Data Processing Addendum

Related documents: Terms of Service (Self-Serve) · Terms of Service (Enterprise / MSA) · Order Form Template · Privacy Policy · DSAR Procedure · Acceptable Use Policy · Sub-Processors List · Security Practices · Law Enforcement Guidelines · CCPA Notice at Collection · CSAM / NCMEC Reporting & Apparent-Minor Content Policy · Creator Likeness Release & Biometric Consent · Biometric Retention & Destruction Schedule · §2257 / §2257A Compliance Statement · Customer AI-Disclosure Attestation · Customer Automation Acknowledgment

1. Definitions

In this DPA, the following capitalized terms have the meanings set out below. Terms used but not defined carry the meaning given in the ToS, the Order Form, or the Privacy Policy (in that order of precedence for purposes of this DPA).

1.1 "Affiliate" means, with respect to a Party, any entity that directly or indirectly controls, is controlled by, or is under common control with that Party, where "control" means direct or indirect ownership of more than fifty percent (50%) of the voting equity or other ownership interests.

1.2 "Agency" has the meaning given in the ToS and is the Customer under this DPA for purposes of the processor-role processing described in §3.

1.3 "Agency Staff Data" means personal data of an Agency's Authorized Users, including login identifiers, authentication metadata, access-control events, audit-trail and activity logs within the Services, configuration-change logs, moderation-decision logs, automation-execution logs, IP addresses, session metadata, and device data generated by Authorized Users' use of the Services. Agency Staff Data is the principal category of Customer Personal Data Company processes as processor under this DPA (see §3). For the avoidance of doubt, Agency Staff Data does not include Creator Biometric Identifiers, Creator Stylistic Data, per-Creator fine-tuned Models, Outputs, Creator KYC records, Agency-entity data, Target-Platform Credentials, or Fan Incidental Data, each of which Company processes as controller under the Privacy Policy and the ToS (see §2 and Annex I).

1.4 "Applicable Data Protection Law" means all data-protection, privacy, and cybersecurity laws and regulations of general applicability to either Party's processing of Customer Personal Data, including without limitation: (a) EEA — Regulation (EU) 2016/679 ("EU GDPR"), Directive 2002/58/EC ("ePrivacy Directive") as implemented in each EU/EEA member state, and national implementing and supplementary laws; (b) United Kingdom — the UK General Data Protection Regulation as defined in section 3(10) of the Data Protection Act 2018 ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"); (c) Switzerland — the Federal Act on Data Protection of 25 September 2020 ("FADP"); (d) United States — the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (together, "CCPA/CPRA") and related regulations; the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, Florida Digital Bill of Rights, Montana Consumer Data Privacy Act, Iowa Consumer Data Protection Act, Delaware Personal Data Privacy Act, New Hampshire, New Jersey, Minnesota, Tennessee, Indiana, Maryland, and other enacted state comprehensive-privacy laws; the Illinois Biometric Information Privacy Act (740 ILCS 14/, "BIPA"); the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code §503.001, "CUBI"); the Washington Biometric Privacy Act (RCW 19.375, "Washington BPA"); the Washington My Health My Data Act (RCW 19.373, "MHMDA"); the Children's Online Privacy Protection Act (15 U.S.C. §§6501–6506, "COPPA"); 28 CFR Part 202; (e) Canada — Personal Information Protection and Electronic Documents Act ("PIPEDA") and Quebec Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law 25 ("Quebec Law 25"); (f) Brazil — Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018, "LGPD"); (g) Japan — Act on the Protection of Personal Information ("APPI"); (h) Australia — Privacy Act 1988 (Cth); (i) Singapore — Personal Data Protection Act 2012; (j) South Korea — Personal Information Protection Act; and (k) any other applicable law governing the processing of Customer Personal Data to which either Party is subject in connection with the Services.

1.5 "Authorized User" has the meaning given in the ToS.

1.6 "Biometric Data" has the meaning given in EU GDPR Art. 4(14) and UK GDPR Art. 4(14); "biometric identifier" has the meaning given in BIPA §10, CUBI §503.001(a), Washington BPA RCW 19.375.010, and CCPA §1798.140(c); and "biometric information" has the meaning given in BIPA §10 and the corresponding CCPA/CPRA provisions. Creator Biometric Identifiers within Customer Content processed by the Services are processed by Company as controller under the Privacy Policy and the Creator Likeness Release, not as processor under this DPA. References to Biometric Data in this DPA that relate to Agency Staff Data (for example, a fingerprint used by Agency's SSO provider for MFA) are processed as processor under this DPA only to the extent they enter Company's Services; Company does not independently enroll or retain Authorized-User biometric identifiers.

1.7 "Company" means Partyhat Technologies Inc., a Delaware C-Corporation, acting as Data Importer and, for Agency Staff Data and other data enumerated in §3 of this DPA, as Processor.

1.8 "Controller" has the meaning given in EU GDPR Art. 4(7) and UK GDPR Art. 4(7) (or the equivalent role under other Applicable Data Protection Law, including "business" under CCPA/CPRA, "controller" under U.S. state comprehensive-privacy laws, "controlador" under LGPD, and "personal information controller" / "handler" under APPI).

1.9 "Creator" has the meaning given in the ToS. Creators are data subjects in respect of Creator Biometric Identifiers, Creator Stylistic Data, and Outputs depicting them; those data categories are processed by Company as controller (see §2.2 and the Privacy Policy).

1.10 "Customer" means the Agency or other counterparty that is Party to the Agreement, and is the Controller in respect of Customer Personal Data where Company processes that data as Processor under this DPA.

1.11 "Customer Content" means data, including personal data, that (a) Customer or its Authorized Users upload or transmit to the Services from Customer's own systems, (b) the Services generate on Customer's behalf from Customer-supplied inputs, (c) the Services collect from Target Platforms using Customer-supplied Target-Platform Credentials and deliver into Customer's workspace, or (d) the Services store on Customer's behalf (including configuration, automation rules, moderation rules, and operational artifacts). Customer Content excludes Creator Biometric Identifiers, Creator Stylistic Data, per-Creator fine-tuned Models, Creator KYC records, and Outputs to the extent those categories are processed by Company as controller under the Privacy Policy.

1.12 "Customer Personal Data" means personal data within Agency Staff Data and any other personal data within Customer Content that Customer directs Company to process on Customer's behalf as Processor under this DPA. For clarity, Customer Personal Data does not include data Company processes as controller under §2.2, the Privacy Policy, or the Creator Likeness Release.

1.13 "Data Exporter" and "Data Importer" have the meanings given in the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum.

1.14 "EU SCCs" means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as they may be amended, replaced, or superseded.

