Privacy and Cookies Policy

Sagecom Inc. Privacy and Cookies Policy Version: 1.0 Effective Date: July 29, 2026 Last Updated: July 29, 2026

The purpose of this Privacy & Cookies Policy ("Privacy Policy") is to explain how Sagecom Inc. ("Sagecom, " "we, " "our, " or "us") collects, uses, discloses, stores, transfers, protects, and otherwise processes Personal Information in connection with our products, services, websites, applications, customer portals, APIs, artificial intelligence ("AI") services, telecommunications services, and related business operations. This Privacy Policy should be read together with Sagecom's: Master Terms of Service AI Services Terms Acceptable Use Policy Data Processing Addendum (DPA) Communications & Call Recording Policy AI Transparency & Responsible Use Policy Customer Support & Onboarding Policy Service Level Agreement (SLA) Any applicable Order Form, Service Agreement, or Enterprise Agreement Where a conflict exists between this Privacy Policy and a separately executed written agreement, the written agreement shall govern to the extent of the conflict.

For purposes of this Privacy Policy, the following terms shall have the meanings set forth below. Account "Account" means a customer, administrator, user, reseller, partner, or authorised account established to access Sagecom Services.

AI Services "AI Services" means any artificial intelligence, machine learning, natural language processing, speech recognition, text generation, voice synthesis, conversational AI, workflow automation, predictive analytics, or intelligent automation service provided by Sagecom. AI Services include, without limitation: AI Receptionists AI Voice Agents AI Sales Agents AI Customer Support Agents AI Chat Assistants AI Workflow Automation AI Call Summarisation AI Transcription AI Knowledge Base Search AI Document Retrieval AI APIs AI Analytics AI Integrations

AI Output "AI Output" means any content generated by an AI Service, including responses, summaries, recommendations, transcripts, classifications, workflow actions, analytics, reports, or other generated material.

AI Prompt "AI Prompt" means any instruction, question, request, uploaded content, document, audio, image, configuration, or information submitted to an AI Service for processing.

Applicable Law "Applicable Law" means all federal, state, provincial, local, and international laws, regulations, rules, judicial decisions, regulatory guidance, and legally binding governmental requirements applicable to the processing of Personal Information.

Authorised User "Authorised User" means an employee, contractor, agent, representative, customer, or other individual authorised by the Customer to access or use Sagecom Services.

Business Customer "Business Customer" means any company, organisation, government entity, educational institution, healthcare provider, nonprofit organisation, or other legal entity using Sagecom Services.

Call Detail Record (CDR) "Call Detail Record" or "CDR" means telecommunications metadata relating to a communication, including originating number, destination number, date, time, duration, routing information, call status, and associated service identifiers, but not the content of the communication unless recording has been enabled.

Cookies "Cookies" mean small text files or similar technologies stored on a user's device that enable websites or applications to recognise returning users, maintain preferences, improve functionality, measure performance, and provide analytics. Cookies include session cookies, persistent cookies, local storage objects, pixels, web beacons, SDK identifiers, and similar tracking technologies.

Customer "Customer" means the individual or legal entity purchasing, subscribing to, or otherwise using Sagecom Services.

Customer Content "Customer Content" means all information, documents, recordings, prompts, knowledge bases, databases, communications, files, software, images, videos, transcripts, workflows, and other materials submitted, uploaded, transmitted, stored, or processed by the Customer using Sagecom Services. Customer Content remains the property of the Customer unless otherwise expressly agreed in writing.

Customer Portal "Customer Portal" means any Sagecom-hosted website or application that enables Customers to administer accounts, manage services, review invoices, configure products, access analytics, or otherwise interact with Sagecom Services.

Personal Information "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual, as defined by Applicable Law. Personal Information may include: names;

addresses; email addresses; telephone numbers; IP addresses; device identifiers; account credentials; billing information; voice recordings; transcripts; location information; identifiers assigned by Sagecom; online identifiers; and any other information protected by Applicable Law.

Processing "Process, " "Processing, " or "Processed" means any operation performed on Personal Information, whether automated or manual, including collection, recording, organisation, storage, alteration, retrieval, consultation, disclosure, transfer, analysis, deletion, destruction, or any other use.

Processor "Processor" means any third party that processes Personal Information solely on behalf of Sagecom or a Customer pursuant to contractual instructions.

Sensitive Personal Information "Sensitive Personal Information" means any category of information aƯorded additional legal protection under Applicable Law, including government identification numbers,

financial account credentials, precise geolocation, biometric information, health information, authentication credentials, or similar protected information.

Services "Services" means all products, software, platforms, telecommunications services, APIs, websites, customer portals, AI Services, cloud services, hosted services, support services, professional services, and related oƯerings made available by Sagecom.

Telecommunications Services "Telecommunications Services" include, without limitation: Cloud PBX UCaaS Hosted Voice SIP Trunking Virtual OƯice Business Messaging Call Recording Voicemail Number Portability Emergency Calling Services Communications APIs

Third-Party Provider "Third-Party Provider" means any vendor, supplier, cloud provider, payment processor, telecommunications carrier, CRM provider, AI platform provider, analytics provider, security provider, or subcontractor engaged by Sagecom to support the provision of Services.

Website "Website" means all Sagecom-owned or operated internet properties, domains, subdomains, mobile applications, portals, landing pages, and online services.

Unless the context otherwise requires: headings are included for convenience only and do not aƯect interpretation; words importing the singular include the plural and vice versa; references to one gender include all genders; the terms "including, " "includes, " and "such as" shall be deemed to mean "including, without limitation"; references to statutes or regulations include amendments, replacements, and successor legislation; references to writing include electronic communications where legally recognised; any obligation not to perform an act also includes an obligation not to permit or authorise that act.

If there is any inconsistency between this Privacy Policy and another Sagecom policy or agreement, the following order of precedence shall apply unless expressly stated otherwise:

These Telecommunications Privacy Provisions govern Sagecom's collection, use, disclosure, storage, processing, retention, and protection of information relating to telecommunications services provided by Sagecom Inc. ("Sagecom, " "we, " "our, " or "us"). These provisions apply to all telecommunications and communications services oƯered by Sagecom, including but not limited to: Cloud PBX Unified Communications as a Service (UCaaS) Hosted Voice SIP Trunking Virtual OƯice Communications APIs Business Messaging Contact Center Services AI Receptionists AI Voice Agents Voicemail Services Call Recording Number Portability Emergency Calling Services (E911) Customer Portal Mobile and Desktop Applications

These provisions supplement Sagecom's Enterprise Privacy & Cookies Policy and shall be interpreted consistently with all applicable telecommunications and privacy laws.

