Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Bratrax Terms of Service (the "Agreement") between Inceptly LLC, a Delaware limited liability company doing business as Bratrax ("Bratrax," "we," "us," or "Processor"), and the customer that has entered into the Agreement ("Customer," "you," or "Controller"). It governs Bratrax's processing of Personal Data on Customer's behalf and replaces the commitment in Section 5.8 of the Agreement to execute a separate data processing agreement on request.

1. Definitions

• "Customer Personal Data" means Personal Data contained within Customer Data (as defined in the Agreement) that Bratrax Processes on Customer's behalf under the Agreement.
• "Data Protection Laws" means all laws applicable to the Processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR, the Swiss FADP, the CCPA, and other U.S. state privacy laws.
• "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as incorporated into the law of the United Kingdom by the Data Protection Act 2018. "Swiss FADP" means the Swiss Federal Act on Data Protection.
• "CCPA" means the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act.
• "Personal Data," "Controller," "Processor," "Data Subject," "Processing," "Personal Data Breach," and "Supervisory Authority" have the meanings given in the GDPR. "Processing" and "Process" are construed accordingly.
• "SCCs" means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0.
• "Subprocessor" means any third party engaged by Bratrax to Process Customer Personal Data.
• "Security Documentation" means the description of Bratrax's technical and organizational measures published at bratrax.com/security, as updated from time to time, which forms Annex II of this DPA.

Capitalized terms not defined here have the meanings given in the Agreement.

2. Roles of the Parties

2.1 Customer as Controller, Bratrax as Processor

With respect to Customer Personal Data, Customer is the Controller and Bratrax is the Processor. This covers the data Customer connects to the Service from Connected Platforms, the data collected by the Bratrax storefront integration on Customer's own web properties, and the reports, dashboards, and attribution outputs Bratrax generates from it. The categories of Customer Personal Data are set out in Annex I.

Storefront tracking. The Bratrax storefront integration is deployed by Customer on Customer's own web properties. Customer decides whether to deploy it, determines the purposes for which it is used, and may remove it at any time. In respect of the data collected through it, Customer is the Controller and Bratrax is the Processor.

2.2 Customer as Processor

Where Customer is itself a Processor acting on behalf of a third-party controller — for example, an agency operating the Service for a client — Bratrax is a Subprocessor. In that case, references in this DPA to Customer's instructions mean instructions permitted by the relevant controller, and Customer warrants that it has the authority to give those instructions and to enter into this DPA on that controller's behalf. Module Three of the SCCs applies in place of Module Two.

2.3 Bratrax as Controller

Bratrax acts as an independent Controller for a narrow, separate category of data: account registration details of Customer's administrators and users (name, email address, company, role), billing metadata received from our payment processor, support correspondence, product usage telemetry, and website analytics collected on bratrax.com. That Processing is governed by our Privacy Policy, not by this DPA.

Some Personal Data is Processed in both capacities, for different purposes. The name, email address, and role of Customer's authorized users are Processed:

• by Bratrax as Processor, where it creates, administers, and removes user accounts, assigns and enforces roles, and records access to Customer Data — all on Customer's instruction and governed by this DPA; and
• by Bratrax as Controller, where it authenticates those users, bills Customer, sends service and marketing communications, provides support, and measures product usage — purposes Bratrax determines for itself, governed by the Privacy Policy.

Where a Data Subject exercises a right in respect of that data, Bratrax will act on Customer's instruction in respect of the Processing described in the first bullet, and will respond directly to the Data Subject in respect of the second.

2.4 Details of Processing

The subject matter, duration, nature, and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex I.

3. Customer's Instructions and Responsibilities

3.1 Documented instructions

Bratrax will Process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by applicable law. In that case, Bratrax will inform Customer of the legal requirement before Processing, unless the law prohibits such notice on important grounds of public interest.

The Agreement, this DPA, and Customer's use and configuration of the Service — including which platforms Customer connects, which attribution models Customer selects, which users Customer authorizes, and which optional features Customer enables — constitute Customer's complete documented instructions. Additional or alternative instructions are binding only if agreed in a written amendment to this DPA, and may be subject to additional fees.

3.2 Lawfulness

Customer is responsible for the accuracy, quality, and lawfulness of Customer Personal Data and for the lawfulness of the means by which Customer acquired it. Customer represents that it has provided all required notices, obtained all required consents, and has a valid legal basis for the Processing instructed under this DPA, including for the collection of data through the Bratrax storefront integration on Customer's web properties and for the connection of each Connected Platform.

Customer is responsible for maintaining the security of the systems, accounts, and credentials it uses to access the Service, and for the secure configuration of the Connected Platforms it connects. Customer agrees that the Service, the Security Documentation, and Bratrax's commitments under this DPA are appropriate to the nature of the Customer Personal Data Customer connects.