1.15 "Fan" has the meaning given in the ToS. Company's position regarding Fan Incidental Data is set out in §2.4 and the Privacy Policy §2.4.

1.16 "Fan Incidental Data" means personal data of Fans contained in messages, posts, comments, or other inbound content received on Creator Target-Platform accounts that Company operates using Target-Platform Credentials Agency has provided. Fan Incidental Data is addressed in §2.4.

1.17 "Personal Data" means any information relating to an identified or identifiable natural person, as that term (or any analogous term, including "personal information" under CCPA/CPRA, "personally identifiable information," and "personal data" under LGPD and GDPR) is defined under Applicable Data Protection Law.

1.18 "Personal Data Breach" has the meaning given in EU GDPR Art. 4(12) and UK GDPR Art. 4(12): a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed. "Security Incident" is used interchangeably with "Personal Data Breach" in this DPA.

1.19 "Processor" has the meaning given in EU GDPR Art. 4(8) and UK GDPR Art. 4(8) (or the equivalent role under other Applicable Data Protection Law, including "service provider" or "contractor" under CCPA/CPRA, "processor" under U.S. state comprehensive-privacy laws, "operador" under LGPD, and "entrusted party" under APPI).

1.20 "Restricted Transfer" means a transfer of Personal Data (a) from the EEA, the UK, or Switzerland to a third country that has not been the subject of an adequacy decision by the European Commission (or the UK Information Commissioner or the Swiss Federal Council, respectively); or (b) any other transfer between jurisdictions for which a transfer mechanism is required by Applicable Data Protection Law.

1.21 "Sensitive Data" means (a) social security number, tax identification number, passport number, driver's license number, or other government-issued identifier; (b) credit or debit card number (other than a last-four-digits-only reference), financial account number, or account password; (c) genetic, biometric, or health information; (d) racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or data concerning sex life or sexual orientation; (e) criminal convictions or offenses; (f) precise geolocation data; (g) any data concerning children under 16; or (h) any other category of data designated as "sensitive personal data," "sensitive personal information," "special categories of data," or equivalent under Applicable Data Protection Law. The Services process extensive Sensitive Data of Creators under a controller role, and the Privacy Policy §10 governs that processing. Sensitive Data within Agency Staff Data is not ordinarily required for the Services; Customer agrees not to route Sensitive Data into the Services as part of Agency Staff Data unless necessary for a documented processing purpose.

1.22 "Sub-processor" means any third party (including any Affiliate of Company) engaged by Company to process Customer Personal Data on Company's behalf in connection with the Services. Consistent with industry practice, telecommunications carriers, last-mile delivery providers, and Target Platforms themselves are not Sub-processors of Company: Target Platforms are independent controllers of data within their own services (including any Fan data they handle), and carriers used for transmission are independent data handlers under telecommunications law. See Annex III.

1.23 "Target Platform" has the meaning given in the ToS.

1.24 "Target-Platform Credentials" has the meaning given in the ToS.

1.25 "Third-Party Request" means a request, demand, subpoena, warrant, court order, administrative demand, or other legal process received by Company from a third party (including a regulator, court, law-enforcement agency, or private litigant) for the disclosure of Customer Personal Data.

1.26 "UK IDTA" means the International Data Transfer Agreement (version B1.0, in force 21 March 2022), together with the UK Addendum to the EU Commission Standard Contractual Clauses (version B1.0), as issued by the UK Information Commissioner, as each may be amended, replaced, or superseded.

2. Roles and Relationship of the Parties

2.1 Processor-role processing by Company (this DPA's principal scope). For Agency Staff Data and any other Customer Personal Data Customer directs Company to process on Customer's behalf, Company acts as Processor and Customer acts as Controller (or, where Customer itself is a processor acting on behalf of another controller, Company acts as Sub-processor and Customer as Processor, and references to "Controller" in this DPA are read accordingly for such data). This DPA is the "written contract" required by EU GDPR Art. 28(3), UK GDPR Art. 28(3), and comparable provisions in other Applicable Data Protection Law.

2.2 Controller-role processing by Company (outside this DPA's processor scope). The following categories of personal data are processed by Company as controller, as explained in the Privacy Policy §2 ("Controller / Processor Map"). This DPA does not convert Company's role for these categories, and the obligations Company owes in respect of them are set out in the Privacy Policy, the Creator Likeness Release & Biometric Consent, the Biometric Retention & Destruction Schedule, the §2257 / §2257A Compliance Statement, and Applicable Data Protection Law:

• Creator Biometric Identifiers (face imagery, voice samples, body imagery, and biometric templates derived from them);
• Creator Stylistic Data (captions, post history, direct-message histories, tone-of-voice examples, writing samples);
• Per-Creator fine-tuned Model artifacts (weights, adapters, LoRAs, embeddings, checkpoints);
• Creator KYC records and §2257 / §2257A records;
• Generated Outputs;
• Creator contact data, onboarding data, and signed releases;
• Agency administrator and account data (separate from Agency Staff Data);
• Security and fraud-prevention data for Services-wide protection;
• Website-visitor and prospective-customer data; and
• Any other data expressly identified as controller-role in the Privacy Policy §2.

Creator data (likeness, outputs, chat logs, model derivatives) is processed by Company as controller because Company determines the purposes and means (including training, product improvement, and cross-customer analytics) under Creator consent captured in the Creator Likeness Release; Agency Staff Data is processed by Company as processor because Agency determines the purposes and means of Authorized Users' administrative and operational use of the Services.

2.3 No joint controllership. The Parties affirmatively disclaim any joint-controllership relationship under EU GDPR Art. 26 / UK GDPR Art. 26 or any analogous provision, except to the extent a court or supervisory authority of competent jurisdiction determines otherwise notwithstanding the Parties' contrary intent. Each Party is independently responsible for its own processing under its own role.

2.4 Fan Incidental Data — interim characterization. When a Fan sends a direct message, comment, reaction, or other inbound content to a Creator Target-Platform account that Company operates on Customer's instructions, the content reaches Company only incidentally as part of the Creator account's ordinary inbox. For purposes of this DPA the Parties treat such Fan Incidental Data as follows:

• (a) The Target Platform is the independent controller of the underlying Fan relationship and of the Fan's account on that Target Platform;
• (b) Customer (or the Creator for whom Customer operates the account) is the controller of the Creator account's interaction record on the Target Platform, to the extent the Target Platform's own terms permit that account's controller to act on such data; and
• (c) Company's role as to Fan Incidental Data reaching the operated account is Processor acting on Customer's documented instructions for purposes of operating the account, subject to the constraint that Fans must separately exercise data-subject rights against the Target Platform (the controller closest to the Fan).

The characterization above is interim. The formal role allocation remains under review. If that resolution differs, this §2.4 will be updated accordingly.

