Data Processing Addendum

1.1.  “Aggregate Data” means information that relates to a group or category of individuals, from which individual identities have been removed, and that is not linked or reasonably linkable to any individual or household.

1.2. “Customer Personal Information” means any Personal Information owned by and first provided by or on behalf of Customer to Company and Processed by Company or Company’s Sub-processor, solely on behalf of Customer, pursuant to the express terms of an applicable statement of work or order under the Agreement.

1.3. “Data Protection Assessment” means an assessment of the impact of processing operations on the protection of Personal Information and the rights of Data Subjects, or is otherwise defined as a “Data Protection Assessment,” “Data Protection Impact Assessment,” or “Risk Assessment” by applicable Data Protection Laws.

1.4. “Data Protection Laws” means any and all applicable domestic and international data protection, security, or privacy-related laws, statutes, directives, or regulations, including but not limited to: (a) the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), together with any amending or replacement legislation, including the California Privacy Rights Act of 2020 and any regulations promulgated thereunder; (b) the Virginia Consumer Data Protection Act of 2021, Va. Code Ann. § 59.1-571 to -581; (c) the Colorado Privacy Act of 2021, Co. Rev. Stat. § 6-1-1301 et seq.; (d) Connecticut Public Act No. 22-15, “An Act Concerning Personal Data Privacy and Online Monitoring”; (e) the Utah Consumer Privacy Act of 2022, Utah Code Ann. § 13-61-101 et seq.; and (f) the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); and (g) all other equivalent or similar laws and regulations in the United States and the European Economic Area (EEA) relating to Personal Information and privacy, and as each may be amended, extended or re-enacted from time to time.

1.5. “Data Subject” means an identified or identifiable natural person whose Personal Information is being Processed. The term “Data Subject” shall refer to a “Consumer” as that term is defined under Data Protection Laws.

1.6. “Deidentified Data” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, be linked directly or indirectly with, or be reasonably be used to infer information about an identifiable natural person.

1.7. “Personal Information” means information that is protected by applicable Data Protection Laws or that otherwise identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a particular individual or household.

1.8. “Personnel” means officers, directors, employees, Sub-processors, agents and representatives.

1.9. “Regulatory Authority” means the applicable public authority or government agency responsible for supervising compliance with Data Protection Laws, including, but not limited to the California Privacy Protection Agency; and U.S. state attorneys general.

1.10. “Sub-processor” means any third party appointed by Company to Process Customer Personal Information as a Company or Processor on behalf of Customer in connection with the Agreement.

1.11. The terms “Business,” “Business Purpose,” “Controller,” “Process,” “Processor,” “Security Breach”, “Sell,” “Service Provider,” and “Share” shall have the same meaning as in the Data Protection Laws, and their cognate terms shall be construed accordingly.

2.1. Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Customer Personal Information, Customer is the Controller or Business (as applicable), Company is the Processor or Service Provider (as applicable), and that Company will engage Sub processors pursuant to the requirements set forth in Section 5 below. The parties acknowledge and agree that neither party has reason to believe that the other party is unable to comply with the provisions of this DPA or otherwise that such party is in violation of any Data Protection Law. For clarity, Company is not responsible for compliance with any Data Protection Laws applicable to Customer or Customer’s industry that are not otherwise generally applicable to Company. Customer acknowledges that it bears sole responsibility for ensuring the lawfulness of the collection, transfer, and processing of all Customer Personal Information provided to Company, including any Personal Information sourced from Customer’s online accounts with third parties or Linked Platforms

2.2. Company’s Processing of Customer Personal Information. Company shall treat Customer Personal Information as confidential and shall only Process Customer Personal Information as necessary to perform its obligations on behalf of and in accordance with Customer’s documented instructions for the following permitted purposes: (i) in accordance with the Agreement and applicable order or scope of work and applicable Data Protection Laws (including without limitation, the CCPA); and/or (ii) as applicable, if initiated by Data Subjects in their use of the Services. Company shall not (a) Sell, Share, or otherwise make available Customer Personal Information to any third party in exchange for monetary or other valuable consideration, and (b) retain, use or disclose Customer Personal Information outside of the direct business relationship with the business or for any other purpose than what is specified in Agreement and/or this DPA. When acting as a Service Provider under the CCPA, Company shall not combine Customer Personal Information with Personal Information it receives from, or on behalf of, another person or persons, or processes as a business, except as expressly permitted by Data Protection Laws. Nothing herein shall limit or restrict Company’s right to use Aggregate Data and/or Deidentified Data. The Company shall Process Customer Personal Information only on the documented instructions of the Customer, including with regard to transfers of Personal Information to a third country or an international organization, unless required to do so by a law to which the Company is subject. In such a case, the Company shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Company shall immediately inform the Customer if, in its opinion, an instruction infringes the General Data Protection Regulation (“GDPR”) or other data protection laws. Company shall notify Customer if it makes a determination that it can no longer meet its obligations under applicable Data Protection Laws, including the CCPA.

