Kingdom Perspective, LLC, operating My Purpose Plan Effective 19 August 2026 · Published on the Company's website and provided to customers on request; referenced by the Data Processing Agreement, Exhibit C

1. Purpose

This register identifies every third party that receives personal data in connection with the My Purpose Plan application and related services (the "Services"), states what each receives and on what basis, and records the retention and deletion terms under which each holds it.

It exists to answer four questions:

1. Who receives personal data, and what exactly do they receive?
2. On what footing — as the Company's service provider, or as a recipient the customer or the user directed data to?
3. How long does each hold it, and what happens when a user deletes their account?
4. Who is contacted, and within what period, if one of them suffers a security incident?

A recipient's absence from this register is a positive claim, not an omission: Section 9 records what was considered and excluded, and why, so that a reversal is a visible change rather than a silent one.

2. How to read this register

Third parties fall into three classes, and the distinction is legal rather than presentational. A reader who treats all three as "vendors" will reach the wrong conclusion about who is accountable for the data.

Deletion-instruction stage. When a user requests account deletion, deletion runs in two stages: the first at the request, the second at the close of the fourteen-day reversal window. A provider's stage follows one test:

Does acting on the first day destroy something a user who cancels on the twelfth day could not get back?

Where it does, the instruction waits for the second stage, because issuing it immediately would impose exactly the penalty the reversal window exists to prevent. Where it does not — the act touches only a credential the Company holds locally, or the provider holds nothing a returning user would want back — it runs at the first stage. The second stage is the default; the first requires a written basis recording that no recoverable state is destroyed, given in the table below.

3. Subprocessors

Every subprocessor is a United States company, and the Company transmits personal data to no recipient outside the United States. Each processes personal data only on the Company's documented instructions, under contractual data protection terms no less protective than those the Company owes its own customers.

Notes on the table.

• Row 1 covers several distinct services whose retention is configured separately and is therefore stated in Section 4 rather than collapsed into one cell.
• Rows 2 and 3 have no deletion instruction to issue. Neither provider holds a per-user record that an instruction could name. The protections are the retention limit and the commitment against training, both of which are terms rather than actions.
• Row 4 is the worked example for the staging test in Section 2: the same provider takes a reversible action at the first stage and an irreversible one at the second.
• Row 7 is listed separately from row 1 deliberately. Both are the same corporate provider, and the information adds nothing new in kind, since the visitor's network address already reaches that provider through the platform in row 1. What differs is the footing: row 1 is the provider acting as the Company's processor on the Company's instructions, while the mapping platform operates under its own terms as an independent controller. A disclosure covering the first does not reach the second, so combining the rows would misstate the position.
• Rows 5, 6, and 7 create no Company-held store, so none has a row in the Data Retention Schedule. Their counterpart there is the single entry covering deletion instructions to subprocessors, together with this register.

4. Platform retention settings

Row 1 above is the platform on which the Services run, so its retention is largely the Company's own configuration rather than a provider commitment. Stated separately because these periods are asked about individually, and because most are Company-set values governed by the change procedure in the Data Retention Policy.

5. Customer-directed destinations

These are not subprocessors. The receiving account belongs to the business customer, is governed by that customer's own agreement with the provider, and no term of the Company's Data Processing Agreement attaches to data once it arrives there. There is no Company retention term to state, because there is no Company–provider relationship.

Consequences that follow from the customer being the controller of the destination:

• The Company cannot revoke the credential on the customer's behalf, and cannot delete from the customer's workspace. That provider's interface offers no permanent-delete capability; where a person leaves the organization, the Company archives that person's page and assigned task pages, and permanent removal is the customer's own action as controller.
• Disconnecting stops any further transfer. Data already delivered is governed by the customer's agreement with the provider.
• The Company's local copy of the credential is purged at the first stage of a deletion request. Purging it has no effect at the destination and is restored at cancellation by re-supplying the same credential, which is why it takes the first-stage branch of the test in Section 2 rather than the second-stage default. Everything the Company derives from the connection — synchronization queues, job records, and the identifiers linking tasks to workspace pages — is ordinary derived data and is purged at the second stage.

6. User-directed disclosures

These are not subprocessors either, and they are distinct from Section 5: the individual user, not a business customer, chooses the recipient, and transmission is the purpose of the feature rather than a background synchronization.

Notes.

• The Company retains no copy of the attachments. The application form is presented within the application, and its contents pass through Company systems in transit only: attachments are forwarded to the recipient's upload endpoint and are written to no Company store. The destination is restricted to the recipient's own upload locations, so the mechanism cannot be directed elsewhere.
• The Company does record that an application was made — the user identifier, the opportunity's identifier, title, organization name and address, the number of attachments, and the date, and never the application's content. It is retained for 24 months and purged at fourteen days on account deletion, per the Data Retention Schedule. Its only operating purpose is to prevent a duplicate application to the same opportunity.
• The Company separately retrieves volunteer listings from this recipient. That direction of flow carries no personal data.

7. Deletion instructions on account deletion

Consolidated view of what is issued and when.

Subscriptions billed through the Apple App Store or Google Play cannot be cancelled by the Company under any circumstances. The account-deletion confirmation screen directs those subscribers to cancel in their own store account settings.

8. Security incidents involving a subprocessor

Each subprocessor is bound by contractual terms requiring it to notify the Company of a security incident affecting personal data without undue delay, and to provide the information the Company needs to meet its own notification obligations.

The Company maintains a current security contact for each provider in this register as part of its incident-response preparations, reviewed on the cadence in Section 10. A subprocessor's notice is treated as the opening input to the Company's own incident procedure rather than as the end of the matter: the Company assesses the incident against its own obligations, notifies affected business customers without undue delay after becoming aware and within 72 hours of confirmation as its Data Processing Agreement requires, and notifies individuals and regulators as applicable law requires. A provider's own notification period does not extend the Company's.

9. Considered and excluded, with reasons

Recorded so that a future reader need not re-derive why an apparently obvious candidate is absent, and so that a reversal is a visible change rather than a silent one.

10. Change control

A change to this register is a change to the Company's data governance programme, and follows the procedure in the Data Retention Policy, which controls.

1. Adding or replacing a subprocessor requires the approval of the programme owner, entry in this register with every column completed, and propagation to the Privacy Policy, the Data Governance Overview, and the Data Processing Agreement's subprocessor exhibit.
2. Customers receive notice at least 30 days before a new subprocessor begins processing their personal data, during which a customer may object on reasonable data-protection grounds. This register as published is that notice mechanism.
3. Moving a party between Sections 3, 5, and 6 is a change of legal footing rather than a presentational edit, and requires the same approval and propagation as an addition.
4. A change to a deletion stage in Section 7 is a change to the Company's deletion process and requires the written basis described in Section 2 before a provider may move from the second stage to the first.
5. Adding a third-party library to the application is a change to this register, whether or not any Company code calls it. A library that transmits on its own initiative is a recipient of personal data on the same terms as one the Company invokes deliberately.
6. This register is reviewed annually, and on any addition of a third party, any change to what an existing party receives, or any incident implicating one.

11. Ownership

This register is owned by the Privacy Officer, who approves every change under Section 10.

Kingdom Perspective, LLC, doing business as My Purpose Plan privacy@mypurposeplan.com