2.5 Customer's controller-side obligations. As Controller, Customer represents and warrants that:

• (a) Customer's provision of Customer Personal Data to Company, and Customer's instructions to Company, comply with Applicable Data Protection Law and with all applicable transparency, notice, consent, data-subject-rights, and data-minimization obligations;
• (b) Customer has a lawful basis for each purpose of processing instructed;
• (c) Customer has, where required, obtained informed consent from each data subject and has provided the data subject with all required notices;
• (d) Customer has assessed the adequacy of the Services' security measures (set out in Annex II and in the Security Practices) for Customer's processing;
• (e) Customer will not instruct Company to process Customer Personal Data in a manner that would cause Company to violate Applicable Data Protection Law; and
• (f) Customer is responsible for determining which laws or regulations apply to Customer's business and whether Company's provision of the Services satisfies those laws or regulations.

2.6 Company's processor-side core undertaking. Company will process Customer Personal Data only (a) on Customer's documented instructions, including as described in this DPA, the Order Form, the ToS, and Customer's reasonable use of the Services' configuration surfaces; (b) as required by Applicable Data Protection Law to which Company is subject, in which case Company will inform Customer of that legal requirement before processing, unless the law prohibits such disclosure on important grounds of public interest; and (c) as otherwise permitted under §3 of this DPA (processor purposes) or §2.2 of this DPA (controller purposes, which are not processor-role processing but are described here for completeness of the data flow).

2.7 Agency's authority to bind Authorized Users. Customer warrants that it has secured, or will secure prior to providing the applicable Authorized User's data to Company, all notices, consents, and lawful bases necessary under Applicable Data Protection Law for Company to process Agency Staff Data as Processor in accordance with this DPA. Where an Authorized User is located in the EEA, UK, or Switzerland, Customer represents that the transfer of that Authorized User's data to Company in the United States is made under a transfer mechanism recognized under Applicable Data Protection Law (see §12).

3. Description of Processing (Processor Role)

3.1 Subject matter. Company processes Customer Personal Data as Processor for the purpose of providing the Services to Customer, in accordance with the ToS, this DPA, and the Order Form. Annex I contains the subject-matter, nature-and-purpose, categories-of-data, categories-of-data-subjects, duration, and frequency of processing required by EU SCCs Annex I.B and by EU GDPR Art. 28(3).

3.2 Nature and purpose — processor role. As Processor, Company processes Customer Personal Data (in particular, Agency Staff Data) to:

• (a) authenticate and authorize Authorized Users' access to the Services;
• (b) provide administrative and operational features (workspace management, role assignment, configuration, audit-trail generation, Authorized-User provisioning and deprovisioning);
• (c) generate logs required for security, anti-abuse, audit, compliance, and service-health monitoring;
• (d) detect and prevent unauthorized access, credential compromise, and abuse of the Services' administrative surfaces;
• (e) provide customer support, triage tickets, and deliver operational notifications;
• (f) perform service-level reporting and billing-related metering for Customer;
• (g) facilitate Authorized Users' exercise of data-subject rights routed through Customer; and
• (h) export and port Customer Personal Data at Customer's written request.

3.3 Categories of data subjects (processor role). Authorized Users of Customer, including individuals located in the United States, the EEA, the UK, Switzerland, Canada, Brazil, Japan, Australia, and elsewhere in the world (Customer staff may log in from anywhere).

3.4 Categories of Customer Personal Data (processor role). Identifiers (name, email, job title, Authorized-User ID, internal user ID); authentication metadata (hashed passwords, MFA tokens, SSO assertions, session cookies); access and audit logs; IP addresses, user-agent strings, device identifiers, approximate geolocation derived from IP; configuration-change logs; automation-execution logs; moderation-decision logs; support-ticket content provided by the Authorized User (excluding any Customer-originated Creator data or Sensitive Data the Customer elects to include, for which Customer is responsible under §2.5).

3.5 Sensitive Data — processor role (not intended). The processor-role scope is not designed to process Sensitive Data as defined in §1.21. If a category of Sensitive Data is reasonably necessary for an Authorized User's administration of the Services (for example, an accessibility accommodation), the Parties will address the data via a written supplemental instruction.

3.6 Duration. Processing continues for the term of the Agreement and through the post-termination retention windows set out in §10.

3.7 Frequency. Continuous during the term.

3.8 What this DPA does not govern. As noted in §2.2, processing of Creator Biometric Identifiers, Creator Stylistic Data, per-Creator fine-tuned Models, Creator KYC and §2257 records, Outputs, and the other controller-role categories listed in §2.2 is outside the scope of this DPA. That processing is governed by the Privacy Policy, the Creator Likeness Release & Biometric Consent, the Biometric Retention & Destruction Schedule, the §2257 / §2257A Compliance Statement, and Applicable Data Protection Law. Annex I scopes only the processor-role data.

4. Processor Obligations (EU GDPR Art. 28 / UK GDPR Art. 28 / CCPA Service-Provider Obligations)

4.1 Process on documented instructions. Company will process Customer Personal Data only on Customer's documented instructions, including in respect of transfers of Customer Personal Data to a third country or an international organization, unless required to do so by Applicable Data Protection Law to which Company is subject; in such a case, Company will inform Customer of that legal requirement before processing, unless the law prohibits such disclosure on important grounds of public interest. Customer's documented instructions are: (a) this DPA (including its annexes and exhibits); (b) the ToS and the Order Form; (c) the Customer configuration selections made in the Services' administration surfaces; and (d) any further written instructions Customer provides in accordance with §4.5.

4.2 No further processing for Company's own purposes (processor-role data only). For Customer Personal Data processed under §3, Company will not "sell," "share" (for cross-context behavioral advertising), or otherwise process that data outside the direct business relationship with Customer or outside the purposes set out in §3, except as required by Applicable Data Protection Law. Company does not combine Customer Personal Data processed under §3 with personal information Company receives from or on behalf of another person, or collects from its own interaction with a consumer, except where combination is required for a business purpose permitted under CCPA/CPRA regulations or other Applicable Data Protection Law.

4.3 Confidentiality. Company will ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.4 Security of processing. Company will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Annex II and in the Security Practices.

4.5 Additional instructions. Customer may issue additional reasonable written instructions to Company consistent with this DPA and Applicable Data Protection Law. Where an additional instruction materially changes the nature or scope of Company's processing obligations or causes Company to incur material additional cost, the Parties will cooperate in good faith to agree on scope and any additional fees. Company may object to an instruction that Company reasonably believes would violate Applicable Data Protection Law, in which case Company will promptly inform Customer.

4.6 Compliance with own obligations. Each Party will comply with its own obligations under Applicable Data Protection Law in respect of the data flows governed by this DPA.

