Data Processing Addendum

• Applicable Data Protection Law means all laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR and CCPA.
• CCPA means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended, and its implementing regulations.
• Customer Personal Data means Personal Data processed by Dub on behalf of Customer in connection with the Services.
• Personal Data means any information relating to an identified or identifiable natural person, or otherwise defined as "personal data," "personal information," or similar terms under Applicable Data Protection Law.
• Standard Contractual Clauses or "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
• Sub-processor means any third party engaged by Dub that processes Personal Data on behalf of the Customer.

This DPA applies when Dub processes Personal Data on behalf of the Customer in connection with the provision of the Services. This DPA is subject to the terms of the Agreement and reflects the parties' agreement with regard to the processing of Personal Data.

For purposes of the GDPR, Customer acts as the controller and Dub acts as the processor with respect to Customer Personal Data.

Customer is responsible for ensuring that its collection and processing of Customer Personal Data, including its instructions to Dub, comply with Applicable Data Protection Law and that it has all rights, consents, and other legal bases necessary for Dub to process Customer Personal Data in accordance with this DPA.

The Customer must provide clear instructions to Dub for the processing of Personal Data as required by applicable law.

Dub will:

• process Personal Data only in accordance with Customer’s documented instructions, unless otherwise required by applicable law;

• ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and access Customer Personal Data only as necessary to perform their responsibilities;

• implement and maintain appropriate technical and organizational measures (described in Annex II) designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access;

• promptly inform Customer if, in Dub's reasonable opinion, a documented processing instruction infringes Applicable Data Protection Law;

• taking into account the nature of the processing and the information available to Dub, provide Customer with reasonable assistance necessary for Customer to comply with its obligations under Applicable Data Protection Law relating to security of processing, data protection impact assessments, and prior consultation with supervisory authorities.

Dub may engage Sub-processors to process Personal Data on behalf of the Customer. Dub will ensure that Sub-processors are subject to data protection obligations consistent with those set forth in this DPA.

Dub shall enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than the obligations imposed on Dub under this DPA, to the extent applicable to the Sub-processor’s services. Dub will remain responsible for the performance of its Sub-processors to the extent required by Applicable Data Protection Law.

Customer is responsible for responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

Taking into account the nature of the Processing, Dub will provide Customer with reasonable assistance necessary for Customer to respond to Data Subject requests.

Dub will notify Customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data ("Security Incident").

Dub will investigate the Security Incident and provide Customer with information reasonably available to Dub and reasonable assistance necessary for Customer to comply with its notification and reporting obligations under Applicable Data Protection Law.

Dub may process Personal Data in the United States and other countries in which Dub or its Sub-processors operate. Where applicable data protection law requires an appropriate safeguard for an international transfer of Personal Data, the transfer will be subject to an appropriate transfer mechanism recognized under applicable data protection law.

Standard Contractual Clauses. Where Customer Personal Data subject to the GDPR is transferred by Customer to Dub in a country that has not been recognized by the European Commission as providing an adequate level of protection, the SCCs are incorporated by reference into and form part of this DPA.

For purposes of the SCCs:

• Module Two (Controller to Processor) applies;
• the data exporter is Customer and the data importer is Dub;
• in Clause 7, the optional docking clause applies;
• in Clause 11, the optional language does not apply;
• in Clause 17, Option 2 applies, and the SCCs will be governed by the law of the EU Member State in which the data exporter is established, provided that such law allows for third-party beneficiary rights; if the data exporter is not established in an EU Member State or such law does not allow for third-party beneficiary rights, the laws of Ireland will govern the SCCs;
• in Clause 18(b), disputes arising from the SCCs will be subject to the courts of the EU Member State whose law governs the SCCs pursuant to Clause 17;
• Annex I to the SCCs is completed as set forth in Annex I to this DPA;
• Annex II to the SCCs is completed as set forth in Annex II to this DPA; and
• Annex III to the SCCs is completed by reference to Dub's Sub-processors identified on Dub's Sub-processors page.

Customer may audit Dub's compliance with this DPA to the extent required by Applicable Data Protection Law. Where appropriate, Dub may satisfy an audit request by providing relevant independent audit reports, certifications, or other documentation demonstrating its compliance with this DPA.

Any additional audit will be subject to reasonable advance notice and appropriate confidentiality and security requirements.