3.3 Data the Service is not designed for

The Service is built for commerce and advertising data. It is not designed to Process the categories below.

Customer must not submit to the Service, or connect a data source containing:

• special categories of Personal Data under Article 9 of the GDPR, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation;
• Personal Data relating to criminal convictions or offences under Article 10 of the GDPR;
• information protected under HIPAA or comparable health-privacy laws;
• financial account numbers, payment card numbers, or cardholder data;
• government-issued identifiers, such as social security, passport, or national insurance numbers; or
• precise geolocation data gathered for the purpose of locating an individual — for example a feed from a location-tracking service, a mobile device, or telemetry hardware.

Children's data. The Service is not directed to children, and Bratrax does not knowingly collect Personal Data from them. Customer must not use the Service to knowingly Process the Personal Data of children, to target children, or to load or connect a data source consisting of or intended to comprise children's Personal Data. Customer remains responsible for its own obligations under applicable children's privacy law, including any age verification or parental consent requirements that apply to Customer's business.

Remediation. On becoming aware that Personal Data of a prohibited category has arrived, Customer will take reasonable steps to remove it and to prevent recurrence. Bratrax may suspend an affected data flow where continued Processing would present a legal or security risk.

3.4 Unlawful instructions

Bratrax will inform Customer if, in its opinion, an instruction infringes Data Protection Laws. Bratrax may suspend performance of the affected instruction until Customer modifies or confirms it, and is not obliged to carry out an instruction it reasonably believes to be unlawful.

3.5 Consent for storefront tracking

Customer is responsible for obtaining and maintaining any consent required, under Article 5(3) of Directive 2002/58/EC as implemented in the applicable jurisdiction and under any equivalent law, for the storing of information on and reading of information from the terminal equipment of visitors to Customer's web properties by the Bratrax storefront integration, and for providing visitors with the information required in connection with it. This includes ensuring that the integration is not loaded before any required consent has been obtained. That responsibility is distinct from, and additional to, Customer's responsibility under Section 3.2 for the lawful basis of the Processing itself.

Bratrax does not obtain consent from visitors, has no interface with them, and does not determine whether consent is required in any jurisdiction. Bratrax Processes data received through Connected Platforms only to the extent Customer has authorised that access, and Customer may revoke it at any time from the relevant platform.

3.6 Transmission to platforms Customer designates

Where Customer enables a feature that transmits Customer Personal Data to a third-party platform Customer has designated, Bratrax makes that transmission on Customer's documented instruction. Enabling the feature constitutes that instruction. The receiving platform is not a Bratrax Subprocessor: it receives the data under Customer's own arrangements with it and Processes it for its own purposes.

Customer is responsible for the legal basis for the transmission and for any consent required for it, which is distinct from Customer's responsibilities under Sections 3.2 and 3.5. Customer is responsible for not instructing a transmission that would infringe a Data Subject's rights, including those of individuals who have withdrawn consent, objected, or opted out of the sale or sharing of personal information. Bratrax will provide reasonable assistance in giving effect to such an exclusion, to the extent the Service provides a mechanism for that purpose.

Customer may disable the feature at any time.

4. Bratrax's Obligations

4.1 Confidentiality

Bratrax ensures that persons authorized to Process Customer Personal Data are bound by an appropriate obligation of confidentiality, whether by contract or statutory duty, and that access is limited to personnel who need it to perform the Agreement.

4.2 Security

Bratrax implements and maintains the technical and organizational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing. Bratrax may update those measures from time to time provided the overall level of security is not materially reduced.

4.3 Assistance with Customer's obligations

Taking into account the nature of the Processing and the information available to it, Bratrax will provide reasonable assistance to Customer in:

• responding to Data Subject requests (Section 6);
• ensuring compliance with the security obligations in Article 32 of the GDPR;
• notifying Personal Data Breaches under Articles 33 and 34 (Section 7); and
• carrying out data protection impact assessments and prior consultations with Supervisory Authorities under Articles 35 and 36, by making available the documentation described in Annex II and Section 9.

Where Customer can fulfil a request through the self-service features of the Service, that use is included at no additional charge. Assistance under this Section that requires Bratrax's manual effort beyond those features — for example, bespoke support for a data protection impact assessment or a prior consultation — may be charged at Bratrax's then-current professional services rates, notified to Customer in advance.

5. Subprocessors

5.1 General authorization

Customer gives Bratrax general written authorization to engage Subprocessors, subject to this Section 5, and authorizes the Subprocessors listed in Annex III as at the effective date of this DPA.

