DATA PROCESSING ADDENDUM

Effective date: 23 October 2026 • Last updated: 23 October 2026

1. Subscription incorporation and scope

This Data Processing Addendum (“DPA”) forms part of the subscription agreement governing the Services (“Agreement”) between 15692016 Canada Inc., carrying on business as Mazuly (“Mazuly”), and the business customer identified in the subscription record (“Customer”). It takes effect when Customer affirmatively accepts it through the subscription process. Customer accepts this DPA through the acceptance process at sign-up. No separate signature is required. The accepting individual must have authority to bind Customer.

This DPA governs personal information and personal data processed by Mazuly on Customer’s behalf (“Customer Data”). It applies to Canadian and United States processing subject to the privacy laws applicable to the relevant activities. “Applicable Privacy Law” includes PIPEDA, applicable Canadian provincial privacy laws, applicable U.S. state comprehensive privacy laws, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and applicable breach-notification laws. A law applies only to the extent its territorial, organizational and subject-matter requirements are met.

This DPA does not replace the Privacy Policy for Mazuly’s genuinely separate processing of its own account, billing and business-contact information. Customer Data may not be reclassified as Mazuly’s own information to avoid this DPA. This is a business-customer processing agreement, not a waiver of consumer privacy rights.

2. Roles and processing description

Customer determines the purposes of processing and acts as the responsible organization, controller or business, as applicable. Mazuly acts as Customer’s processor or service provider. Where Customer processes information for another organization, Customer must have authority to engage Mazuly as a downstream processor and to issue instructions. Legal roles depend on actual activities, not labels alone.

Subject matter and purposes: Mazuly processes Customer Data to host and organize Customer’s account content; generate AI-assisted content from Customer’s inputs; publish content and replies to accounts Customer connects, including through automations Customer enables; retrieve reviews and related information from those accounts; analyse Customer’s website and publicly available information at Customer’s request; and provide related support, troubleshooting, security, backup and recovery. Only purchased and enabled functions are authorized. Customer discloses Customer Data only for these limited, specified purposes, not for Mazuly’s unrelated commercial use.

Nature of processing: collection on Customer’s instructions, storage, retrieval, organization, analysis, AI inference where enabled, transmission, correction, export and deletion. Processing is ongoing or event-based according to Customer’s settings and instructions.

Individuals and data: Customer’s authorized users, Customer’s customers and reviewers, and individuals included in content Customer submits, reviews or support materials. Data may include names, business/contact details, email addresses, message and review content and metadata, prompts and generated content containing personal information, account-access records and relevant support or service logs. Only data actually submitted or lawfully collected for an enabled function is within scope.

Duration: the subscription term, any documented return/transition period requested by Customer, and the limited deletion, backup or legally required retention periods in section 10. Materially different purposes or data categories require documented agreement before processing.

Sensitive or specially regulated data, including protected health information, biometric identifiers, payment-card credentials, government identifiers, precise geolocation or children’s data, are not authorized unless Mazuly expressly agrees to the scope and legally required safeguards. This DPA alone is not a HIPAA business associate agreement or other required sector-specific instrument.

Notwithstanding the preceding paragraph, reviews and other content retrieved from Customer’s connected accounts may contain sensitive information supplied by third parties. Such content is processed on Customer’s instructions, and Customer is solely responsible for any obligations that apply to it, including professional confidentiality and health-privacy obligations when responding to reviews.

3. Instructions and use restrictions

Mazuly will process Customer Data only on documented instructions reflected in this DPA, the applicable Order, authorized account settings and lawful written instructions, unless required by law. It will notify Customer if an instruction appears unlawful and may suspend the affected processing pending clarification. If law requires different processing, Mazuly will give prior notice unless legally prohibited and limit processing to the legal requirement.

Mazuly will not sell Customer Data, use it for its own advertising, share it for cross-context behavioral advertising, or use it to train general-purpose or shared AI models. It will contractually require, or configure, its subprocessors not to do so. Any different processing requires a separate lawful written arrangement and required notices or consents before it begins; a general service-improvement clause is insufficient.

Mazuly may use information as anonymous or deidentified data only where it meets the applicable legal standard. It will maintain that status, not attempt reidentification except where expressly permitted by law for a lawful verification purpose, and impose equivalent restrictions on authorized recipients. Pseudonymized information remains protected where an individual remains identifiable.

4. Customer responsibilities

Customer will comply with its own obligations, give required notices, obtain required consents or other lawful permissions, minimize submitted data, configure access and retention appropriately, and issue lawful instructions. Customer is responsible for its decision to send messages, publish content or enable automated processing and for applicable recipient-consent and opt-out requirements.

Customer will maintain accurate privacy and incident contacts in its subscription record and identify relevant restrictions before processing. These responsibilities do not transfer Mazuly’s own statutory or contractual duties to Customer. Unless Customer designates another contact in the Services, notices may be sent to the account owner’s email address.

