Data Processing Agreement

Revised: November 4, 2026

This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Master Subscription Agreement (“MSA”) between MindFire Internet Solutions, Inc. (“MindFire,” “Processor,” or “Service Provider”) and the customer that has accepted the MSA (“Customer,” “Business,” or “Controller”). It governs MindFire's Processing of Personal Data on Customer's behalf. Capitalized terms not defined here have the meaning given in the MSA.

1. Definitions

Capitalized terms relating to privacy, data protection, or the processing of personal information or personal data, including, without limitation, “Personal Data,” “Data Subject,” “Personal Information,” “Processing,” “Controller,” “Processor,” “Business,” “Sale,” “Service Provider,” “Sell,” “Share,” “Sensitive Personal Information,” and “Consumer,” shall have the meanings assigned to such terms under the Applicable Data Protection Laws applicable to the relevant processing of data. Where a particular term is not defined under an Applicable Data Protection Law, such term shall be interpreted in accordance with its ordinary meaning and the context of such law. “Applicable Data Protection Laws” means all privacy and data-protection laws applicable to the Processing under this DPA. The specific laws named in this DPA are illustrative and do not limit the defined term “Applicable Data Protection Laws”; a non-exhaustive, periodically updated reference list is provided in Annex D. As between the parties, Customer is responsible for determining which Applicable Data Protection Laws apply to Customer's data, audiences, and campaigns, and for instructing MindFire accordingly. “Personal Data” means Personal Data within Your Data that MindFire Processes on Customer's behalf.

2. Roles of the Parties

For Personal Data Processing to provide the Services, Customer is the Controller/Business and MindFire is the Processor/Service Provider acting solely on Customer's behalf. MindFire does not receive Personal Data as consideration for the Services. Any MindFire feature under which data is shared across customers (e.g., data enrichment, data purchasing services) is outside the scope of this DPA and may be governed by separate agreement(s).

3. Scope and Details of Processing

The subject matter, duration, nature and purpose of Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex A. MindFire Processes Personal Data only to provide the Services and as further instructed by Customer. Consent, cookie, and tracker obligations for Customer's microsites and landing pages are addressed in the MSA.

4. Processing on Documented Instructions

MindFire will process Personal Data only on Customer's documented instructions (including as set out in the MSA, applicable Order Forms, and this DPA), unless required by law, in which case MindFire will notify Customer unless legally prohibited from doing so. MindFire will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.

5. CCPA/CPRA Service-Provider Obligations

MindFire shall not: (a) Sell or Share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the MSA and this DPA, or as otherwise permitted by the CCPA; (c) retain, use, or disclose Personal Data outside the direct business relationship between the parties; or (d) combine Personal Data with personal information from other sources except as permitted by the CCPA. MindFire will provide the same level of privacy protection as required of Businesses under the CCPA and will notify Customer if it can no longer meet its obligations.

6. Confidentiality

MindFire ensures that personnel authorized to process Personal Data are bound by confidentiality obligations and process Personal Data only on a need-to-know basis for a legitimate purpose, consistent with the MSA.

7. Security Measures

MindFire will implement and maintain appropriate technical and organizational measures to protect Personal Data, as described in Annex B and consistent with its SOC 2 Type II program. MindFire's SOC 2 Type II report is available under a separate non-disclosure agreement as described in the MSA.

8. Subprocessors

Customer provides general authorization for MindFire to engage the subprocessors listed in Annex C. MindFire will impose data-protection obligations on each subprocessor no less protective than this DPA and remains responsible for their performance. MindFire will give Customer at least 30 days' notice of any intended addition or replacement of a subprocessor and a means to object on reasonable data-protection grounds.

9. Assistance with Consumer / Data-Subject Requests

Taking into account the nature of the Processing, MindFire will provide reasonable assistance to enable Customer to respond to requests from Consumers/Data Subjects to exercise their rights (including access, deletion, correction, opt-out of Sale or Share, and limiting the use of Sensitive Personal Information), and will forward to Customer, without responding, any such request MindFire receives directly.

10. Personal Data Breach

MindFire will notify Customer without undue delay, and no later than 72 hours, after becoming aware of a Personal Data Breach affecting Customer's Personal Data, and will provide information reasonably necessary for Customer to meet its own notification obligations and take remedial measures. “Personal Data Breach” means any unauthorized or unlawful access to, acquisition, use, disclosure, alteration, loss, destruction, or other compromise of Personal Data maintained, processed, or controlled by MindFire in connection with the Services that compromises the security, confidentiality, or integrity of such Personal Data and requires notification to Customer under Applicable Data Protection Laws.

11. Data Protection Impact Assessments

MindFire will provide Customer reasonable assistance with data-protection impact assessments and prior consultations with supervisory authorities where required by Applicable Data Protection Laws and relating to the Services.

