Data Processing Addendum

Effective Date: January 1, 2026
Last Updated: September 1, 2026

This Data Processing Addendum (together with any Exhibits, Attachments, Schedules, Appendices, the “Addendum” or “DPA”) forms part of the Agreement, including all attachments, exhibits, and appendices (“Agreement”) entered into between Customer and Audiense, LLC with its subsidiaries Elevar, LLC and Audiense, LTD (together and separately
“Audiense”). This Addendum reflects the Parties’ agreement with regard to Audiense’s Processing of Personal Data (defined below) in connection with providing Services described in the Agreement. In the event of a conflict, the terms and conditions of this Addendum will prevail. Capitalized terms shall have the meaning given them in the Agreement, in this DPA, and in the Data Protection Laws, as applicable.

Customer and Audiense agree as follows:

1. DEFINITIONS.

The following terms, including any derivatives thereof, will have the meanings set forth below.
1.1. “Anonymous Data” means data that does not relate to an identified or identifiable person and cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable person.
1.2. “Applicable Services” has the meaning given in Section 2.1.
1.3. “Data Protection Laws” means any laws that apply to the Processing of data by Audiense under the Agreement. This includes laws, regulations, guidelines, requirements, and government issued rules in the U.S. and other jurisdictions, at the international, country, state/provincial, or local levels, currently in effect and as they become effective.
1.4. “Data Subject” means any living identified or identifiable natural person to which Personal Data relates or identifies.
1.5. “Data Subject Request” means a request to access, correct, amend, transfer, rectify, restrict, limit use, opt out of sale or sharing or other processing, or delete a Data Subject’s Personal Data consistent with that person’s rights under Data Protection Laws.
1.6. “De-Identified Data” means data that cannot reasonably be used to infer information about, or otherwise be linked to, a particular person, household, or device associated with a person or household.
1.7. “Derived Data” has the meaning set forth in the Agreement.
1.8. “First-Party Processing Services” means services under which Audiense processes Customer’s own data as Customer’s service provider or processor and returns processed results to Customer, without selling or licensing Customer Personal Data to third parties except as expressly authorized in writing by Customer.
1.9. “Output Data” means data, analytics, scores, models, segments, insights, reports, or other results produced by Audiense through Transformation or analytics that are Customer Data, Anonymous Data, or De-Identified Data, and that do not include Customer Personal Data in identifiable form.
1.10. “Personal Data,” “Personal Information,” or “Customer Personal Data” means Customer information Processed by Audiense under the Agreement that is linked, reasonably linkable, or relates to an identified or identifiable natural person. Personal Data, Personal Information, and Customer Personal Data are collectively referred to in this Addendum as “Customer Personal Data,” except where the context requires otherwise.
1.11. “Process” or “Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, sale, analysis, alignment or combination, restriction, erasure, or destruction.
1.12. “Processor Terms” means Sections 4 through 9 of this DPA, which apply only as set forth in Section 2 of this DPA.
1.13. “Security Incident” means any confirmed accidental, unauthorized, unintended, or unlawful processing, access to, exfiltration, theft, disclosure, destruction, loss, alteration, compromise, and/or malicious infection of Customer Personal Data transferred, transmitted, stored, or otherwise Processed by Audiense or any of its Subprocessors or third parties that Process Personal Data on Audiense’s behalf.
1.14. “Services” will have the same meaning provided under the Agreement.
1.15. “Standard Contractual Clauses” means the agreement executed by and between Customer and Audiense pursuant to the European Commission’s decision ((EU) 2021/914) of 4 June 2021 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.
1.16. “Subprocessor” means a subcontractor engaged by Audiense or its affiliates to Process Customer Personal Data as part of the performance of the Services.
1.17. “Third-Party Data Brokerage Services” means services under which Audiense acquires data (which may include Customer-supplied data) for Audiense’s independent data products, databases, segments, models, and related analytics, which Audiense may Transform and then sell, license, or otherwise make available to third parties in Audiense’s discretion, as an independent controller, and not as Customer’s processor.
1.18. “Transform” or “Transformation” means Audiense’s processing designed to create Derived Data.
1.19. “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0.
1.20. “Website Analytics and Management Services” means Audiense’s services that measure, collect, analyze, and report on Customer’s website and app performance, user interactions, and traffic.

