Files.

6. Documented instructions and processing contrary to the law

The Processor processes data only on the Controller's documented instructions, including any transfers to third countries, unless required to do otherwise by law.

Should the Processor consider that an instruction infringes the GDPR or other data protection provisions, it shall inform the Controller without undue delay and may suspend performance of the instruction until the matter is clarified or the instruction amended.

The Processor shall inform the Controller, prior to processing, of any legal obligations requiring further processing, unless prohibited by law.

7. Confidentiality and authorised persons

The Processor ensures that persons authorised to access the data:

• are granted access only to the extent necessary; • are bound by contractual or statutory confidentiality obligations; • receive adequate instructions on data protection; • do not process the data for their own purposes; • have their access terminated when no longer necessary.

Confidentiality obligations survive termination of the relationship.

The Processor does not disclose the Materials or the Final Files to parties other than the Controller, the recipients indicated by the Controller, authorised Sub-processors, and parties to whom disclosure is required by law.

8. Technical and organisational measures

The Processor adopts technical and organisational measures appropriate to the risk, taking into account the nature of the data, the presence of health data, and the context and purposes of the processing.

The minimum measures are described in Annex 2 and include, prior to receipt of identifiable clinical Materials:

• encryption of the computer used for processing; • encryption of HDDs and external media; • protection of the NAS and local archives; • strong individual credentials and automatic device locking; • multi-factor authentication where available; • security updates and patches; • antimalware protection and firewalls; • access restriction under the least-privilege principle; • secure transfers via SwissTransfer (Infomaniak Network SA) or another authorised secure channel; • expiring links and passwords where appropriate; • communication of passwords via a separate channel; • backup and restoration procedures; • secure deletion at the end of the retention period.

The Processor does not knowingly accept identifiable clinical Materials before the encryption measures set out in Annex 2 are operational.

9. Use of software and prohibition of use for training or AI

Professional software such as Adobe Premiere Pro, After Effects, Photoshop, Lightroom and DaVinci Resolve, as well as equivalent tools, may be used for processing.

Unless expressly and documentedly instructed by the Controller, the Processor:

• uses the software locally to the extent technically possible; • disables or avoids unnecessary cloud synchronisation; • does not upload the Materials to generative artificial intelligence services; • does not permit the Materials to be used to train, improve or evaluate models; • does not use facial recognition or biometric identification functions; • does not use review or sharing platforms other than those authorised.

Any use of new cloud or AI functions involving processing by third parties requires prior assessment and, where necessary, the Controller's authorisation and an update to the list of Sub-processors.

10. Transfer and delivery via SwissTransfer

The Materials are normally uploaded directly by the Controller via SwissTransfer, a service of Infomaniak Network SA, with info@dentalphotovideo.it as the recipient, or via another secure channel authorised in writing. The Final Files are delivered through the same service or another authorised secure channel.

Where the files contain personal data, health data or confidential information, the Processor applies, and the Controller is required to adopt, where available and appropriate:

• password protection; • links with a short availability period; • a limit on the number of downloads and access restricted to recipients; • communication of the password via a separate channel; • minimisation of information contained in the transfer and file names.

The Controller must not send identifiable health data via WhatsApp, social networks, unauthorised chat applications or ordinary e-mail attachments, unless specifically instructed and with adequate protections in place.

The Processor maintains, where applicable, a contractual relationship and a data processing agreement with the provider of the transfer service.

Location of the transfer service. SwissTransfer is a service of Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias, Switzerland. Infomaniak states that files transmitted via SwissTransfer are processed and hosted exclusively in its own data centres in Switzerland and that files are encrypted in transit and at rest. Infomaniak publishes its own data processing agreement pursuant, among others, to Article 28 GDPR. Switzerland benefits from an adequacy decision of the European Commission. SwissTransfer is a temporary transfer service and does not constitute an archive: files remain available for the configured period and are then deleted from the service.

11. Sub-processors and general authorisation

The Controller grants the Processor a general written authorisation to engage Sub-processors, provided that they:

• are established in the European Union or the European Economic Area or, where established outside the European Economic Area, only where the transfer is covered by appropriate safeguards pursuant to Chapter V of the GDPR and subject to prior information to the Controller within the terms set out in this Article; • provide sufficient guarantees; • are bound by data protection obligations substantially equivalent to those set out in this Agreement; • access only the data that is necessary; • are subject to confidentiality obligations; • are included in the updated list of Sub-processors.

