Data Processing Addendum

This Data Processing Addendum (including its annexes, this "DPA") is between the customer that uses the Services ("Customer," "you") and Memorable Holdings Group LLC – Marketing – Series 2 ("Memorable," "Provider," "we") (each a "Party" and together the "Parties"). It forms part of the Memorable Terms of Use or, for white-label partners, the Partner Agreement (either, the "Agreement"). No signature is required: this DPA applies to every Customer whose Customer Data includes Personal Data, from the date the Customer first accepts the Agreement. A signed copy is available on request at support@memorable.one.

1.Definitions

The following terms have the meanings set out below. Capitalized terms not defined here have the meanings given in the Agreement.

Applicable Data Protection Laws

The privacy, data protection, and data security laws and regulations of any jurisdiction within the United States that apply to Memorable's Processing of Personal Data under the Agreement, including, as and to the extent applicable, the State Privacy Laws.

Customer Data

Information provided or otherwise made available by or on behalf of Customer to Memorable for Processing on Customer's behalf to perform the Services, including contact lists, phone numbers, email addresses, consent records, tags, and message content and history.

Data Subject

The identified or identifiable natural person to whom Personal Data relates.

Information Security Incident

A breach of Memorable's security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Memorable's possession, custody, or control. It does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.

Personal Data

Customer Data that constitutes "personal data," "personal information," or "personally identifiable information" as defined in Applicable Data Protection Laws, or information of a similar character regulated by them. Personal Data does not include information about Customer's own personnel and business contacts held for the account relationship, or information Memorable receives, collects, or generates independently of the Services and not from or on behalf of Customer.

Process or Processing

Any operation performed by Memorable (or on its behalf) for Customer under the Agreement on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Security Measures

The measures described in Section 4.1 and Annex 3.

Services

The Memorable platform and related services described in the Agreement.

State Privacy Laws

The comprehensive state-specific data privacy laws (and implementing regulations) currently in effect and applicable to Memorable's Processing of Personal Data under the Agreement.

Subprocessors

Memorable's affiliates and the third parties Memorable engages to Process Personal Data in relation to the Services, listed in Annex 4.

2.Duration and scope

2.1 This DPA remains in effect for as long as Memorable Processes Personal Data, notwithstanding the expiration or termination of the Agreement.

2.2 Processing of Personal Data subject to the State Privacy Laws, with respect to which Customer is a business, controller, processor, or service provider (as those terms are defined in the State Privacy Laws), is also subject to Annex 2.

3.Customer instructions

Memorable will Process Personal Data only in accordance with Customer's documented instructions, including as set out in this DPA, the Agreement, any order form, and any other written instructions from Customer that are consistent with the Agreement and this DPA. If Customer requests instructions outside the scope of the Services, or that would require Memorable to materially change the Services or undertake additional work, the Parties will agree to them in a written amendment. By accepting this DPA, Customer instructs Memorable to Process Personal Data to provide the Services (including to send, deliver, and log the messages Customer initiates, honor opt-outs, and keep consent records) and to perform its other obligations and exercise its rights under the Agreement. The details of the Processing, including the Parties' roles, are described in Annex 1.

4.Security

4.1 Memorable's security measures

Memorable will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Annex 3, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing and the risks to Data Subjects. Memorable may update the Security Measures from time to time, including to maintain or improve security or address changes in Applicable Data Protection Laws, so long as the updated measures do not materially decrease the overall protection of Personal Data.

4.2 Personnel

Memorable will require that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.

4.3 Information Security Incidents

Memorable will notify Customer without undue delay after becoming aware of an Information Security Incident. The notification will describe, to the extent then known, available details of the incident, the steps taken to mitigate the potential risks, and the steps Memorable recommends Customer take. Memorable's notification of or response to an incident is not an acknowledgement of fault or liability. Memorable will reasonably cooperate with Customer and take commercially reasonable steps within its control, as reasonably requested and mutually agreed in good faith, to assist in the investigation of the incident. Customer is solely responsible for complying with notification laws applicable to Customer and for fulfilling any third-party notification obligations. If Customer determines that an incident must be notified to a regulatory authority, Data Subjects, the public, or others, then to the extent the notice refers to or identifies Memorable, and where permitted by law, Customer will notify Memorable in advance and consult with Memorable in good faith on any clarifications or corrections Memorable reasonably recommends that relate to Memorable's involvement and are consistent with applicable law.

