Terms of service

This Master Services Agreement (the "Agreement") is between FourLeaf LLC d/b/a SafeReact, a Wyoming limited liability company with its office at 30 N. Gould St., Ste. #5497, Sheridan, WY 82801 ("FourLeaf," "Provider," "we," or "us"), and the customer identified in the applicable Order Form or account registration ("Customer" or "you"). Each is a "Party."

THIS AGREEMENT CONTAINS A BINDING INDIVIDUAL ARBITRATION PROVISION AND CLASS ACTION WAIVER IN SECTION 13.

Acceptance. Customer accepts this Agreement by (a) clicking to accept during account registration, (b) executing an Order Form that references this Agreement, or (c) accessing or using the Service. An individual accepting on behalf of an entity represents that he or she has authority to bind it. If Customer does not accept this Agreement, Customer may not access or use the Service.

1. Definitions

• "Affiliate" means an entity that controls, is controlled by, or is under common control with a Party, where control means ownership of 51% or more of the voting interests.
• "Applicable Law" means all laws and regulations applicable to a Party's activities under this Agreement, including the CAN-SPAM Act, the Telephone Consumer Protection Act, the California Consumer Privacy Act, and other state privacy laws.
• "Connected Platform" means a third-party email service provider, marketing platform, or other system that Customer connects to the Service.
• "Credit" means a prepaid unit of Service consumption, as described in Section 6.
• "Customer Data" means (a) any list, file, or record Customer submits to the Service, including email addresses in plain text or a hash format the Service supports, and associated fields, and (b) data the Service accesses from a Connected Platform on Customer's behalf.
• "Customer Registration Data" means information Customer provides when registering or contacting Provider, such as name, company name, work email, website, and billing information.
• "Intellectual Property Rights" means all patent, copyright, trademark, trade secret, and other intellectual property rights.
• "Order Form" means an ordering document executed by the Parties that references this Agreement, substantially in the form of Exhibit A, or an online checkout.
• "Provider Technology" means all proprietary technology, models, software, and data Provider uses to provide the Service.
• "Results" means the scores, verdicts, reason codes, recommended actions, appended data, and other outputs the Service returns for Customer Data, including records the Service recommends against mailing.
• "Service" means SafeReact's email hygiene, reactivation scoring, audience scoring, data append, and Connected Platform sync services accessed through the Site, including any API, dashboard, and file exchange, and the Results.
• "Site" means www.safereact.com.
• "Suppression Notice" means a notice from Provider identifying records that must not be mailed, sold, shared, or further processed under Applicable Law, including deletion requests received through the California Delete Request and Opt-out Platform.

2. Services and License

2.1 Services

Provider will provide the Service as described on the Site and in any Order Form.

2.2 License

Subject to Customer's compliance with this Agreement and payment of all fees, Provider grants Customer a non-exclusive, non-transferable, non-sublicensable right during the term to access and use the Service for Customer's internal business purposes.

2.3 Results

Provider grants Customer a perpetual, non-exclusive, non-transferable license to use Results downloaded or synced during the term for Customer's internal business purposes, subject to Sections 2.5 and 3.

2.4 Agency Use

Customer may use the Service to process data on behalf of its own clients, provided Customer has the authority to submit that data and remains responsible for its clients' compliance with this Agreement. Resale, white-label distribution, or channel arrangements require a separate written agreement with Provider.

2.5 Restrictions

Customer will not, and will not permit any third party to:

1. resell, sublicense, or make the Service available to a third party, except as permitted by Section 2.4;
2. resell, redistribute, or disclose appended data contained in Results to any third party;
3. modify, create derivative works of, reverse engineer, decompile, or disassemble the Service;
4. use the Service or Results to send unsolicited or unlawful email or text messages;
5. use the Service or Results for any data category or use case covered by a Special Use Policy, except in compliance with that Special Use Policy and any separate agreement it requires (Section 2.8);
6. use the Service to harvest email addresses or to determine whether unknown email addresses exist;
7. use the Service for competitive analysis or benchmarking, or to build a competing product or service;
8. probe, scan, or test the vulnerability of the Service, or interfere with or disrupt it;
9. upload unlawful, infringing, or malicious content or code; or
10. attempt to gain unauthorized access to the Service or related systems.

