GAL Runtime Ltd — Data processing addendum Version 1.1 DRAFT, October 21, 2026 Not effective. Founder and legal review pending. Proposed update. This version is available for review. It does not replace an agreement you have already accepted. Customer instructions, concrete safeguards and accountable handling of personal data. This is an unexecuted review draft. It requires completed deployment schedules and agreement before it governs processing. It does not replace a current signed DPA. 1. Parties, roles and instructions This draft is intended for an Order between GAL Runtime Ltd, Israeli company number 517139382, and the identified Customer. It becomes part of that agreement only when agreed with completed deployment schedules. It covers personal data GAL processes for Customer in providing configuration distribution and authorized support (“Covered Data”). Schedule A must identify whether Customer is a controller or itself a processor. GAL acts as processor or subprocessor accordingly. GAL will process Covered Data only on documented instructions and for the agreed purposes, flag an instruction it reasonably considers unlawful, and explain a legal requirement to depart from the instructions unless notice is prohibited. Each party remains responsible for obligations applicable to its role. 2. Purpose limits and confidentiality GAL will restrict access to authorized people who need Covered Data for the agreed work and are subject to confidentiality obligations. GAL remains responsible for the personnel and processing providers it authorizes, subject to the agreement and applicable law. GAL will not use Covered Data to train general-purpose AI models under this agreement. Calling a record telemetry, a hash or an aggregate does not remove its contractual or statutory protection. The purposes, retention and customer instructions continue to apply. Where GAL acts as a service provider or contractor under applicable California privacy law, GAL will not sell or share Covered Data for cross-context behavioral advertising, use it outside the permitted business relationship, or combine it with unrelated personal data except as the law permits. GAL will provide the protection required for that role, notify Customer if it can no longer do so, and allow reasonable steps to verify compliance and stop or remedy unauthorized use. These commitments do not determine whether that law applies to a particular customer. 3. Security measures Schedule B must describe the technical and organizational safeguards for the actual deployment, including access control, tenant isolation, signing-key custody, transport and storage protection, logging, backup and recovery, and support access. GAL will maintain the agreed measures and will not materially reduce their overall protection during the agreed processing. An empty schedule is not evidence of a control, certification, residency guarantee or air-gapped service. A customer requiring regulated or classified processing must first agree a separately validated scope and obtain any required approvals. 4. Processing providers Schedule C must identify the authorized subprocessors and their services, data access and processing locations. GAL must require applicable data-protection obligations from them and remains responsible for their authorized processing under this agreement. Before a proposed new subprocessor receives Covered Data, GAL will notify Customer through the agreed contact and allow the objection period recorded in Schedule C. An objection based on reasonable privacy or security concerns requires a good-faith effort to resolve it. The schedule must specify the alternative or termination remedy if the objection cannot be resolved. A provider mentioned in a general privacy notice is not automatically approved for a restricted deployment. 5. Requests and regulatory assistance GAL will refer requests about Covered Data to Customer unless Customer instructs otherwise or law requires a direct response. GAL will provide assistance reasonably needed for applicable individual-rights requests, security assessments, impact assessments and regulatory consultation, taking account of the processing and information available to GAL. Verify identity and authority proportionately and use a suitable channel. Optional assistance charges, if agreed, cannot remove a mandatory statutory duty. 6. Personal-data incidents GAL will notify Customer without undue delay after becoming aware of a breach affecting Covered Data and within any shorter binding deadline in Schedule B or applicable law. Initial notice must not wait for a complete investigation. GAL will provide available information about the nature, affected data, likely consequences, mitigation and contact, followed by material updates. GAL will investigate, contain and cooperate in remediation and required notifications. Schedule B must name operational contacts, escalation arrangements and an achievable maximum notification time. No fixed notification promise or incident-response capability is established by this uncompleted draft. 7. Evidence and audits GAL will provide information reasonably needed to demonstrate compliance with this DPA and permit audits required by applicable law, with reasonable confidentiality, security, scope and scheduling protections. Existing suitable evidence may avoid unnecessary duplication but cannot eliminate a legally required audit. Do not treat an unavailable certificate or an unperformed assessment as evidence. Additional access needed because of an incident, regulator request or applicable law is not automatically barred by an ordinary review frequency. 8. Return, deletion and retained copies At the end of processing, GAL will return or securely delete Covered Data at Customer’s choice, except where applicable law requires retention. Schedule A must set return formats, completion dates, active-system deletion, backup expiry and the evidence GAL will provide. Copies retained lawfully remain protected and restricted from unrelated use. A general request window or a statement that data can be deleted does not establish actual retention or backup expiry. Those must be settled for the deployment before this schedule is executed. 9. International processing and precedence Schedule C must record storage, support and other access locations and the lawful arrangements for any restricted transfers. Where standard contractual clauses or another instrument are needed, attach the applicable instrument, complete its parties, roles, modules and annexes, and assess any required additional measures. Naming a cloud region or linking to a vendor’s terms does not complete that work. Consider applicable Israeli requirements as well as the laws relevant to Customer and the affected people. This DPA controls conflicts about Covered Data, while mandatory transfer instruments and statutory rights prevail where required. It does not establish that a particular transfer is already lawful. 10. Required deployment schedules Completion required before agreement or covered processing. The following are required facts, not promises of controls already implemented. Deployment schedules to complete Schedule Required content A — processing and lifecycle Customer and GAL entities and roles; authorized contacts; subjects, categories and purposes; duration and frequency; permitted data; return, deletion, backups and legal holds. B — security and incidents Measured safeguards; responsibility for each control; evidence dates; incident contacts, escalation and maximum notification time; support-access boundaries. C — providers and locations Provider legal entities, services, data and access locations; authorization; change notice and objection period; unresolved-objection remedy; accepted contracts and applicable transfer instruments. Request the deployment-specific package through shay@gal.run. Do not include secrets or restricted data in that initial request.