4.4 Customer's security responsibilities and assessment

Without limiting Memorable's obligations under this Section 4, Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data; (b) securing the account credentials, systems, and devices Customer uses to access the Services, including API keys and webhook secrets; (c) securing any systems Customer connects to the Services; and (d) backing up Personal Data as applicable. Customer acknowledges that it has evaluated the Services, the Security Measures, and Memorable's commitments under this DPA and has determined that they are adequate to meet Customer's needs, including any security obligations of Customer under Applicable Data Protection Laws.

5.Customer's responsibilities

5.1 Customer will ensure (and is solely responsible for ensuring) that it has provided all notices to, and obtained all consents and permissions from, third parties (including Data Subjects), and has reserved all necessary rights, as required under Applicable Data Protection Laws and messaging laws for Memorable to Process Personal Data as contemplated by the Agreement, including consent to receive text messages and email.

5.2 Customer represents and warrants that Customer Data does not and will not contain: social security numbers or other government-issued identification numbers; protected health information subject to HIPAA or other information about an individual's medical history, mental or physical condition, or medical treatment or diagnosis; health insurance information; biometric information; passwords or credentials for third-party accounts; credentials to financial accounts; tax return data; payment card information subject to the PCI Data Security Standard; personal data of children under 16 years of age; or any other information within the special categories of data defined in Applicable Data Protection Laws (together, "Restricted Data"). Names, phone numbers, email addresses, tags, preferences, and ordinary marketing engagement data are not Restricted Data.

6.Data subject rights

6.1 Memorable will, taking into account the nature of the Processing, provide Customer with assistance reasonably necessary and technically feasible for Customer to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws ("Data Subject Requests") with respect to Personal Data in Memorable's possession or control. The Services let Customer view, export, correct, opt out, and delete contacts directly. Where a request requires work beyond the Services, Customer will compensate Memorable at its then-current professional services rates, which Memorable will quote in advance on request.

6.2 If Memorable receives a Data Subject Request directly, Memorable will (i) promptly notify Customer, unless prohibited by law; and (ii) advise the Data Subject to submit the request to Customer. Customer is solely responsible for responding to the request, unless otherwise required by law. Opt-out requests received by text (such as STOP) are honored by the Services automatically and recorded for Customer.

7.Subprocessors

7.1 Customer authorizes the engagement of Memorable's affiliates as Subprocessors and generally authorizes Memorable to engage third parties as Subprocessors in accordance with this Section.

7.2 The current Subprocessors, their functions, and locations are listed in Annex 4. Memorable may continue to use the Subprocessors engaged as of the effective date of this DPA.

7.3 When engaging any Subprocessor, Memorable will enter into a written contract containing data protection obligations not less protective than those in this DPA, to the extent applicable to the nature of the services the Subprocessor provides. Memorable remains responsible for the performance of all obligations subcontracted to a Subprocessor and is liable for the Subprocessor's acts and omissions to the same extent as if Memorable had performed the Processing itself.

7.4 When Memorable engages a new Subprocessor after the effective date of this DPA, it will give Customer notice (including the Subprocessor's name, location, and the activities it will perform) by updating Annex 4 on this page and emailing Customer's account email at least 15 days before the Subprocessor begins Processing Personal Data. If Customer objects in writing within 15 days after the notice, on reasonable grounds relating to the protection of Personal Data, the Parties will work together in good faith to find a mutually acceptable resolution. If they cannot within a reasonable time, Customer may, as its sole and exclusive remedy, terminate the Agreement by written notice and pay Memorable all amounts due and owing as of the termination date.

8.Audits

Customer may audit Memorable's compliance with this DPA up to once per year, and on such other occasions as may be required by Applicable Data Protection Laws or a competent regulatory authority with jurisdiction over Customer, on written request that provides reasonable detail and, where available, documentation of the requirement. Memorable will contribute by providing the information and assistance reasonably necessary, in the first instance by completing a written security questionnaire and sharing relevant policies and reports. Any third-party auditor must be independent, not a competitor of Memorable, and bound by a customary non-disclosure agreement. Customer must submit a proposed audit plan (scope, duration, and start date) at least two weeks in advance; Memorable will review it, raise any concerns (for example requests that could compromise its security or other customers' confidentiality), and work cooperatively with Customer to agree a final plan. Where the controls to be assessed are addressed in a SOC 2, ISO, NIST, or similar audit report issued within the preceding 12 months, and Memorable confirms there have been no known material changes to the audited controls, Customer will accept that report in lieu of an audit of those controls. Audits take place during regular business hours, subject to the agreed plan and Memorable's security and other policies, and may not unreasonably interfere with Memorable's business. Nothing in this Section requires Memorable to breach any duty of confidentiality. Customer will promptly notify Memorable of any non-compliance discovered, will share any audit reports generated, may use them only to meet its regulatory requirements or confirm compliance with this DPA, and bears the cost of the audit, including reimbursing Memorable's reasonable, documented costs at its then-current professional services rates.

