Data Processing Agreement

1.1 Part of your agreement.

This Data Processing Agreement ("DPA") is part of the agreement between Spreadcheer LLC ("Spreadcheer") and you: the Partner Agreement if you are a Partner, or the Terms of Service if you buy the Service directly (the "Agreement"). "You" means that Partner or direct customer.

1.2 What it covers.

"Customer Personal Data" means personal information that you, your users or, if you are a Partner, your Customers submit to or collect through the Service, and for which Spreadcheer acts as a service provider. It does not cover your own account, billing and contact details, which Spreadcheer handles under its Privacy Policy.

1.3 Roles.

• If you buy directly, you are the business or controller and Spreadcheer is your service provider or processor.
• If you are a Partner, each of your Customers is the business or controller, you are its service provider or processor, and Spreadcheer is your subcontractor.

1.4 Details.

Schedule 1 describes the processing.

2.1 Limited purpose.

Spreadcheer will process Customer Personal Data only to provide the Service and for the business purposes in Schedule 1, following your instructions. The Agreement and your use of the Service are your instructions.

2.2 No sale or sharing.

Spreadcheer will not sell Customer Personal Data or share it for cross-context behavioral advertising.

2.3 No other use.

Spreadcheer will not keep, use or disclose Customer Personal Data for any purpose other than those in Schedule 1, or outside its direct business relationship with you, except as privacy law allows a service provider to do.

2.4 No combining.

Spreadcheer will not combine Customer Personal Data with personal information it receives from other sources or other customers, except as privacy law allows a service provider to do.

2.5 Permitted internal use.

Spreadcheer may use Customer Personal Data internally to build and improve the quality of the Service, to detect security incidents and to protect against fraud or illegal activity. It will not use Customer Personal Data to perform services for anyone else or to build profiles of individuals.

2.6 No AI training.

Spreadcheer will not use Customer Personal Data to train generative AI models and will not allow its AI providers to do so.

2.7 Compliance.

Spreadcheer will comply with the privacy laws that apply to it as a service provider and will give Customer Personal Data the level of protection those laws require. It will tell you within 5 business days if it decides it can no longer meet its obligations.

2.8 Your right to check.

You may take reasonable and appropriate steps, as Section 7 describes, to confirm that Spreadcheer uses Customer Personal Data consistently with your own legal obligations. On notice, you may take reasonable steps to stop and remedy any unauthorized use.

2.9 Confidentiality.

Spreadcheer will make sure everyone it authorizes to handle Customer Personal Data is bound to keep it confidential.

2.10 Requests from individuals.

If an individual asks Spreadcheer about Customer Personal Data, Spreadcheer will refer the request to you and give you reasonable help to respond.

3.1 Notices and consents.

You are responsible for giving every notice and getting every consent the law requires for Customer Personal Data to be processed as the Agreement describes.

3.2 Lawful instructions.

Your instructions to Spreadcheer must comply with the law.

3.3 Data you must not submit.

You will not submit protected health information, payment card numbers, government identification numbers or the personal information of children.

3.4 If you are a Partner.

You will:

• (a) have a written agreement with each Customer that meets the legal requirements for a service provider or processor;
• (b) publish a privacy notice that includes Spreadcheer's platform data section unchanged; and
• (c) be the first point of contact for your Customers on data protection matters.

4.1 Authorization.

You authorize Spreadcheer to use sub-processors in the categories in Schedule 3.

4.2 Contracts.

Spreadcheer will have a written contract with each sub-processor that requires it to protect Customer Personal Data to the standard this DPA sets.

4.3 Changes.

Spreadcheer will give notice at least 15 days before adding a new category of sub-processor, by email or by updating Schedule 3. If you object on reasonable data protection grounds and the parties cannot resolve it, you may end the affected part of the Service.

4.4 Responsibility.

Spreadcheer is responsible for its sub-processors' handling of Customer Personal Data, subject to the limits in the Agreement.

5.1 Spreadcheer's measures.

Spreadcheer will maintain the security measures in Schedule 2. It may update them as long as the overall level of protection does not fall.

5.2 Your part.

You are responsible for the security of your own systems and credentials, and those of your users and Customers.

6.1 Notice.

Spreadcheer will notify you without undue delay, and within 72 hours, after confirming unauthorized access to Customer Personal Data in its systems.

6.2 Information.

The notice will describe what happened, the data involved and the steps Spreadcheer is taking, to the extent known. Spreadcheer will update you as it learns more.

6.3 Who notifies whom.

You are responsible for any notice the law requires to individuals, regulators and, if you are a Partner, your Customers. Spreadcheer will give reasonable help.

6.4 No admission.

A notice under this Section is not an admission of fault or liability.

7.1 Information.

Once a year, on request, Spreadcheer will answer a reasonable security questionnaire and give you a summary of its security measures.

7.2 Audits.

You may audit Spreadcheer on site only where the law requires it or after a security incident affecting your data. You must give 30 days' notice, keep the results confidential and pay your own costs.

8.1 During the Agreement.

You can export and delete Customer Personal Data through the Service at any time.

8.2 On request or account deletion.

When you delete your account or ask in writing, Spreadcheer will delete Customer Personal Data from its live systems within 30 days and from backups within 90 days. It deletes social account access tokens within 24 hours after an account is disconnected.

8.3 If you do not ask.

If the Agreement ends and you do not ask for deletion, Spreadcheer may keep Customer Personal Data until you do.

8.4 What Spreadcheer may keep.

Spreadcheer may keep data the law requires it to keep, and data that has been de-identified under Section 9.

11.1 Precedence.

If this DPA and the rest of the Agreement conflict on a data protection matter, this DPA controls.

11.2 Liability.

Each party's liability under this DPA is subject to the limits and exclusions in the Agreement.

11.3 Term.

This DPA applies for as long as Spreadcheer processes Customer Personal Data.

11.4 Governing law.

The governing law and dispute terms of the Agreement apply to this DPA.

11.5 United States only.

This DPA covers personal information about people in the United States. You will not submit personal information about people elsewhere unless the parties first agree additional terms in writing.