Upon termination of the Agreement, Dub will, at the Customer's choice, return or delete Customer Personal Data processed on behalf of the Customer, unless required by applicable law to be retained.

To the extent Dub processes Customer Personal Data subject to the CCPA, the parties acknowledge and agree that Customer is a Business and Dub is a Service Provider, as those terms are defined under the CCPA.

Customer discloses Customer Personal Data to Dub only for the limited and specified purposes described in the Agreement.

Dub will:

• process Customer Personal Data only for the limited and specified purposes described in the Agreement and as otherwise permitted by the CCPA;
• not Sell or Share Customer Personal Data;
• not retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and Dub except as permitted by the CCPA;
• not combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from Dub's own interactions with a Data Subject, except as permitted by the CCPA.

This DPA shall be governed by and construed in accordance with the laws governing the Agreement.

For any questions regarding this DPA or Dub's data processing activities, please contact us at support@dub.co

A. List of Parties

Data Exporter

Name: Customer, as identified in the Agreement.

Address: As identified in the Agreement or Customer's Dub account.

Contact details: As identified in the Agreement or Customer's Dub account.

Activities relevant to the data transferred: Customer's use of the Services under the Agreement.

Role: Controller.

Data Importer

Name: Dub Technologies, Inc.

Address: 2261 Market Street STE 5906, San Francisco, CA 94114

Contact details: support@dub.co

Activities relevant to the data transferred: Provision of the Services under the Agreement.

Role: Processor.

B. Description of Transfer

Customer Personal Data may relate to:

• Customer's employees, contractors, representatives, and authorized users;
• Customer's customers, prospective customers, and end users;
• Customer's partners, affiliates, and partner applicants; and individuals who interact with Customer's links, websites, applications, campaigns, or partner programs through the Services.

Depending on Customer's use and configuration of the Services, Customer Personal Data may include: name and email address; account, customer, partner, and other identifiers; IP address; device and browser information; geographic and referral information; link, click, and attribution information; lead and conversion information; transaction and revenue information; partner application and program information; commission and payout information; and other Personal Data submitted by Customer to the Services.

Frequency of Transfer: Customer Personal Data may be transferred and processed on a continuous basis for the duration of the Agreement.

Purpose of Processing: To provide and support the Services under the Agreement, including link management, analytics and attribution, partner and affiliate program management, commission calculation, payout facilitation, fraud prevention, and related functionality used by Customer.

Sub-processor Processing: The subject matter and nature of Processing performed by each Sub-processor are described by the applicable services identified on Dub's Sub-processors page. Processing continues for as long as the applicable Sub-processor is engaged by Dub to provide those services.

C. Competent Supervisory Authority

The competent supervisory authority will be determined in accordance with Clause 13 of the SCCs.

Dub maintains technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Encryption. Dub enforces HTTPS and encrypts data in transit using TLS 1.2 or higher. Customer data at rest is encrypted using AES 256-bit encryption.

Access Controls. Access to Dub’s corporate network, production systems, network devices, and support tools requires unique user identification. Dub uses role-based access controls, and access to sensitive systems requires multi-factor authentication. Access to critical systems is reviewed quarterly to ensure access remains appropriate.

Personnel Security. Dub personnel are subject to confidentiality obligations. New hires undergo background and/or reference checks as permitted by applicable law.

Network and Infrastructure Security. Dub maintains network access restrictions designed to permit only approved communication channels and protocols. Infrastructure logging is configured to monitor web traffic and suspicious activity and generate automated alerts for anomalous activity.

Vulnerability Management and Testing. Dub performs regular vulnerability scanning and remediates identified issues based on risk and impact. Dub also engages an independent third party to perform penetration testing of its production environment annually and remediates identified vulnerabilities in accordance with its remediation procedures.

Change Management. Dub maintains documented software development and change management procedures. Source code is maintained using version control, code changes are tested prior to implementation, and production releases require appropriate approval.

Monitoring and Incident Response. Dub maintains systems for monitoring its cloud infrastructure and alerting appropriate personnel of security events. Dub maintains a documented incident response plan and processes for logging, classifying, tracking, and resolving security and privacy incidents.

Vendor Management. Dub maintains a vendor risk management program and periodically reviews security and compliance documentation for critical vendors and Sub-processors.

Independent Assurance. Dub undergoes an independent SOC 2 Type II examination covering the Security and Availability Trust Services Criteria.