9.Return and deletion

9.1 On the date the Services involving Processing of Personal Data cease (the "Cessation Date"), Memorable will promptly stop Processing Personal Data for any purpose other than storage and the Processing needed to return, delete, or anonymize it, or as otherwise permitted or required under this DPA or applicable law.

9.2 Customer may export its contacts and message history as CSV files from the Services at any time before the Cessation Date. On written request made no later than 30 days after the Cessation Date (the "Post-cessation Storage Period"), Memorable will, within a commercially reasonable period and to the extent technically possible, (i) return a complete copy of the Personal Data in its possession by secure file transfer or another commercially reasonable secure method, and then delete or anonymize all other copies, or (ii) at its option, delete or anonymize the Personal Data.

9.3 If Customer does not instruct Memorable in writing during the Post-cessation Storage Period, Memorable will, within a commercially reasonable time afterward, delete or anonymize all Personal Data then in its possession, custody, or control to the fullest extent technically feasible.

9.4 Memorable may retain Personal Data to the extent permitted or required by applicable law, carrier rules, or messaging regulations (for example, records of consent and opt-outs), for no longer than required, provided that Memorable will (i) keep such Personal Data confidential and protect it in accordance with the Security Measures, (ii) Process it only as necessary for the purpose specified in the law or rule permitting or requiring retention, and (iii) delete or anonymize it once it is no longer permitted or required to be retained.

10.Artificial intelligence and automated processing

10.1 Memorable will not use Personal Data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, whether Memorable's own or a third party's, unless (a) such use is reasonably necessary to provide the Services in accordance with Customer's documented instructions, or (b) Customer expressly authorizes it in writing.

10.2 Memorable will prohibit its Subprocessors, including any AI model providers, from using Personal Data for their own model training, fine-tuning, development, or improvement purposes, except as Customer expressly authorizes in writing.

10.3 The Services do not make automated decisions about Data Subjects that produce legal or similarly significant effects. If that changes, Memorable will disclose the processing to Customer, provide meaningful information about the logic involved to the extent reasonably available without disclosing trade secrets, and reasonably cooperate with Customer, as required by Applicable Data Protection Laws, to enable Data Subjects to exercise their rights.

11.Miscellaneous

11.1 Except as expressly modified by this DPA, the terms of the Agreement remain in full force and effect. If this DPA conflicts with the other terms of the Agreement, this DPA governs with respect to the Processing of Personal Data. Memorable's access to Personal Data is not part of the consideration exchanged by the Parties under the Agreement.

11.2 Notices under this DPA may be given in accordance with the Agreement's notice clause, to Customer's contact details for data protection, to Memorable's primary points of contact with Customer, or to any email address Customer designates for Services-related communications. Customer is solely responsible for ensuring those addresses are valid. Notices to Memorable go to support@memorable.one.

11.3 Memorable will cooperate in good faith with Customer to consider amendments reasonably necessary to address compliance with Applicable Data Protection Laws, and may, on written notice, vary this DPA solely to the extent necessary to maintain compliance with Applicable Data Protection Laws, provided the variation does not materially reduce the protections afforded to Personal Data or materially increase Customer's obligations without Customer's written agreement.

11.4 The total aggregate liability of either Party to the other under or in connection with this DPA will under no circumstances exceed the limitations and caps on, and will be subject to the exclusions of, liability agreed in the Agreement.

Annex 1.Data processing details

Provider details

Name: Memorable Holdings Group LLC – Marketing – Series 2
Address: 30 N Gould St Ste N, Sheridan, WY 82801
Contact for data protection: Privacy lead, support@memorable.one
Provider activities: Operating a text and email marketing platform that lets businesses collect consented contacts, send and schedule messages, manage replies and opt-outs, and report on results, including under white-label partners' brands.

Customer details

Name: The entity or other person that is the counterparty to the Agreement.
Contact for data protection: The account owner's email address on file, unless Customer designates another contact in writing.
Customer activities: Use and receipt of the Services under and in accordance with the Agreement, as part of Customer's ongoing business operations.

Processing details

Categories of Data Subjects: Customer's own customers, prospects, and subscribers whom Customer chooses to message through the Services; Customer's personnel and other business contacts who use or are referenced in the Services.

