Data processing addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service or executed MSA or other service agreement applicable to the Services between Incenify LLC ("Incenify") and Customer (the "Agreement"). Capitalized terms not defined here have the meanings in that Agreement. The version incorporated at acceptance applies.

"Applicable Data Protection Law" means any privacy or data protection law applicable to the Processing of Personal Data under the Agreement, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the California Consumer Privacy Act of 2018, as amended ("CCPA"), in each case only to the extent applicable.

"Personal Data" means personal data, personal information, or similar information relating to an identified or identifiable individual that Incenify Processes on behalf of Customer. "Data Subject" means the individual to whom Personal Data relates. "Processing" and "Process" have the meanings assigned under Applicable Data Protection Law. "Controller," "Processor," "Business," "Service Provider," "Contractor," and "Supervisory Authority" have the meanings assigned under Applicable Data Protection Law.

Customer is the Controller or Business, and Incenify is the Processor, Service Provider, or Contractor, as applicable, with respect to Personal Data submitted to the Services. This DPA applies only to Personal Data Processed by Incenify on Customer's behalf in connection with the Services. The subject matter, duration, nature, and purpose of Processing, types of Personal Data, and categories of Data Subjects are described in Exhibit A.

This DPA controls a conflict concerning Personal Data processing; applicable SCCs or other mandatory transfer clauses control a conflict with this DPA. Contractual liability between the parties is allocated under the applicable agreement’s limitation-of-liability provisions, without limiting Data Subject rights or liability that cannot lawfully be limited.

Incenify will Process Personal Data only: (a) to provide the Services as described in the applicable agreement and Order; (b) in accordance with additional documented instructions provided by Customer and accepted by Incenify; and (c) as necessary to comply with applicable law. If Incenify believes an instruction violates Applicable Data Protection Law, Incenify will inform Customer unless prohibited by law. Customer is responsible for ensuring that its instructions comply with Applicable Data Protection Law.

Where the CCPA applies, Incenify will Process Personal Data only for the limited and specified business purposes described in the Agreement and Exhibit A. Incenify will not: (i) sell or share Personal Data; (ii) retain, use, or disclose Personal Data for a purpose other than those limited and specified business purposes or as otherwise permitted by the CCPA; (iii) retain, use, or disclose Personal Data outside the direct business relationship between Incenify and Customer, except as permitted by the CCPA; or (iv) combine Personal Data with personal information received from another source or collected from Incenify's own interaction with an individual, except as permitted by the CCPA.

Incenify will provide the level of privacy protection required of service providers and contractors under the CCPA and will notify Customer if Incenify determines that it can no longer meet its applicable obligations. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data.

Incenify will ensure that persons authorized to Process Personal Data are subject to confidentiality obligations and have access only as necessary to perform their responsibilities.

Incenify will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature, scope, context, and purposes of the Processing and the risks to individuals.

Such measures include encryption of Personal Data in transit and at rest, authentication and role-based access controls, and restricted access to production systems, as applicable to the Services. Incenify may update its measures from time to time, provided the overall level of protection is not materially reduced.

Customer grants general written authorization for Incenify to engage subprocessors for the agreed Processing. Incenify will provide a current list on written request and at least thirty (30) days' notice before a new or replacement subprocessor begins the affected Processing. Incenify will impose equivalent applicable data protection obligations appropriate to the delegated Processing and remain responsible to Customer for their performance as required by Applicable Data Protection Law.

Customer may object to a new subprocessor on reasonable data protection grounds by notifying legal@incenify.com within fifteen (15) days after notice. The parties will work in good faith to resolve the objection. If they cannot resolve it, Customer may terminate only the affected Services and receive a pro-rata refund of prepaid fees for the terminated portion.

Taking into account the nature of the Processing and to the extent required by Applicable Data Protection Law, Incenify will provide reasonable assistance to Customer in responding to requests from Data Subjects. If Incenify receives a Data Subject request directly concerning Personal Data Processed on Customer's behalf, Incenify will promptly forward it to Customer unless legally prohibited. Customer is responsible for responding to the request.

Incenify may charge a reasonable fee for assistance that is materially beyond the functionality of the Services or the assistance required by Applicable Data Protection Law.

Incenify will notify Customer without undue delay after becoming aware of a Personal Data breach (a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data) affecting data Processed under this DPA. To the extent reasonably available, the notice will describe the nature of the breach, the categories of affected data, the approximate number of affected Data Subjects and records, likely consequences, and measures taken or proposed. Incenify will reasonably cooperate with Customer's investigation and provide information reasonably necessary for Customer to meet applicable legal notification obligations.

Notification will be sent to the security contact designated in the Order, account or program records, or another written designation. If no security contact is designated, Incenify will notify the primary customer contact for the affected Services.

Incenify will make available information necessary to demonstrate compliance with this DPA and the applicable processor obligations under data protection law. The parties will ordinarily begin with relevant written documentation and remote review. That process does not prevent an audit or inspection required by Applicable Data Protection Law or the SCCs.