2.6 Connected Platforms

If Customer connects a Connected Platform, Customer authorizes Provider to access that platform and to read and write data, including contact profile properties and segments, as needed to perform the Service. Customer's use of a Connected Platform is governed by Customer's agreement with its provider. Provider is not responsible for Connected Platforms, their availability, or changes to their APIs.

2.7 Changes to the Service

Provider may modify the Service, its models, and its infrastructure from time to time, provided that a modification does not materially reduce the core functionality of the Service for Credits already purchased.

2.8 Special Use Policies

Certain data categories and uses, including credit and financial data, motor vehicle and automotive data, health-related data, and other sensitive data, are governed by separate use policies that Provider publishes on the Site or provides to Customer (each, a "Special Use Policy"). A Special Use Policy may require Customer to execute a separate written agreement, certification, or addendum before using the affected data or Results. Each applicable Special Use Policy is incorporated into this Agreement, and Customer will comply with it.

3. Customer Responsibilities

3.1 Account

Customer is responsible for all activity under its account. Customer will protect its account credentials and API keys and notify Provider promptly of any suspected compromise. Provider is not liable for unauthorized use resulting from Customer's failure to protect its credentials.

3.2 Customer Data

Customer represents and warrants that:

1. it has all rights, notices, and consents necessary to submit Customer Data to the Service and to have Provider process it as contemplated by this Agreement;
2. Customer Data was collected and is maintained in compliance with Applicable Law and with the privacy policies under which it was collected, and those policies permit the processing contemplated by this Agreement;
3. Customer Data was not obtained through email harvesting, dictionary attacks, or any other unfair, deceptive, or unlawful practice;
4. Customer Data relates only to residents of the United States, unless Provider agrees otherwise in writing;
5. Customer Data does not knowingly include data relating to individuals under sixteen (16) years of age; and
6. Customer will not submit Protected Health Information under HIPAA unless the Parties have first executed a Business Associate Agreement, and will not submit government identification numbers, financial account numbers, or other sensitive personal information beyond the fields the Service is designed to process, except as permitted by an applicable Special Use Policy.

3.3 Mailing Decisions

Customer is solely responsible for its use of the Service and Results, including its mailing and messaging decisions and how it mails the records Provider returns, and will comply with Applicable Law.

3.4 Evidence of Compliance

In connection with any claim, complaint, or government inquiry relating to Customer Data, Customer will provide Provider with reasonable evidence of its compliance with Section 3.2 within two (2) business days of Provider's request.

4. Customer Data

4.1 Ownership

As between the Parties, Customer retains all right, title, and interest in Customer Data. Customer Data is Customer's Confidential Information.

4.2 Use

Provider processes Customer Data as a service provider and processor, solely to provide the Service to Customer in accordance with this Agreement and the Data Processing Addendum in Exhibit B (the "DPA"). Provider will not sell, rent, or share Customer Data with any third party except Subprocessors under the DPA, and will not use Customer Data to build, train, or enrich Provider's own data assets or models. Matching Customer Data against Provider Technology to generate Results is processing to provide the Service and is not enrichment of Provider's data assets.

4.3 Retention and Deletion

Provider deletes Customer Data according to the retention option Customer selects, and in any case within thirty (30) days after processing, except as required by Applicable Law or permitted by Section 4.4. Provider may retain de-identified, aggregated processing metrics that do not identify Customer or its contacts. Provider may retain Customer Registration Data for the duration of Customer's account and handle it under the Privacy Policy at www.safereact.com/privacy.

4.4 Privacy Suppression

1. Notwithstanding Section 4.3, Provider may retain the minimum information necessary to identify which customer submitted a given record, solely to deliver Suppression Notices required by Applicable Law.
2. Customer will honor each Suppression Notice within the period required by Applicable Law, and in any case within thirty (30) days after Provider delivers it.
3. Customer will not mail, sell, or share any record that Results identify as privacy suppressed.
4. Each Party will maintain a suppression list of individuals who have opted out of its email marketing and will process unsubscribe requests within ten (10) business days of receipt, or any shorter period Applicable Law requires.
5. Except as required by law or to prove compliance with law, Provider will not sell, rent, license, or otherwise transfer any email address contained in a suppression list or Suppression Notice to any third party.

4.5 Security

Provider will maintain commercially reasonable technical and organizational measures designed to protect Customer Data in its possession, as further described in the DPA.