5.2 Terms imposed on Subprocessors

Bratrax will engage each Subprocessor under a written contract imposing data protection obligations that are, in substance, no less protective than those in this DPA. Bratrax remains fully liable to Customer for a Subprocessor's performance of its data protection obligations.

5.3 Notice of changes

Bratrax will give Customer at least 30 days' notice before a new Subprocessor begins Processing Customer Personal Data, by updating the Subprocessor list at Annex III and sending notice to the email address associated with Customer's account administrator. Customer is responsible for keeping that address current.

5.4 Objection

Customer may object to a new Subprocessor on reasonable data protection grounds by emailing legal@bratrax.com within 15 days of that notice, stating the grounds. The parties will work together in good faith to find a commercially reasonable alternative — for example, disabling the affected feature for Customer. If no such alternative is available within 60 days of the objection, Customer may terminate the portion of the subscription that cannot be provided without the objected-to Subprocessor, on written notice. Termination on this ground is the sole remedy for an unresolved objection. Fees already paid are not refunded, consistent with Sections 4.3 and 15.2 of the Agreement.

5.5 Emergency replacement

Where a Subprocessor must be replaced urgently for security, availability, or legal reasons, Bratrax may do so without the 30-day notice period, and will inform Customer as soon as reasonably practicable. Customer's objection right under Section 5.4 continues to apply after the fact.

6. Data Subject Rights

The Service provides Customer with self-service means to access and export Customer Personal Data. Correction or deletion of an individual Data Subject's records is actioned by Bratrax on Customer's written request; where that requires manual effort beyond the self-service features of the Service, Bratrax may charge for it as set out in Section 4.3. Customer is responsible for responding to Data Subject requests in the first instance.

If Bratrax receives a request from a Data Subject relating to Customer Personal Data, Bratrax will not respond to it directly except to acknowledge receipt and direct the Data Subject to Customer, unless legally required to respond or Customer has authorized Bratrax to do so. Bratrax will notify Customer of the request without undue delay.

Where Customer cannot fulfil a request through the Service, Bratrax will provide reasonable assistance on written request to legal@bratrax.com. Assistance beyond what is reasonably necessary, or which is repetitive or manifestly unfounded, may be subject to a reasonable charge notified to Customer in advance.

7. Personal Data Breach

Bratrax will notify Customer of a Personal Data Breach affecting Customer Personal Data in Bratrax's possession, custody, or control without undue delay after becoming aware of it. Notice will be sent to the email address associated with Customer's account administrator.

This Section does not apply to a security incident caused by Customer or by anyone accessing the Service using Customer's credentials or on Customer's behalf.

For the purposes of this Section, Bratrax becomes aware of a Personal Data Breach when it has established, with reasonable certainty, that such a breach has occurred.

The notice will describe, to the extent known at the time: the nature of the breach including, where possible, the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information. Where that information is not all available at the time of notification, Bratrax will provide an initial notice containing the information then available and will supplement it in phases without undue further delay as the investigation progresses. An initial notice given on that basis satisfies the notification obligation in this Section.

Bratrax will take reasonable steps to contain and investigate the breach and will provide Customer with reasonable cooperation in meeting Customer's own notification obligations to Supervisory Authorities and Data Subjects. Where Customer's notification to a Supervisory Authority or to Data Subjects identifies Bratrax by name, Customer will give Bratrax advance notice of the proposed reference and consult with Bratrax in good faith on it. Bratrax's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

8. Security Measures

Bratrax's technical and organizational measures are described in Annex II. Two apply as structural properties of the Service:

• Per-customer isolation. Each customer's data is held in a dedicated logical data store. Bratrax does not commingle one customer's data with another's.
• EU data residency. Customer Personal Data is hosted on servers in the European Union (Finland). Backups are held in the United States, as described in Section 10.1.

These structural measures form part of the measures described in Annex II, and Bratrax may change how they are implemented in accordance with Section 4.2, provided the overall level of protection is not materially reduced.

9. Audits and Information

Bratrax will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR. In the first instance this means the information published in this DPA and its Annexes, including the Security Documentation, together with any security questionnaire responses or third-party audit reports Bratrax makes generally available to customers.

Bratrax maintains a record of the categories of Processing carried out on behalf of Customer in accordance with Article 30(2) of the GDPR, and will make that record available to a Supervisory Authority on request.

Where Bratrax holds a current third-party audit report or certification covering the Service — including a SOC 2 Type 2 report, an ISO/IEC 27001 certification, or an equivalent assessment against a recognised control framework — provision of that report to Customer satisfies Bratrax's obligations under this Section in respect of the matters covered by it, provided the report was issued within the preceding 12 months and Bratrax is not aware of any material change to the controls it covers. Bratrax may require the report to be treated as Confidential Information.