To provision, operate, support, secure, and improve telecommunications services, Sagecom may collect and process information including: Subscriber Information Customer name Company name Service address Billing address Telephone numbers Email addresses User accounts Extension assignments Administrator details

Network Information IP addresses SIP registration logs Device identifiers MAC addresses User agent strings Network diagnostics Bandwidth statistics Connection history Authentication records

Service Configuration Call routing IVR configuration Hunt groups Ring groups Voicemail settings Business hours Follow-me settings Call forwarding Caller ID settings Presence status AI workflow configuration

Call Detail Records (CDRs) Sagecom maintains Call Detail Records that may include: originating telephone number destination telephone number extension trunk identifier call duration date and time routing information call completion status network identifiers quality metrics

service identifiers Call Detail Records generally do not contain the content of communications unless call recording has been enabled by the Customer.

Communications Metadata We may collect metadata relating to communications, including: message timestamps voicemail metadata SMS routing API request logs webhook events conferencing metadata participant information device registration information

Where applicable under United States telecommunications laws and regulations, Sagecom recognises Customer Proprietary Network Information ("CPNI") as confidential information relating to the quantity, technical configuration, type, destination, location, amount of use, and billing of telecommunications services subscribed to by a Customer. CPNI may include: subscribed services call usage feature subscriptions billing information service plans call destination information

network usage account configuration telecommunications preferences Sagecom protects CPNI in accordance with applicable law and industry standards.

Subject to applicable law, Sagecom may use CPNI to: provide requested services; provision telecommunications services; troubleshoot network issues; authenticate customers; prevent fraud; secure customer accounts; improve service quality; respond to support requests; comply with legal obligations; bill customers accurately. Where required by law, Sagecom will obtain Customer consent before using CPNI for additional marketing purposes.

Sagecom does not sell telecommunications information or CPNI. Information may be disclosed only: with Customer authorisation; to authorised users; to telecommunications carriers necessary to complete communications;

to emergency service providers; to payment processors; to trusted cloud providers; to contracted service providers; to regulators; pursuant to valid legal process; where necessary to investigate fraud or abuse; to protect life, safety, property, or network security. All third-party providers are contractually required to protect Customer information.

Where enabled, Sagecom Services may support: automatic call recording; on-demand recording; AI-assisted recording; quality assurance recording; compliance recording; voicemail recording. Customers are solely responsible for determining whether notice or consent is legally required before recording communications. Sagecom acts solely as a technology provider and does not monitor recorded communications except as necessary for authorised support, security investigations, legal compliance, or customer-authorised troubleshooting.

Voicemail messages remain Customer Content. Unless otherwise configured:

voicemail is stored securely; access is restricted to authorised users; Customers control deletion of voicemail; Sagecom personnel access voicemail only when authorised or legally required.

Certain telecommunications services support Enhanced 911 ("E911") functionality. To facilitate emergency services, Sagecom may process: registered service address; emergency callback number; location information provided by the Customer; account identifiers; routing information. Customers are responsible for maintaining accurate emergency location information. Failure to maintain current information may delay or misroute emergency response.

When Customers request number porting, Sagecom may collect information required by applicable telecommunications carriers, including: authorised contact information; service address; account numbers; billing records; telephone numbers; Letters of Authorisation (LOAs); Customer Service Records (CSRs).

This information is used solely for porting and related regulatory requirements.

Customers using Sagecom APIs remain responsible for protecting: API keys; OAuth credentials; authentication tokens; webhook secrets; application credentials. API activity may be logged to maintain security, investigate incidents, monitor availability, and improve platform performance.

Sagecom employs administrative, technical, and physical safeguards designed to protect telecommunications information, including: TLS encryption; encryption at rest where supported; role-based access controls; multi-factor authentication; audit logging; intrusion detection; fraud monitoring; network segmentation; vulnerability management; backup and disaster recovery; continuous monitoring; secure provisioning procedures.

Sagecom may monitor telecommunications systems to detect: toll fraud; account compromise; credential abuse; denial-of-service attacks; suspicious registration attempts; spam; robocalling; artificial traƯic generation; unauthorised access. Appropriate action may include suspension of aƯected services to protect Customers and the integrity of the network.

Telecommunications records are retained only for the period necessary to: provide services; maintain billing records; resolve disputes; investigate fraud; comply with legal obligations; satisfy regulatory requirements; enforce contractual rights. Retention periods may vary depending upon the type of information and applicable legal requirements.

Subject to Applicable Law, Customers may request: access to telecommunications information; correction of inaccurate information; deletion where legally permissible; copies of certain account information; updates to emergency service information; restrictions on marketing communications; review of account privacy preferences. Identity verification may be required before fulfilling requests.

Telecommunications information may be processed in jurisdictions where Sagecom or its authorised providers operate. Where cross-border processing occurs, Sagecom implements reasonable contractual, organisational, and technical safeguards designed to protect Customer information in accordance with applicable privacy laws.

Sagecom is committed to complying with applicable telecommunications and privacy laws, including, where applicable: Federal Communications Commission (FCC) regulations; Customer Proprietary Network Information (CPNI) requirements; Communications Assistance for Law Enforcement Act (CALEA), where applicable; Telephone Consumer Protection Act (TCPA); Truth in Caller ID Act; U.S. state privacy laws;

applicable data protection laws in jurisdictions where Sagecom provides Services. Nothing in this Policy limits Sagecom's ability to comply with lawful governmental requests, regulatory obligations, court orders, subpoenas, or emergency disclosures permitted or required by Applicable Law.

Questions relating to telecommunications privacy, CPNI, or communications data should be directed to: Privacy OƯicer Sagecom Inc. Miami, Florida, USA Email: privacy@sagecominc.com Alternative Contact: info@sagecominc.com

This Cookie & Consent Management Policy ("Cookie Policy") explains how Sagecom Inc. ("Sagecom, " "we, " "our, " or "us") uses cookies and similar technologies on our websites, customer portals, cloud applications, APIs, mobile applications, AI Services, and other online services (collectively, the "Services"). This Policy forms part of Sagecom's Enterprise Privacy & Cookies Policy and should be read together with our Privacy Policy, Terms of Service, Data Processing Addendum (DPA), AI Services Terms, and other applicable policies.

Cookies are small text files placed on a user's browser, computer, or mobile device when visiting a website or using an online service. Cookies enable websites and applications to recognise returning users, remember preferences, improve functionality, maintain security, analyse performance, and personalise user experiences.