12. Return and Deletion

On termination or expiry of the MSA, MindFire will, at Customer's option, return or delete Personal Data in accordance with the MSA. Customer may purchase extended retention as an instruction under this DPA.

13. Audits

MindFire will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, satisfied primarily through its SOC 2 Type II report (available subject to a non-disclosure agreement described in the MSA). MindFire does not offer on-site audits. If Customer requests completion of a security questionnaire, MindFire offers this as a service that will be scoped and included in the applicable Order Form or work order.

14. International Transfers

Where Personal Data subject to the GDPR or UK GDPR is transferred outside the EEA or UK, the parties will implement an approved transfer mechanism (including the EU Standard Contractual Clauses and the UK Addendum), which are incorporated into this DPA by reference.

15. Sensitive and Children's Data

MindFire will process Sensitive Personal Information only as necessary to provide the Services and on Customer's instructions, and will not use it to infer characteristics for MindFire's own purposes. Customer is responsible for providing any notice and obtaining any consent required by law, including for the Personal Data of minors.

16. Excluded Services

Data Enrichment Service, Data Purchasing Service, and other features involving cross-customer use of data are expressly excluded from this DPA. For those services, MindFire acts as an independent controller/third party under the separate applicable agreement(s), and Customer is responsible for having a lawful basis to use the resulting data.

17. Precedence and Liability

This DPA is incorporated into the MSA. In the event of a conflict on data-protection matters, this DPA prevails over the body of the MSA; on all other matters the MSA prevails. Each party's liability arising under this DPA is subject to the limitations of liability in the MSA.

18. Term

This DPA takes effect on the MSA effective date and remains in effect for the term of the MSA and thereafter until MindFire has returned or deleted all Customer Personal Data in accordance with Section 12 (Return and Deletion).

Annex A — Details of Processing

Subject matter: MindFire's attribution, personalization (PURL/GURL), omnichannel, and AI Voice Agent Services provided under the MSA.

Duration: The term of the MSA and any agreed retention period.

Nature and purpose: Hosting personalized microsites, capturing and attributing campaign responses, and enabling multichannel campaigns on Customer's behalf.

Types of Personal Data: Name, postal address, email, phone, campaign/response data, online identifiers such as IP address and device/browser identifiers; Sensitive Personal Information only where instructed, e.g., ethnicity, as in Section 4(h) of the MSA.

Categories of Data Subjects: Customer's campaign recipients and visitors to Customer's microsites.

Annex B — Technical and Organizational Measures

MindFire maintains measures consistent with its SOC 2 Type II program, including: encryption of data in transit and at rest; role-based access controls and multi-factor authentication; audit logging; logical isolation of customer data; regular audits and penetration testing; continuous monitoring and incident response; and backup and disaster recovery.

Annex C — Approved Subprocessors

Annex D — Schedule of Applicable Laws

This Annex is an informational, non-binding reference list. It does not limit, and is not limited by, the defined term “Applicable Data Protection Laws.” MindFire may update this Annex from time to time (for example, annually or upon a significant legal change) without amending the DPA or the MSA. Citations and links are provided for convenience purposes only.

United States - Privacy Laws

United States - Sector / Marketing / Signal Laws

• California Invasion of Privacy Act (CIPA) — wiretap/recording — Cal. Penal Code §§ 630–638 (relevant to call recording and tracking-pixel/“wiretap” claims and the AI Voice Agent)
• California “Opt Me Out Act” (AB 566) — browser opt-out signals — Effective Jan 1, 2027; expands GPC/universal opt-out signal support
• Telephone Consumer Protection Act (TCPA) — 47 U.S.C. § 227 (calls, SMS, ringless voicemail)
• CAN-SPAM Act — 15 U.S.C. § 7701 et seq. (commercial email)
• Children's Online Privacy Protection Act (COPPA) — 15 U.S.C. § 6501 et seq. (under-13 data)
• Where applicable to Customer data: HIPAA / CMIA (health), GLBA (financial), FERPA (student) — 45 C.F.R. Parts 160/164; Cal. Civ. Code § 56 et seq.; 15 U.S.C. § 6801 et seq.; 20 U.S.C. § 1232g

European Union / United Kingdom

• EU General Data Protection Regulation (GDPR), Reg. (EU) 2016/679 — eur-lex.europa.eu/eli/reg/2016/679/oj
• UK GDPR & Data Protection Act 2018 — legislation.gov.uk/ukpga/2018/12/contents
• EU Standard Contractual Clauses (2021/914) — commission.europa.eu … standard-contractual-clauses
• UK International Data Transfer Agreement / Addendum (ICO) — ico.org.uk … international data transfer agreement