The Processor shall notify the Controller, normally with at least ten days' notice, of the addition or replacement of a Sub-processor able to access the data, indicating its identity, location, assigned activity and the location of the processing.

Within the period indicated, the Controller may raise a reasoned and documented objection based on data protection grounds. The Parties shall cooperate to identify a reasonable solution. Failing a solution, the Processor may avoid using the contested Sub-processor or, where this would make performance of the Service impossible, terminate the relevant part of the relationship, refunding the portion not performed.

In urgent situations necessary to ensure security or continuity, the notice period may be shortened, without prejudice to the obligation to inform the Controller as soon as possible.

The Processor remains liable to the Controller for the performance of the obligations entrusted to Sub-processors.

12. Freelance collaborators

The Processor may entrust post-production activities to qualified, selected freelance collaborators established exclusively in Italy or, in any event, in the European Union/European Economic Area.

Before accessing the Materials, each collaborator must:

• be formally authorised or appointed as a Sub-processor, depending on their actual role; • sign confidentiality and security undertakings; • receive documented instructions; • use encrypted devices and media; • avoid unnecessary copies; • delete or return the data at the end of the activity; • not use the Materials for portfolio, AI, training or their own purposes.

The identity of collaborators who actually access the data is communicated in accordance with the procedure set out in Article 11.

13. International transfers

The Processor does not knowingly transfer personal data outside the European Union or the European Economic Area without the Controller's instruction or authorisation and without a valid basis under Chapter V GDPR.

Should an authorised supplier involve an international transfer, the Processor shall verify the existence of an adequacy decision or appropriate safeguards, including, where necessary, standard contractual clauses, supplementary measures and a transfer impact assessment.

This Agreement does not, by itself, constitute a valid safeguard for transfers to third countries.

14. Assistance with data subjects' rights

Taking into account the nature of the processing, the Processor assists the Controller, by appropriate technical and organisational measures, in responding to requests for the exercise of data subjects' rights.

If the Processor directly receives a request concerning data processed on behalf of the Controller, it:

• does not independently decide on the merits; • promptly informs the Controller; • forwards the request, unless prohibited by law; • responds directly only on the Controller's documented instructions.

The Controller remains responsible for verifying the requester's identity, assessing the request and responding within the statutory time limits.

Ordinary assistance reasonably connected with the Service is included. Extraordinary or repeated activities may be subject to a quotation, unless necessary to remedy a breach by the Processor.

15. Assistance with security, impact assessments and authorities

The Processor assists the Controller, taking into account the nature of the processing and the information available, in relation to:

• security of processing; • management of personal data breaches; • data protection impact assessments; • prior consultations; • requests from the supervisory authority; • documentation of the measures and activities carried out.

The Controller remains responsible for determining whether an impact assessment or prior consultation is necessary.

The Processor cooperates, upon request, with the competent supervisory authority.

16. Personal data breaches

The Processor informs the Controller of any personal data breach of which it becomes aware without undue delay and, where reasonably possible, within 24 hours of discovery.

Notice is sent to the contacts indicated by the Controller in the Order or in the account. The Processor's contact for breaches is:

a.battaglia@dentalphotovideo.it

The initial notice contains, to the extent available:

• the nature of the incident; • the date and time of discovery; • the categories of data and data subjects involved; • the approximate number of data subjects and records, where known; • the possible consequences; • the measures taken or proposed; • a contact point for updates.

Where it is not possible to provide all information immediately, the Processor shall communicate it progressively without further undue delay.

The Processor:

• adopts immediate containment and mitigation measures; • preserves relevant evidence; • documents the incident and the actions taken; • cooperates with the Controller; • does not independently notify the supervisory authority or data subjects, unless required by law or instructed by the Controller.

The Controller remains responsible for assessing and, where required, carrying out notifications to the supervisory authority and communications to data subjects.

17. Return, deletion and retention

Unless otherwise documentedly instructed, the Processor retains the Materials, the Final Files and the Project Files for six months from final delivery.

The Controller may purchase one or more extended retention periods of a further 12 months per project, at the price published on the Website, including at a later time provided the files have not already been deleted. Before the expiry of the active period the Processor sends a warning email regarding the forthcoming expiry and the subsequent deletion; within the stated deadline the Controller may purchase a further 12-month period, renewable for successive periods of the same duration. There is no automatic renewal; the warning is a courtesy communication and failure to receive it for reasons not attributable to the Processor does not extend retention. After deletion, recovery is not guaranteed and extended retention can no longer be purchased for the deleted material. For projects archived due to inactivity, the specific rules set out in the B2B General Terms and Conditions of Sale remain applicable.

