DATA PROCESSING AGREEMENT (DPA)

Version 1.1 - Effective Date: January 11, 2026

This Agreement regulates the terms and conditions for the processing of personal data between the funeral entity utilizing Lumina Memorials' services (hereinafter, the Controller) and Pedro Sanz Bruguera, holder of NIF 43503332M (hereinafter, the Processor). The electronic acceptance of this document constitutes a binding contract in accordance with Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR).

1. SUBJECT MATTER AND DURATION

The Processor shall process personal data on behalf of the Controller to provide the digital memorial platform "Lumina Memorials." The term of this Agreement shall coincide with the duration of the provided services.

2. PURPOSE OF PROCESSING AND DATA CATEGORIES

• Purpose: Management of digital memorials, creation of family access accounts, storage of multimedia memories, and delivery of service notifications.

• Data Categories: First and last name, email address, IP address, and multimedia content (text, photos, videos) generated by end users.

3. DATA OF DECEASED PERSONS (ART. 3 LOPDGDD)

Due to the nature of the service, both parties acknowledge that processing may include data pertaining to deceased persons. In accordance with Article 3 of the Spanish Organic Law 3/2018 (LOPDGDD), the Processor shall facilitate the exercise of rights (access, rectification, or erasure) by persons related to the deceased through family or factual ties, or their heirs, unless expressly prohibited by the deceased.

4. OBLIGATIONS OF THE PROCESSOR

The Processor agrees to:

1. Process data solely in accordance with the documented instructions provided by the Controller.

2. Guarantee the confidentiality of any personnel authorized to process the data.

3. Implement technical and organizational security measures to ensure a level of security appropriate to the risk.

4. Assist the Controller in responding to requests for the exercise of data subject rights.

5. SUB-PROCESSORS

The Controller provides general authorization for the subcontracting of auxiliary services necessary for the platform. The Processor currently utilizes the following critical sub-processors:

• Infrastructure and Hosting: Amazon Web Services (AWS), with servers located within the European Union.

• Email Management: SendGrid. Any changes to sub-processors will be communicated to the Controller, who may object based on reasonable grounds.

6. WHITE LABEL RESPONSIBILITY

The Controller (Funeral Home) guarantees that it possesses a valid legal basis (consent, performance of a contract, or legitimate interest) to incorporate family members' data into the platform. The Processor shall not be held liable for claims arising from a lack of information or prior consent from the Funeral Home to its end clients.

7. DATA DISPOSITION UPON TERMINATION

Upon termination of the services, the Processor shall proceed to delete or return all personal data within a maximum period of 30 days, unless there is a legal obligation to retain such data, in which case the data shall remain blocked.

8. GOVERNING LAW AND JURISDICTION

This Agreement is governed by Spanish law. For any disputes, the parties submit to the exclusive jurisdiction of the Courts and Tribunals of Barcelona, Spain.