2. SCOPE; ROLE; APPLICABILITY

2.1. Service Types and Applicability. The Parties acknowledge that Customer may purchase one or more of the following service types, as set forth in an Order Document (each, as applicable, the “Applicable Services”):
2.1.1. First-Party Processing Services — Audiense acts as Customer’s service provider/processor. The Processor Terms apply.
2.1.2. Website Analytics and Management Services — Audiense acts as Customer’s service provider/processor. The Processor Terms apply.
2.1.3. Third-Party Data Brokerage Services — Audiense acts as an independent business/controller.
2.2. Carve-Out for Brokerage Inputs. This Section applies only to Brokerage Inputs expressly designated by Customer in an applicable Order Document for Third-Party Data Brokerage Services. Customer Personal Data collected or Processed in connection with First-Party Processing Services or Website Analytics and Management Services shall not become Brokerage Inputs or fall outside the Processor Terms merely because Audiense aggregates, de-identifies, derives, transforms, combines, or otherwise modifies such data.
Audiense may use and disclose Brokerage Inputs and Output Data derived from Brokerage Inputs only for the Third-Party Data Brokerage Services expressly described in the applicable Order Document and in compliance with applicable Data Protection Laws. Nothing in this DPA requires Audiense to return or delete Output Data derived solely from Brokerage Inputs, provided that such Output Data does not contain Customer Personal Data and cannot reasonably be linked to Customer or any identified or identifiable individual.

3. CUSTOMER OBLIGATIONS

3.1. With respect to First-Party Processing Services and Website Analytics and Management Services, Audiense shall Process Customer Personal Data solely as necessary to provide, maintain, secure, support, and improve the Applicable Services provided to Customer in accordance with the Agreement, this DPA, and Customer’s documented instructions. Audiense shall not sell, license, disclose, or otherwise make Customer Personal Data available to third parties for their independent commercial purposes; compile Customer Personal Data into profiles for sale or licensing to other customers; use Customer Personal Data to develop products or services for third parties; or use Customer Personal Data to train artificial intelligence or machine-learning models, except with Customer’s prior express written authorization.
3.2. The foregoing restrictions do not prohibit Audiense from Processing Customer Personal Data through authorized Subprocessors as necessary to provide the Services or from using Anonymous Data or De-Identified Data that has been created in accordance with applicable Data Protection Laws and cannot reasonably be linked to Customer or an identified or identifiable individual.
3.3. Any use of Customer-supplied Personal Data in connection with Third-Party Data Brokerage Services shall be permitted only where such services are expressly identified in the applicable Order Document and shall be governed by Section 10 of this DPA.
3.4. Customer’s instructions for the processing of Customer Personal Data shall comply with the Data Protection Laws. Customer acknowledges that Audiense is reliant on Customer for direction as to the extent to which Audiense is entitled to use and Process Customer Personal Data. Consequently, Audiense will not be liable for any claim brought against Customer or Audiense by a Data Subject arising from any act or omission by Audiense to the extent that such act or omission resulted from Customer’s instructions or Customer’s use of the Applicable Services.