At the end of the period or upon termination of the relationship, the Processor, at the Controller's choice and subject to legal obligations:

• returns any data still available; • deletes the data from active systems and media; • deletes or renders inaccessible collaborators' copies; • requests Sub-processors to delete or return the data; • provides, upon reasonable request, confirmation that deletion has taken place.

Where immediate deletion from technical backups is not reasonably possible, the data is isolated, no longer processed, and deleted in the normal overwrite cycle.

The Processor may retain only the administrative data necessary to demonstrate performance of the contract, compliance with its obligations and the handling of disputes, without retaining clinical content beyond what is necessary.

The Controller is responsible for downloading and for its own backup of the delivered Files.

18. Record of processing activities and accountability

The Processor maintains, where required by the GDPR, a record of the categories of processing activities carried out on behalf of controllers.

The Processor retains reasonable documentation relating to:

• instructions received; • Sub-processors; • security measures; • breaches; • deletions; • requests from data subjects; • relevant checks and updates.

The documentation is made available to the Controller to the extent necessary to demonstrate compliance, while protecting trade secrets, security and the data of other clients.

19. Audits and inspections

The Processor makes available to the Controller the information reasonably necessary to demonstrate compliance with this Agreement.

The Controller may carry out, directly or through an independent, non-competing auditor bound by confidentiality, an audit relating to the processing carried out on its behalf, subject to the following conditions:

• no more than once every twelve months, except in the event of an incident, a request from the supervisory authority or reasonable suspicion of a serious non-conformity; • at least fifteen Business Days' written notice, except in cases of urgency; • preference for documentary or remote verification; • conducted during normal business hours; • no access to the data, systems or information of other clients; • adoption of measures limiting interference with business activities.

The ordinary costs of the audit are borne by the Controller. If a substantial breach attributable to the Processor is established, the reasonable costs directly connected with the verification and remediation may be charged to the Processor.

Inspections by the competent supervisory authority are not subject to the time limits indicated above.

20. Liability of the Parties

Each Party is liable for the obligations incumbent upon it under the GDPR, this Agreement and the documented instructions.

The Processor is not liable for breaches arising solely from:

• unlawful or incomplete instructions from the Controller; • the absence of a legal basis, privacy notices, consents or authorisations; • publication or use of the Final Files decided by the Controller; • unnecessary or excessive data included in the Materials; • the Controller's failure to retain copies of the originals; • access to or modifications made by the Controller or third parties after delivery.

Any limitations of liability provided for in the B2B Terms and Conditions do not apply in cases where liability cannot be limited by law, and do not prejudice the rights of data subjects.

21. Term, termination and suspension

This Agreement takes effect upon electronic acceptance or signature and remains effective for as long as the Processor processes personal data on behalf of the Controller.

In the event of a material breach of data protection obligations, the non-breaching Party may request suspension of the processing until the issue is resolved.

If compliance cannot be restored within a reasonable time, either Party may terminate the affected Service, without prejudice to the obligations of return, deletion, confidentiality, liability and cooperation.

22. Hierarchy, amendments and versioning

This Agreement supplements the B2B General Terms and Conditions of Sale and the Order.

In the event of a conflict concerning data protection, this Agreement shall prevail. For commercial and operational matters not governed herein, the B2B Terms and Conditions and the quotation remain applicable.

Each Order is governed by the version accepted at the time of purchase. Future amendments have no retroactive effect.

Where a material update is necessary for processing already under way, the Processor shall inform the Controller and, where necessary, request renewed acceptance.

This English text is a courtesy translation provided for convenience only. In the event of any discrepancy or conflict between this English version and the Italian version, the Italian version shall prevail.

23. Governing law and jurisdiction

This Agreement is governed by Italian law and the GDPR.

The Parties shall first attempt an amicable settlement and, where provided for by the B2B Terms and Conditions, mediation.

Without prejudice to the mandatory powers of the supervisory authorities and the rights of data subjects, disputes between the Parties are subject to the exclusive jurisdiction of the Court of Milan.

24. Electronic form and acceptance

This Agreement may be entered into in electronic form.

Acceptance recorded at checkout or in the customer area, linked to the user's identity, the Order, the version of the document, the language, and the date and time, constitutes proof of the agreement between the Parties.

The Controller represents that the person accepting the document is authorised to bind the company, practice, entity or organisation indicated in the Order.

A storable copy of this Agreement is made available via the Website, the personal account area or the Order confirmation.