2.3. Customer’s Processing of Customer Personal Information. Customer shall, in its use of the Services, Process Personal Information in accordance with the requirements of Data Protection Laws. Customer’s instructions to Company related to the Processing of Customer Personal Information shall comply with Data Protection Laws. Customer instructs Company (and authorizes Company to instruct each Sub-processor) to Process Customer Personal Information, and in particular, transfer Customer Personal Information to any jurisdiction, as necessary for the provision of the Services and consistent with the Agreement and this DPA. Customer represents and warrants that it shall (i) not provide Company with (or instruct Company to Process) any Personal Information unless it shall first have given and received the necessary notices and consents under Data Protection Laws; (ii) comply with any other requirements under applicable Data Protection Laws; (iii) have obtained all necessary rights, authorizations, and consents from Data Subjects and any relevant third parties (including Linked Platforms) to permit Company’s Processing of Customer Personal Information as contemplated herein; and (iv) ensure that its provision of Customer Personal Information to Company, including any data sourced from Customer’s online accounts with third parties, does not violate any terms of service, privacy policy, or other agreement between Customer and such third parties. Customer shall indemnify, defend, and hold harmless Company from and against any Losses arising from or related to Customer’s breach of this Section 2.3.

2.4. Details of the Processing. The subject matter of Processing, the duration of the Processing, the nature and purpose of the Processing, the types of Customer Personal Information, and categories of Data Subjects Processed under this DPA are specified in the Agreement.

2.5. Non-Retaliation. Company shall not take any action that would cause Customer to be in violation of its obligations not to discriminate or retaliate against a Data Subject for exercising their rights under the CCPA.

2.6. Government Requests. Company agrees that if it receives a legally binding request from a public authority for the disclosure of Customer Personal Information, it shall: (i) promptly notify Customer of the request, unless otherwise prohibited by law. If prohibited, Company shall use its best efforts to obtain a waiver of the prohibition and shall document such efforts; (ii) review the legality of the request and challenge it if, after careful assessment, it concludes there are reasonable grounds to consider the request is unlawful. Company shall pursue possibilities of appeal; and (iii) provide only the minimum amount of information permissible in response to a request, based on a reasonable interpretation of the request.

3.1.  The parties shall reasonably cooperate in responding to Data Subject rights requests (“Data Subject Request”) and complying with requirements of Data Protection Laws in relation thereto. Such cooperation shall include, upon Customer’s reasonable request and to the extent Company is legally required to do so, assisting Customer by providing access to Customer Personal Information in Company’s possession.

3.2. If a Data Subject Request is made directly to Company, Company will promptly inform Customer and will advise the Data Subject to submit the request to Customer. Customer will be solely responsible for responding substantively to any such Data Subject Requests or other communications involving Personal Information.

3.3. If Company becomes aware that the Customer Personal Information it has received is inaccurate, or has become outdated, it shall inform Customer without undue delay. Company shall cooperate with the Customer to erase or rectify the information.

3.4. Upon Customer’s direction and to the extent that it is commercially reasonable, Company shall delete or enable Customer to delete the relevant Customer Personal Information and shall notify any Sub-processors processing such data to do the same.

3.5. Rights under CCPA. Nothing in this DPA or the Agreement is intended to, nor shall it be interpreted to, waive or limit any rights or remedies of any party or Data Subject under the CCPA. Any provision that purports to do so shall be void and unenforceable.

4.1. Confidentiality. Company shall ensure that its Personnel engaged in the Processing of Customer Personal Information are informed of the confidential nature of the Customer Personal Information and have received appropriate training regarding Processing of Customer Personal Information.

4.2. Reliability. Company shall endeavor, in the exercise of its reasonable business discretion, to ensure the reliability of any Personnel engaged in the Processing of Customer Personal Information.