4. PROCESSING OF PERSONAL DATA

4.1. Processing of Personal Data. With respect to First-Party Processing Services and Website Analytics and Management Services, Audiense shall Process Customer Personal Data only as necessary to provide, operate, maintain, secure, support, and improve the Applicable Services provided to Customer, in accordance with the Agreement, this DPA, the applicable Order Document, and Customer’s documented instructions. Except as expressly provided below, Audiense shall not sell or share Customer Personal Data; compile or combine Customer Personal Data into profiles, datasets, audience segments, or other data products for sale, licensing, or use by other customers or third parties; or otherwise use Customer Personal Data for the independent commercial purposes of Audiense or any third party. Audiense may disclose Customer Personal Data to authorized Subprocessors and transmit Customer Personal Data to platforms, integrations, or other destinations selected by Customer, in each case solely as necessary to provide the Applicable Services and in accordance with Customer’s documented instructions.
Notwithstanding the foregoing, if Customer expressly and affirmatively opts in through an Order Document or other written agreement, Customer authorizes Audiense to use, combine, aggregate, de-identify, derive from, enhance, and otherwise Process the Customer Personal Data identified in such opt-in (“Opt-In Data”) for the purposes specified therein, including to create datasets, audience segments, profiles, insights, analytics, models, and other data products. To the extent expressly authorized by Customer’s opt-in and permitted by applicable Data Protection Laws, Audiense may use, license, sell, share, disclose, distribute, and otherwise commercialize Opt-In Data and data products derived therefrom for Audiense’s own business purposes and for the benefit of its customers, licensees, and other third parties. Customer represents and warrants that it has provided all notices, obtained all consents and authorizations, and possesses all rights necessary to authorize such Processing and commercialization of Opt-In Data. Audiense shall Process Opt-In Data only within the scope of Customer’s affirmative opt-in and to the extent permitted by applicable Data Protection Laws. Except to the extent expressly authorized by Customer’s opt-in and permitted by applicable Data Protection Laws, Customer Personal Data shall remain subject to the restrictions set forth in this DPA.
4.1.1. Audiense shall be responsible for complying with Data Protection Laws and Customer’s documented instructions when Processing Customer Personal Data. Audiense shall inform Customer without undue delay if, in Audiense’s reasonable opinion, a Customer instruction violates applicable Data Protection Laws.
4.1.2. Customer instructs Audiense to Process Customer Personal Data as necessary to provide the Applicable Services in accordance with the Agreement, this DPA, the applicable Order Document, and Customer’s documented instructions. Where Customer expressly and affirmatively opts in pursuant to Section 1.1, Customer further instructs and authorizes Audiense to Process the applicable Opt-In Data for the purposes and uses expressly authorized by such opt-in, including, as applicable, the aggregation, combination, de-identification, derivation, enhancement, use, licensing, sale, sharing, disclosure, distribution, and commercialization of such Opt-In Data and data products derived therefrom, in each case to the extent permitted by applicable Data Protection Laws.
4.1.3. Except with respect to Opt-In Data Processed as expressly authorized by Customer pursuant to Section 1.1, Audiense shall not retain, use, disclose, sell, or share Customer Personal Data except as necessary to provide the Applicable Services in accordance with the Agreement, this DPA, the applicable Order Document, and Customer’s documented instructions, or as required by applicable law. Any Processing of Opt-In Data shall be limited to the scope and purposes of Customer’s affirmative opt-in and shall comply with applicable Data Protection Laws.
4.1.4. The subject matter, nature, purpose, and duration of the Processing, as well as the categories of Data Subjects and Customer Personal Data Processed, are described in Schedule 1 to this DPA, the applicable Order Document, and, where applicable, Customer’s affirmative opt-in pursuant to Section 1.1.
4.1.5. In Processing Customer Personal Data under the Agreement, Audiense shall provide the level of privacy protection required by applicable Data Protection Laws. Audiense shall notify Customer without undue delay if Audiense determines that it or any Subprocessor can no longer meet its obligations under applicable Data Protection Laws. In such event, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized Processing of Customer Personal Data.
4.2. Data Subject Requests. Audiense shall inform Customer without undue delay if it receives a request from a Data Subject to exercise their rights under Data Protection Laws which is intended for Customer. Audiense will provide such assistance, including taking any appropriate technical and organizational measures, as required for Customer to fulfill its obligations under Data Protection Laws to respond to Data Subject Requests, to the extent Customer is unable to fulfill its obligations absent such assistance. Audiense may charge Customer, and Customer shall reimburse Audiense, for any such assistance beyond providing self-service features included as part of the Services. Notwithstanding its obligations under this Section, nothing in this Section obligates Audiense to respond to a Data Subject Request directly from a Data Subject and does not otherwise assume any liability or responsibility for responding to Data Subject Requests.
4.2.1. Requests to Delete. Unless it is permitted to retain Personal Data under the Data Protection Laws, Audiense will comply with Customer’s direction to delete any Personal Data where required by law, and shall notify any Subprocessors of such direction as applicable. Audiense shall not be required to delete any of the Personal Data to comply with a Data Subject’s request directed by Customer if it is necessary or permitted to maintain such information in accordance with applicable law.
4.3. Regulator Requests. Both Parties will reasonably assist the other in communicating and cooperating with any regulators relating to the Processing of Personal Data under the Agreement.
4.3.1. Each Party shall notify the other of all enquiries from a regulator that the Party receives which relate to the Processing of Customer Personal Data under the Agreement, unless prohibited from doing so at law or by the regulator.
4.3.2. Unless a regulator requests in writing to engage directly with Audiense, the Parties (acting reasonably and taking into account the subject matter of the request) agree that if and to the extent Audiense is acting as a Service Provider, Customer shall be responsible for handling all regulator requests relating to the Processing of Personal Data under the Agreement. Customer shall: (a) be responsible for all communications or correspondence with the regulator in relation to the Processing of Personal Data and the provision or receipt of the Services, and (b) keep Audiense informed of such communications or correspondence to the extent permitted by law. At Customer’s expense, Audiense shall provide such assistance as Customer may require in relation to such a regulator request, to the extent Customer is unable to fulfill its obligations absent such assistance.
4.4. Deletion and Return of Personal Data. Unless agreed upon in the Agreement, upon termination of the Agreement or Customer’s request, Audiense will: (a) if requested to do so by Customer, return all Personal Data to Customer or provide a self-service functionality allowing Customer to do the same, or (b) within 90 days of the termination or expiry of the Agreement, delete and use all reasonable efforts to procure the deletion of all other copies of Customer Personal Data processed by Audiense or any Subprocessors.
4.5. Disclosure.
4.5.1. Audiense shall inform its personnel engaged in the Processing of Customer Personal Data of the confidential nature of the Customer Personal Data and ensure that they are subject to binding confidentiality obligations.
4.5.2. If Customer Personal Data is being provided to a third party in response to a subpoena or other discovery request, to the extent permitted by applicable law, Audiense will provide Customer with notice of the subpoena or discovery request prior to disclosing the Customer Personal Data so that Customer may, at its expense, object to the subpoena or discovery request, or seek an appropriate protective order.
4.6. Confidentiality. Audiense agrees to inform all individuals with authorized access to Personal Data of the confidential nature of such information. Audiense will ensure that all employees are subject to binding confidentiality obligations.
4.7. Data Protection Impact Assessments and Prior Consultation. Audiense agrees to provide all reasonable assistance to Customer in completing any data protection impact assessments and/or consultations with government authorities pursuant to Data Protection Laws to the extent Customer is unable to fulfill its obligations absent such assistance.