4.7 Data minimization. Company will process the minimum Customer Personal Data necessary to provide the Services and to meet Company's obligations under this DPA, and will apply measures to anonymize, de-identify, pseudonymize, or aggregate Customer Personal Data where reasonably necessary and consistent with the Services' functionality.

4.8 Anonymized / de-identified data. Any Customer Personal Data that has been anonymized, de-identified, or aggregated by Company in accordance with Applicable Data Protection Law ("Anonymized Data") is not subject to this DPA; provided, however, Company will not re-identify, and will not attempt to re-identify, any Anonymized Data except for the limited purpose of testing the effectiveness of Company's own de-identification pipeline.

4.9 Records of processing. Company maintains records of processing activities carried out on behalf of Customer in accordance with EU GDPR Art. 30(2) / UK GDPR Art. 30(2) and will make relevant portions of those records available to Customer on written request to the extent reasonably necessary to demonstrate compliance.

4.10 Data Protection Officer / Representative. Company's primary privacy contact is privacy@partyhat.ai. Because the Services are not offered to residents of, or data subjects located in, the Excluded Jurisdictions (including the EEA and the UK — see Privacy Policy §1.8 and ToS §2), no EU Article 27 representative or UK Article 27 representative is engaged. A DPO has not been appointed on a mandatory basis under GDPR Art. 37; privacy@partyhat.ai functions as the DPO-equivalent contact for enterprise-customer diligence purposes.

5. Data Subject Rights — Processor Assistance

5.1 Self-service features. Company provides, through the Services, features that allow Customer to (as Controller of Agency Staff Data) access, export, correct, delete, and restrict processing of Customer Personal Data relating to its Authorized Users. These features are Company's first-line assistance mechanism for data-subject-rights requests routed through Customer.

5.2 Supplemental assistance. To the extent Customer cannot, using the Services' self-service features, meet its obligations under Applicable Data Protection Law with respect to a data-subject request, Company will, upon Customer's written request, provide reasonable and timely additional assistance, at no additional cost, including assistance to respond to requests for access, rectification, erasure, restriction, portability, or objection, and to address opt-outs of sale / sharing / targeted advertising / profiling.

5.3 Direct data-subject requests to Company. If Company receives a data-subject request directly from an individual whose Customer Personal Data Company processes as Processor under this DPA, Company will (a) promptly forward the request to Customer; (b) not respond substantively to the request except to confirm receipt and direct the individual to Customer or to confirm that the request has been forwarded, as required or permitted by Applicable Data Protection Law; and (c) assist Customer in responding in accordance with §5.2.

5.4 Controller-role requests (for completeness). Where a data subject exercises rights in respect of data that Company processes as controller (§2.2), Company responds directly under the DSAR Procedure and the Privacy Policy §9 (Rights matrix). Nothing in §5.1–5.3 derogates from that direct obligation.

5.5 Timelines. Company will provide the assistance described in §5.1–5.3 within a period reasonable in the circumstances and compatible with Customer's statutory response window under Applicable Data Protection Law.

5.6 Verification. Company is entitled to require Customer (or the data subject, where the request is received directly) to verify identity in proportion to the sensitivity of the data and the risk of fraudulent impersonation, consistent with the DSAR Procedure.

6. Data Protection Impact Assessments, Prior Consultation, and Cooperation

6.1 DPIA assistance. Taking into account the nature of the processing and the information available to Company, Company will provide Customer with reasonable cooperation and assistance to enable Customer to perform a Data Protection Impact Assessment ("DPIA") under EU GDPR Art. 35 / UK GDPR Art. 35 and equivalent provisions of other Applicable Data Protection Law (including LGPD Art. 38), and prior-consultation procedures under EU GDPR Art. 36 / UK GDPR Art. 36, where applicable.

6.2 Transfer Impact Assessment. Where Customer is required to perform a Transfer Impact Assessment in connection with Company's processing, Company will provide relevant information within Company's knowledge regarding the transfer's legal and practical framework. See also §12.

6.3 Regulator cooperation. Company will, at Customer's reasonable written request and to the extent consistent with Applicable Data Protection Law, cooperate with Customer's compliance interactions with supervisory authorities, including Company's own direct obligations of cooperation under EU GDPR Art. 31 / UK GDPR Art. 31.

6.4 Reasonable-cost allocation. DPIA, prior-consultation, and regulator-cooperation assistance is provided at no additional cost within a reasonable scope; Company may charge reasonable fees for assistance that materially exceeds the ordinary scope (for example, where Customer requests extensive bespoke reports or legal-process responses). Fees will be agreed in writing before work is undertaken.

7. Sub-Processors

7.1 General authorization. Customer gives Company a general authorization under EU GDPR Art. 28(2) / UK GDPR Art. 28(2) to engage Sub-processors to process Customer Personal Data, subject to the notice and objection rights in §7.3–§7.4 and to the flow-down obligations in §7.5.

7.2 Current Sub-processor list. Company's current Sub-processors are listed in Annex III and are also published in the Sub-Processors List at core/sub-processors.md. Customer may subscribe to a notification list for Sub-processor updates; the subscription mechanism is published alongside the Sub-Processors List.

7.3 Notice of change. Company will provide Customer with at least thirty (30) days' prior written notice of (a) any new Sub-processor, or (b) any change to an existing Sub-processor that (i) results in the processing of Customer Personal Data in a new third country (including the introduction of a new cross-border-transfer leg), (ii) is an infrastructure / hosting Sub-processor, (iii) is a Sub-processor that will process Sensitive Data within Customer Personal Data, or (iv) is a Sub-processor engaged for model-inference functions that will receive Customer Personal Data. For all other changes in Sub-processors (including changes in an existing Sub-processor's Affiliates used to deliver the Sub-processor's services), Company will provide at least ten (10) days' prior written notice. Notice is given via email to Customer's Security Contact (or equivalent designated recipient) and via the Sub-Processor notification channel.

7.4 Objection right. During the applicable notice period in §7.3, Customer may object in writing on reasonable grounds relating to data protection. The Parties will discuss the objection in good faith. If the Parties cannot agree a mutually acceptable resolution within the notice period (or a mutually agreed extension), Customer's sole remedy is to discontinue use of the affected Service component by written notice to Company, without prejudice to Customer's obligation to pay Fees accrued before the discontinuation.

7.5 Flow-down. Company will ensure that each Sub-processor is bound by a written agreement that (a) imposes data-protection and security obligations substantially equivalent to, and no less protective than, those applicable to Company under this DPA; (b) includes, where applicable, the California Specific Terms (Exhibit C); (c) includes a lawful transfer mechanism where the Sub-processor processes Customer Personal Data in a third country (see §12); and (d) names Company (or Company's controlling Affiliate) as third-party beneficiary of the data-protection and confidentiality provisions to the extent required by Applicable Data Protection Law.