Where that information is not sufficient, Customer may request an audit by emailing legal@bratrax.com, subject to the following:

• audits are limited to once in any 12-month period, except where required by a Supervisory Authority or by applicable Data Protection Laws;
• Customer gives at least 30 days' written notice and the parties agree the scope, timing, and duration in advance;
• audits are conducted during business hours, in a manner that does not disrupt Bratrax's operations, and must not require access to any other customer's data or to Bratrax's premises where that would compromise the security or confidentiality of other customers;
• any auditor engaged by Customer must not be a competitor of Bratrax and must be bound by confidentiality obligations at least as protective as those in the Agreement;
• any automated scanning, penetration testing, or other technical or intrusive testing of the Service requires Bratrax's prior written approval;
• Customer bears its own costs and Bratrax's reasonable costs of supporting the audit; and
• on Bratrax's request following an audit, Customer will return or destroy the records it obtained, subject to any legal retention requirement.

Audit findings are the Confidential Information of both parties. Where the Agreement grants Customer audit or inspection rights covering the same subject matter, this Section applies in their place and not in addition to them. When exercising any information, audit, or transparency right under this DPA or the SCCs, Customer will protect, and will not require the disclosure of, Bratrax's confidential information and trade secrets.

10. International Transfers

10.1 Where data is held and who accesses it

Customer Personal Data is hosted on servers in the European Union (Finland). Backups are held in cloud storage located in the United States.

Bratrax is a United States company. Its personnel and contractors work remotely and access Customer Personal Data from countries outside the EEA. Those transfers are made under the Standard Contractual Clauses as set out in Section 10.2. Certain Subprocessors listed in Annex III are located in the United States.

10.2 Standard Contractual Clauses

Where Bratrax Processes Personal Data protected by the GDPR and transfers it to a country that has not been the subject of an adequacy decision, the SCCs are incorporated into this DPA by reference and apply, completed as follows:

• Module Two (Controller to Processor) applies where Customer is a Controller. Module Three (Processor to Processor) applies where Customer is a Processor acting on behalf of a third-party controller.
• Clause 7 (docking clause) is not included.
• Clause 9(a): Option 2 (general written authorization) applies, with the notice period specified in Section 5.3 of this DPA.
• Clause 11(a): the optional independent dispute resolution provision is not included.
• Clause 13: the competent Supervisory Authority is identified in Annex I, Section C.
• Clause 17: Option 1 applies. The SCCs are governed by the law of Ireland.
• Clause 18(b): disputes are resolved before the courts of Ireland.
• Annex I, II, and III of the SCCs are populated by Annexes I, II, and III of this DPA respectively.

For the avoidance of doubt, Customer is the "data exporter" and Bratrax is the "data importer." On written request to legal@bratrax.com, Bratrax will provide Customer with an executed copy of the SCCs as completed by this DPA.

10.3 United Kingdom

Where Personal Data is protected by the UK GDPR, the UK Addendum applies to the SCCs and is completed as follows: Table 1 (parties) is populated by Annex I, Section A; Table 2 selects the SCCs as incorporated in Section 10.2 above; Table 3 (appendix information) is populated by Annexes I, II, and III of this DPA; and in Table 4, neither party may end the Addendum as set out in Section 19 of the Addendum. References in the SCCs to the GDPR are read as references to the UK GDPR, and the competent authority is the UK Information Commissioner's Office.

10.4 Switzerland

Where Personal Data is protected by the Swiss FADP, the SCCs apply with the following amendments: references to the GDPR are read as references to the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; and the term "member state" does not exclude Data Subjects in Switzerland from bringing proceedings in their place of habitual residence.

10.5 Alternative transfer mechanisms

If the SCCs, the UK Addendum, or the Swiss amendments are invalidated, superseded, or replaced, or if a different transfer mechanism becomes available and applicable, Bratrax may adopt that mechanism on notice to Customer, and it will apply in place of the mechanism it replaces. Bratrax will implement supplementary technical and organizational measures where required to ensure an essentially equivalent level of protection.

10.6 Government access requests

If Bratrax receives an order or request from a public authority for disclosure of Customer Personal Data, it will, to the extent legally permitted, notify Customer without undue delay, challenge requests that are unlawful or overbroad, and disclose only the minimum amount of data legally required. Where notice is prohibited, Bratrax will use reasonable efforts to obtain a waiver of the prohibition.

10.7 Local laws and transfer impact assessment

Clause 14 of the SCCs requires the parties to assess whether the laws and practices of each country of destination would prevent Bratrax from fulfilling its obligations under the SCCs. Bratrax will maintain a documented assessment covering the transfers described in Section 10.1: each country in which Customer Personal Data is stored or from which it is accessed, the laws and practices of those countries relevant to public authority access, and the technical, organisational, and contractual measures Bratrax applies to supplement the protections in the SCCs.

