Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between Consumer Fusion, Inc. ("Processor") and the customer entity ("Controller") that has executed an Order Form or Master Service Agreement with Consumer Fusion (the "Agreement"). This DPA forms part of the Agreement and governs the processing of Personal Data by Consumer Fusion on behalf of the Controller.

In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection matters.

Capitalized terms used in this DPA have the following meanings:

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Law.
• "Data Protection Law" means the GDPR, CCPA, and any other applicable privacy or data protection law or regulation.
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• "CCPA" means the California Consumer Privacy Act of 2018, as amended by the CPRA.
• "Processing" means any operation performed on Personal Data, whether by automated means or otherwise.
• "Sub-processor" means any third party engaged by Consumer Fusion to process Personal Data on behalf of the Controller.

Consumer Fusion processes Personal Data only as described below:

• Purpose: To provide the reputation management, listings management, review management, and related services described in the Agreement.
• Types of data: Business contact information (name, email, phone), account credentials, and any Personal Data contained in Customer Data submitted to the platform.
• Data subjects: The Controller's employees, agents, and end customers whose Personal Data is submitted to the platform.
• Duration: For the term of the Agreement, and as otherwise required by applicable law.

Consumer Fusion will process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law.

Consumer Fusion agrees to:

• Process Personal Data only for the purposes described in this DPA and the Agreement
• Ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations
• Implement and maintain appropriate technical and organizational measures to protect Personal Data, as described in our Security page
• Assist the Controller in responding to Data Subject requests to exercise their rights under applicable Data Protection Law
• Notify the Controller without undue delay, and in any case within 72 hours, upon becoming aware of a Personal Data breach
• Make available to the Controller all information necessary to demonstrate compliance with this DPA
• Delete or return all Personal Data to the Controller upon termination of the Agreement, at the Controller's choice

Consumer Fusion uses Sub-processors to deliver certain aspects of the Services. By entering into this DPA, the Controller provides general authorization for Consumer Fusion to engage Sub-processors, subject to the following conditions:

• Consumer Fusion will maintain an updated list of Sub-processors and make it available upon request
• Consumer Fusion will notify the Controller of any intended changes to Sub-processors with reasonable advance notice
• Consumer Fusion will impose data protection obligations on each Sub-processor equivalent to those in this DPA
• Consumer Fusion remains liable to the Controller for the acts and omissions of its Sub-processors

To obtain the current list of Sub-processors or to object to a new Sub-processor, contact legal@consumerfusion.com.

Consumer Fusion primarily stores and processes data in the United States. Where Personal Data is transferred from the European Economic Area (EEA), United Kingdom, or Switzerland to a country not recognized as providing an adequate level of data protection, Consumer Fusion will ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

Customers requiring SCCs or other transfer mechanisms should contact legal@consumerfusion.com.

Upon termination or expiration of the Agreement, Consumer Fusion will, at the Controller's election, either return all Personal Data to the Controller or securely delete it, within 60 days of the termination date, except where retention is required by applicable law. Consumer Fusion will certify such deletion in writing upon request.

Consumer Fusion implements and maintains appropriate technical and organizational security measures commensurate with the risk of Processing, including:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls, including role-based access and multi-factor authentication
• Regular security assessments and penetration testing
• SOC 2 Type II certification maintained on an annual basis
• Incident response procedures with defined notification timelines

A more complete description of our security measures is available on our Security page.

Upon reasonable written notice (no less than 30 days), Consumer Fusion will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and will allow for audits or inspections conducted by the Controller or its designated auditor, subject to reasonable confidentiality obligations and at the Controller's cost. Consumer Fusion may satisfy this obligation by providing its current SOC 2 Type II report.

Consumer Fusion will, to the extent legally permitted, promptly notify the Controller of any request received directly from a Data Subject regarding their Personal Data. The Controller is responsible for responding to Data Subject requests. Consumer Fusion will provide reasonable assistance to the Controller in fulfilling such requests, taking into account the nature of the Processing and the information available to Consumer Fusion.

This DPA is effective as of the date the Agreement becomes effective and remains in force for the duration of the Agreement. Termination of the Agreement automatically terminates this DPA, subject to any post-termination obligations regarding deletion or return of data.

For DPA-related inquiries, SCCs, or Sub-processor lists:

• Email: legal@consumerfusion.com