5. Confidentiality and security

Mazuly will ensure that personnel processing Customer Data are bound by confidentiality obligations, receive appropriate training, and have access only as needed for authorized duties. Access will be reviewed and removed when no longer required.

Mazuly will maintain reasonable administrative, technical and physical safeguards appropriate to the nature, volume and sensitivity of Customer Data and processing risks. These will include least-privilege access, multifactor authentication for privileged administration, logical customer separation, appropriate encryption in transit and at rest, protected credentials and integration secrets, security logging and monitoring, risk-based vulnerability remediation, controlled system changes, protected backups where used, secure disposal and documented incident-response procedures.

Mazuly will periodically assess safeguards and address material deficiencies. Changes must not materially reduce overall protection or breach Applicable Privacy Law. These are contractual commitments, not claims that Mazuly holds any particular certification. Customer remains responsible for its devices, credentials, local copies and user-permission choices.

6. Subprocessors and connected platforms

Customer gives general authorization for Mazuly to engage suitable subprocessors to perform the specified processing. Mazuly will provide a current list identifying each subprocessor’s legal identity, function and processing locations, which is available to Customer on request. No schedule or customer-completed annex is required.

Mazuly will assess each subprocessor and impose written obligations concerning purpose limitation, confidentiality, security, assistance, incidents, deletion and onward processing that are no less protective in substance than the applicable obligations in this DPA. Mazuly remains responsible for delegated performance, subject to the Agreement’s lawfully applicable liability provisions.

Mazuly will notify Customer of an addition or replacement by updating the list or by email. Customer may object on reasonable data-protection grounds within 10 days of the notice. If the Parties cannot resolve the objection, Customer’s sole remedy is to stop using the affected Services or terminate the affected Order Form.

A genuinely urgent security, legal or continuity need may justify shorter notice, with notice as soon as practicable and equivalent safeguards. Required legal protections and Customer’s reasonable objection rights remain applicable.

A platform separately selected and contracted by Customer is not automatically Mazuly’s subprocessor. Mazuly will disclose Customer Data to such a platform only on lawful instructions. Providers actually selected by Mazuly to perform its obligations cannot be relabelled as independent Customer choices to avoid this DPA.

7. Rights requests and compliance assistance

Mazuly will reasonably assist Customer with legally required access, correction, deletion, portability, withdrawal, restriction, opt-out, appeal and other individual-rights requests, taking account of the processing and information available. It will promptly forward requests received directly and act substantively only on instructions or as required by law. Customer will supply necessary verified request information, and Mazuly will carry out lawful instructions within a period enabling Customer to meet applicable deadlines.

Mazuly will provide relevant information and reasonable cooperation for privacy/data-protection assessments, transfer assessments, regulatory inquiries, cybersecurity audits and applicable automated-decisionmaking obligations. Assistance obligations include applicable U.S. state-law processor duties, not merely voluntary support.

Mazuly may charge reasonable fees for assistance beyond the self-service tools available in the Services, except where the assistance is required because of Mazuly’s own breach. Mazuly will not charge for remedying its own breach or allow fee discussions to delay mandatory cooperation. Each Party remains responsible for obligations imposed directly on it.

8. Security incidents and notifications

“Security Incident” means accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data. Mazuly will notify Customer’s designated incident or account-administrator contact without undue delay after confirming a Security Incident affecting Customer Data, and within any shorter period required by applicable law.

To the extent known, notice will describe the nature and timing, affected data and individuals, likely consequences, containment and remediation, and a response contact. Unknown details will be identified and updated without undue delay. Mazuly will investigate, contain and mitigate the incident, preserve relevant evidence, maintain required records and reasonably assist Customer’s assessment and notices.

Customer determines its own notification obligations. Mazuly will not notify individuals on Customer’s behalf without instructions unless legally required, and will coordinate where lawful. Neither Party may prevent the other from making a legally required notification. Notification is not itself an admission of liability.

Where Quebec’s private-sector privacy law section 18.3 applies, Mazuly will notify Customer’s person in charge of personal-information protection without delay of a violation or attempted violation of any confidentiality obligation concerning information communicated under the service mandate, whether or not it meets the Security Incident definition or a harm threshold.

9. Verification, audits and remediation

Mazuly will make available information reasonably necessary to demonstrate compliance, including relevant policies, security information and independent reports actually held. Customer may request such information no more than once in any 12-month period, unless required by a regulator or following a Security Incident. Mazuly will respond in writing, which satisfies Customer’s audit rights except where applicable law requires an inspection, in which case the inspection will be at Customer’s cost, on at least 30 days’ notice, during business hours, subject to confidentiality and without access to other customers’ data.No auditor may be a competitor of Mazuly or employed by one.

The Parties will coordinate scope, notice and timing reasonably, protecting other customers’ information and system security without unreasonably blocking verification. Customer may take reasonable and appropriate steps to ensure permitted use and, on notice, stop and remediate unauthorized use. Mazuly will cooperate and correct its deficiencies.