7.6 Liability for Sub-processors. Company will remain fully liable to Customer for any act or omission of a Sub-processor that causes Company to breach its obligations under this DPA, as if such act or omission had been Company's own.

7.7 Model-vendor routing rule. Company's practice, as described in the Privacy Policy §§6 and 12, is that it does not route Creator Biometric Identifiers, sexually explicit prompts, or sexually explicit Outputs through third-party model-vendor Sub-processors whose Acceptable Use Policies prohibit such content. The explicit-generation path uses in-house or open-weight self-hosted Models. This allocation is reflected in Annex III. Nothing in this §7.7 creates a direct Customer-Sub-processor relationship.

7.8 Telecommunications, delivery, and Target-Platform providers not Sub-processors. Consistent with §1.22, the following are not Sub-processors of Company: (a) telecommunications carriers used by Company's email, SMS, or voice Sub-processors for transmission to end-recipients; (b) last-mile delivery providers for transactional email; and (c) Target Platforms themselves, which are independent controllers of their own services.

8. Security of Processing

8.1 Technical and organizational measures. Company implements and maintains appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk presented by processing Customer Personal Data, including where appropriate the pseudonymization and encryption of personal data; the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing, and evaluating the effectiveness of those measures. The measures are described at a summary level in Annex II; the full description is in the Security Practices.

8.2 Key commitments (summary). Without limiting §8.1 or Annex II, Company commits to:

• (a) Encryption at rest using AES-256 or stronger, with keys managed in a hardware-security-module-backed key-management system;
• (b) Encryption in transit using TLS 1.2 or higher (TLS 1.3 where supported);
• (c) Separate encryption keys and access segmentation for Creator Biometric Identifiers and per-Creator fine-tuned Models (this commitment is primarily relevant to Company's controller-role processing under §2.2 but is summarized here because Customers routinely ask about biometric segmentation; the Privacy Policy §13 and the Biometric Retention & Destruction Schedule govern the substantive obligation);
• (d) Role-based access controls, multi-factor authentication for privileged access, least-privilege provisioning, and periodic access reviews;
• (e) Segregation of production, staging, and test environments, with non-production environments prohibited from processing Creator Biometric Identifiers;
• (f) Annual third-party penetration testing of the Services and key infrastructure;
• (g) Vulnerability management and patching;
• (h) Personnel background checks (where permitted), annual security-awareness training, and confidentiality obligations; and
• (i) A documented incident-response plan aligned to recognized industry frameworks.

Company does not hold a SOC 2 or ISO third-party attestation at launch; see the Trust Center for the current compliance-posture disclosure.

8.3 Customer responsibility. Customer is responsible for the secure use of the Services on Customer's side, including the security of Customer-controlled credentials, the administration of Authorized-User access, the secure handling of any exports of Customer Personal Data, and the independent determination of whether the measures in §8.2 and Annex II are adequate for Customer's processing.

9. Personal Data Breach Notification

9.1 Notification to Customer. Company will notify Customer of any Personal Data Breach involving Customer Personal Data Company processes as Processor or Sub-processor without undue delay after Company's confirmation of the Personal Data Breach, targeting forty-eight (48) hours (the "Breach-Notification Target"). The Breach-Notification Target is designed to afford Customer sufficient margin to meet Customer's own controller-side regulator-notification obligations under Applicable Data Protection Law (e.g., the 72-hour timeline under EU GDPR Art. 33 where applicable). Company will not delay notification to await confirmation of every fact; notification may be in installments as information becomes available.

9.2 Content of notification. To the extent information is available at the time of notification, Company will include: (a) a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of Customer Personal Data records concerned; (b) the name and contact details of Company's Data Protection Officer or other contact point where more information can be obtained; (c) a description of the likely consequences of the Personal Data Breach; and (d) a description of the measures taken, or proposed to be taken, by Company to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Company will update the notification as additional facts become available.

9.3 Delivery. Notification is delivered to the Security Contact designated by Customer (per the ToS / Order Form). Customer is responsible for maintaining a current Security Contact; if no Security Contact is designated, notification is delivered to Customer's Legal Notices Contact.

9.4 Assistance. Company will provide reasonable assistance to Customer's investigation, mitigation, and regulator / data-subject notification activities, including by providing information within Company's possession that is reasonably necessary for Customer to comply with its own notification obligations under Applicable Data Protection Law.

9.5 Breach of Company's own controller-role data. For Personal Data Breaches affecting data Company processes as controller under §2.2 (including Creator Biometric Identifiers), Company's notification obligations to affected data subjects and regulators are governed by the Privacy Policy §13, the Biometric Retention & Destruction Schedule, the CSAM / NCMEC Reporting Policy where applicable, and Applicable Data Protection Law. Company will still notify Customer of any such breach to the extent reasonably likely to affect Customer's personnel or Customer's account.

9.6 Confidentiality of notification. Breach notifications may contain information that is sensitive or subject to law-enforcement hold. Customer will treat the content of the notification as Company's Confidential Information and will limit disclosure to personnel with a need to know and to regulatory / professional advisors, in each case under obligations of confidentiality at least as protective as those under the ToS.

9.7 No admission. A notification under this §9 is not an admission of fault or liability.

10. Return and Deletion of Customer Personal Data

10.1 Customer export right during the term. During the term of the Agreement, Customer may export Customer Personal Data through the self-service features in the Services. Company will provide reasonable written-request assistance where the self-service features are insufficient.

10.2 Post-termination export window. Upon expiration or termination of the Agreement, Company will make Customer Personal Data available to Customer for export through the Services for thirty (30) days after the effective date of termination. Customer is responsible for initiating and completing the export within that window.

10.3 Deletion from production systems. Company will delete Customer Personal Data from Company's production systems within thirty (30) days after the earlier of (a) the end of the post-termination export window under §10.2; or (b) Customer's written instruction to delete received during or before the export window.

10.4 Deletion from backups. Company will delete Customer Personal Data from Company's backup systems in the ordinary course of backup rotation and in any event no later than sixty (60) days after the corresponding production-system deletion under §10.3. Pending rotational deletion, backup data is securely isolated and protected from any further processing except as necessary for disaster recovery.