Sagecom also uses similar technologies, including: Web Beacons Pixel Tags Local Storage Session Storage Software Development Kits (SDKs) Device Identifiers Log Files Server-Side Tracking API Session Tokens Authentication Cookies For purposes of this Policy, all such technologies are collectively referred to as "Cookies. "

Sagecom uses Cookies to: operate our websites and applications; authenticate users; maintain secure login sessions; prevent fraud and abuse; remember user preferences; improve website performance; monitor system reliability; analyse visitor behaviour; personalise content; measure marketing eƯectiveness; support AI-powered functionality;

maintain Customer Portal sessions; enable API authentication; improve accessibility; provide customer support. Cookies are never used to access information stored elsewhere on a user's device.

Essential Cookies Essential Cookies are required for the operation of Sagecom Services and cannot be disabled through our Cookie Preference Centre. Examples include: authentication login sessions account security fraud prevention load balancing shopping cart functionality service provisioning network routing API authentication customer portal access Without these Cookies, certain Services may not function properly.

Functional Cookies Functional Cookies remember user preferences and improve usability.

Examples include: preferred language time zone accessibility settings dashboard preferences communication preferences remembered usernames extension settings AI interface preferences

Performance Cookies Performance Cookies collect anonymous or aggregated information about how users interact with our Services. These Cookies help us understand: page loading performance; website responsiveness; navigation patterns; feature adoption; system reliability; service performance. Performance Cookies help improve overall customer experience.

Analytics Cookies Analytics Cookies allow Sagecom to understand how visitors use our Services. Analytics may include: pages visited;

session duration; referring websites; browser type; operating system; approximate geographic region; device category; user interaction events. Analytics information is generally aggregated and is not intended to identify individual users.

Security Cookies Security Cookies help detect and prevent: unauthorised access; credential abuse; account takeover attempts; bot traƯic; distributed denial-of-service attacks; spam; fraudulent activity. These Cookies protect both Sagecom and its Customers.

Advertising and Marketing Cookies Where permitted by applicable law and enabled by the user, Sagecom may use Cookies to: measure advertising eƯectiveness; understand campaign performance; avoid repetitive advertising;

personalise marketing communications; improve customer engagement. Advertising Cookies are only activated where required consent has been obtained.

AI Service Cookies AI-powered Services may use Cookies or similar technologies to: maintain AI conversation sessions; preserve context during active interactions; remember authorised user preferences; support AI workflow continuity; improve service reliability; maintain authenticated AI sessions. AI Service Cookies do not use Customer Content to train public AI models.

Sagecom may permit trusted third-party providers to place Cookies necessary for delivering Services. These providers may include: cloud infrastructure providers; analytics providers; payment processors; CRM platforms; customer support platforms; communications providers; AI technology providers; fraud detection providers;

cybersecurity providers; content delivery networks (CDNs). Each provider is contractually required to process information only for authorised business purposes.

Where required by Applicable Law, Sagecom obtains user consent before placing non-essential Cookies on a user's device. Our Cookie Consent Platform may allow users to: Accept All Cookies Reject Non-Essential Cookies Save Custom Preferences Change Consent at Any Time View Cookie Categories Review Third-Party Providers Essential Cookies remain active because they are necessary for the operation and security of our Services.

Users may update Cookie preferences at any time by: using the Cookie Preference Centre; selecting the "Cookie Settings" link available on our websites, where provided; modifying browser settings; deleting previously stored Cookies. Changes generally apply to future browsing sessions and may require a page refresh or new login.

Most web browsers allow users to: block Cookies; delete Cookies; receive notifications before Cookies are stored; restrict third-party Cookies; automatically clear Cookies when closing the browser. Disabling certain Cookies may aƯect website functionality, authentication, saved preferences, and access to portions of the Services.

Mobile applications may use technologies similar to Cookies, including: mobile device identifiers; secure application tokens; encrypted authentication credentials; push notification identifiers; crash reporting services; software analytics. Users may control many of these settings through their device operating system.

Some web browsers provide "Do Not Track" ("DNT") signals. Because there is no universally accepted standard governing DNT responses, Sagecom currently responds to such signals only where required by Applicable Law. Users should instead use our Cookie Preference Centre or browser settings to manage tracking preferences.

Information collected through Cookies is retained only for as long as necessary to fulfil the purposes described in this Policy, including: maintaining active sessions; remembering user preferences; improving website performance; ensuring security; meeting legal and regulatory obligations. Retention periods vary depending on the type of Cookie and its intended purpose.

Cookie-related information may be processed in countries where Sagecom or its authorised service providers operate. Where required, Sagecom implements appropriate contractual, organisational, and technical safeguards to protect personal information transferred across borders.

Sagecom does not knowingly use Cookies to profile or market to children. Our Services are not directed to individuals under the age of 18.

Cookie information is protected using reasonable administrative, technical, and organisational safeguards, including: encrypted communications (TLS); secure authentication; role-based access controls; secure session management;

monitoring for unauthorised access; vulnerability management; audit logging.

Sagecom may update this Cookie Policy periodically to reflect changes in technology, legal requirements, or business practices. The revised version will become eƯective upon publication unless otherwise stated. Where required by Applicable Law, we will obtain renewed consent before implementing material changes aƯecting the use of non-essential Cookies.

Questions regarding this Cookie & Consent Management Policy or your Cookie preferences may be directed to: Privacy OƯicer Sagecom Inc. Miami, Florida, USA Email: privacy@sagecominc.com Alternative Contact: info@sagecominc.com

This section applies to the processing of Personal Data governed by the European Union General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), the United Kingdom General Data Protection Regulation ("UK GDPR"), the UK Data Protection Act 2018, and other applicable international privacy and data protection laws. These provisions supplement Sagecom's Enterprise Privacy & Cookies Policy and apply to Customers, authorised users, website visitors, and individuals located within the European

Economic Area ("EEA"), the United Kingdom ("UK"), Switzerland, or any jurisdiction with substantially similar privacy requirements where Sagecom processes Personal Data.

Depending on the Services provided, Sagecom may act as either: Data Controller, when determining the purposes and means of processing Personal Data for its own business operations; or Data Processor, when processing Personal Data solely on behalf of a Customer in accordance with documented instructions. Customers acting as Data Controllers remain responsible for ensuring they have a lawful basis for the collection and processing of Personal Data using Sagecom Services.