4.6 Pilot Data

Customer may submit records for a pilot or proof-of-concept evaluation before any Order Form is executed (the "Pilot Data"). Provider processes Pilot Data only to perform that evaluation and return Results to Customer, and the restrictions in Sections 4.2 through 4.5 apply to it. If the Parties do not execute an Order Form or other definitive written agreement for the Service within ninety (90) days after the Pilot Data is submitted, Provider will delete the Pilot Data and all copies within thirty (30) days after that period ends, other than routine system backups that are overwritten in the ordinary course and are not accessed, and will confirm the deletion in writing on Customer's request. If the Parties do execute an Order Form, the Pilot Data is Customer Data under this Agreement.

5. Results; Warranty; Disclaimer

5.1 No Performance Guarantee

Results are recommendations based on Provider's models and data. Provider does not guarantee any particular open rate, click rate, conversion, deliverability outcome, match rate, or revenue. Performance figures, benchmarks, and estimates, including typical reactivation rates or cost estimates shown by any calculator, are illustrative and not a promise of results. Customer is responsible for testing and for its own mailing decisions.

5.2 Limited Warranty

Provider warrants that the Service will be performed in a workmanlike manner consistent with general industry standards. Customer must report any material deficiency in writing within ninety (90) days after receiving the affected Results, or the deficiency is waived. Customer's exclusive remedy, and Provider's sole obligation, for breach of this warranty is reprocessing of the affected records or, at Provider's option, reinstatement of the Credits consumed for them.

5.3 Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE SERVICE AND RESULTS ARE PROVIDED "AS IS" AND "AS AVAILABLE," AND EACH PARTY DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. PROVIDER DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT RESULTS WILL BE CORRECT, COMPLETE, OR ACCURATE FOR ANY PARTICULAR RECORD.

6. Fees and Payment

6.1 Credits

The Service is sold on a prepaid Credit basis. Each record submitted for processing consumes the number of Credits stated on the pricing page at www.safereact.com/pricing or in the applicable Order Form for the services selected, whether or not the Service matches the record or Customer acts on the Results, unless an Order Form states otherwise.

1. Free Credits. Each Customer receives a one-time grant of 10,000 free Credits upon registration. The grant is issued once per Customer and its Affiliates, is not transferable, has no cash value, and is not available in connection with any purchase.
2. Purchase and Rates. Credits are purchased in advance at the then-current published rates or the rates in an Order Form. The rate for a purchase is determined by the total number of Credits in that purchase, and that single rate applies to every Credit in it. Rates are not blended or graduated, and separate purchases are priced independently. Fees are stated in US dollars.
3. Expiration. Credits expire twelve (12) months after the date of the purchase in which they were issued. Free Credits expire twelve (12) months after the date of the grant. Expired Credits are forfeited, have no cash value, and cannot be refunded or reinstated.
4. Consumption Order. Where Customer holds Credits from more than one purchase, Credits are consumed in order of earliest expiration first.
5. Refunds. Except as required by law or as stated in Sections 7.4 and 11.1, purchased Credits are non-refundable, including unused and expired Credits.
6. Rate Changes. Provider may change published rates prospectively on notice. A rate change does not affect Credits already purchased.

6.2 Order Forms

Fees under an Order Form are invoiced as stated in the Order Form. Unless the Order Form states otherwise, Customer will pay each invoice within thirty (30) days of receipt, and Credits are applied to Customer's account upon payment.

6.3 Payment Method

Customer authorizes Provider and its payment processors to charge Customer's payment method for fees due. Customer will keep its payment information current and accurate. Provider may place temporary authorization charges to validate a payment method.

6.4 Late Payment

Late amounts accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. Customer is liable for reasonable collection costs, including attorneys' fees, for amounts not paid when due. Provider may suspend the Service for amounts more than ten (10) days past due after notice to Customer.

6.5 Taxes

Fees are exclusive of applicable taxes, which Customer is responsible for paying, other than taxes based on Provider's net income.

7. Term and Termination

7.1 Term

This Agreement remains in effect while Customer holds unexpired Credits or an active Order Form, and terminates sixty (60) days after Customer's last Credits expire if no Order Form is then active. Each Order Form remains in effect for the term it states. If an Order Form states no term, its term is twelve (12) months and renews automatically for successive twelve (12) month periods unless either Party gives notice of non-renewal at least ninety (90) days before the end of the then-current term.