Mazuly will notify Customer promptly if it determines it can no longer meet this DPA or applicable processor/service-provider obligations and will suspend affected processing where necessary pending remediation. Quebec confidentiality-verification rights and legally required regulator access are not restricted by routine audit arrangements.

10. Return, deletion and retention

At Customer’s choice, Mazuly will return Customer Data through the export functionality available in the Services or delete it at the end of the Services, unless retention is legally required. Mazuly is not required to create custom exports. A requested return/transition period may continue for up to 30 days after termination where lawful, under this DPA. Mazuly will delete active copies within 30 days after that period or sooner on lawful instructions or where law requires. Suspension or a Customer breach does not itself extinguish return/deletion duties. Content already published to a third-party platform at Customer’s direction remains subject to that platform’s control and is not removed from it by deletion from the Services; Mazuly is not responsible for removing it.

Where legally permitted, isolated backup copies may remain protected and unavailable for ordinary use until overwritten through a documented cycle, no later than 90 days after active deletion. If restored for recovery, deletion instructions will be reapplied promptly. This does not authorize retention where a law requires earlier destruction.

Legally required retained records will be minimized, isolated and used only for the required purpose, then deleted when that duty ends. Mazuly will identify the retention basis and duration unless prohibited, require corresponding subprocessor action and confirm completion on request. This DPA continues while Customer Data remains held.

Where Quebec section 18.3 applies, communicated information must not be kept after expiry of the mandate except as legally permitted or required. Any lawful return/transition service must be documented; the periods above do not override that rule. Deidentification is not a substitute for required return or deletion unless lawfully instructed and legally sufficient.

11. Canadian and international processing

Each Party will meet Canadian accountability and safeguard obligations applying to its role. Where PIPEDA applies, Mazuly will provide contractual and organizational protection appropriate to the entrusted information and reasonably assist Customer’s outsourcing accountability obligations.

Customer Data is primarily stored in Canada and may be processed and stored by subprocessors in the United States and other countries. This DPA is not a promise of exclusive Canadian or U.S. residency. Proposed new countries are subject to advance notice and reasonable objection under section 6. Mazuly will provide information needed for legally required transfer assessments and safeguards.

Where Quebec law requires an assessment and written protections before processing outside Quebec, those requirements must be satisfied before the transfer. Each Party will give notices required of it about cross-border processing and lawful foreign-government access. Mazuly will notify Customer of legally binding demands unless prohibited, review validity, pursue reasonable available safeguards and disclose only what is legally required.

This DPA does not itself authorize processing outside its agreed scope or replace a legally required international-transfer instrument for information subject to another jurisdiction’s transfer restrictions.

12. United States privacy-law terms

Where applicable U.S. state privacy law treats Customer as a controller or business, Mazuly will process Customer Data only as its processor or qualifying service provider/contractor for the specified purposes and comply with obligations applicable to that role. The protections below apply to CCPA-covered Customer Data and to analogous requirements of other applicable state laws.

Mazuly will not: (a) sell or share Customer Data as defined by the CCPA; (b) retain, use or disclose it for a purpose other than the specified business purposes, except as expressly permitted by applicable law; (c) retain, use or disclose it outside the direct business relationship with Customer, except as expressly permitted by law; or (d) combine it with personal information received from another person or collected through Mazuly’s own interactions with individuals, except where expressly permitted by law and consistent with Customer’s instructions. Mazuly will not use Customer Data for its own targeted advertising or unrelated cross-customer profiling.

Mazuly will comply with applicable CCPA provisions and regulations and provide the same level of privacy protection required of businesses for the entrusted information. Mazuly certifies that it understands and will comply with the contractual restrictions in this section. This certification forms part of the electronically accepted DPA.

Customer may exercise the compliance, monitoring and remediation rights in section 9, including reasonable reviews, assessments, audits or other agreed security-controlled testing. Mazuly will notify Customer if it can no longer meet applicable requirements, enable compliance with consumer requests, and impose corresponding applicable restrictions on subcontractors. Neither electronic acceptance nor this contractual designation alone establishes that every statutory qualification or exemption is met.

13. Priority, liability and continuing effect

For conflicts about processing Customer Data, this DPA prevails over inconsistent Agreement, Order or policy provisions, unless a later valid written amendment expressly identifies and changes the affected DPA provision. Mandatory law prevails in all cases. No unilateral policy change may expand processing purposes or materially reduce agreed protections.

The Agreement’s lawfully applicable liability limits and remedies govern contractual claims under this DPA. This DPA creates no separate monetary cap and does not limit non-waivable statutory liability, bind regulators, waive individual rights or delay mandatory notification or cooperation. The Agreement’s governing law and dispute procedures apply subject to these protections.

The Parties will reasonably cooperate to address changes in Applicable Privacy Law and suspend processing that cannot lawfully continue. This DPA remains effective while Mazuly or its subprocessors hold Customer Data. Privacy and incident notices will use the contact details designated in the subscription record or Agreement; Customer must keep its contacts current.