10.5 Creator-offboarding deletion (cross-reference). The deletion schedule for Creator Biometric Identifiers, Creator Stylistic Data, per-Creator fine-tuned Models, and related controller-role data on Creator offboarding is governed by the Privacy Policy §8, the Creator Likeness Release, and the Biometric Retention & Destruction Schedule. Those instruments require: (a) commercially reasonable deletion of the per-Creator fine-tuned Model artifact from production within thirty (30) days of Creator offboarding, with backup purge on the backup-rotation cycle (up to sixty (60) further days); (b) destruction of Creator Biometric Identifiers per the Biometric Retention & Destruction Schedule (earlier of purpose-satisfaction, three (3) years of inactivity, or offboarding), except where retention is required for §2257 / §2257A or legal-hold purposes; and (c) disclosure of the residual cryptographic-deletion limit for non-Creator-specific base Models, since current machine-learning science does not reliably support surgical erasure of a specific Creator's contribution from a base Model's weights. This §10.5 is provided for completeness of the deletion-mechanics picture; the operative deletion rules for controller-role biometric data are the Privacy Policy, the Creator Likeness Release, and the Biometric Retention & Destruction Schedule.

10.6 Legal-hold and statutory-retention overrides. Notwithstanding §10.2–§10.5, Company may retain Customer Personal Data (and, for controller-role data, Creator data) to the extent and for the duration required by Applicable Data Protection Law, §2257 / §2257A recordkeeping, a CSAM report made to the NCMEC CyberTipline under 18 U.S.C. §2258A, a legal hold, or any other overriding legal obligation. Retained data is preserved under the same security controls and is not used for any purpose other than satisfying the retention requirement.

10.7 Certification of deletion. Upon Customer's written request, Company will provide a written certification that deletion under §10.3 and §10.4 has been performed, subject to the overrides in §10.6.

10.8 Sub-processor deletion. Company will cause each Sub-processor processing Customer Personal Data under §7 to delete that Customer Personal Data on a timeline substantively equivalent to §10.3 and §10.4, subject to the same overrides in §10.6.

11. Audit

11.1 Third-party audit reports. Company does not carry a SOC 2 or ISO third-party attestation at launch (see core/security-practices.md §6.1). If and when Company engages an external auditor for SOC 2, ISO, or equivalent attestation, Company will make available to Customer, on written request under NDA, the then-current attestation letter and the portions of the audit report reasonably necessary for Customer to evaluate Company's compliance with this DPA (the "Audit Report"). Pending issuance, interim trust documentation (per core/trust-center.md §5.2) is available under NDA.

11.2 Customer on-site audit right (constrained). In addition to the Audit Report, Company will, upon Customer's reasonable prior written request and to the extent Customer determines in good faith that the Audit Report does not satisfy Customer's obligations under Applicable Data Protection Law, allow for and contribute to an audit, including inspection, conducted by Customer (or a third-party auditor mandated by Customer and acceptable to Company) of Company's processing of Customer Personal Data under this DPA. The following conditions apply:

• (a) Frequency. Not more than once per calendar year, except (i) where required by a supervisory authority or court order, (ii) following a Personal Data Breach affecting Customer, or (iii) where Customer has a reasonable good-faith basis to believe Company is in material non-compliance with this DPA.
• (b) Notice. At least thirty (30) days' prior written notice, except in the three circumstances in §11.2(a)(i)–(iii), which require reasonable notice under the circumstances.
• (c) Scope. Limited to records, documentation, systems, and processing activities relevant to Company's processing of Customer Personal Data under this DPA. The audit will not (i) extend to any other Customer's data, (ii) extend to processing Company performs as controller under §2.2, (iii) require disclosure of Company's Confidential Information not reasonably necessary for the audit, or (iv) be conducted in a manner that materially disrupts Company's operations.
• (d) Audit plan. The Parties will agree in good faith on an audit plan (scope, timing, personnel, location) before the audit commences.
• (e) Fees. Customer pays Customer's own audit costs and Company's reasonable assistance costs at Company's then-current rates, unless the audit establishes material non-compliance attributable to Company, in which case Company bears its own assistance costs.
• (f) Confidentiality. The auditor (including any third-party auditor) must be bound by confidentiality obligations at least as protective as those in the ToS before accessing any records or premises.
• (g) Findings. The Parties will, within thirty (30) days of the audit's completion, discuss any findings and agree on remediation in good faith.

11.3 Supervisory-authority audits. Company will cooperate with any audit, inspection, or request from a competent supervisory authority in accordance with Applicable Data Protection Law. Where the supervisory authority addresses its request to Customer, Company will provide reasonable assistance at no additional cost.

11.4 CCPA assistance right (California). To the extent required by CCPA/CPRA, Customer has the right to take reasonable and appropriate steps (including through the audit rights in this §11) to help ensure that Company uses Customer Personal Data transferred to it in a manner consistent with Customer's obligations under CCPA/CPRA. See Exhibit C.

12. International Transfers

12.1 Upstream transfers — geographic scope. The Services are not offered to residents of, or data subjects located in, the Excluded Jurisdictions (Privacy Policy §1.8; ToS §2 — including the EEA, UK, Switzerland, Brazil, Canada, Australia, Japan, South Korea, India, China, and Singapore). Consequently, Restricted Transfers of Customer Personal Data from an Excluded Jurisdiction to Company in the United States are not, in the ordinary course, expected under this DPA. Customer warrants that it will not use the Services to engage data subjects in an Excluded Jurisdiction (see ToS §2 and the Customer Automation Acknowledgment).

12.2 Fallback for inadvertent upstream transfer. If, notwithstanding §12.1, an Authorized User incidentally accesses the Services from outside the United States (for example, on staff travel), any resulting Restricted Transfer of that Authorized User's personal data is performed under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller-to-Processor), with the law of Ireland as governing law (Clause 17, Option 1) and the courts of Ireland as forum (Clause 18); UK Addendum B1.0 applies for UK-origin transfers, if any; Swiss FADP adjustments per the FDPIC's published guidance apply for Swiss-origin transfers, if any. Annexes are completed by reference to this DPA's Annexes I–III and the Security Practices.

12.3 Downstream transfers to Sub-Processors. Onward transfers of Customer Personal Data to Sub-Processors that operate outside the United States rely on a valid transfer mechanism (Sub-Processor's own DPF certification; SCCs between Company and the Sub-Processor; or a back-to-back SCCs flow). The Sub-Processors List (core/sub-processors.md §7) identifies the transfer mechanism for each Sub-Processor.

12.4 Transfer Impact Assessment. For downstream SCC-reliant legs, Company has undertaken and will maintain a Transfer Impact Assessment consistent with the judgment of the Court of Justice of the European Union in Case C-311/18 (Schrems II) and the European Data Protection Board's Recommendations 01/2020. Company will provide Customer, on written request, the information within Company's knowledge reasonably necessary for Customer's own TIA, subject to confidentiality.