Bratrax will make that assessment available to Customer on request to legal@bratrax.com, so that Customer may rely on it in carrying out its own assessment as data exporter, and will make it available to a competent Supervisory Authority on request. Bratrax will provide Customer with such further information as Customer reasonably requires in order to complete its own assessment.

Bratrax will review the assessment at least annually, and additionally where it becomes aware of a material change in the laws or practices of a country of destination or in the circumstances of a transfer. Where a review concludes that the measures in place no longer ensure a level of protection essentially equivalent to that guaranteed within the EEA, Bratrax will notify Customer and will either suspend the affected transfer or implement additional safeguards.

11. Artificial Intelligence Features

11.1 AI features Bratrax operates

Where Customer enables an AI feature that Bratrax operates, Customer Personal Data is transmitted to an AI Subprocessor listed in Annex III for the sole purpose of generating the response, and only when a user invokes the feature. Where Customer supplies its own API key for the relevant AI provider, that traffic runs under Customer's own agreement with that provider and not under this DPA.

11.2 AI providers Customer connects

Customer may connect its own third-party AI client to the Service using an access token that Customer generates and controls. Bratrax returns Customer Personal Data to that client on Customer's documented instruction, as Customer's Processor, on the same basis as Customer's own queries through the Service.

The AI provider Customer connects is not a Bratrax Subprocessor. Bratrax does not determine the purposes or means of that provider's Processing and has no contractual relationship with it in respect of Customer Personal Data. Customer is responsible for its own terms with that provider and for the legal basis for that Processing. Customer may terminate the connection at any time by regenerating or deleting the access token.

11.3 Delivery into Slack

Where Customer installs the Bratrax assistant into a Slack workspace Customer controls, Slack Processes the delivered content under Customer's own agreement with Slack and is not a Bratrax Subprocessor in that flow. Where content is delivered into a channel of the Bratrax community Slack workspace, which Bratrax operates under its own agreement with Slack, Slack acts as a Bratrax Subprocessor and is listed on that basis in Annex III. Customer is responsible for controlling membership of any channel linked to its account.

Bratrax does not store the content of Slack messages.

11.4 No use of Customer Personal Data to train AI models

Bratrax does not use Customer Personal Data to train, fine-tune, or otherwise develop any machine learning or artificial intelligence model.

Customer Personal Data transmitted to an AI Subprocessor under Section 11.1 is used solely to generate a response to the requesting user and is not used to train that provider's models. Bratrax will not engage an AI Subprocessor that reserves the right to train on Customer Personal Data, and will give notice under Section 5.3 before engaging any new AI Subprocessor.

Where Customer connects its own AI provider under Section 11.2, that provider's training and retention practices are governed by Customer's agreement with it, and Bratrax gives no commitment on its behalf.

12. Deletion and Return

Customer's choice. On termination or expiry of the Agreement, Customer may direct Bratrax to return or to delete Customer Personal Data. Customer may exercise that choice at any time, before or after termination, by written notice to legal@bratrax.com.

Return. Customer may export Customer Personal Data in a structured, commonly used, machine-readable format at any time during the Agreement and during the 30 days following termination, using the export functions of the Service. Where Customer is unable to export data it is entitled to, Bratrax will provide reasonable assistance on written request.

Deletion on request. Where Customer directs deletion, Bratrax will delete Customer Personal Data from its live systems within 30 days of the direction. Deletion under this paragraph is irreversible. Once performed, Customer Personal Data cannot be restored and any later restoration request cannot be met. Customer should export anything it wishes to keep before directing deletion.

Where Customer gives no direction. Where Customer has not directed return or deletion, Bratrax will retain Customer Personal Data on the following schedule, which mirrors Section 15.4 of the Agreement, so that Customer's data is not lost through inadvertent lapse of the subscription:

• Days 0–30 after termination: Customer retains access to the Service and may export Customer Personal Data.
• Days 31–180: Customer Personal Data is held in cold storage, inaccessible to Customer, and may be restored on Customer's written request.
• After 180 days: Bratrax permanently deletes Customer Personal Data.

Customer may direct deletion at any point during that period, which ends the schedule and takes effect as set out above.

Retention required by law. Bratrax may retain Customer Personal Data to the extent required by applicable law, or as necessary for the establishment, exercise, or defence of legal claims, and where it does so will continue to protect it under this DPA and Process it only for the purpose requiring retention.

Backups. Backup copies are not deleted individually. They are removed as the backups containing them age out on rotation, which means a copy may persist in backup for up to 90 days after deletion from the live systems.

Certification. On Customer's written request, Bratrax will certify deletion in writing.