7.2 Termination by Customer

Customer may close its account at any time. Closing an account does not relieve Customer of payment commitments under an active Order Form.

7.3 Termination for Breach; Suspension

Either Party may terminate this Agreement or any Order Form on written notice if the other Party materially breaches it and fails to cure the breach within ten (10) days after receiving notice. Provider may suspend Customer's access immediately, without liability, for a breach of Section 2.5, 3.2, or 4.4, for non-payment under Section 6.4, or for activity that threatens the security or integrity of the Service or harms third parties.

7.4 Effect of Termination

On termination or expiration:

1. all unpaid fees become due, and Customer will stop using the Service;
2. unused Credits are forfeited and are not refundable, except that if Provider terminates other than for Customer's breach, or discontinues the Service, Provider will refund the purchase price of Customer's unused, unexpired purchased Credits;
3. Provider will delete Customer Data in accordance with Sections 4.3 and 4.4; and
4. either Party may retain the minimum amount of the other Party's Confidential Information required to comply with Applicable Law.

7.5 Survival

Sections 1, 2.3, 2.5, 3, 4, 5.3, 6 (as to amounts due), 7.4, 7.5, and 8 through 14, and the DPA for as long as Provider retains Customer Data, survive termination or expiration.

8. Intellectual Property

Provider and its licensors own all right, title, and interest in the Provider Technology, the Service, and the Results (excluding Customer Data and subject to Customer's license in Section 2.3), including all related Intellectual Property Rights and improvements. If Customer provides feedback about the Service, Provider may use it without restriction or obligation. This Agreement is not a sale and conveys no ownership in the Service. Provider reserves all rights not expressly granted.

9. Confidentiality

9.1 Definition

"Confidential Information" means non-public information a Party (the "Disclosing Party") provides to the other (the "Receiving Party") that is marked confidential or is reasonably understood to be confidential, including Customer Data, Customer Registration Data, the Provider Technology, non-public pricing, Order Form terms, performance and test results, and reports.

9.2 Obligations

The Receiving Party will protect the Disclosing Party's Confidential Information with at least the care it uses for its own confidential information, and no less than reasonable care. It will use that information only to exercise its rights and perform its obligations under this Agreement, and will disclose it only to its employees, contractors, and Subprocessors who need to know it and are bound by obligations at least as protective.

9.3 Exclusions

These obligations do not apply to information the Receiving Party can show (a) was known to it without confidentiality obligation before disclosure, (b) became public through no wrongful act of the Receiving Party, (c) was rightfully received from a third party without confidentiality obligation, or (d) was independently developed without use of or reference to the Disclosing Party's Confidential Information.

9.4 Compelled Disclosure

If the Receiving Party is required by law or court order to disclose Confidential Information, it will give the Disclosing Party prompt notice where permitted, cooperate with reasonable efforts to obtain a protective order, and disclose only the portion legally required.

9.5 Equitable Relief

Monetary damages may be inadequate for a breach of this Section 9, and the Disclosing Party may seek injunctive relief without posting a bond.

10. Representations and Warranties

Each Party represents and warrants that (a) it has full power and authority to enter into and perform this Agreement, (b) its performance of this Agreement will not violate Applicable Law, and (c) its performance will not breach any obligation it owes to a third party.

11. Indemnification

11.1 By Provider

Provider will defend Customer against any third-party claim alleging that the Service, as provided by Provider and used in accordance with this Agreement, infringes or misappropriates a third party's Intellectual Property Rights, or arising from Provider's violation of Applicable Law in performing the Service, and will indemnify Customer for resulting damages finally awarded or agreed in settlement, including reasonable attorneys' fees ("Losses").

1. Exclusions. Provider has no obligation for claims arising from (a) Customer Data, (b) combination of the Service with products, services, or data not provided by Provider, (c) modification of the Service not made by Provider, or (d) use of the Service in breach of this Agreement.
2. Remedies. If the Service is, or Provider reasonably believes it is likely to be, enjoined, Provider may at its option procure the right for Customer to continue using it, modify it to be non-infringing, or terminate the affected Service and refund Customer's unused, unexpired purchased Credits.
3. Sole Remedy. This Section 11.1 states Provider's sole liability, and Customer's exclusive remedy, for infringement claims.

