Data Processing Addendum

This Data Processing Addendum (the "DPA") describes how Spartera, Inc. ("Spartera") Processes Personal Data on behalf of a customer, partner, or client ("Client"). It forms part of, and is incorporated by reference into, whichever of the following agreements applies to you:

Marketplace and Platform. The Spartera Marketplace Terms of Service and the Platform Partner Agreement, where Spartera hosts and Processes a Seller's Source Data under the Custodian Model.

Advisory Services. The Spartera Advisory Services Master Services Agreement (the "MSA") and any applicable Statement of Work ("SOW"), where Spartera Processes Personal Data in the course of delivering advisory, consulting, or implementation services.

In each case, the agreement above is referred to as the "Principal Agreement". Capitalized terms not defined here have the meanings given in the Principal Agreement.

This DPA applies only to the extent Spartera actually Processes Personal Data on Client's behalf. Under the Spartera Platform Model and API Data Products Model, Source Data remains in the Seller's own infrastructure and Spartera does not act as a Processor of it. Marketplace products may not contain personal data at all: see Marketplace Terms Section 5 and Platform Partner Agreement Section 5.2.

This DPA is effective automatically, without signature, whenever Spartera Processes Personal Data on Client's behalf. A countersigned copy is available on request at legal@spartera.com.

Where this DPA conflicts with the Principal Agreement with respect to the Processing of Personal Data, this DPA controls.

"Applicable Data Protection Law" means all data protection and privacy laws applicable to the Processing of Personal Data under the Principal Agreement, including (a) Regulation (EU) 2016/679 (the "EU GDPR"); (b) the UK Data Protection Act 2018 and the UK GDPR (the "UK GDPR"); (c) the Swiss Federal Act on Data Protection (the "Swiss FADP"); (d) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA/CPRA"); and (e) any other applicable national, state, or provincial data protection law.

"Controller", "Processor", "Data Subject", "Personal Data", "Processing", and "Personal Data Breach" have the meanings given in the EU GDPR, or the equivalent terms under other Applicable Data Protection Law, including "business," "service provider," "consumer," and "personal information" under CCPA/CPRA.

"Data Privacy Framework" or "DPF" means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification programs operated by the U.S. Department of Commerce, and their respective successors, as amended, superseded, or replaced from time to time.

"EU SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

"Sub-processor" means any third party engaged by Spartera to Process Personal Data on behalf of Client.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office, version B1.0, in force 21 March 2022.

2.1 Roles. With respect to Personal Data Processed under the Principal Agreement, Client is the Controller — or, where Client is itself a Processor for a third party, the Processor — and Spartera is the Processor (or Sub-processor).

2.2 Compliance. Each party shall comply with its respective obligations under Applicable Data Protection Law. Client is responsible for the lawfulness of its Processing of Personal Data, including establishing a valid legal basis and providing required notices to Data Subjects.

2.3 Registration Obligations. Client is solely responsible for determining whether it qualifies as a "data broker," "data collector," or similar regulated entity under any applicable law, and for satisfying any resulting registration, disclosure, fee, deletion-request, or opt-out obligations.

3.1 Subject Matter. The subject matter of the Processing is the provision of the services described in the Principal Agreement.

3.2 Scope. The duration, nature, and purpose of Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex 1 below.

3.3 Minimization. Spartera's architecture is designed to minimize the Processing of Personal Data. Under the Platform Model and API Data Products Model, analytics execute within Client-controlled environments and only processed outputs are returned. In advisory engagements, Spartera works against schemas, metadata, and aggregated outputs rather than raw records wherever feasible. The Processing described in this DPA applies only to the extent Personal Data is actually Processed by Spartera.

4.1 Documented Instructions. Spartera shall Process Personal Data only on documented instructions from Client. The Principal Agreement, any applicable SOW, and this DPA constitute Client's complete and final documented instructions regarding the Processing of Personal Data. Additional or alternative instructions must be agreed in writing.

4.2 Notice of Unlawful Instructions. Spartera shall promptly inform Client if, in its reasonable opinion, an instruction violates Applicable Data Protection Law, and may suspend Processing under the relevant instruction pending Client's confirmation or modification.