5. AUDITS.

Customer may audit Audiense’s compliance with its obligations under this DPA and the Data Protection Laws, and will cooperate in a data protection impact assessment (together, “Audit”) as required by Data Protection Laws, subject to the following requirements:
5.1. Audiense will inform Customer if, in its opinion, any of Customer’s instructions relating to the Audit violate applicable Data Protection Laws.
5.2. Customer may perform such Audits not more than once per year or more frequently if required by Data Protection Laws applicable to Customer.
5.3. Customer may use a third party to perform the Audit on its behalf, provided the third party is a qualified auditor and executes a confidentially agreement acceptable to Audiense before the Audit.
5.4. To request an audit, Customer must submit a detailed proposed audit plan to Audiense at least four weeks in advance of the proposed audit date. Audiense will review the proposed audit plan and collaborate cooperatively with Customer to agree on a final audit plan. All such audits must be conducted during regular business hours, subject to the agreed final audit plan and Audiense’s health and safety or other relevant policies and may not unreasonably interfere with Audiense business activities. Nothing in this clause 5.4 shall require Audiense to breach any duties of confidentiality. Customer must provide Audiense with any Audit reports or findings generated in connection with any Audit at no charge, unless prohibited by law. Customer may use the Audit reports only for the purposes of meeting its Audit requirements under Data Protection Laws and/or monitoring and confirming compliance with the requirements of this DPA. The Audit reports shall constitute Confidential Information of the Parties under the Agreement.
5.5. Under the following circumstances, Customer agrees to accept those findings in lieu of requesting an Audit of the controls covered by the report: (a) the requested Audit scope is addressed in a similar Audit report performed by a qualified third-party auditor for Audiense within twelve (12) months of Customer’s request, (b) if permitted by the Data Protection Laws, and (c) Audiense confirms there are no known material changes in the controls audited. All Audits are at Customer’s sole cost and expense. Any request for Audit assistance requiring the use of resources different from or in addition to those required for provision of the Services will be considered an additional Service for which reasonable additional fees may be charged. Audiense reserves the right to require Customer’s written agreement to pay for such fees before providing such Audit assistance.
5.6. Customer will promptly notify Audiense of any non-compliance discovered during the course of an audit and provide Audiense any audit reports generated in connection with any audit, unless prohibited by applicable law or otherwise instructed by a regulatory or governmental authority. Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this DPA.
5.7. Any audits are at Customer’s expense. Customer shall reimburse Audiense for any reasonable, documented out-of- pocket costs incurred by Audiense or its Subprocessors in connection with such audits.