13. Aggregated and De-Identified Data

Bratrax creates aggregated and de-identified data from Customer Data in the course of operating the Service. Bratrax performs that de-identification as Customer's Processor and on Customer's instruction. Once data has been aggregated and de-identified such that it no longer relates to an identified or identifiable natural person, it is no longer Personal Data and this DPA does not apply to it.

Bratrax takes reasonable measures to ensure that aggregated and de-identified data cannot be associated with, or reasonably linked to, an individual consumer, household, or device. De-identification is performed on Customer Personal Data within Customer's own data environment before that data is combined with data derived from any other customer. Bratrax will not attempt to re-identify aggregated or de-identified data, except solely to test whether its de-identification processes are effective, and will contractually require any recipient of such data to observe the same restrictions.

Bratrax uses aggregated and de-identified data only to operate, secure, improve, and develop the Service.

Bratrax does not publish industry benchmarks derived from Customer Data — that is, comparative performance metrics presented as a reference point for the market.

Bratrax may describe patterns, trends, and observations it has drawn from operating the Service, in its marketing, product communications, and educational content, provided that: (i) no individual Customer is identified or reasonably identifiable from the description; (ii) the description is not attributed to any Customer, and does not disclose any Customer's own metrics; and (iii) any figure is drawn from a population large enough that no Customer's contribution can be inferred from it. Bratrax will not disclose a specific Customer's data or results without that Customer's written consent.

14. U.S. State Privacy Laws

14.1 California (CCPA/CPRA)

Where Bratrax Processes Personal Data subject to the CCPA, Bratrax acts as a "service provider" and Customer as the "business." Terms used in this Section 14.1 and not defined in this DPA have the meanings given in the CCPA.

Business purposes. Customer discloses Personal Data to Bratrax only for the following limited and specified business purposes, and for no others:

• retrieving Personal Data from the Connected Platforms Customer has authorized, and from the Bratrax storefront integration Customer has installed;
• structuring, storing, joining, and resolving that data across sources to produce order-level marketing attribution for Customer;
• generating and delivering Customer's dashboards, reports, and data exports;
• where Customer has enabled an AI feature that Bratrax operates under Section 11.1, generating responses to questions Customer's users ask through that feature;
• administering Customer's user accounts, roles, and access to the Service;
• providing technical support to Customer, including investigating and resolving issues Customer reports;
• maintaining, monitoring, and repairing the Service, including debugging to identify and repair errors that impair its existing intended functionality, and helping to ensure the security and integrity of the Service, in each case to the extent reasonably necessary and proportionate for those purposes;
• creating aggregated and de-identified data as described in Section 13; and
• transmitting Customer Personal Data to a third-party platform Customer has designated, as described in Section 3.6.

Where Customer connects its own AI client under Section 11.2, Bratrax's retrieval and transmission of Customer Personal Data to that client is a disclosure made on Customer's documented instruction and at Customer's direction, on the same basis as Customer's own queries through the Service. Bratrax does not retain, use, or disclose that Personal Data for any purpose of its own in connection with that flow.

Restrictions. Bratrax will not:

• sell or share Customer Personal Data, as "sell" and "share" are defined under the CCPA, without Customer's instruction. Where Customer instructs a transmission under Section 3.6, that disclosure is made by Customer as the business and at Customer's direction; Bratrax does not make it for its own purposes and receives no consideration for it;
• retain, use, or disclose Customer Personal Data for any purpose other than the business purposes listed above, or as otherwise permitted by the CCPA;
• retain, use, or disclose Customer Personal Data for any commercial purpose other than those business purposes, unless expressly permitted by the CCPA;
• retain, use, or disclose Customer Personal Data outside the direct business relationship between Bratrax and Customer; or
• combine Customer Personal Data with personal information received from, or on behalf of, any other person, or collected from Bratrax's own interactions with a consumer, except as expressly permitted by the CCPA.

No sale or exchange of value. Customer's disclosure of Personal Data to Bratrax is made solely to enable Bratrax to perform the services described in the Agreement, and Bratrax's access to that Personal Data does not form any part of the consideration exchanged between the parties under the Agreement. Bratrax provides no monetary or other valuable consideration to Customer in exchange for Personal Data, and receives none from Customer for any purpose other than the provision of the Service. Bratrax does not sell or share Personal Data collected under the Agreement.

Level of protection. Bratrax will comply with all applicable requirements of the CCPA and, with respect to Customer Personal Data it collects under the Agreement, will provide the same level of privacy protection as the CCPA requires of businesses. This includes implementing reasonable security procedures and practices appropriate to the nature of that Personal Data.

Customer's oversight rights. Customer may take reasonable and appropriate steps to ensure that Bratrax uses Customer Personal Data in a manner consistent with Customer's obligations under the CCPA. Those steps may include reviewing the documentation Bratrax makes available under Section 9 and exercising the audit rights in that Section, subject to the conditions set out there.