ANNEX 1 – DESCRIPTION OF THE PROCESSING

Subject matter: Photographic, video, audio and audiovisual post-production, including the receipt, organisation, processing, export, delivery and temporary storage of the Materials.

Purpose: Performance of the professional Service requested by the Controller, with no autonomous purposes of the Processor.

Duration: From receipt of the Materials until deletion, normally six months from final delivery, or for the 12-month extended retention periods purchased, including at a later time and renewable, with no automatic renewal.

Operations: Indirect collection, receipt, consultation, organisation, copying, recording, adaptation, editing, modification, retouching, blurring upon instruction, conversion, export, storage, transmission, delivery, backup, restoration and deletion.

Data subjects: Adult and minor patients, healthcare personnel, employees, collaborators, speakers, participants, staff and persons appearing in the Materials.

Data: Identification data, images, voice, photos, videos, clinical data, X-rays, scans, screenshots, health information, metadata and other data necessary for the project.

Special categories: Data concerning health. Any biometric data only if already generated by the Controller for its own purposes; the Processor does not carry out biometric identification.

Frequency: Occasional or per individual assignment, unless there is an ongoing relationship.

Main location: Italy and the European Union/European Economic Area.

Privacy contacts: Processor: a.battaglia@dentalphotovideo.it Controller: contact indicated in the Order or in the account.

ANNEX 2 – TECHNICAL AND ORGANISATIONAL MEASURES

A. Governance and access • access to data limited to the Processor and authorised collaborators; • individual credentials, strong and non-shared passwords; • multi-factor authentication where available; • prompt revocation of access no longer necessary; • documented confidentiality obligations; • periodic instructions and training.

B. Devices and media • full-disk encryption of the processing computer; • encryption of HDDs and external media; • protection of the NAS and its credentials; • automatic screen locking; • reasonable inventory of media; • physical custody in locations not accessible to the public.

C. Software security • operating system and application updates; • antivirus/antimalware and firewalls; • software obtained from reliable sources and properly licensed; • prohibition of unauthorised plugins or applications for clinical Materials; • prohibition of uploads to unauthorised AI or cloud services.

D. Transmission • SwissTransfer (Infomaniak Network SA) or an equivalent authorised channel; • passwords for sensitive transfers, where available; • passwords communicated separately; • expiring links; • recipients verified before sending; • no unnecessary health data in the transfer title or file name.

E. Storage and backup • local archives on encrypted HDD/NAS; • backups consistent with the risk and reasonable restoration testing; • logical separation of projects; • deletion at the end of the period; • isolation of backup copies pending overwriting.

F. Continuity and incidents • restoration procedures; • incident management and documentation; • dedicated data breach contact; • updating of measures based on risk and the state of the art.

G. Minimisation • requests to remove unnecessary data; • processing of only the relevant portion; • blurring upon instruction; • limitation of copies and intermediate formats.

The measures are periodically reviewed and updated when reasonably necessary.

ANNEX 3 – AUTHORISED SUB-PROCESSORS

SwissTransfer: Supplier: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias, Switzerland. Activity: transfer and temporary storage of files, limited to the configured transfer duration and strictly necessary for delivery. Data processing agreement: the supplier publishes its own data processing agreement pursuant, among others, to Article 28 GDPR. Location: Infomaniak states that SwissTransfer files are processed and hosted exclusively in its own data centres in Switzerland, with encryption in transit and at rest. Switzerland benefits from an adequacy decision of the European Commission. Data: Materials and Final Files transferred.

Freelance collaborators: As of the effective date of version 1.2, no permanent named collaborator is indicated.

The Processor may appoint collaborators established exclusively in Italy or the EU/EEA, upon prior notice pursuant to Article 11, indicating:

• name or company name; • country; • assigned activity; • categories of data accessible; • expected start date.

The Controller may request the updated list at any time.

ANNEX 4 – SUMMARY DATA BREACH PROCEDURE

Detection: Anyone who detects an anomalous event immediately informs the Processor.

Containment: Suspension of access, revocation of links, password changes, isolation of devices or other urgent measures.

Assessment: Identification of data, data subjects, systems, duration, recipients and possible consequences.

Notice to the Controller: Without undue delay and, where reasonably possible, within 24 hours of discovery, to the address indicated by the Controller.

Updates: Progressive information where the initial notice is incomplete.

Documentation: Recording of the facts, decisions, measures taken and available evidence.

Cooperation: Assistance to the Controller with assessment, notification to the supervisory authority, communication to data subjects and remedial measures.

Processor's contact: a.battaglia@dentalphotovideo.it