Where required by the EU GDPR or UK GDPR, Sagecom processes Personal Data only where one or more lawful bases apply, including: the individual's consent; performance of a contract; compliance with legal obligations; protection of vital interests; performance of a task carried out in the public interest; or Sagecom's or a third party's legitimate interests, provided such interests are not overridden by the rights and freedoms of the individual. Where processing relies on consent, consent may be withdrawn at any time without aƯecting the lawfulness of processing carried out before withdrawal.

Depending upon the Services used, Sagecom may process: contact information;

business information; account credentials; billing information; telecommunications records; call recordings; AI prompts and responses; transcripts; uploaded documents; CRM information; customer support records; technical identifiers; device information; IP addresses; authentication logs; API activity; website usage information. Sagecom does not intentionally collect Special Category Data unless required by the Customer for authorised business purposes and permitted by Applicable Law.

Customers should avoid submitting Special Category Data unless strictly necessary and legally authorised. Where such information is processed, Sagecom applies appropriate technical and organisational safeguards designed to protect its confidentiality, integrity, and availability.

Where AI Services are enabled:

AI prompts are processed solely to provide requested functionality; Customer Content remains under Customer ownership; Customer Content is not used to train public or shared AI foundation models unless the Customer has expressly opted in through a separate written agreement; AI-generated outputs are intended to assist users and are subject to human oversight where appropriate.

Personal Data may be processed in countries outside the EEA or the UK. Where Personal Data is transferred internationally, Sagecom implements appropriate safeguards, which may include: the European Commission's Standard Contractual Clauses (SCCs); the UK International Data Transfer Agreement (IDTA) or UK Addendum to the SCCs; adequacy decisions issued by competent authorities; contractual confidentiality obligations; encryption in transit and at rest where supported; organisational and technical safeguards appropriate to the risk.

Subject to Applicable Law, individuals may have the right to: access their Personal Data; correct inaccurate Personal Data; request deletion ("right to be forgotten"); restrict processing; object to processing based on legitimate interests; receive a portable copy of their Personal Data in a structured, commonly used, and machine-readable format;

withdraw consent where processing is based on consent; object to direct marketing; request human review of certain automated decisions where legally applicable. Requests will be handled within the timeframes required by Applicable Law, subject to identity verification and any lawful exemptions.

Sagecom may use automated technologies to: route communications; classify enquiries; generate summaries; detect fraud; prioritise support requests; recommend workflow actions. Unless expressly stated otherwise, Sagecom does not make decisions based solely on automated processing that produce legal or similarly significant eƯects without appropriate human involvement where required by Applicable Law.

Sagecom maintains appropriate technical and organisational measures designed to protect Personal Data, including: encryption in transit using TLS; encryption at rest where supported; multi-factor authentication for administrative access; role-based access controls; audit logging; vulnerability management;

continuous security monitoring; secure backup procedures; disaster recovery planning; vendor security assessments.

Personal Data is retained only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, enforce contractual rights, and maintain service integrity. Retention periods are described in Sagecom's Data Retention & Secure Disposal Policy.

Sagecom may engage trusted subprocessors to support the delivery of Services, including providers of: cloud infrastructure; telecommunications services; payment processing; customer relationship management; analytics; artificial intelligence; email and messaging; cybersecurity; customer support. Each subprocessor is contractually required to implement appropriate confidentiality, privacy, and security measures consistent with Applicable Law.

Where Sagecom acts as a Data Processor, Customers may request or execute Sagecom's Data Processing Addendum (DPA). The DPA governs: processing instructions; confidentiality; security measures; subprocessors; international transfers; audit rights; assistance with data subject requests; breach notification; return or deletion of Personal Data upon termination.

Individuals who believe their Personal Data has been processed unlawfully may contact Sagecom using the details below. Where applicable, individuals also have the right to lodge a complaint with their local supervisory authority within the EEA, the UK Information Commissioner's OƯice (ICO), or another competent data protection authority.

Questions regarding these GDPR and UK GDPR provisions, data protection practices, or the exercise of privacy rights should be directed to: Privacy OƯicer Sagecom Inc. Miami, Florida, USA Email: privacy@sagecominc.com

Alternative Contact: info@sagecominc.com Sagecom will respond to privacy requests within the timeframes required by Applicable Law and may request reasonable information to verify the identity of the requesting individual before processing a request.

Sagecom Inc. ("Sagecom, " "we, " "our, " or "us") is committed to protecting Personal Information and complying with applicable United States federal and state privacy laws governing the collection, use, disclosure, storage, sharing, and protection of Personal Information. This section supplements Sagecom's Enterprise Privacy & Cookies Policy and applies where applicable under state privacy legislation. Sagecom continually monitors legislative developments and updates its privacy practices as new state privacy laws become eƯective. Nothing in this Policy limits any rights granted under Applicable Law.

These provisions apply to individuals residing in states that have enacted comprehensive privacy legislation, where such laws apply to Sagecom's processing activities. Depending on the applicable law, individuals may be entitled to exercise privacy rights relating to: access to Personal Information; correction of inaccurate Personal Information; deletion of Personal Information; data portability; withdrawal of consent;

opt-out of targeted advertising; opt-out of profiling in furtherance of decisions producing legal or similarly significant eƯects; appeal of privacy request decisions. Availability of these rights may vary depending upon the applicable state law and the nature of the processing activity.

For California residents, Sagecom provides rights consistent with the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Subject to applicable exemptions, California residents may request: confirmation of whether Sagecom processes their Personal Information; access to categories and specific pieces of Personal Information; correction of inaccurate Personal Information; deletion of Personal Information; portability of eligible Personal Information; limitation of the use and disclosure of Sensitive Personal Information where applicable; information regarding categories of Personal Information collected, disclosed, or shared; information regarding categories of recipients receiving Personal Information; information regarding business purposes for processing. Sagecom does not sell Personal Information or Sensitive Personal Information and does not share Personal Information for cross-context behavioral advertising as those terms are defined under California law, unless expressly disclosed and permitted by Applicable Law. California residents exercising privacy rights will not receive discriminatory treatment for doing so.

Where applicable, Virginia residents may request: confirmation of processing; access to Personal Data; correction of inaccuracies; deletion of Personal Data; data portability; opt-out of: o targeted advertising; o the sale of Personal Data; o profiling producing legal or similarly significant eƯects. Where required, Sagecom provides an appeal process for denied privacy requests.

Colorado residents, where applicable, may request: access; correction; deletion; data portability; withdrawal of consent; opt-out of: o targeted advertising; o sale of Personal Data; o profiling producing legal or similarly significant eƯects. Sagecom recognises valid browser-based universal opt-out preference signals where required by Colorado law.