12.5 Supplemental measures. For data flowing to Sub-Processors in jurisdictions identified as posing heightened governmental-access risk in the TIA, Company has implemented supplemental technical measures (encryption in transit and at rest under Company's key control; access minimization; logging), organizational measures (contractual restrictions on government-access responses; training), and legal measures (challenging overbroad requests; publishing transparency statistics).

12.6 No alteration. Nothing in this DPA alters the text of the EU SCCs, the UK IDTA, the UK Addendum, or the ANPD SCCs except as the relevant instrument expressly permits.

12.7 Conflict. In the event of conflict between any incorporated transfer instrument and the remainder of this DPA, the incorporated transfer instrument controls as to matters it addresses.

12.8 Updates. If, during the term, any of the transfer instruments is amended, replaced, or invalidated, the Parties will cooperate in good faith to amend this DPA to incorporate a replacement mechanism recognized under Applicable Data Protection Law.

13. California Specific Terms (CCPA / CPRA)

The Parties additionally agree to the California Specific Terms set forth at Exhibit C to the extent Customer Personal Data includes "personal information" of a California resident as defined by CCPA/CPRA and Company processes that personal information as a "service provider" or "contractor" to Customer as a "business."

14. Liability and Remedies

14.1 Subject to Agreement cap. The Parties' respective liabilities under this DPA are subject to the exclusions and limitations of liability set out in the Agreement (the ToS or the MSA, as applicable), including any damages cap. Nothing in this DPA enlarges or reduces the overall liability cap.

14.2 Separate-cap consideration. Some enterprise counterparties request a separate, enhanced DPA cap (for example, a multiple of the standard cap or an uncapped treatment for willful / grossly negligent violations). The Order Form may specify a different cap for DPA matters if the Parties so agree.

14.3 Indemnification cross-reference. Cross-indemnities for third-party privacy claims arising from a Party's breach of this DPA are set out in the Agreement (ToS §13 / MSA §17).

14.4 Liability split for joint processing. Where Applicable Data Protection Law (for example, EU GDPR Art. 82) imposes joint and several liability, the Parties will allocate responsibility between themselves in proportion to their respective fault following a final, non-appealable judgment or regulatory decision, to the maximum extent permitted by law.

14.5 No third-party beneficiary of processor obligations except as required by law. Except to the extent Applicable Data Protection Law, including the EU SCCs and UK IDTA, requires that data subjects or supervisory authorities have direct rights against Company as Data Importer or Processor, this DPA does not confer any rights on third parties.

15. Order of Precedence

In the event of conflict or inconsistency between this DPA and the other documents in the Agreement, the order of precedence for the data-protection subject matter addressed by this DPA is:

1. Any mandatory provision of Applicable Data Protection Law (including the EU SCCs, the UK IDTA, the UK Addendum, the ANPD SCCs, and the DPF Principles) to the extent the provision applies by its own terms;
2. Exhibit C (California Specific Terms) as to CCPA/CPRA matters within its scope;
3. This DPA body and Annexes I, II, and III;
4. The Order Form, solely to the extent it addresses DPA-subject-matter items;
5. The ToS / MSA;
6. The Privacy Policy.

For matters not addressed by this DPA, the order of precedence set out in the ToS / MSA governs.

16. Term, Amendment, and Notices

16.1 Term. This DPA is effective as of the Effective Date and continues for the term of the Agreement and thereafter for so long as Company processes Customer Personal Data, including during the post-termination windows in §10.

16.2 Amendment. Company may amend this DPA on thirty (30) days' prior written notice to Customer. Amendments that materially reduce the protection Customer Personal Data receives under this DPA are effective only on Customer's written acceptance (or, for click-through Self-Serve, on Customer's affirmative renewed acceptance). Amendments required by Applicable Data Protection Law (for example, to incorporate a replacement transfer instrument) may take effect on the notice date, subject to the Parties' good-faith cooperation.

16.3 Self-serve acceptance. For the Self-Serve version of the Services, Customer accepts this DPA by clickwrap at the same time Customer accepts the ToS. A record of acceptance is preserved by Company.

16.4 Notices. All notices required under this DPA are given in accordance with the notice provisions of the Agreement. Notifications under §9 (Personal Data Breach) and §7.3 (Sub-processor change) may additionally be given via email to the contact addresses Customer has designated.

16.5 Entire agreement; severability; waiver. Standard provisions in the Agreement apply.

17. Signature / Execution

17.1 Enterprise counterparties. For enterprise counterparties, this DPA is executed as an exhibit to the MSA or as a standalone agreement countersigned by both Parties. Signature blocks appear below. Electronic signature (DocuSign or equivalent) is sufficient.

17.2 Self-serve counterparties. For Self-Serve counterparties, this DPA is accepted by clickwrap concurrent with the ToS.

17.3 Counterparts. This DPA may be executed in counterparts, each of which is deemed an original.

Company: Partyhat Technologies Inc. — By: ___________________ — Name: ___________________ — Title: ___________________ — Date: ___________________

Customer: ___________________ — By: ___________________ — Name: ___________________ — Title: ___________________ — Date: ___________________

Annex I — Description of Processing (Processor Role)

This Annex I corresponds to EU SCCs Annex I (Description of the transfer) and EU GDPR Art. 28(3) (subject-matter and duration; nature and purpose; type of personal data; categories of data subjects).

A. List of Parties

• Data Exporter / Controller: Customer, as identified in the Order Form or clickwrap record, including each individual Authorized User whose personal data is transmitted to Company in connection with Customer's use of the Services.
• Data Importer / Processor: Partyhat Technologies Inc., a Delaware C-Corporation, 262 Chapman Rd, Ste 240, Newark, DE 19702; privacy contact: privacy@partyhat.ai. No EU / UK Article 27 representative is engaged; the Services are not offered to EU / UK data subjects per Privacy Policy §1.8 and ToS §2 (Excluded Jurisdictions).

B. Description of Transfer

C. Competent Supervisory Authority

Under Variant B (SCCs) §12(B).1(f), the competent supervisory authority is the Irish Data Protection Commission to the extent the transfer falls within its jurisdiction; otherwise, the supervisory authority of the Data Exporter's establishment. Under Variant A (DPF), the Principles are enforced as described in the U.S. Department of Commerce DPF program.

D. Scope exclusions (for the avoidance of doubt)

Annex I scopes only the processor-role data enumerated in §3 and §1.12. Creator Biometric Identifiers, Creator Stylistic Data, per-Creator fine-tuned Model artifacts, Outputs, Creator KYC / §2257 / §2257A records, Fan Incidental Data, and other data that Company processes as controller under §2.2 and the Privacy Policy §2 are not within Annex I's scope.

Annex II — Technical and Organizational Measures

This Annex II corresponds to EU SCCs Annex II (Technical and organizational measures). The full description of Company's technical and organizational measures is in the Security Practices. The summary table below is provided for ease of reference and maps the EU SCCs Annex II categories to the corresponding controls.