11.2 By Customer

Customer will defend, indemnify, and hold harmless Provider, its Affiliates, and their officers, directors, employees, and agents from all Losses arising from any third-party claim or government inquiry or investigation relating to:

1. Customer Data, or Customer's right, title, or interest in it;
2. the absence, insufficiency, or invalidity of any notice or consent required under Applicable Law;
3. Customer's mailing or messaging activities, including its use of Results and any alleged violation of the CAN-SPAM Act, the Telephone Consumer Protection Act, or privacy laws;
4. Customer's actual or alleged violation of Applicable Law or breach of this Agreement; or
5. the acts or omissions of Customer's clients under Section 2.4.

11.3 Procedure

The indemnified Party will (a) promptly notify the indemnifying Party of the claim, (b) give the indemnifying Party sole control of the defense and settlement, and (c) provide reasonable cooperation at the indemnifying Party's expense. The indemnified Party may participate in the defense with its own counsel at its own expense. The indemnifying Party will not settle any claim in a manner that admits fault of, or imposes obligations on, the indemnified Party without its prior written consent. Provider may, at its own expense, assume the exclusive defense of any matter subject to indemnification by Customer.

12. Limitation of Liability

12.1 Exclusion of Damages

EXCEPT FOR (i) CUSTOMER'S PAYMENT OBLIGATIONS, (ii) CUSTOMER'S INDEMNIFICATION OBLIGATIONS AND PROVIDER'S OBLIGATIONS FOR INTELLECTUAL PROPERTY CLAIMS UNDER SECTION 11.1, (iii) A PARTY'S WILLFUL MISCONDUCT OR FRAUD, AND (iv) CUSTOMER'S BREACH OF SECTION 2.5 OR 3.2, IN NO EVENT WILL EITHER PARTY BE LIABLE FOR (A) ANY SPECIAL, PUNITIVE, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, OR FOR LOST PROFITS, REVENUE, OR BUSINESS, LOSS OF USE, OR INTERRUPTED COMMUNICATIONS, EVEN IF ADVISED OF THEIR POSSIBILITY, OR (B) AGGREGATE LIABILITY FROM ALL CAUSES OF ACTION AND THEORIES OF LIABILITY IN EXCESS OF THE AMOUNTS PAID OR PAYABLE BY CUSTOMER UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

13. Dispute Resolution

13.1 Governing Law

This Agreement is governed by the laws of the State of Texas, without regard to its choice-of-law rules. The Federal Arbitration Act governs Section 13.3.

13.2 Informal Resolution

Before commencing arbitration or litigation, a Party must send the other a written notice describing the claim and the relief sought. The Parties will attempt to resolve the claim informally for thirty (30) days after the notice is received.

13.3 Arbitration

Any dispute arising out of or relating to this Agreement or the Service will be resolved by binding arbitration administered by JAMS under its Comprehensive Arbitration Rules, before one neutral arbitrator, seated in Austin, Texas. Hearings will be conducted by video unless the Parties agree otherwise. Questions of arbitrability are for the arbitrator. Each Party bears its own costs except as a statute provides. Judgment on the award may be entered in any court of competent jurisdiction.

13.4 Exceptions

Either Party may (a) bring an individual action in small claims court, and (b) seek injunctive relief in the state or federal courts in Travis County, Texas, for misuse of its Intellectual Property Rights, Confidential Information, or data. The Parties consent to exclusive jurisdiction and venue in those courts for any matter not subject to arbitration.

13.5 Class Action Waiver

Claims may be brought only in a Party's individual capacity, and not as a plaintiff or class member in any class, collective, or representative proceeding. The arbitrator may not consolidate claims or preside over any form of class or representative proceeding.

13.6 Opt-Out

CUSTOMER MAY OPT OUT OF SECTIONS 13.3 AND 13.5 BY GIVING PROVIDER WRITTEN NOTICE WITHIN THIRTY (30) DAYS AFTER FIRST ACCEPTING THIS AGREEMENT.

13.7 Limitation Period

Any claim under this Agreement, other than for indemnification, must be filed within one (1) year after it arose, or it is forever barred.

