ANNEX 1: DETAILS OF PROCESSING OF POSTED PERSONAL DATA

Version : 1.0, Last Updated on : 14 OCT 2026

This Annex 1 includes details of the Processing of Posted Personal Data in connection with the Agreement.

Subject Matter and Duration of the Processing of Posted Personal Data:

The subject matter and duration of the Processing of the Posted Personal Data are set out in the Agreement and this Addendum. Unless otherwise stated in the Agreement and this Addendum, the duration of the Processing of the Posted Personal Data corresponds with the duration of the relevant Service and for a limited period thereafter in accordance with applicable Data Protection Laws.

The Nature and Purpose of the Processing of Posted Personal Data:

GSBN is engaged to provide the Services to Customer which involve the Processing of Posted Personal Data. The scope of the Services is set out in the Agreement, and the Posted Personal Data will be Processed by GSBN to deliver the Services, to exercise its rights and perform its obligations under the Agreement and otherwise to comply with applicable laws. This Processing includes operations incidental to the provision of the Services under the Agreement (including monitoring, testing, modifying, improving the systems used, and services offered, by GSBN in connection with the GSBN Platform).

Description of Processing environment for Posted Personal Data relating to distributed ledger:

1. Platform architecture and on-chain data

The GSBN Platform leverages a permissioned blockchain environment designed to support the validation and recording of organisational transactions only. Data recorded on the blockchain ledger is limited to cryptographic hashes of transactional references that evidence the occurrence, sequencing and integrity of transactions. The hashing process is a one-way cryptographic function that results in a loss of informational content, such that on-chain records do not permit the reconstruction, inference or determination of the substance of underlying documents or any Posted Personal Data contained within them.

2. Account structure and transaction attribution

Transactions recorded on the GSBN Platform are associated with organisational accounts established by Controllers. Organisational accounts may be linked, off-chain, to individual user accounts for the purposes of access control, authentication, auditability and operational accountability. Any such linkage is maintained exclusively within GSBN-managed off-chain systems and does not alter the on-chain data model, which remains limited to cryptographic hashes and transactional references. The linkage does not permit the reconstruction or determination of the content of underlying transaction documents or Posted Personal Data.

3. Off-chain Processing of Posted Personal Data

  • All Posted Personal Data Processed in connection with the GSBN Platform, including user identifiers and user-related, access or operational metadata, is Processed off-chain within GSBN-managed systems, acting as a Processor on the documented instructions of the Controller.
  • Personal data contained within transaction documents referenced by an on-chain hash is stored off-chain in encrypted form under the exclusive control of the Controller and is not accessible to, visible by, or otherwise Processed by GSBN.

4. Governance model and node participation

The GSBN Platform operates under a permissioned governance model. Participation is restricted to approved node operators onboarded in accordance with GSBN’s governance framework. GSBN is responsible for the onboarding, operational management and offboarding of node operators, including the granting, suspension and revocation of node access. Node operators are required to comply with GSBN’s applicable technical, security and data-handling requirements to ensure the consistent and secure operation of the GSBN Platform.

5. Allocation of roles and determination of means

  • GSBN operates and maintains the GSBN Platform infrastructure, including the technical coordination of nodes, in its capacity as a Processor. In doing so, GSBN determines only non-essential technical and organisational means of the Service, such as infrastructure architecture, security controls, availability, resilience and performance parameters. GSBN does not determine the purposes of Processing, nor the essential means of any Processing of Posted Personal Data carried out by or on behalf of the Controller.
  • The operation of nodes, provision of blockchain infrastructure, enforcement of technical parameters or implementation of governance and security requirements does not give rise to controllership or joint controllership for GSBN or any node operator. Responsibility for determining the purposes and essential means of Processing remains exclusively with the Controller.

6. Distributed ledger replication and node geography

  • Due to the distributed and permissioned nature of the GSBN Platform, cryptographic hashes and transactional references recorded on the blockchain ledger may be replicated across nodes operated by approved node operators, including nodes located outside the European Economic Area. These ledger records form part of the decentralised ledger infrastructure of the Platform and do not include identifiable Posted Personal Data.
  • Node operators participating in the distributed ledger are subject to GSBN’s governance requirements but are not engaged by GSBN as Subprocessors.

The Types of Posted Personal Data to be Processed:

  • Basic identification data (e.g. name, phone number, mailing address, job title and department and email address);
  • Employee specific data (e.g. employer name, employee number, social security number, etc.);
  • Financial data (e.g. bank account number, payment card details);
  • Location data;
  • Interaction data (e.g. which parts of the GSBN Platform or what Services Customer uses or accesses, including logs of access times and services and files accessed, created, modified or deleted); and
  • Technical/device data (e.g. IP address, web browser type, MAC address, device or application ID, hashed password, username, and other digital identifiers).

It is not envisaged that any Special Category Personal Data will be Processed in connection with the Agreement.

The categories of Data Subject to whom the Posted Personal Data relates:

  • Users of the Services;
  • Contacts at organisations in the shipping supply chain;
  • Senders or recipients of shipments or consignments; and
  • Personnel, including Representatives.

The Obligations and Rights of Customer:

The obligations and rights of Customer are set out in the Agreement and this Addendum.

The Processing Operations Carried Out in Relation to the Posted Personal Data:

The Processing operations carried out in relation to the Posted Personal Data, for the purposes set out above, are as follows:

  • Collecting and recording the data;
  • Hosting the data;
  • Organizing, structuring and storing the data;
  • Checking, analysing, aggregating and de-identifying the data;
  • Protecting the data including by means of encryption/decryption, restricting access to it, maintaining backups of it, performing security and business continuity/recovering testing in relation to it;
  • Adapting or altering the data;
  • Consulting or retrieving the data;
  • Disclosing or transferring the data (including for Processing by permitted Subprocessors); and
  • Returning/deleting the data once it is no longer required to be Processed pursuant to the Agreement.

Subprocessor(s):

GSBN uses the following Subprocessor(s) as at the Addendum Effective Date:

  • Name: IQAX Limited (“IQAX”).
  • Description of Processing: To develop, operate, manage, maintain and enhance the GSBN Platform for GSBN, including providing hosting and operations services to GSBN, making the GSBN Platform accessible to GSBN and providing application/API development, systems integrations services and other products or services as may be agreed in connection with the GSBN Platform (the “IQAX Services”).

IQAX uses the following Subprocessors in connection with its provision of the IQAX Services as at the Addendum Effective Date:

NameDescription of Processing
MicrosoftCollecting and recording the data;
Hosting the data;
Organizing, structuring and storing the data; and Protecting the data including by means of encryption/decryption, restricting access to it, and maintaining backups of it.
OracleCollecting and recording the data;
Hosting the data;
Organizing, structuring and storing the data; and
Protecting the data including by means of encryption/decryption, restricting access to it, and maintaining backups of it.
AlibabaCollecting and recording the data;
Hosting the data;
Organizing, structuring and storing the data; and
Protecting the data including by means of encryption/decryption, restricting access to it, and maintaining backups of it.
CrowdStrikeCollecting and recording the data;
Organizing, structuring and storing the data; and
Checking, analysing, aggregating and de-identifying the data.
Global Technology Integrator LimitedProtecting the data including by means of encryption/decryption, restricting access to it, maintaining backups of it, performing security and business continuity/recovering testing in relation to it; Adapting or altering the data; Consulting or retrieving the data; and Disclosing or transferring the data.

Additional or replacement Subprocessors may be added in accordance with Section 9 of this Addendum.