Categories of Personal Data: Personal details such as name and contact information (phone number, email address); consent and opt-out records and their source; tags, preferences, and segmentation data Customer applies; message content and delivery, reply, and click history; technological details such as device type and link click metadata.

Sensitive categories of data: None. As noted in Section 5.2, Restricted Data must not be submitted to the Services.

Frequency of transfer: Ongoing, as initiated by Customer in and through its use of the Services.

Nature and purpose of the Processing: Processing operations required to provide the Services and perform Memorable's obligations under the Agreement, as initiated by Customer and consistent with its documented instructions.

Duration and retention: For the period determined under the Agreement and Section 9 of this DPA.

Transfers to Subprocessors: As described in Annex 4.

Annex 2.State privacy laws

For purposes of this Annex, "business," "controller," "processor," "commercial purpose," "sell," "share," "service provider," and "contractor" have the meanings given in the applicable State Privacy Laws, and "personal information" means Personal Data to the extent it constitutes "personal information" or "personal data" (or a similar term) governed by the State Privacy Laws.

It is the Parties' intent that, with respect to any personal information, Memorable is a service provider, contractor, and/or processor under the State Privacy Laws. Memorable (a) acknowledges that personal information is disclosed by Customer only for the limited and specified purposes described in the Agreement; (b) will comply with its applicable obligations under the State Privacy Laws and provide the same level of privacy protection as the State Privacy Laws require; (c) agrees that Customer may take reasonable and appropriate steps to help ensure that Memorable's Processing of personal information is consistent with Customer's obligations under the State Privacy Laws; (d) will notify Customer in writing if it determines that it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Customer may, on reasonable notice, take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

Memorable will not (a) sell or share any personal information; (b) retain, use, or disclose personal information for any purpose other than the specific purpose of providing the Services, including for a commercial purpose other than providing the Services, except as otherwise permitted by the State Privacy Laws; (c) retain, use, or disclose personal information outside the direct business relationship between Memorable and Customer; or (d) combine personal information received from Customer with personal information received from another person or collected from Memorable's own interaction with a Data Subject, except as permitted by the State Privacy Laws and necessary to provide the Services. Memorable certifies that it understands these obligations and will comply with them.

Notice of Subprocessor engagements under Section 7 satisfies Memorable's obligation under the State Privacy Laws to give notice of, and an opportunity to object to, such engagements. Customer may conduct audits under Section 8 to help ensure that Memorable's use of personal information is consistent with its obligations under the State Privacy Laws. The Parties acknowledge that Memorable's retention, use, and disclosure of personal information as authorized by Customer's documented instructions is integral to the provision of the Services and the Parties' business relationship.

Annex 3.Security measures

• Responsibility. A named owner is responsible for the development, implementation, and maintenance of Memorable's information security program, with periodic review of risks and of compliance with Memorable's policies.
• Encryption. Personal Data is encrypted in transit over public networks using TLS, and at rest on the storage of Memorable's hosting provider. Passwords are stored only as salted hashes.
• Access control. Access to Personal Data is granted on a need-to-know and least-privilege basis, with unique user accounts and role-based permissions in the Services (owner, admin, member; partner and client scopes), multi-factor authentication on administrative cloud consoles, and prompt removal of access when a role changes or ends.
• Segregation. Customer accounts are logically segregated; each white-label partner and each client sees only its own data.
• Secrets and credentials. API keys, webhook secrets, and integration tokens are stored hashed or encrypted; keys are shown once at creation and can be revoked at any time.
• Logging and monitoring. System and application events, administrative actions, message sends, opt-outs, and consent events are logged, and anomalies are reviewed.
• Physical and environmental security. Infrastructure runs in the data centers of Memorable's hosting and cloud Subprocessors, which maintain physical access controls and environmental protections.
• Change management. Code changes are version-controlled, reviewed, and tested before deployment.
• Vulnerability and patch management. Dependencies and infrastructure are kept current, and identified vulnerabilities are assessed and remediated based on severity.
• Incident management. Procedures to investigate, respond to, mitigate, and notify in accordance with this DPA.
• Resilience. Databases are backed up by the hosting provider on a regular schedule, and services are designed to recover from foreseeable failures.
• Secure disposal. Personal Data is deleted or rendered unreadable when retention ends, in accordance with Section 9.

Annex 4.Subprocessors

Customer approves Memorable's engagement of the following Subprocessors to provide the Services:

Third-party services that Customer connects to its account (for example HubSpot, GoHighLevel, Zapier, or a webhook endpoint) receive data at Customer's direction and are Customer's own processors, not Memorable's Subprocessors.