6. SECURITY MEASURES.

Subject to the obligations of Customer under the Agreement:
6.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Audiense and each Audiense Affiliate shall, in relation to the Customer Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, as appropriate, the measures referred to in Article 32 of the GDPR.
6.2. In assessing the appropriate level of security, Audiense shall take account in particular of the risks that are presented by Processing, including without limitation the risks of a Security Incident.
6.3. Audiense shall notify Customer without undue delay after becoming aware of a Security Incident and shall co-operate with Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of a Security Incident. The parties agree to reasonably cooperate with one another before communicating about any Security Incident with any third party. Audiense’s notification of or response to a Security Incident under this clause 4.3 will not be construed as an acknowledgement by Audiense of any fault or liability with respect to the Security Incident.
6.4. Audiense will implement and maintain as a minimum standard the measures set out in Schedule 2. Audiense may update or modify the security measures set out in Schedule 2 from time to time, including (where applicable) following any review by Audiense of such measures in accordance with clause 8.6 of the SCCs, provided that such updates and/or modifications do not reduce the overall level of protection afforded to the Customer Personal Data by Audiense under this DPA.
6.5. Customer acknowledges and agrees that, taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the security measures set out in Schedule 2 are appropriate to ensure the security of the Customer Personal Data.

7. SUBPROCESSORS

7.1. Customer authorizes Audiense and each Audiense Affiliate to appoint (and permit each Subprocessor appointed in accordance with this Section 5 to appoint) Subprocessors in accordance with this Section 5 and any restrictions in the Agreement and applicable Data Protection Laws including the Standard Contractual Clauses and UK Addendum, if applicable. Customer grants Audiense general authorization to engage Subprocessors, subject to this Section, from an agreed list, as well as Audiense’s current Subprocessors listed in the Subprocessor list attached hereto as Schedule 3, as may be updated in accordance with this Section 5..
7.2. Audiense and each Audiense Affiliate may continue to use those Subprocessors already engaged by Audiense or any Audiense Affiliate as of the date of this DPA, subject to Audiense and each Audiense Affiliate in each case as soon as practicable meeting the obligations set out in Section 5.3. Audiense shall give Customer fifteen (15) days’ prior written notice of the appointment of any new Subprocessor, and Customer must inform Audiense of any objection to such new Subprocessor within ten (10) days of such notice. If Customer objects to a Subprocessor under this Section, the parties will make a good-faith effort to resolve Customer’s objection. In the absence of a resolution, Audiense will make commercially reasonable efforts to provide Customer with the same level of service, without using the new Subprocessor to process Customer Data. If Audiense is unable to make available such change within a reasonable period of time, each party may, as its sole and exclusive remedy, terminate the Agreement with regard to the affected portion of the Services, by providing written notice to the other party. During any such objection period, Audiense may suspend the affected portion of the Services.
7.3. Audiense will ensure that any Subprocessor that has access to Customer Personal Data enters into a written agreement obligating the Subprocessor to comply with terms that are at least as restrictive as those imposed on Audiense under the Data Protection Laws.
7.4. Audiense shall remain fully liable to Customer for the performance of its Subprocessors’ obligations and shall be responsible to Customer for its Subprocessors’ Processing of Personal Data.