For onward transfers to Sub-processors, Company requires each Sub-processor to implement technical and organizational measures substantively equivalent to those in this Annex II, subject to §7.5.

Annex III — Sub-Processors

This Annex III corresponds to EU SCCs Annex III (List of sub-processors). The current list of Company's Sub-processors, together with the processing each performs, location(s), transfer mechanism, and links to the Sub-processor's security / privacy documentation, is published in the Sub-Processors List. The list is maintained current and notified to subscribing customers per §7.3.

For convenience, the principal categories of Sub-processors engaged as of the Effective Date are summarized below. The Sub-Processors List is the authoritative record; this summary is informational.

Note on Creator Biometric Identifiers and explicit Outputs (Privacy Policy §§6, 12 and DPA §7.7). Company does not route Creator Biometric Identifiers, sexually explicit prompts, or sexually explicit Outputs through third-party AI Model-vendor Sub-processors whose Acceptable Use Policies prohibit such content. Explicit-generation paths use in-house or open-weight self-hosted Models.

Note on Target Platforms (DPA §1.22 and §7.8). Target Platforms (Instagram, TikTok, X / Twitter, OnlyFans, Fansly, Reddit, Facebook, and similar) are not Company's Sub-processors. They are independent controllers of their own services.

Exhibit A — EU SCCs Module-Selection Terms

This Exhibit A records the selections made by the Parties for the EU SCCs as incorporated under DPA §12(B).1. Where this Exhibit A and §12(B).1 conflict, §12(B).1 controls.

Exhibit B — UK IDTA / UK Addendum Completion Tables

This Exhibit B records the selections made by the Parties for the UK IDTA (version B1.0) and the UK Addendum to the EU Commission Standard Contractual Clauses (version B1.0), as incorporated under DPA §12(B).2. Where this Exhibit B and §12(B).2 conflict, §12(B).2 controls.

B.1 UK IDTA (version B1.0) — Completion Tables

B.2 UK Addendum (version B1.0) — Completion Tables (alternative)

Exhibit C — California Specific Terms (CCPA / CPRA)

This Exhibit C applies to the extent Customer Personal Data processed by Company as Processor under this DPA includes "personal information" of a California resident and Company is acting as a "service provider" or "contractor" to Customer (as "business"), as those terms are defined by CCPA/CPRA and related regulations.

C.1 Definitions. Terms used in this Exhibit C have the meaning given in CCPA/CPRA and the regulations adopted by the California Privacy Protection Agency, including without limitation "business," "business purpose," "consumer," "personal information," "sell," "share," and "service provider."

C.2 Service-provider / contractor status. Company is a "service provider" or "contractor" of Customer with respect to Customer Personal Data of California residents that Company processes as Processor under this DPA.

C.3 Purpose limitation. Company will process Customer Personal Data only for the business purposes set out in §3 of this DPA, the ToS, the Order Form, and Customer's documented instructions, and as otherwise required by Applicable Data Protection Law. Company will not retain, use, or disclose Customer Personal Data for any other purpose, including a "commercial purpose" other than the business purposes specified, or outside the direct business relationship with Customer.

C.4 No sale; no sharing for cross-context behavioral advertising. Company will not "sell" Customer Personal Data, and will not "share" Customer Personal Data for cross-context behavioral advertising, as those terms are defined by CCPA/CPRA. Company acknowledges and confirms that it does not receive Customer Personal Data as consideration for any Services provided to Customer.

C.5 No combination. Company will not combine Customer Personal Data that Company receives from or on behalf of Customer with personal information Company receives from or on behalf of another person, or collects from Company's own interaction with a consumer, unless the combination is required to perform a business purpose expressly permitted under CCPA/CPRA, including regulations thereto or regulations adopted by the California Privacy Protection Agency.

C.6 Same level of privacy protection. Company will comply with its CCPA/CPRA obligations as a service provider or contractor and will provide the same level of privacy protection as required by CCPA/CPRA, including the obligations in this Exhibit C and 11 C.C.R. §7051.

C.7 Customer's audit right. Customer has the right to take reasonable and appropriate steps (including through the audit rights in DPA §11) to ensure that Company's use of Customer Personal Data is consistent with Customer's obligations under CCPA/CPRA.

C.8 Notice of inability to comply. Company will notify Customer if Company determines it can no longer meet its obligations under CCPA/CPRA in respect of Customer Personal Data. Company will notify within a reasonable time but no later than five (5) business days of Company's determination.

C.9 Remediation. Upon receipt of a Customer notice under C.7 that Company is engaging in unauthorized use, Customer may take reasonable and appropriate steps to stop and remediate the unauthorized use of Customer Personal Data, including requiring Company to provide documentation demonstrating remediation.

C.10 Consumer-request assistance. Company will provide reasonable cooperation and assistance to enable Customer to respond to consumer requests under CCPA/CPRA, including rights to know, delete, correct, opt out of sale or sharing, limit use and disclosure of sensitive personal information, and non-discrimination. See DPA §5.

C.11 Sub-processor CCPA compliance. Company will cause each Sub-processor to be contractually bound to the equivalent of the obligations in this Exhibit C with respect to Customer Personal Data of California residents, pursuant to DPA §7.5.

C.12 Sensitive-personal-information. Company will not use sensitive personal information within Customer Personal Data for any purpose other than those permitted under Cal. Civ. Code §1798.121 and the regulations thereunder. For the avoidance of doubt, this Exhibit C does not govern Company's controller-role processing of Creator sensitive personal information under §2.2 of this DPA; that processing is governed by the Privacy Policy §§10, 12 and §15 and the Creator Likeness Release.

C.13 Certification. Company certifies that it understands the restrictions in this Exhibit C and will comply with them.

C.14 Data-subject requests received directly. If Company receives a request from a California resident directly, Company will (a) either inform the resident that the resident should direct the request to Customer or (b) act on the request as a service provider / contractor at Customer's direction. Company will not independently respond to the request on the merits except as required or permitted by Applicable Data Protection Law.

C.15 Non-discrimination cooperation. Company will provide Customer with the support Customer reasonably requires to honor California residents' non-discrimination right under CCPA/CPRA §1798.125.

C.16 State equivalents. The Parties will read C.1–C.15 as applicable, with necessary adjustments, to analogous "service provider" or "processor" obligations under other U.S. state comprehensive-privacy laws (VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, FDBR, MCDPA, ICDPA, DPDPA, NHDPL, NJDPA, MDPA, TNDPIA, INDPL, MODPA, and others enacted or enacted after the Effective Date).

Change Log

• 2026-04-16 — initial draft.