Connecticut residents may exercise rights relating to: access; correction; deletion; portability; consent withdrawal; targeted advertising opt-out; sale opt-out; profiling opt-out. Customers may appeal certain denied privacy requests in accordance with Applicable Law.

Where applicable, Utah residents may request: confirmation of processing; access; deletion; portability; and may opt out of: targeted advertising; and sale of Personal Data.

Where applicable, Iowa residents may request:

access; deletion; portability; and may opt out of: sale of Personal Data; and targeted advertising.

Indiana residents may request: access; correction; deletion; portability; and may opt out of: targeted advertising; sale of Personal Data; profiling in furtherance of decisions producing legal or similarly significant eƯects.

Montana residents may request: access; correction; deletion; portability; and may opt out of: targeted advertising;

sale of Personal Data; qualifying profiling activities.

Where applicable, Tennessee residents may request: confirmation of processing; access; correction; deletion; portability; and may opt out of: sale of Personal Data; targeted advertising; qualifying profiling activities.

Texas residents may request: confirmation of processing; access; correction; deletion; portability; and may opt out of: targeted advertising; sale of Personal Data; profiling producing legal or similarly significant eƯects.

Where applicable, Oregon residents may request: access; correction; deletion; portability; withdrawal of consent; and may opt out of: targeted advertising; sale of Personal Data; qualifying profiling.

Delaware residents may request: access; correction; deletion; portability; and may opt out of: targeted advertising; sale of Personal Data; qualifying profiling activities.

Where applicable, New Hampshire residents may exercise rights to:

access; correction; deletion; portability; and may opt out of: targeted advertising; sale of Personal Data; qualifying automated profiling.

Where applicable, New Jersey residents may request: confirmation of processing; access; correction; deletion; portability; and may opt out of: targeted advertising; sale of Personal Data; profiling with legal or similarly significant eƯects.

Nebraska residents, where applicable, may exercise rights relating to: access; correction; deletion;

portability; targeted advertising opt-out; sale opt-out; profiling opt-out.

Kentucky residents may request: access; correction; deletion; portability; and may opt out of: targeted advertising; sale of Personal Data; profiling.

Where applicable, Minnesota residents may exercise rights to: access; correction; deletion; portability; consent withdrawal; and may opt out of: targeted advertising; sale of Personal Data;

qualifying profiling.

If and when applicable, Rhode Island residents will be aƯorded privacy rights required under applicable state law, including rights of access, correction, deletion, portability, and applicable opt-out rights.

Sagecom recognises that additional U.S. states may enact comprehensive privacy legislation after publication of this Policy. Where such laws apply to Sagecom's processing activities, Sagecom will implement commercially reasonable measures to comply with applicable legal requirements and update this Policy as necessary.

To protect Personal Information, Sagecom may require reasonable verification of identity before processing a privacy request. Verification methods may include: account authentication; confirmation of contact information; government-issued identification where legally appropriate; additional information reasonably necessary to verify identity. Where a request is submitted by an authorised agent, Sagecom may require documentation demonstrating the agent's authority to act on behalf of the individual.

Where Applicable Law provides a right to appeal the denial of a privacy request, Sagecom will provide instructions for submitting an appeal.

Appeals will be reviewed by personnel who were not involved in the original decision whenever practicable, and a written response will be provided within the timeframe required by Applicable Law.

Sagecom will not unlawfully discriminate against any individual for exercising privacy rights provided under Applicable Law. Unless otherwise permitted by law, Sagecom will not: deny Services solely because an individual exercises a privacy right; charge diƯerent prices solely because an individual exercises a privacy right; reduce service quality solely because an individual exercises a privacy right; or retaliate against an individual for exercising lawful privacy rights.

Sagecom does not sell, rent, or trade Personal Information or Sensitive Personal Information for monetary consideration. Sagecom also does not knowingly sell: AI prompts; AI-generated responses; voice recordings; call transcripts; Customer knowledge bases; Customer Content; telecommunications records; or API data. Any disclosure to service providers is limited to the purposes of providing, securing, supporting, or improving the Services and is governed by written contractual obligations.

Privacy requests may be submitted by contacting: Privacy OƯicer Sagecom Inc. Miami, Florida, USA Email: privacy@sagecominc.com Alternative Contact: info@sagecominc.com Sagecom will respond to verified privacy requests within the timeframes required by Applicable Law and may request additional information to verify the identity of the requester before fulfilling a request.

This Subprocessor & Vendor Management Policy ("Vendor Policy") describes how Sagecom Inc. ("Sagecom, " "we, " "our, " or "us") selects, evaluates, manages, monitors, and oversees third-party vendors, subprocessors, contractors, cloud providers, and technology partners that process Personal Information or Customer Content on Sagecom's behalf. This Policy forms part of Sagecom's Enterprise Privacy & Cookies Policy, Data Processing Addendum (DPA), AI Services Terms, Master Terms of Service, Information Security Program, and Supplier Risk Management Program.

This Policy applies to all third parties that: process Personal Information; access Customer Content; provide cloud infrastructure; support telecommunications services;

support AI Services; provide software platforms; process payments; provide messaging services; provide cybersecurity services; provide technical support; host infrastructure; process analytics; provide CRM or business applications.

A Subprocessor is any third party engaged by Sagecom to process Personal Information or Customer Content on Sagecom's behalf in connection with the delivery of the Services. Examples include providers of: cloud hosting; artificial intelligence platforms; telecommunications carriers; payment processing; email delivery; SMS messaging; customer support software; CRM platforms; authentication services; identity verification; analytics; security monitoring;

backup and disaster recovery.

Depending on the Services provided, Sagecom may engage trusted providers in the following categories: Cloud Infrastructure cloud hosting; virtual servers; object storage; content delivery networks (CDNs); managed databases; backup services. Artificial Intelligence Large Language Models (LLMs); speech recognition; speech synthesis; natural language processing; AI inference services; transcription services; translation services. Telecommunications SIP carriers; PSTN providers; number portability providers; emergency services routing; messaging gateways;

voice infrastructure providers. Customer Relationship Management Examples may include: HubSpot Salesforce Zoho CRM Microsoft Dynamics 365 Zendesk Communications email providers; SMS gateways; notification services; conferencing providers. Payment Processing payment gateways; merchant processors; subscription billing providers; fraud detection services. Security endpoint protection; vulnerability management; intrusion detection; identity management; audit logging; threat intelligence. Analytics

website analytics; application monitoring; product analytics; performance monitoring.