8. DATA TRANSFERS

8.1. Standard Contractual Clauses. To the extent Customer Personal Data subject to the GDPR is transferred from the European Economic Area to Audiense in a country that has not been recognized as providing an adequate level of protection, the Parties agree that the European Commission Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 are hereby incorporated into this DPA by reference and shall be deemed executed by the Parties upon execution of, or acceptance of, this DPA.
8.2. Where Customer acts as a controller and Audiense acts as a processor, Module Two (Controller to Processor) shall apply. Where Customer acts as a processor and Audiense acts as a Subprocessor, Module Three (Processor to Processor) shall apply.
8.3. For purposes of the Standard Contractual Clauses, Customer shall be the data exporter and Audiense shall be the data importer. The information required to complete Annex I of the Standard Contractual Clauses shall be deemed completed by the information contained in the Agreement and Schedule 1 of this DPA, and the technical and organizational measures required by Annex II shall be deemed completed by Schedule 2 of this DPA.
8.4. Support for Cross-Border Data Transfers. Audiense will provide Customer reasonable support to enable Customer’s compliance with the requirements imposed on the transfer of personal data to third countries with respect to data subjects located in the EEA, Switzerland, and UK. Audiense will, upon Customer’s request, provide information to Customer which is reasonably necessary for Customer to complete a transfer impact assessment (“TIA”). Audiense may charge Customer, and Customer shall reimburse Audiense, for any assistance provided by Audiense with respect to any TIAs, data protection impact assessments or consultation with any supervisory authority of Customer.
8.5. Customer Personal Data Subject to the UK and Swiss Data Protection Laws. To the extent that the processing of Customer Personal Data is subject to UK or Swiss data protection laws, the UK laws and/or Swiss laws (as applicable) shall apply.

9. ADDITIONAL COMPLIANCE PROVISIONS

9.1. The Parties each represent and warrant to each other that they have read and understand the requirements of all applicable Data Protection Laws, and will be responsible for their own compliance with them.
9.1.1. Audiense shall not have any liability to Customer to the extent the basis of liability arises from failure by Customer to provide any required notice or obtain any necessary consents to collect, use, transfer, or otherwise Process Personal Data, or failure by Customer to fully comply with the Agreement, this DPA, or applicable Data Protection Laws.
9.1.2. Each Party agrees that it is responsible for its own compliance with the requirements of the GDPR and other applicable Data Protection Laws and agrees to indemnify, defend, and hold harmless the other Party from and against any claims, demands, losses, liabilities, fines, penalties, costs, and expenses arising out of or relating to its own acts and omissions that do not comply with the Data Protection Laws. This duty to indemnify, defend, and hold harmless includes fines that may be imposed by a governing authority and any and all reasonable attorneys’ fees and court costs.
9.2. Data provided to Audiense for First-Party Processing Services or Website Analytics and Management Services will not constitute Brokerage Inputs and will not be used for Third-Party Data Brokerage Services unless Customer expressly designates the data as Brokerage Inputs in a separate Order Document or written authorization that specifically describes the permitted commercialization.

10. THIRD-PARTY DATA BROKERAGE SERVICES

10.1. Role; Independence. For Third-Party Data Brokerage Services, Audiense acts as an independent business/controller with respect to Brokerage Inputs and any Personal Data derived therefrom that Audiense Processes for such services. Audiense does not act as Customer’s service provider/processor with respect to such Processing, and the Processor Terms do not apply to such Processing.
10.2. Brokerage Inputs; Authorization and Permissions.
10.2.1. Customer may expressly and affirmatively opt in through an Order Document or other written agreement to provide or authorize the use of specified Customer Personal Data or other data for inclusion in Audiense’s Third-Party Data Brokerage Services (“Brokerage Inputs”). The applicable opt-in shall identify the data or categories of data constituting Brokerage Inputs and authorize Audiense to Process such Brokerage Inputs for Third-Party Data Brokerage Services. Customer Personal Data shall not constitute Brokerage Inputs or become subject to this Section solely because Audiense Processes, aggregates, de-identifies, derives, transforms, combines, or otherwise modifies such data in connection with First-Party Processing Services or Website Analytics and Management Services.
10.2.2. To the extent expressly authorized by Customer’s opt-in and permitted by applicable Data Protection Laws, Customer authorizes Audiense to use, combine, aggregate, de-identify, derive from, enhance, Transform, license, sell, share, disclose, distribute, and otherwise commercialize Brokerage Inputs and data products derived therefrom in connection with Audiense’s Third-Party Data Brokerage Services, including disclosure, sale, or licensing to Audiense’s customers, licensees, and other third parties.
10.2.3. Customer represents and warrants that Brokerage Inputs were collected and disclosed in compliance with applicable Data Protection Laws and that Customer has provided all required notices, obtained all required consents and authorizations, and possesses all rights necessary to authorize Audiense to Process and commercialize the Brokerage Inputs as expressly contemplated by the applicable opt-in and this Section.
10.2.4. Customer shall not provide or designate as Brokerage Inputs any data subject to contractual, legal, or other restrictions inconsistent with the Processing contemplated by this Section unless such restrictions are expressly identified to and accepted in writing by Audiense.
10.3. No Attribution. Audiense will not attribute De-Identified Data, Output Data, Derived Data, or other data products derived from Brokerage Inputs to Customer except as necessary for audit, compliance, compensation, or other purposes expressly described in the applicable Order Document or other written agreement.
10.4. Consumer Requests. Each Party will be individually responsible, in its role as an independent business/controller, for responding to data subject or consumer requests for which it is responsible under applicable Data Protection Laws. The Parties will reasonably cooperate to route misdirected requests to the appropriate Party and, where required by applicable Data Protection Laws, to facilitate the exercise of applicable data subject or consumer rights.