4.3 No Independent Use. Spartera shall not Process Personal Data for its own purposes, sell Personal Data, or share Personal Data for cross-context behavioral advertising. Spartera shall not retain, use, or disclose Personal Data outside the direct business relationship with Client, or for any purpose other than performing the services. Spartera does not use Client Personal Data to train machine learning models or artificial intelligence systems.

Spartera shall ensure that personnel authorized to Process Personal Data are bound by written confidentiality obligations or an appropriate statutory obligation of confidentiality, and that access is limited to personnel who need it to perform the services.

6.1 Security Measures. Spartera shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are described in Annex 2 below.

6.2 Review. Spartera may update its security measures from time to time, provided the updated measures do not materially reduce the overall level of protection.

7.1 General Authorization. Client provides Spartera with general written authorization to engage Sub-processors, subject to this Section 7. The current list is set out in Annex 3 below.

7.2 Notice of Changes. Spartera shall provide at least thirty (30) days' prior notice of the addition or replacement of any Sub-processor by updating Annex 3 on this page and, where Client has provided a notice address, by written notice. Client may object on reasonable data-protection grounds within fifteen (15) days. If the parties cannot reach a commercially reasonable resolution within thirty (30) days of the objection, Client may terminate the affected service for cause, and Spartera shall refund any prepaid fees for services not yet performed.

7.3 Flow-Down Obligations. Spartera shall enter into a written agreement with each Sub-processor containing data protection obligations no less protective than those in this DPA, including with respect to security and breach notification. Spartera remains fully liable to Client for the performance of each Sub-processor.

8.1 Assistance. Taking into account the nature of the Processing, Spartera shall provide Client with reasonable assistance, by appropriate technical and organizational measures, to enable Client to respond to requests from Data Subjects exercising rights of access, rectification, erasure, restriction, portability, and objection.

8.2 Forwarded Requests. If Spartera receives a request from a Data Subject relating to Client's Personal Data, Spartera shall promptly notify Client and shall not respond except to acknowledge receipt or as required by law.

8.3 Government and Legal Demands. If Spartera receives a subpoena, court order, warrant, or other legally binding demand seeking disclosure of Personal Data, Spartera shall: (a) not disclose Personal Data except to the extent legally required; (b) immediately notify Client in writing unless legally prohibited; and (c) reasonably cooperate with Client, at Client's expense, if Client wishes to limit, challenge, or seek protective relief against the disclosure, to the extent permitted by law.

9.1 Notification. Spartera shall notify Client without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Client's Personal Data.

9.2 Content of Notice. The notification shall include, to the extent then known: (a) the nature of the breach, including the categories and approximate number of Data Subjects and records affected; (b) the likely consequences; (c) measures taken or proposed to address the breach and mitigate adverse effects; and (d) a point of contact for further information.

9.3 Cooperation. Spartera shall cooperate with Client and provide reasonable assistance in Client's investigation, mitigation, and notification obligations.

Taking into account the nature of the Processing and the information available to Spartera, Spartera shall provide reasonable assistance to Client in conducting data protection impact assessments and prior consultations with supervisory authorities, where required by Applicable Data Protection Law.

11.1 Data Privacy Framework. To the extent Spartera is self-certified under the applicable Data Privacy Framework and the Personal Data transferred falls within the scope of that certification, the DPF applies to the transfer. Where the DPF does not apply, or where Spartera determines it can no longer provide at least the same level of protection as required by the DPF Principles, the mechanism in Section 11.2 applies.

11.2 EU/EEA Transfers. Where Spartera Processes Personal Data originating from the European Economic Area outside the EEA in a jurisdiction not recognized by the European Commission as providing adequate protection, and the DPF does not apply, the EU SCCs are incorporated into this DPA by reference. Module Two (Controller to Processor) applies where Client acts as a Controller, and Module Three (Processor to Processor) applies where Client acts as a Processor for a third-party Controller. Population details are set out in Annex 4 below.

11.3 UK Transfers. Where Spartera Processes Personal Data subject to the UK GDPR outside the United Kingdom in a jurisdiction not recognized by the UK Secretary of State as providing adequate protection, the UK Addendum is incorporated by reference, with the EU SCCs as the "Approved EU SCCs" referenced therein.