Consumer requests. Bratrax will enable Customer to comply with consumer requests made under the CCPA, through the self-service means described in Section 6 and, where those are not sufficient, through the assistance described in that Section. Where Customer receives a consumer request that requires action by Bratrax, Customer will inform Bratrax of the request and provide the information Bratrax needs to give effect to it.

Certification and notice. Bratrax certifies that it understands the restrictions in this Section 14.1 and will comply with them. Bratrax will notify Customer if it determines that it can no longer meet its obligations under the CCPA. On such notice, or on becoming aware of unauthorized use of Customer Personal Data by Bratrax, Customer may take reasonable and appropriate steps to stop and remediate that use.

Subcontractors. Bratrax engages Subprocessors that Process Personal Data subject to the CCPA only under a written contract that complies with the CCPA, including the requirements of this Section 14.1.

Construction. Any ambiguity in this Section 14.1 is resolved in favour of compliance with the CCPA.

14.2 Other U.S. state privacy laws

Where Bratrax Processes Personal Data subject to a comprehensive U.S. state privacy law other than the CCPA — including the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, and comparable state laws as they take effect — Bratrax acts as a "processor" and Customer as the "controller," and the following apply. Each is already provided for elsewhere in this DPA; this Section restates them in the form those statutes require.

• Instructions and scope. Bratrax Processes Personal Data only in accordance with Customer's instructions (Section 3.1). The nature and purpose of the Processing, the types of Personal Data, the categories of Data Subjects, the duration, and the rights and obligations of both parties are set out in this DPA and in Annex I.
• Confidentiality. Each person Processing the Personal Data is subject to a duty of confidentiality (Section 4.1).
• Deletion or return. At Customer's direction, Bratrax will delete or return the Personal Data at the end of the provision of services, unless retention is required by law (Section 12).
• Demonstrating compliance. Bratrax will make available to Customer the information reasonably necessary to demonstrate compliance with its obligations (Section 9).
• Assessments. Bratrax will allow and cooperate with reasonable assessments by Customer or Customer's designated assessor, in accordance with Section 9. Alternatively, Bratrax may arrange for a qualified and independent assessor to assess Bratrax's policies and technical and organizational measures using an appropriate and accepted control standard or framework and assessment procedure, and provide a report of that assessment to Customer on request.
• Subcontractors. Bratrax engages Subprocessors only under a written contract requiring the Subprocessor to meet Bratrax's obligations in respect of the Personal Data (Section 5.2).

Where a state law imposes a mandatory contractual requirement not addressed above, that requirement applies to the extent it is mandatory, and this Section 14.2 is construed to give it effect.

15. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or any other theory, is subject to the limitations and exclusions of liability set out in Section 12 of the Agreement. Any reference in the Agreement to the liability of a party means the aggregate liability of that party under the Agreement and this DPA together.

Nothing in this Section 15 limits either party's liability to Data Subjects under the third-party beneficiary provisions of the SCCs, or any liability that cannot be limited or excluded under Data Protection Laws.

16. Term, Changes, and Precedence

16.1 Term

This DPA takes effect when Customer accepts the Agreement and continues until Bratrax has deleted all Customer Personal Data in accordance with Section 12. Provisions that by their nature should survive termination do so.

16.2 Changes to this DPA

Bratrax may update this DPA where necessary to reflect a change in Data Protection Laws, a change in an approved transfer mechanism, or a material change in the nature of the Processing carried out under the Service, and may make non-material corrections and clarifications at any time. Bratrax will give at least 30 days' notice of any material change by posting an updated version on this page and notifying Customer's account administrator, except where a shorter period is required to comply with law or to address a security risk.

Changes will not materially reduce the protections afforded to Customer Personal Data. Where Customer reasonably considers that a change does materially reduce those protections, Customer may notify Bratrax within the notice period, and the parties will discuss the change in good faith. If the parties do not resolve the matter within 30 days, Customer may terminate the affected portion of the subscription on written notice. Fees already paid are not refunded.

This Section does not permit Bratrax to vary the SCCs, the UK Addendum, or the Swiss amendments, which may only be modified as those instruments permit.

16.3 Order of precedence

In the event of a conflict, the following order applies: (i) the SCCs (including the UK Addendum and Swiss amendments) as incorporated in Section 10; (ii) this DPA; (iii) the Agreement; (iv) the Privacy Policy. A Service Agreement does not vary this DPA unless it expressly says so and is signed by both parties.

16.4 Governing law

Except for the SCCs, which are governed as set out in Section 10.2, this DPA is governed by the law identified in Section 16 of the Agreement.