Incenify will allow and contribute to audits, including inspections, by Customer or its appointed independent auditor to verify those obligations. Reviews will be proportionate to the Processing, under appropriate confidentiality duties, during normal business hours, and on thirty (30) days' notice unless a shorter period is required by law, a competent authority, or the circumstances of a Personal Data breach. Routine reviews occur no more than once in twelve months; that limit does not apply where further review is required by law or a competent authority, follows a Personal Data breach, or is reasonably necessary because of evidence of material noncompliance.

The parties will protect other customers' information and security-sensitive material, using redactions, controlled access, or equivalent evidence where appropriate. These arrangements may not prevent verification of compliance or restrict mandatory audit rights. Customer bears its auditor's costs. Reasonable fees for additional assistance must be agreed in advance and must not make legally required assistance conditional on a fee or limit regulatory powers.

Incenify will make international transfers only as permitted by documented instructions and Applicable Data Protection Law. Where a safeguard is required, the parties will use an applicable adequacy decision, the SCCs with completed transfer details and required supplementary measures, or another recognized mechanism. The applicable transfer locations, subprocessors, and safeguards will be documented before the affected Processing begins.

Before a restricted UK transfer begins, the parties will establish the applicable UK transfer mechanism, such as a UK adequacy regulation or the UK Addendum to the EU SCCs, with any required supporting documentation.

During the Services, Incenify will apply the retention and deletion instructions agreed for the relevant data categories in the Order or documented program requirements, subject to Applicable Data Protection Law. The standard end-of-service return and deletion process below applies without an SOW. The parties will document any agreed retention periods for supporting files, claim outcomes, and transaction records in the program requirements.

At the end of the affected Services, Customer chooses return followed by deletion or deletion of the Personal Data, unless applicable law requires retention. Customer may record that choice in advance or notify Incenify no later than thirty (30) days after the end. An earlier deletion instruction controls. Where return is requested, Incenify will provide the export and delete remaining active copies without undue delay after return. If Customer gives no instruction, this DPA constitutes its instruction to delete active copies without undue delay after that thirty-day export window.

Incenify will retain data only for the limited return and deletion process or a legal retention requirement, with continued safeguards and restricted use. Backup copies will be put beyond ordinary use and removed through the applicable backup deletion cycle; the relevant cycle will be documented in the agreed retention schedule. If restoration is necessary before that cycle completes, the deletion instructions will be reapplied. Legally retained data will be isolated from ordinary use and deleted when the legal requirement ends.

Incenify will confirm completion on reasonable request, identifying any remaining legally retained or backup copies and their applicable retention or deletion treatment. These terms apply when the affected Services end, even if unrelated Orders remain active.

Customer will provide necessary notices, establish required consents or other lawful bases, issue lawful instructions, and protect the accounts and systems it controls. Incenify remains responsible for its own processor obligations. A third-party claim arising from Customer's breach of these duties is subject to the scope, exclusions, defense procedures, and liability limits in the applicable agreement’s indemnity and liability provisions; this section creates no separate uncapped indemnity.

Taking account of the Processing and the information available to it, Incenify will provide the assistance required by Applicable Data Protection Law with security obligations, impact assessments, breach response, and prior consultations with competent authorities. Additional services beyond those obligations may be scoped and priced by written agreement. Incenify does not provide legal advice.

Subject Matter. Provision of the Incenify channel incentive management platform and related services.

Duration. The term of the applicable Order and any limited period during which Incenify retains Personal Data as permitted by the Agreement or law.

Nature and Purpose. Hosting, organizing, validating, reporting, communicating about, and administering channel incentive programs, including eligibility, activities, claims, rewards, and related support.

Types of Personal Data. As configured by Customer and applicable to the Services: names, postal addresses, email addresses, phone numbers, employer or employment information, program eligibility information, transaction or activity information, submitted materials, support communications, activity logs, IP addresses, and device identifiers. The Services are not intended for Social Security numbers, payment-card information, bank-account information, health information, biometric information, or government identification numbers unless expressly agreed in an Order.

Categories of Data Subjects. Customer personnel, channel partner personnel, program participants, and other Authorized Users.

Where required for a restricted transfer subject to the GDPR, the parties incorporate the clauses adopted by European Commission Implementing Decision (EU) 2021/914, without modification to their mandatory text. Module Two applies where Customer exports data as controller and Incenify imports it as processor. If the parties act in different roles, the appropriate module and processing terms must be agreed before the transfer.

For Module Two, Clause 7 (docking) applies; Clause 9 uses general written authorization with the thirty-day notice period in Section 6; the optional independent dispute-resolution language in Clause 11 is not selected. Clause 17 uses Option 1 with Irish law, and Clause 18(b) selects the courts of Ireland, subject to the SCCs' mandatory rights and jurisdiction provisions.

Before a transfer relying on these clauses, the parties will complete and incorporate a transfer schedule identifying the exporting and importing entities and contacts, their roles and activities, the transfer frequency and duration, categories of individuals and data (including any sensitive data and safeguards), purpose and retention, the competent supervisory authority determined under Clause 13, and concrete technical and organizational measures for Annex II. The transfer schedule supplements the general processing description in Exhibit A. Any required UK Addendum must include its completed tables and applicable mandatory clauses.

The applicable SCCs control over inconsistent agreement terms. A website liability limitation cannot restrict third-party beneficiary rights or any liability the SCCs do not allow the parties to limit.