11. GENERAL

11.1. Interaction With the Agreement.
11.1.1. This DPA supplement and (in case of contradictions) supersedes the Agreement with respect to any processing of Customer Personal Data as a Service Provider.
11.1.2. With respect to Customer Affiliates, by entering into the Agreement, Customer warrants it is duly authorized to enter into the DPA for and on behalf of any such Customer Affiliates and, subject to clause 11.1.3, each Customer Affiliate shall be bound by the terms of this DPA as if they were the Customer.
11.1.3. Customer warrants that it is duly mandated by any Customer Affiliates on whose behalf Audiense processes Customer Personal Data in accordance with this DPA to (a) enforce the terms of this DPA on behalf of the Customer Affiliates, and to act on behalf of the Customer Affiliates in the administration and conduct of any claims arising in connection with this DPA; and (b) receive and respond to any notices or communications under this DPA on behalf of Customer Affiliates.
11.1.4. The Parties agree that any notice or communication sent by Audiense to Customer shall satisfy any obligation to send such notice or communication to a Customer Affiliate.
11.2. Certification. By signing this DPA, Audiense certifies that it understands the restrictions herein and will comply with them.
11.3. Liability. Each Party’s liability under or in connection with this DPA is subject to the limitations on liability contained in the Agreement, to the extent permitted by law.
11.4. No Restriction. The obligations contained in this DPA, including the Exhibits, Attachments, and Appendices, shall not restrict Audiense in its rights and/or obligations to: (a) comply with federal, state, or local laws, or to comply with a court order or subpoena to provide information or legal holds, or (b) to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.