11.4 Swiss Transfers. Where Spartera Processes Personal Data subject to the Swiss FADP, the EU SCCs apply with the following adaptations: (a) references to the EU GDPR include the Swiss FADP; (b) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and (c) "Member State" is replaced by "Switzerland" to the extent necessary to protect Data Subjects resident in Switzerland.

11.5 Conflict. In the event of a conflict between this DPA and the EU SCCs or UK Addendum, the EU SCCs or UK Addendum prevails with respect to the transfers they govern.

Upon termination or expiration of the Principal Agreement or the relevant SOW, Spartera shall, at Client's election, return or delete all Personal Data Processed on Client's behalf, including existing copies, unless Applicable Data Protection Law requires further retention. Spartera shall provide written certification of deletion upon reasonable request. Personal Data retained in routine backups will be deleted in accordance with Spartera's backup retention schedule and remains subject to the protections of this DPA until deletion.

This Section does not apply to analytics outputs lawfully purchased by a Marketplace Buyer, which are retained for that Buyer as described in the Marketplace Terms, Section 9. Such outputs may not contain Prohibited Data, and Spartera may remove them under the Marketplace Terms, Section 12, where they are found to do so.

13.1 Information. Spartera shall make available information reasonably necessary to demonstrate compliance with this DPA, which may include then-current security certifications, audit reports where available, and responses to industry-standard security questionnaires.

13.2 On-Site Audit. Where the information provided under Section 13.1 is insufficient, Client may, no more than once in any twelve (12) month period and on at least thirty (30) days' prior written notice, audit Spartera's compliance with this DPA. The audit shall be conducted during normal business hours, subject to reasonable confidentiality obligations, without unreasonable interference with Spartera's operations, and at Client's expense — except where the audit reveals a material breach by Spartera, in which case Spartera shall reimburse Client's reasonable audit costs.

13.3 Regulator Audits. Spartera shall cooperate with audits or investigations conducted by a competent supervisory authority where required by Applicable Data Protection Law.

To the extent Spartera Processes Personal Information (as defined under CCPA/CPRA) on behalf of Client, Spartera is a "Service Provider" and certifies that it understands and will comply with the following restrictions:

15.1 Liability. Each party's liability arising out of or relating to this DPA, whether in contract, tort, or under any other theory, is subject to the limitations of liability set forth in the Principal Agreement, and any reference in those limitations to "this Agreement" includes this DPA. Nothing in this DPA limits a Data Subject's rights under Applicable Data Protection Law.

15.2 Order of Precedence. With respect to the Processing of Personal Data, this DPA prevails over any conflicting provision of the Principal Agreement. With respect to international data transfers, the EU SCCs and the UK Addendum prevail over conflicting provisions of this DPA.

15.3 Term. This DPA takes effect when Spartera first Processes Personal Data on Client's behalf and remains in force for so long as such Processing continues, and thereafter to the extent necessary to give effect to surviving obligations, including return or deletion of Personal Data and post-termination confidentiality and security obligations.

15.4 Changes. Spartera may update this DPA from time to time, provided that no update materially reduces the protections afforded to Personal Data. Material changes and Sub-processor additions are subject to the notice provisions in Section 7.2.

15.5 General. The provisions of the Principal Agreement regarding notices, governing law, venue, severability, waiver, assignment, and counterparts apply to this DPA.

A. Categories of Data Subjects. Individuals whose Personal Data is contained in the Source Data or materials Client provides to or makes accessible by Spartera. Depending on the engagement, these may include Client's employees, Client's customers or end users, and Client's business contacts. Confirmed in each SOW where advisory Processing applies.

B. Categories of Personal Data. May include name, business contact details (email, phone, title, employer), professional or business information, identifiers contained in data schemas, sample records provided for analysis, and other categories specified in the applicable SOW or connection configuration. Sensitive or special categories of Personal Data are not Processed unless expressly agreed in writing.

C. Special Categories of Data. None, unless expressly identified in the applicable SOW. Where special category data is in scope, Client warrants that an appropriate legal basis under Article 9 GDPR or equivalent applies.

D. Nature and Purpose of Processing. For the Custodian Model: hosting Client Source Data on Spartera-managed infrastructure and executing Client-defined transformation logic against it to produce analytics outputs. For Advisory Services: data analysis, strategic and pricing recommendations, schema review, and ancillary activities necessary to deliver the engagement.