Before engaging a subprocessor, Sagecom conducts a risk-based assessment that may include: organisational background review; financial stability review; information security evaluation; privacy programme assessment; regulatory compliance review; contractual review; service capability assessment; reputation review; business continuity assessment; disaster recovery capability; data protection controls; AI governance practices (where applicable). The level of due diligence is proportionate to the sensitivity of the data processed and the criticality of the services provided.

Subprocessors must maintain security measures appropriate to the services they provide. Where appropriate, Sagecom expects vendors to implement controls such as: encryption in transit using TLS;

encryption at rest; multi-factor authentication; least-privilege access; role-based access controls; audit logging; vulnerability management; penetration testing; malware protection; secure software development practices; security incident response procedures; business continuity and disaster recovery plans. Where available, vendors are expected to maintain recognised security certifications or attestations such as ISO/IEC 27001, SOC 2 Type II, PCI DSS (where applicable), or equivalent standards.

Each subprocessor that processes Personal Information must be contractually obligated to: process information only on documented instructions from Sagecom; implement appropriate technical and organisational safeguards; maintain confidentiality obligations; notify Sagecom of security incidents without undue delay; assist Sagecom in responding to privacy requests where applicable; comply with applicable privacy and data protection laws; return or securely delete Personal Information upon termination of services, unless retention is required by law.

Subprocessors providing AI capabilities must agree to contractual obligations addressing, where applicable: confidentiality of Customer Content; restrictions on AI model training using Customer Content; data isolation between customers; safeguards against unauthorised disclosure; responsible AI governance; human oversight where appropriate; logging and audit capabilities; secure API authentication; compliance with applicable AI regulations. Unless expressly authorised by the Customer through a separate written agreement, Customer Content submitted to Sagecom AI Services will not be intentionally used to train public or shared AI foundation models.

Where a subprocessor processes Personal Information outside the country in which it was collected, Sagecom implements appropriate transfer safeguards, including, where applicable: Standard Contractual Clauses (SCCs); the UK International Data Transfer Agreement (IDTA) or UK Addendum; adequacy decisions; contractual confidentiality obligations; encryption and other technical safeguards.

Sagecom periodically reviews the performance and compliance of subprocessors based on the nature and risk of the services provided. Reviews may include: security assessments; compliance reviews; audit reports; penetration testing summaries; service level performance; incident history; vulnerability disclosures; privacy programme updates; financial stability. Higher-risk vendors may be reviewed more frequently.

Sagecom reserves the right to engage new subprocessors, replace existing subprocessors, or discontinue the use of subprocessors as business needs evolve. Where required by contract or applicable law, Sagecom will provide Customers with notice of material changes to subprocessors and, where applicable, provide an opportunity to raise reasonable objections.

Where Customers have a contractual right to object to a new subprocessor, objections must: be submitted in writing; identify the specific privacy, security, or regulatory concern; be supported by reasonable evidence.

Sagecom will work in good faith to address legitimate concerns. Where no reasonable resolution can be achieved, either party may exercise rights available under the applicable agreement.

All vendors with access to Customer information must be subject to legally enforceable confidentiality obligations. Access to Customer information is limited to authorised personnel with a legitimate business need to perform contracted services.

Subprocessors must notify Sagecom without undue delay after becoming aware of any confirmed or reasonably suspected security incident aƯecting Personal Information or Customer Content processed on Sagecom's behalf. Such notifications should include, where available: the nature of the incident; aƯected data categories; aƯected systems; remediation actions; known or reasonably anticipated impact. Sagecom will fulfil its own notification obligations to Customers and regulators where required by Applicable Law or contractual commitments.

Where required under an executed Data Processing Addendum (DPA), Master Services Agreement, or Enterprise Agreement, Sagecom may make available reasonable information demonstrating compliance with its subprocessor management obligations.

To protect the confidentiality of Sagecom and its vendors, audits may be satisfied through recognised third-party audit reports, certifications, independent assessments, or other appropriate evidence rather than direct inspection of vendor facilities.

Upon termination of a vendor relationship, Sagecom requires the vendor, subject to applicable law and contractual obligations, to: return Customer information where appropriate; securely delete Personal Information and Customer Content; revoke system access; destroy authentication credentials; certify deletion upon request where contractually required; continue to protect retained information where legal retention obligations apply.

Customers may request general information regarding categories of subprocessors used to provide the Services. Where contractually agreed, Sagecom may also provide a current subprocessor list identifying principal vendors and the categories of services they perform, subject to confidentiality, security, and legal restrictions.

Sagecom does not permit subprocessors to: sell Personal Information; sell Customer Content; use Customer data for independent marketing; disclose Customer information except as authorised by Sagecom or required by law.

Subprocessors process Personal Information solely to support the delivery, security, maintenance, and improvement of the Services under Sagecom's documented instructions and contractual controls.

This Policy will be reviewed periodically and updated as necessary to reflect: changes in Applicable Law; new technologies; evolving security threats; operational changes; new categories of subprocessors; regulatory guidance.

Questions regarding Sagecom's Subprocessor & Vendor Management Programme may be directed to: Privacy OƯicer Sagecom Inc. Miami, Florida, USA Email: privacy@sagecominc.com Alternative Contact:info@sagecominc.com

This Incident Response & Data Breach Notification Policy ("Incident Response Policy") establishes Sagecom Inc. 's ("Sagecom, " "we, " "our, " or "us") procedures for identifying,

responding to, investigating, containing, remediating, documenting, and reporting actual or suspected cybersecurity incidents, privacy incidents, and Personal Data breaches. The objectives of this Policy are to: protect Customer information; minimise business disruption; maintain service availability; comply with applicable privacy, telecommunications, cybersecurity, and data breach notification laws; preserve evidence; support rapid recovery; improve Sagecom's security posture through continuous learning. This Policy forms part of Sagecom's Enterprise Privacy & Cookies Policy, Information Security Program, Business Continuity Plan, Disaster Recovery Plan, Data Processing Addendum (DPA), AI Governance Framework, and Master Terms of Service.

This Policy applies to all: Sagecom employees; contractors; consultants; authorised users; temporary personnel; subprocessors; managed service providers; cloud providers; telecommunications partners; AI technology providers;

third-party vendors processing Customer information. It applies to all Sagecom systems, including: Cloud PBX UCaaS Hosted Voice Virtual OƯice Customer Portal AI Receptionists AI Voice Agents AI APIs Websites Mobile Applications Internal Systems Cloud Infrastructure Customer Knowledge Bases Call Recordings Voice Transcripts AI Conversation Logs

Security Incident A Security Incident means any event that actually or potentially compromises the confidentiality, integrity, or availability of Sagecom systems or Customer information. Examples include: malware infections; ransomware;

phishing attacks; credential compromise; denial-of-service attacks; unauthorised access; insider misuse; network intrusion; system compromise.

