# Idealx Console Data and Service Cooperation Schedule Version 2.3 | Published 28 September 2026 Read with your completed account and service particulars. Managed services: scope and priority ------------------------------------ Console data and operational cooperation must support MDA permissions consistently across all channels and route client withdrawal, termination, complaint and security actions. Preserve exact document versions and client capacity. No transfer of legal responsibility or unrestricted access follows merely from data integration. This amendment has priority for its stated MDA scope. Unrelated service provisions continue to apply. Overview -------- This schedule forms part of the Console Services Agreement between Idealx Platform Pty Ltd and the identified Firm. It applies to standard Console, Fund Console and approved strategy workflows. It supplements the KYC schedule without itself activating statutory reliance or appointing the Firm as an Idealx representative. 1 Purposes and roles -------------------- Each party may collect, use and disclose information only for the authorised account, professional, onboarding, payment, fee, strategy, fund, support and compliance activities it actually performs, or another lawful disclosed purpose. Each remains responsible for its own obligations. Supplying a technology interface does not make Platform the author of the Firm's advice or responsible for auditing all professional work. The Firm must provide accurate authority and service records, apply the collection notice, obtain consent where required and restrict data to Clients and personnel within its authorised scope. Platform may rely reasonably on those records, subject to known inconsistencies and its own duties. Neither owns an individual, a professional mandate or personal information as unrestricted property. 2 Access and records -------------------- Use approved authenticated channels, named users, role limits and appropriate encryption. No shared login, secret export, sale of Client information or unrelated solicitation is permitted. Staff may access only records required for their work. Report obsolete permissions, errors and suspected compromise promptly; preserve evidence and act on revocations without delay. The Firm must provide ordinary mandate, fee, instruction and onboarding evidence requested for a legitimate service or compliance purpose within one Business Day, and sooner where reasonably necessary for an urgent incident, payment or legal deadline. Explain a genuine impediment immediately and supply available evidence. Business Day excludes weekends and public holidays in Melbourne. No deadline authorises disclosure prohibited by law or waives privilege. Route protected issues to the appropriate compliance contact without exposing prohibited content. The Firm retains professional records and its pre-existing materials. Platform retains its lawful commercial and service records. Each gives the other the limited access needed to perform this agreement, handle complaints, correct errors and meet legal duties. Ordinary secure record exchange and export are included in standard Console access; an unagreed export charge cannot obstruct mandatory access or Client transition. 3 Technical providers and overseas handling ------------------------------------------- Platform may use and replace suitable hosting, identity, communications and AI providers within the accepted service. It must establish appropriate confidentiality, security, purpose limits and records access for its subcontractors and remains responsible for performance for which it is legally or contractually accountable. Firm subcontracting follows its Console and Client authority restrictions. Before new overseas disclosure, the responsible party must assess the lawful basis, necessary protections and required notices. The actual service and overseas-handling record identifies locations and recipients where required and practicable. Neither this schedule nor a general privacy acknowledgement waives Australian privacy protections. No access for TMA LLC-FZ is conferred merely by its ownership of technology. 4 AI and confidential materials ------------------------------- The Firm may use approved Atlas, Agent X or AtlasX functions within recorded access rights. It must review outputs and confirm consequential instructions under the ordinary workflow. AI does not establish identity, authority, suitability or required Client consent. Do not upload unnecessary sensitive information or use an unapproved external AI tool for Client data. Neither party is authorised by this schedule to use identifiable Client records, confidential conversations or proprietary Firm strategies for unrelated general-purpose model training. Such use requires a separately assessed lawful basis and necessary consent and disclosure. Properly de-identified service analytics may be used where lawful and consistent with confidentiality and reasonable protection against re-identification. 5 Incidents complaints and continuity ------------------------------------- Notify the other party without undue delay and, for a material incident affecting shared data, no later than twenty-four hours after awareness. A shorter legal deadline or existing service commitment prevails. Supply available facts first and follow with updates; do not wait for a completed investigation. Coordinate containment, restoration and communications while each party fulfils its own notification duties. No party may prohibit legally required notification or admissions required by law. Each party must assist reasonably with access and correction requests, complaints, transaction disputes and regulator enquiries concerning the shared service. No party is appointed to manage every complaint of the other. Platform ordinarily coordinates the platform channel; responsibility for independent professional advice remains with its provider, subject to applicable licensee obligations. On termination, provide a usable export of authorised records and revoke unnecessary access. Retain only records required by law or another documented lawful need, protect them and delete or de-identify when that basis ends. Records needed for ongoing obligations or a live legal hold must not be destroyed. Confidentiality survives while information remains confidential. 6 Verification and contract priority ------------------------------------ Platform may request relevant assurance or perform a proportionate audit under the Console agreement. Routine assurance ordinarily occurs no more than annually, with additional checks justified by a material incident, evidence gap, regulatory request or risk change. Protect unrelated Firm records and other clients' confidential information. Each party bears its ordinary compliance costs; the Console indemnity governs documented costs caused by a proven breach. The Console agreement governs liability, notices, governing law and termination. This schedule adds no recurring Firm access charge, new Client deduction authority or general guarantee. A material scope expansion requires the applicable approval and Client consent; operational updates cannot rewrite the commercial bargain.