4.3. Limitation of Access. Company shall ensure that Company’s access to Customer Personal Information is limited to those Personnel performing the Services in accordance with the Agreement.

4.4. Data Protection Officer. To the extent required by applicable Data Protection Laws, each party has appointed a data protection officer.

5.1. Appointment of Sub-processors. With respect to the Processing of Customer Personal Information, Customer hereby authorizes Company to appoint Sub-processors to Process Customer Personal Information for a business purpose on behalf of, and consistent with the business purpose set forth herein.

5.2. Where Company engages a Sub-processor, it shall do so by way of a written contract that imposes on the Sub-processor, in substance, the same data protection obligations as those binding on the Company under this DPA, including the requirements of the SCCs. Company shall remain fully liable to Customer for the performance of the Sub-processor’s obligations.

5.3. Company shall maintain a list of its current Sub-processors for the Services and shall make such list available to Customer upon their written request. Company shall provide Customer with at least thirty (30) days’ prior written notice of the engagement of any new Sub-processor. If Customer has a reasonable basis to object to Company’s use of a new Sub-processor, Customer shall notify Company in writing within fifteen (15) days after receipt of the notice. In the event Customer objects, the parties shall work in good faith to find a mutually agreeable resolution. If the parties cannot agree, Customer may, as its sole and exclusive remedy, terminate the applicable Order Form with respect to those Services which cannot be provided by Company without the use of the objected-to Sub-processor.

6.1. Controls for the Protection of Customer Personal Information. Company shall maintain appropriate physical, technical and organizational measures designed to protect the security confidentiality, and integrity of

Customer Personal Information. In the event of any (i) unauthorized acquisition, alteration, or disclosure of Customer Personal Information that requires notification to an individual, government or regulatory body, or law enforcement authority under Data Protection Laws, or (ii) breach of Data Protection Laws with respect to Customer Personal Information, Company shall notify Customer promptly.

6.2. Data Security Incident Management and Notification. Company shall maintain security incident management policies and procedures, and if Company determines that there has been a Security Breach, Company shall promptly: (i) notify Customer in writing of such Security Breach; (ii) investigate and take steps to remediate the Security Breach, and (iii) provide information regarding the specific Customer Personal Information adversely impacted by the Security Breach as reasonably requested by Customer.

7.1. Audits and Assessments. If required of Company under applicable Data Protection Laws, Company shall reasonably cooperate with Customer at Customer’s expense, in relation to any audit of Company reasonably necessary to enable Customer to comply with its obligations under Data Protection Laws (“Audit”), and shall seek the equivalent cooperation from relevant Sub-processors. Any Audit shall be: (i) subject to a mutually agreed upon scope; (ii) conducted by an independent third party who has signed a nondisclosure agreement with Company or the Sub-processor, as the case may be; and (iii) subject to the confidentiality obligations set forth in the Agreement. Customer shall use reasonable endeavors to minimize any disruption caused to the Company’s (or Sub-processor’s, as the case may be) business activities as a result of an Audit. Audits shall take place no more than once in any calendar year except as otherwise required of Company under applicable Data Protection Laws. In addition, if required of Company under applicable Data Protection Laws, Company shall allow Customer to take reasonable and appropriate steps to (a) ensure that Company’s use of Customer Personal Information is consistent with Customer’s obligations under applicable Data Protection Laws, and (b) stop and remediate unauthorized use of Customer Personal Information. Any information disclosed in connection with an Audit shall be the Confidential Information of Company (and/or Sub-processor, as the case may be).

7.2. Data Protection Assessments. Upon Customer’s request and to the extent required of Company under applicable Data Protection Laws, Company shall provide Customer, at Customer’s reasonable expense with the reasonably necessary information needed for Customer to carry out a Data Protection Assessment related to Customer’s use of the Services, to the extent that Customer does not otherwise have access to the relevant information and that such information is reasonably available to Company.

8.1. Company shall on written request return all Customer Personal Information to Customer or delete the same from its systems, except as otherwise permitted by applicable Data Protection Laws. Notwithstanding the foregoing, Company shall be entitled to retain: (a) Aggregate Data and Deidentified Data derived from Customer Personal Information; (b) any data incorporated into trained machine learning models, AI algorithms, or statistical models; and (c) copies of Customer Personal Information to the extent required by applicable law or for the establishment, exercise, or defense of legal claims.