Personal Data Breach A Personal Data Breach means a confirmed or reasonably suspected security incident resulting in the accidental or unlawful: destruction; loss; alteration; unauthorised disclosure; unauthorised access to; Personal Information or Customer Content.

Customer Content Customer Content includes: AI prompts; AI responses; call recordings; transcripts; voicemail; uploaded documents;

knowledge bases; CRM information; business records; communications.

Security incidents are classified according to their severity and business impact. Severity 1 – Critical Examples include: confirmed unauthorised disclosure of Personal Information; ransomware aƯecting production systems; compromise of customer credentials; large-scale outage; AI platform compromise; telecommunications infrastructure compromise. Immediate executive escalation is required.

Severity 2 – High Examples include: attempted unauthorised access; service degradation aƯecting multiple customers; malware detected on production infrastructure; significant phishing attacks.

Severity 3 – Moderate Examples include:

isolated account compromise; unsuccessful intrusion attempts; limited service interruption; suspicious network activity.

Severity 4 – Low Examples include: policy violations; isolated configuration issues; informational alerts; minor operational events.

Sagecom follows a structured incident response process consisting of: Phase 1 – Preparation Preparation includes: security awareness training; incident response planning; access controls; backup verification; logging and monitoring; vulnerability management; tabletop exercises; business continuity testing.

Phase 2 – Detection

Potential incidents may be identified through: security monitoring; audit logs; intrusion detection; endpoint protection; cloud monitoring; AI monitoring; telecommunications monitoring; Customer reports; employee reports; vendor notifications.

Phase 3 – Assessment Upon detection, Sagecom evaluates: aƯected systems; aƯected Customers; aƯected data; operational impact; legal obligations; regulatory reporting requirements; likelihood of ongoing compromise.

Phase 4 – Containment Containment measures may include: isolating aƯected systems; disabling compromised accounts;

revoking authentication tokens; blocking malicious IP addresses; suspending API credentials; disabling integrations; restricting administrative access. Containment measures are designed to minimise additional risk while preserving evidence.

Phase 5 – Investigation The investigation may include: forensic analysis; log review; malware analysis; timeline reconstruction; root cause analysis; vendor coordination; regulatory consultation where appropriate. Evidence is preserved using appropriate chain-of-custody procedures where necessary.

Phase 6 – Eradication Where appropriate, Sagecom may: remove malicious software; reset credentials; patch vulnerabilities; rebuild aƯected systems; revoke compromised certificates; strengthen security controls.

Phase 7 – Recovery Recovery activities include: restoring services; validating system integrity; monitoring for recurring threats; confirming remediation; communicating service restoration.

Phase 8 – Lessons Learned Following significant incidents, Sagecom conducts a post-incident review to evaluate: root cause; response eƯectiveness; communication eƯectiveness; policy improvements; technical improvements; training needs; vendor performance. Corrective actions are documented and tracked to completion.

Upon becoming aware of a suspected Personal Data Breach, Sagecom will promptly evaluate: whether Personal Information was aƯected; the categories of information involved; the number of aƯected individuals;

whether information was encrypted; the likelihood of misuse; the potential impact on aƯected individuals; notification obligations under Applicable Law.

Where Sagecom determines that a Personal Data Breach requires notification under Applicable Law or contractual obligations, Sagecom will notify aƯected Customers without undue delay and, where applicable, within the timeframes required by law or an executed Data Processing Addendum (DPA). Notifications may include, where available: date of the incident; date of discovery; incident summary; systems aƯected; categories of information involved; known or anticipated impact; actions already taken; recommended Customer actions; contact information for additional assistance. Notification timeframes may vary depending on applicable legal, contractual, or regulatory requirements.

Where required by Applicable Law, Sagecom will notify the appropriate regulatory authority or supervisory body within the legally required timeframe. Regulatory notifications may include:

description of the incident; categories of aƯected information; estimated number of aƯected individuals; remediation actions; contact details for Sagecom's Privacy OƯicer or designated representative.

Where Applicable Law requires notification directly to aƯected individuals, Sagecom will provide clear and timely communications describing: the nature of the breach; the information involved; potential risks; recommended protective measures; available support resources; Sagecom contact information.

Subprocessors and third-party vendors must notify Sagecom without undue delay after becoming aware of any confirmed or reasonably suspected incident aƯecting Customer information processed on Sagecom's behalf. Vendor notifications should include: nature of the incident; systems aƯected; information aƯected; remediation activities; ongoing risks.

AI-related incidents may include: unauthorised access to prompts; knowledge base exposure; AI workflow compromise; prompt injection attacks; model misuse; unauthorised AI API access; disclosure of Customer Content; manipulation of AI responses. Sagecom maintains monitoring and security controls designed to detect and mitigate AI-specific threats.

Telecommunications incidents may include: SIP fraud; toll fraud; call interception; credential compromise; number hijacking; denial-of-service attacks; unauthorised call routing; E911 service disruption. Appropriate containment measures may include temporary suspension of aƯected accounts or services to protect Customers and network integrity.

During a significant incident, Sagecom may communicate with: aƯected Customers; regulators; law enforcement; telecommunications partners; cloud providers; cybersecurity partners; payment processors; AI technology providers. Only authorised spokespersons may make public statements regarding an incident.

For each material incident, Sagecom maintains records including: incident description; detection date and time; response timeline; aƯected systems; aƯected data categories; forensic findings; remediation actions; notifications issued; lessons learned. Documentation is retained in accordance with Sagecom's Data Retention & Secure Disposal Policy.

Customers are responsible for: maintaining secure passwords; enabling multi-factor authentication where available; protecting API credentials; promptly reporting suspected compromises; maintaining accurate contact information; implementing appropriate endpoint security; complying with applicable security obligations.

Sagecom periodically reviews and updates its incident response capabilities through: security assessments; penetration testing; vulnerability scanning; tabletop exercises; disaster recovery testing; business continuity testing; vendor risk assessments; AI security reviews; telecommunications security reviews.

Nothing in this Policy shall be interpreted as creating additional liability beyond that expressly set forth in Sagecom's Master Terms of Service, Enterprise Agreement, or applicable law. The existence of this Policy does not guarantee that all security incidents can be prevented, detected, or remediated without interruption or impact.