SCHEDULE 1

DETAILS OF DATA PROCESSING

1. Roles of the Parties
For purposes of the Processing of Personal Data under the Agreement:
• Customer: Controller (or Processor, where Customer processes Personal Data on behalf of a third party).
• Audiense: Processor (or Subprocessor, where Customer acts as a Processor).
To the extent Audiense independently determines the purposes and means of Processing Personal Data, Audiense shall act as an independent Controller with respect to such Processing, as further described in the Agreement or applicable privacy notice.
2. Subject Matter of Processing
The Processing of Customer Personal Data necessary for Audiense to provide the Applicable Services described in the Agreement, applicable Order Document, Statement of Work, or other applicable service documentation, including hosting, analytics, audience intelligence, data enrichment, reporting, support, account administration, and other Applicable Services.
3. Nature and Purpose of Processing
Audiense may Process Customer Personal Data as necessary to provide, operate, maintain, secure, support, and improve the Applicable Services and to perform its obligations under the Agreement. Processing activities may include, as applicable:
• collection and receipt;
• access and retrieval;
• organization and structuring;
• storage and hosting;
• matching, enrichment, combination, and analysis;
• consultation and use;
• transmission and disclosure as authorized by Customer;
• reporting and generation of Results;
• security monitoring and troubleshooting; and
• deletion, return, or destruction.
Audiense shall Process Customer Personal Data only for the purposes specified in the Agreement, the applicable Order Document or Statement of Work, and Customer’s documented instructions, except as otherwise required by applicable law.
4. Categories of Data Subjects
Depending on the Applicable Services purchased, Customer Personal Data may relate to:
• Customer’s employees, personnel, contractors, and Authorized Users;
• Customer’s customers and prospective customers;
• consumers and members of Customer’s loyalty or membership programs;
• website, application, and platform users or visitors;
• business contacts and representatives;
• individuals included within Customer-provided datasets; and
• other individuals whose Personal Data is submitted to or otherwise Processed through the Applicable Services by or on behalf of Customer.
5. Categories of Personal Data
Depending on the Applicable Services purchased, Customer Personal Data may include:
• name and other identifiers;
• contact information, including postal address, email address, and telephone number;
• account and user identifiers;
• demographic information;
• household information;
• commercial and transactional information;
• customer, membership, or loyalty information;
• online identifiers and device information;
• internet, website, application, or platform activity;
• location information, where applicable to the Applicable Services;
• preferences, interests, audience attributes, segments, and behavioral information;
• inferred, modeled, appended, or enriched attributes;
• business and professional information; and
• other Personal Data provided by or on behalf of Customer in connection with the Applicable Services.
6. Special Categories / Sensitive Personal Data
The Applicable Services are not intended for Customer to provide special-category or sensitive Customer Personal Data unless expressly authorized in the applicable Order Document or otherwise agreed by the parties in writing. Customer shall not provide such Customer Personal Data unless its Processing is permitted under the Agreement and applicable law.
7. Duration of Processing
Audiense may Process Customer Personal Data for the duration of the applicable Agreement or Order Document and thereafter only for the period reasonably necessary to return or delete Customer Personal Data, comply with applicable legal obligations, resolve disputes, enforce agreements, or as otherwise permitted under the Agreement.
Upon termination or expiration, Customer Personal Data will be returned or deleted in accordance with the DPA and Audiense's applicable retention and deletion requirements.
8. Processing Frequency
Processing may occur on a continuous, recurring, periodic, batch, or ad hoc basis, depending on the Applicable Services and Customer’s use of those Applicable Services.

SCHEDULE 2

TECHNICAL AND ORGANIZATIONAL MEASURES

Audiense has implemented the following technical and organizational measures (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, as well as the risks for the rights and freedoms of natural persons:
1. Organizational management and dedicated staff responsible for the development, implementation, and maintenance of Audiense’s information security program.
2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Audiense’s organization, monitoring and maintaining compliance with Audiense’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management.
3. Utilization of commercially available and industry standard encryption technologies for Customer Personal Data that is:
(a) being transmitted by Audiense over public networks (i.e., the internet) or when transmitted wirelessly; or
(b) at rest or stored on portable or removable media (i.e., laptop computers, CD/DVD, USB drives, back-up tapes).
4. Data security controls which include at a minimum, but may not be limited to, logical segregation of data, logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, (e.g., granting access on a need-to-know and least privilege basis, use of unique IDs and passwords for all users, periodic review, and revoking/changing access promptly when employment terminates or changes in job functions occur).
5. Password controls designed to manage and control password strength, expiration, and requiring that Audiense’s passwords that are assigned to its employees: (i) be at least eight (8) characters in length, (ii) not be stored in a readable format on Audiense’s computer systems; (iii) must have defined complexity; (iv) must have a history threshold to prevent reuse of recent passwords; and (v) newly issued passwords must be changed after first use.
6. System audit or event logging and related monitoring procedures to proactively record user access and system activity for routine review.
7. Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Audiense’s possession.
8. Change management procedures and tracking mechanisms designed to test, approve, and monitor all changes to Audiense’s technology and information assets.
9. Incident / problem management procedures designed to allow Audiense to investigate, respond to, mitigate, and notify of events related to Audiense’s technology and information assets.
10. Network security controls that provide for the use of firewall systems, intrusion detection systems, and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
11. Vulnerability assessment, patch management and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate, and protect against identified security threats, viruses, and other malicious code.
12. Business resiliency/continuity and disaster recovery procedures in an effort to maintain service and/or recovery from foreseeable emergency situations or disasters.

SCHEDULE 3

AUDIENSE SUBPROCESSOR LIST

Effective Date: August 1, 2026

Audiense engages the following third-party service providers to process Personal Data on behalf of Audiense in connection with the provision, operation, support, and administration of its services.

Changes to Subprocessors

Audiense may update this Subprocessor List from time to time in accordance with the applicable Data Processing Agreement. Any appointment of a new or replacement Subprocessor will be subject to the notice and objection procedures set forth in the Data Processing Agreement.