8.2. In the event of termination or expiration of the Agreement, the Company shall, at the choice of the Customer, either: (a) return to the Customer all Customer Personal Information Processed on its behalf and delete all existing copies thereof within thirty (30) days; or (b) delete all Customer Personal Information Processed on behalf of the Customer, within thirty (30) days. Upon completing this action, the Company shall certify to the Customer in writing that it has done so. In the event that any applicable law to which the Company is subject prohibits the return or deletion of the Customer Personal Information, the Company warrants that it will: (a) continue to ensure compliance with the data protection measures contained in this DPA for as long as it retains such Customer Personal Information; and (b) Process such Customer Personal Information only to the extent and for the duration strictly required under that applicable law.

9.1. The parties acknowledge that the provision of the Services under the Agreement may require the transfer of Customer Personal Information from the other countries, where the GDPR is the applicable data protection law, to the Company in the United States. To ensure that such transfers are made in compliance with applicable Data Protection Laws, the parties agree that the Standard Contractual Clauses (“SCCs”) shall apply as set forth herein.

9.2. For the purposes of the SCCs, Customer and its authorized affiliates shall be the “data exporter” and Company shall be the “data importer”.

9.3. Applicable SCC Modules. Where Customer acts as a Controller and Company acts as a Processor, Module Two (Controller to Processor) shall apply. (b) Where Customer acts as a Processor acting on behalf of a third-party Controller and Company acts as a Sub-processor, Module Three (Processor to Processor) shall apply.

9.4. The optional Clause 7 of the SCCs shall be deemed to be included

9.5. The information required in the Annexes to the SCCs shall be deemed completed as follows: (i) Annex I: The identity of the parties, their roles, and the description of the data transfer shall be as set forth in the Agreement and the applicable Order Form(s). (ii) Annex II: The technical and organizational security measures shall be as described in Section 6 of this DPA and any security exhibits attached to the Agreement. (iii) Annex III: The list of sub-processors shall be maintained and made available to Customer in accordance with Section 5 of this DPA.

10.1. The parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the Customer Personal Information by the Company, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the Company from fulfilling its obligations under the SCCs. In providing this warranty, the parties declare that they have taken due account of the specific circumstances of the transfer, the laws and practices of the third country of destination, and any relevant contractual, technical, or organisational safeguards put in place. The parties agree to document this assessment and make it available to the competent supervisory authority on request.

The parties to this DPA hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this DPA, including disputes regarding its existence, validity or termination or the consequences of its nullity; and this DPA is governed by the laws of the country or territory stipulated for this purpose in the Agreement.

COMPANY’S LOSSES OR LIABILITY UNDER THIS DPA, INCLUDING WITH RESPECT TO LIABILITY RELATING TO A SECURITY BREACH, BREACH OF THIS DPA, OR ALLEGED OR ACTUAL VIOLATION OF DATA PROTECTION LAWS, SHALL BE LIMITED TO THE AMOUNT PAID BY CUSTOMER TO COMPANY UNDER THE AGREEMENT IN THE 12 MONTHS PRIOR TO THE CLAIM GIVING RISE TO SUCH LOSSES. NOTWITHSTANDING ANYTHING TO THE CONTRARY, COMPANY SHALL HAVE NO LIABILITY UNDER THIS DPA FOR ANY CLAIMS, LOSSES, OR DAMAGES ARISING FROM OR RELATED TO: (A) CUSTOMER’S FAILURE TO COMPLY WITH ITS OBLIGATIONS UNDER THIS DPA OR APPLICABLE DATA PROTECTION LAWS; (B) CUSTOMER’S INSTRUCTIONS THAT INFRINGE DATA PROTECTION LAWS; (C) THE ACCURACY, LEGALITY, OR QUALITY OF CUSTOMER PERSONAL INFORMATION PROVIDED BY CUSTOMER; OR (D) ANY DATA SOURCED FROM CUSTOMER’S ONLINE ACCOUNTS WITH THIRD PARTIES OR LINKED PLATFORMS WHERE CUSTOMER FAILED TO OBTAIN REQUIRED CONSENTS OR AUTHORIZATIONS.

In the event of any change to or adoption of new Data Protection Law(s), the parties shall mutually agree upon any reasonably necessary amendments or revisions to this DPA.