Questions regarding this Incident Response & Data Breach Notification Policy, or reports of suspected security incidents, should be directed to: Privacy OƯicer Sagecom Inc. Miami, Florida, USA Privacy & Compliance Email: privacy@sagecominc.com Security Incident Reporting Email: security@sagecominc.com General Support Email: support@sagecominc.com Alternative Contact: info@sagecominc.com

This section establishes the relationship between Sagecom's legal agreements, privacy policies, security policies, artificial intelligence governance documents, telecommunications policies, and service agreements. These documents collectively form Sagecom's Enterprise Legal Framework and are intended to operate together to provide a comprehensive contractual, operational, privacy, security, and compliance framework governing the use of Sagecom Services.

The Sagecom Enterprise Legal Framework consists of the following governing documents: A. Master Terms of Service (Primary Agreement)

The Master Terms of Service establishes the primary contractual relationship between Sagecom and the Customer and governs, among other matters: Service eligibility Account registration Service provisioning Subscription terms Billing and payment Acceptable use Intellectual property Confidentiality Warranties Service limitations Limitation of liability Indemnification Suspension and termination Governing law Arbitration and dispute resolution Enterprise provisions Unless otherwise stated, the Master Terms of Service governs all Sagecom Services.

B. Privacy & Cookies Policy The Enterprise Privacy & Cookies Policy describes how Sagecom collects, processes, stores, protects, retains, transfers, and discloses Personal Information and Customer Content. It includes, among other topics: Privacy principles Telecommunications privacy

AI privacy Cookie management Consent management Data retention Customer rights International transfers Security safeguards Incident response Subprocessor management Applicable privacy laws The Privacy Policy supplements—but does not replace—the Master Terms of Service.

C. AI Services Terms The AI Services Terms establish the contractual conditions governing the use of Sagecom's AI-powered services. These terms address: AI functionality AI usage limitations Acceptable AI use Customer responsibilities AI-generated content Human oversight Prompt ownership Knowledge base management AI APIs AI workflows

AI disclaimers AI service limitations The AI Services Terms apply only to Customers using AI-enabled services.

D. Data Processing Addendum (DPA) Where Sagecom processes Personal Data on behalf of a Customer, the Data Processing Addendum governs: Controller and Processor responsibilities Processing instructions Security measures International transfers Subprocessors Confidentiality Audit rights Data subject requests Security incidents Return or deletion of Personal Data Applicable privacy laws The DPA prevails over the Privacy Policy where required by Applicable Law.

E. AI Transparency & Responsible Use Policy The AI Transparency & Responsible Use Policy establishes Sagecom's enterprise AI governance principles, including: Responsible AI Human oversight Transparency Fairness

Bias mitigation Explainability Accountability AI risk management AI security AI governance AI ethics Customer disclosures AI monitoring This Policy supplements both the Privacy Policy and the AI Services Terms.

F. Service Terms and Use Policy This Policy governs: Voice recordings AI call recordings Call transcription Voicemail Business messaging SMS Email communications AI summaries Consent requirements Telecommunications recording laws Data retention Disclosure of recordings

Where recording laws apply, this Policy supplements the Privacy Policy and AI Services Terms.

G. Acceptable Use Policy (AUP) The Acceptable Use Policy establishes prohibited activities relating to Sagecom Services, including: unlawful activities; network abuse; fraud; spam; abusive communications; AI misuse; cybersecurity threats; telecommunications abuse; intellectual property violations. Violation of the AUP may result in suspension or termination under the Master Terms of Service.

H. Service Level Agreement (SLA) The SLA establishes Sagecom's operational commitments relating to: availability; uptime; maintenance; support; response times; incident priorities; service credits;

disaster recovery; planned maintenance. The SLA does not modify privacy obligations but defines operational performance commitments.

I. Customer Support & Onboarding Policy This Policy governs: onboarding; implementation; provisioning; training; support requests; escalation procedures; implementation responsibilities.

J. Refund & Cancellation Policy This Policy governs: cancellations; subscription termination; refunds; credits; billing adjustments.

The following table summarises how Sagecom's policies interact.

Policy Primary Purpose Related Documents Master Terms of Service Primary contractual agreement All policies Privacy & Cookies Policy Privacy, cookies, security and Personal Information DPA, AI Terms, Call Recording Policy AI Services Terms AI service usage Privacy Policy, AI Transparency Policy AI Transparency & Responsible Use Policy AI governance AI Services Terms, Privacy Policy Data Processing Addendum Data processing obligations Privacy Policy, Master Terms Communications & Call Recording Policy Recording and communications Privacy Policy, AI Terms Acceptable Use Policy Permitted and prohibited use Master Terms SLA Operational commitments Master Terms Customer Support & Onboarding Policy Service implementation Master Terms Refund & Cancellation Policy Commercial terms Master Terms

Each policy identified in this section is incorporated by reference into the Master Terms of Service and forms part of the contractual relationship between Sagecom and the Customer, unless expressly excluded in a written agreement. By accessing or using Sagecom Services, Customers acknowledge that these policies collectively govern the provision and use of the Services.

If any inconsistency exists between Sagecom documents, the following order of precedence shall apply unless Applicable Law requires otherwise:

processing).

other supporting documentation. Where a conflict concerns only Personal Data processing, the Data Processing Addendum shall prevail to the extent required by Applicable Law. Where a conflict concerns only AI governance or AI-specific operational requirements, the AI Services Terms and AI Transparency & Responsible Use Policy shall govern those matters to the extent of the inconsistency.

Sagecom may amend or update these policies periodically to reflect: changes in applicable laws or regulations; evolving cybersecurity risks; technological advancements; new products or services;

changes in industry standards; operational improvements. Material changes will become eƯective upon publication or as otherwise communicated to Customers, except where Applicable Law or an executed agreement requires advance notice or Customer consent.

Questions regarding the interpretation or application of Sagecom's legal policies should be directed to: Legal & Compliance Department Sagecom Inc. Miami, Florida, USA Legal Enquiries: legal@sagecominc.com Privacy OƯice: privacy@sagecominc.com General Support: support@sagecominc.com General Enquiries: info@sagecominc.com This section should appear immediately after the Definitions and Interpretation section in the Master Terms of Service and be cross-referenced from the Enterprise Privacy & Cookies Policy, AI Services Terms, Data Processing Addendum (DPA), AI Transparency & Responsible Use Policy, Communications & Call Recording Policy, and Service Level Agreement to ensure a consistent, enterprise-wide governance framework.