E. Duration of Processing. For the duration of the Principal Agreement or applicable SOW, plus any post-termination retention period required by law, after which Personal Data is returned or deleted in accordance with Section 12.

F. Frequency of Processing. Continuous for the Custodian Model, for so long as the Client's data is hosted. As needed for Advisory Services; typically project-based and time-limited.

G. Retention. Personal Data is retained only for the duration described in (E), plus a reasonable period for backup deletion cycles.

Spartera maintains the following measures, which may be updated from time to time provided the overall level of protection is not materially reduced.

1. Access Control. Role-based access control with least-privilege principles. Unique user accounts with no shared credentials for production systems. Multi-factor authentication required for administrative access to production environments. Periodic review and revocation of access on personnel changes.

2. Encryption. Personal Data encrypted in transit using TLS 1.2 or above. Personal Data at rest encrypted using industry-standard algorithms, including AES-256, where stored on Spartera-controlled systems.

3. Logging and Monitoring. Logging of administrative actions and access to production systems. Monitoring for anomalous activity and security events.

4. Vulnerability and Patch Management. Regular application of security patches to Spartera-managed systems. Periodic vulnerability scanning of Spartera-controlled infrastructure.

5. Personnel Security. Background checks for personnel with access to production systems, where permitted by law. Written confidentiality obligations covering all personnel. Periodic security awareness training.

6. Incident Response. Documented incident response procedures, including breach notification escalation paths. Designated security contact for incident coordination.

7. Business Continuity. Regular backups of production data, encrypted and access-controlled. Documented business continuity and disaster recovery procedures.

8. Data Minimization and Pseudonymization. Where feasible, analyses are performed against schemas, metadata, and aggregated outputs rather than raw records. Pseudonymization or anonymization applied where appropriate to the Processing purpose.

9. Physical Security. Personal Data is hosted on infrastructure provided by Sub-processors with industry-standard physical security controls, including access controls, surveillance, and environmental controls. Personal Data is not Processed in unsecured physical locations.

10. Vendor Management. Sub-processors are subject to written data protection obligations no less protective than those in this DPA. Periodic review of Sub-processor security and data protection practices.

The following Sub-processors are approved as of the date at the top of this page. Spartera will provide notice of changes in accordance with Section 7.2.

EU SCCs. Module Two (Controller to Processor) applies where Client acts as a Controller. Module Three (Processor to Processor) applies where Client acts as a Processor for a third-party Controller.

Data Exporter: Client, as identified in the Principal Agreement. Data Importer: Spartera, Inc., Reston, Virginia, United States. Contact: legal@spartera.com.

Clause 7 (Docking Clause): Not used. Clause 9 (Sub-processors): Option 2 — general written authorization, with thirty (30) days' prior notice of changes per Section 7.2. Clause 11(a) (Independent Dispute Resolution): Optional language not included. Clause 17 (Governing Law): The law of Ireland. Clause 18 (Choice of Forum): The courts of Ireland.

Annex I.A (List of Parties): As identified above. Annex I.B (Description of Transfer): As set out in Annex 1 of this DPA. Annex I.C (Competent Supervisory Authority): Determined per Clause 13 of the EU SCCs based on the Data Exporter's establishment. Annex II (Technical and Organizational Measures): As set out in Annex 2 of this DPA. Annex III (Sub-processors): As set out in Annex 3 of this DPA.

UK Addendum. Table 1 (Parties): as identified above. Table 2 (Selected SCCs): EU SCCs Module Two, as populated above. Table 3 (Appendix Information): Annexes 1, 2, and 3 of this DPA. Table 4 (Termination): Either party may end the UK Addendum if the ICO issues a revised Approved Addendum that materially changes the rights or obligations of the parties, as set out in Section 19 of the UK Addendum.

This DPA is effective without signature. If your organization requires a countersigned copy, or if you need the EU SCCs and UK Addendum executed as standalone documents, contact legal@spartera.com and we will provide them.

For questions about this Addendum, our sub-processors, or our security measures, contact legal@spartera.com. Related documents: Privacy Policy, Website Terms of Service, Marketplace Terms of Service, and the Platform Partner Agreement.