14. General

14.1 Order of Precedence

If there is a conflict, the following control in this order: (a) the DPA, as to the processing of Customer Data; (b) an executed Order Form, as to that order; (c) any applicable Special Use Policy or separate agreement it requires; (d) this Agreement; and (e) other policies posted on the Site. Terms in a Customer purchase order or other Customer document do not apply, even if accepted by Provider.

14.2 Modifications

Provider may modify this Agreement by giving Customer at least thirty (30) days' notice, and continued use of the Service after the effective date constitutes acceptance. For Customers with an active Order Form, modifications take effect at the next renewal of that Order Form unless the Parties agree otherwise in writing. Changes required by law, or to the Privacy Policy, may take effect sooner.

14.3 Publicity

Unless Customer opts out in writing or an Order Form states otherwise, Provider may identify Customer by name and logo as a SafeReact customer on the Site and in promotional materials. Neither Party will otherwise use the other's name, trademarks, or logos without prior written consent.

14.4 Notification of Legal Action

To the extent permitted by law, each Party will promptly notify the other of any actual or threatened legal action or government inquiry, including by the Federal Trade Commission or a state attorney general, that relates to email, text messaging, privacy, or the data processed under this Agreement.

14.5 Notices

Provider may give routine notices by email to the address on Customer's account or Order Form, or through the Service. Notices of breach, termination, or a claim must be in writing and delivered personally, by recognized overnight courier, or by certified mail, return receipt requested, to the addresses above, with a copy by email to legal@safereact.com for Provider. Notices are effective on delivery or refusal of delivery.

14.6 Assignment

Neither Party may assign this Agreement without the other Party's prior written consent, except to an Affiliate or in connection with a merger, consolidation, or sale of all or substantially all of its assets, provided the successor assumes all of the assigning Party's obligations under this Agreement.

14.7 Force Majeure

Neither Party is in default to the extent its performance, other than payment, is delayed or prevented by causes beyond its reasonable control, including acts of God, internet or telecommunications failures, hacking, natural disaster, or acts of government, provided it gives reasonably prompt notice.

14.8 Export and Sanctions

Customer will not use the Service in violation of US export control or sanctions laws, and represents that it is not located in, or owned or controlled by a person in, a comprehensively sanctioned country or on a US government restricted-party list.

14.9 Relationship

The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship, and there are no third-party beneficiaries.

14.10 Miscellaneous

A waiver is effective only if in writing and signed by the waiving Party, and waives no other breach. If any provision is held unenforceable, it will be severed and the remainder will remain in effect. Rights and remedies are cumulative unless stated otherwise. No rule of construction against the drafting Party applies. This Agreement may be executed electronically and in counterparts.

14.11 Entire Agreement

This Agreement, including its Exhibits and any Order Forms, is the entire agreement of the Parties on its subject matter and supersedes all prior or contemporaneous agreements, proposals, and representations.

Contact

FourLeaf LLC d/b/a SafeReact · 30 N. Gould St., Ste. #5497, Sheridan, WY 82801 · legal@safereact.com · (800) 360-6213

Exhibit A: Order Form

This Order Form is entered into under, and incorporates, the SafeReact Master Services Agreement (the "Agreement"). If this Order Form conflicts with the Agreement, this Order Form controls for this order.

1. Customer

2. Services

• Email hygiene and reactivation scoring
• Audience scoring and intent
• Data Append
• Connected Platform sync
• Agency use: processing data on behalf of Customer's clients (Section 2.4)

3. Commercial Terms

4. Special Terms

• Records the Service cannot match do not consume Credits
• Customer opts out of publicity under Section 14.3
• Other (describe):

5. Contacts

6. Signatures

Exhibit B: Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Agreement. Capitalized terms not defined here have the meanings given in the Agreement. This DPA applies to the extent Data Protection Laws apply to Customer Personal Data.

1. Definitions

• "CCPA" means the California Consumer Privacy Act of 2018 and its regulations, as amended.
• "Customer Personal Data" means Personal Data contained in Customer Data.
• "Data Protection Laws" means all privacy, data protection, and security laws applicable to the Processing of Customer Personal Data, including the CCPA.
• "Personal Data" means information that constitutes "personal information," "personal data," or a similar term under Data Protection Laws.
• "Process" means any operation performed on Personal Data, including collection, storage, matching, combination, retrieval, use, disclosure, and deletion.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Provider's possession, custody, or control. It does not include unsuccessful attempts or activities that do not compromise Customer Personal Data, such as pings, port scans, unsuccessful log-in attempts, or denial-of-service attacks.
• "Subprocessor" means any third party Provider engages to Process Customer Personal Data on Customer's behalf.