17. Contact

Data protection contact: legal@bratrax.com Entity: Inceptly LLC, a Delaware limited liability company, doing business as Bratrax Mail: 131 Morninghill Drive, Columbia, SC 29210, USA EU and UK representative: Prighter Group, appointed under Article 27 of the GDPR and Article 27 of the UK GDPR. Bratrax's EU representative is established in Ireland. Data subjects may contact the representative at https://app.prighter.com/portal/14060742704

Requests for security questionnaire responses, subprocessor notifications, audit requests, and data subject assistance all go to legal@bratrax.com.

Annex I — Description of Processing

This Annex populates Annex I of the SCCs and Table 1 and Table 3 of the UK Addendum.

A. List of Parties

B. Description of Transfer

Categories of Data Subjects

• Customer's end customers and purchasers.
• Visitors to Customer's web properties, including anonymous visitors identified only by a session or device identifier.
• Subscribers to Customer's email and SMS marketing lists.
• Customer's authorized users of the Service.

Categories of Personal Data

• Identifiers: name, email address, telephone number, postal address, customer ID, order ID, anonymous visitor and session identifiers, hashed identifiers used for identity resolution.
• Commercial data: order and transaction history, line items, product interest, order value, currency, refund and subscription status, abandoned checkout records.
• Marketing engagement data: email and SMS opens, clicks, and delivery events; campaign and flow membership.
• Online activity data: page views, referrer, UTM parameters and click identifiers, timestamps, and derived touchpoint and attribution records.
• Technical data: IP address, user agent, browser and device type.
• Account data for Customer's authorized users: name, email address, role, and authentication metadata — included here to the extent Bratrax Processes it as Processor for user administration and access control. Bratrax's separate Controller-capacity Processing of the same data is described in Section 2.3 and governed by the Privacy Policy.

Advertising platform data (campaign structure, spend, impressions, clicks, and aggregate conversion counts) is generally not Personal Data, but is included here to the extent it relates to an identifiable individual.

Sensitive data

None. The Service is not designed to Process special categories of Personal Data, and Section 3.3 prohibits Customer from submitting them.

Frequency of the transfer

Continuous, on an ongoing basis for the duration of the Agreement.

Nature and purpose of the Processing

Collection, retrieval, structuring, storage, organization, joining across sources, identity resolution, aggregation, analysis, and deletion — for the purpose of providing marketing attribution analytics, dashboards, and reporting to Customer, and for maintaining, securing, and supporting the Service.

Retention period

For the duration of the Agreement, and thereafter as set out in Section 12 of this DPA.

Subprocessor transfers

The Subprocessors listed in Annex III Process Customer Personal Data for the purposes and durations stated there.

C. Competent Supervisory Authority

Where Customer is established in the EEA, the competent Supervisory Authority is that of the EEA member state in which Customer is established. Where Customer is not established in the EEA but its Processing falls within the scope of the GDPR under Article 3(2) and it has appointed a representative under Article 27, the competent Supervisory Authority is that of the member state in which that representative is established. Where Customer is not established in the EEA and has appointed no such representative, the competent Supervisory Authority is that of a member state in which the Data Subjects whose Personal Data is transferred are located; the parties designate the Irish Data Protection Commission for that purpose.

Bratrax has appointed a representative under Article 27 of the GDPR, established in Ireland, and a representative under Article 27 of the UK GDPR. Contact details are in Section 17.

For transfers subject to the UK GDPR, the competent authority is the UK Information Commissioner's Office. For transfers subject to the Swiss FADP, it is the Swiss Federal Data Protection and Information Commissioner.

Annex II — Technical and Organizational Measures

This Annex populates Annex II of the SCCs. The technical and organizational measures Bratrax maintains are described in its Security Documentation, published at https://bratrax.com/security, which forms part of this Annex and is updated from time to time provided the overall level of security is not materially reduced. Those measures address, at a minimum:

• encryption in transit, and pseudonymization of anonymous visitor activity;
• confidentiality obligations and role-based, least-privilege access control, with administrative access logged;
• per-customer data isolation, enforced by application-level access controls;
• data residency in the European Union, with encrypted, monitored backups;
• resilience and restoration, including rebuild from source data;
• security incident detection, investigation, and notification; and
• secure development and change control, and written data protection terms imposed on every Subprocessor.

Annex III — Subprocessors

This Annex populates Annex III of the SCCs. The current list of Subprocessors authorized to Process Customer Personal Data is published at https://bratrax.com/subprocessors, which forms part of this Annex. Changes are notified in accordance with Section 5.3, and Customer may object under Section 5.4. Transfers to Subprocessors located outside the EEA are made under the transfer mechanisms described in Section 10, and each such Subprocessor is bound by data protection terms no less protective, in substance, than those in this DPA.