2. Roles

Customer is the controller or business, and Provider is the processor or service provider, with respect to Customer Personal Data. Where Customer acts as a processor for a third-party controller, Provider is Customer's subprocessor.

3. Customer Obligations

Customer will (a) provide all notices and obtain all consents and rights necessary for Provider to Process Customer Personal Data under the Agreement, (b) ensure its instructions comply with Data Protection Laws, and (c) promptly notify Provider of any opt-out, deletion request, or revocation of consent that affects Customer Personal Data Provider holds. Provider is not responsible for determining the Data Protection Laws that apply to Customer.

4. Instructions

Provider will Process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, and Customer's use and configuration of the Service, unless Applicable Law requires otherwise. Provider will inform Customer if, in its opinion, an instruction violates Data Protection Laws.

5. CCPA Service Provider Terms

Terms used in this Section have the meanings given in the CCPA. Provider will not (a) Sell or Share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than the Business Purposes specified in the Agreement, or outside the direct business relationship between Customer and Provider; or (c) combine it with Personal Data received from or on behalf of any other person, or collected from Provider's own interactions with consumers, except as needed to perform the Business Purpose of providing the Service. Provider will provide the same level of privacy protection the CCPA requires, will notify Customer if it can no longer meet its CCPA obligations, and certifies that it understands and will comply with these restrictions. On written notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

6. Security and Security Incidents

Provider will maintain reasonable technical and organizational measures designed to protect the confidentiality, security, and integrity of Customer Personal Data, and will ensure that personnel who Process it are bound by confidentiality obligations. Upon confirming a Security Incident, Provider will notify Customer without undue delay and in any case within the customer notification timeframe set out in Provider's Incident Response Plan, currently [_] hours. Provider will take reasonable steps to identify the cause of the Security Incident, minimize harm, and prevent recurrence, and will provide information Customer reasonably needs to meet its obligations under Data Protection Laws. Notification is not an acknowledgment of fault or liability.

7. Subprocessors

Customer generally authorizes Provider to engage Subprocessors. Provider will make its current Subprocessor list available on the Site or on request, and will give notice before adding or replacing a Subprocessor. Customer may object on reasonable data protection grounds by written notice within ten (10) days. If Provider cannot reasonably accommodate the objection, Customer may, as its sole remedy, terminate the affected portion of the Service and receive a refund of unused, unexpired purchased Credits for it. Provider will bind each Subprocessor to written data protection obligations no less protective than this DPA and remains responsible for its Subprocessors' acts and omissions.

8. Assessments and Audits

On written request, Provider will provide reasonable information and assistance for any data protection assessment Data Protection Laws require of Customer, and may charge on a time-and-materials basis for onerous or repeated requests. Once per calendar year, Provider will respond in writing to reasonable requests for information needed to confirm its compliance with this DPA, which Provider may satisfy with third-party audit reports it makes available. If those responses are insufficient, Customer may conduct an audit at its own expense, provided that (a) Customer gives reasonable advance written notice of the date, scope, and auditor; (b) the auditor is not a Provider competitor and is approved by Provider, which approval will not be unreasonably withheld; (c) the audit occurs during business hours without unreasonable disruption; (d) the auditor follows Provider's security and confidentiality policies; and (e) all audit information and results are Provider's Confidential Information.

9. Data Subject Requests

Each Party will provide the other reasonable assistance in responding to requests from individuals to exercise their rights under Data Protection Laws. If Provider receives a request directly relating to Customer Personal Data, it will direct the individual to Customer, except that Provider will process deletion and opt-out requests it receives as a registered data broker and deliver resulting Suppression Notices under Section 4.4 of the Agreement.

10. Deletion

Provider will delete Customer Personal Data in accordance with Sections 4.3 and 4.4 of the Agreement, and on termination will delete any Customer Personal Data it still holds, unless Applicable Law requires retention.

11. General

This DPA governs over the rest of the Agreement as to the Processing of Customer Personal Data. Notices under this DPA may be sent by email. All liability under this DPA is subject to the limitations in Section 12 of the Agreement.

Appendix 1: Details of Processing