2. International Data Transfers

Transfer Mechanisms

Company may Process Customer Data protected by Applicable Privacy Laws that require measures ensuring adequate protection for transfers to third countries. Where Customer is located outside the EEA or an adequate third country, the Parties agree to enter into Module Four of the EU SCCs and the UK Addendum as implemented within Attachment 1 (each a “Transfer Mechanism”). For FADP-subject transfers, the EU SCCs will be interpreted by replacing “GDPR” with “FADP,” and the FDPIC will be the competent supervisory authority. For the Transfer Mechanisms, Company is the data exporter and Customer is the data importer. Execution of an Ordering Document or use of the Services subject to this DPA constitutes both parties’ accession to the Transfer Mechanisms.

Location(s) of Processing

A list of current Processing locations applicable to the Services is available at meetmarigold.com/sub-processors-privacy/ and, as applicable, within the Processing Details Attachment.

International Transfers

Company and/or its Authorized Persons shall not Process or transfer Personal Data outside the territory in which it was first collected unless it implements measures necessary to comply with Applicable Privacy Laws. Transfers to Company Affiliates in adequate countries (EEA/UK decisions) will follow applicable adequacy decisions. Subject to Customer signing up for Privacy Updates, Company will inform Customer in advance of new international transfers and assist Customer in assessing compliance obligations.

3. Customer Affiliates

• Contractual Relationship. By executing this DPA, Customer does so on behalf of itself and its Customer Affiliates, establishing a separate DPA between Company and each such Affiliate; references to “Customer” or “data exporter” shall mean “Customer Affiliate.”
• Communication. The contracting Customer coordinates all communications and may act on behalf of its Customer Affiliates.
• Rights of Customer Affiliates. Where required by law, a Customer Affiliate may exercise rights and seek remedies under this DPA; otherwise, the contracting Customer exercises rights on an aggregate basis for itself and its Affiliates.

4. Role and Scope of Processing

• Roles of the Parties. Customer is the Controller; Company Processes Customer Data as Processor.
• Company Data. Company acts as Controller for Company Data and will not retain it beyond the term unless required to fulfill the Processing purpose.
• Processing Instructions. Customer instructs Company to Process Customer Data to: (i) perform the Services; (ii) perform steps necessary to perform the Agreement/DPA; (iii) perform Processing initiated by Users; and (iv) follow reasonable Customer instructions consistent with the Agreement/DPA. Company will inform Customer if an instruction infringes Applicable Privacy Laws or if Company can no longer comply.
• Details of the Processing. Summarized in the Processing Details Attachment.
• Customer’s Processing of Personal Data. Customer (and Users) must comply with Controller obligations, including accuracy, quality, legality, consents, third-party processor usage, and email/content practices. If Company becomes aware Personal Data is inaccurate or outdated, Company will inform Customer without undue delay and cooperate to erase/rectify.

5. Company’s Processing of Personal Data

• Processing Principles. Company Processes Personal Data (i) in compliance with Processor obligations; (ii) per applicable Transfer Mechanisms; (iii) according to Customer instructions; and (iv) under Agreement confidentiality provisions.
• No Rights as a Controller. Except for Company Data, Company has no right, title, or interest in Personal Data and will not sell, rent, or lease such data. Nothing constitutes cross-context behavioral advertising “sharing” or “selling” between the parties.

6. Data Subject Requests

Company shall, to the extent legally permitted and where Customer can be identified as Controller, promptly notify Customer if it receives a Data Subject request (access, rectification, restriction, erasure, portability, objection, or automated decision-making). Taking into account the nature of Processing, Company will assist Customer by appropriate technical and organizational measures. Where Customer lacks ability within the Services to address a request, Company will provide reasonable cooperation upon written request; Customer is responsible for any costs. Company will not respond directly without Customer’s prior authorization unless legally required (in which case Company will promptly notify Customer unless prohibited by law).

7. Return/Deletion of Data Upon Termination

Return or deletion of Personal Data under applicable Transfer Mechanisms or Applicable Privacy Laws will be initiated by Company only after Customer’s written request. Absent a specific written deletion request, Customer Data will be deleted per Company’s data retention policies.

8. Security of Processing

Customer acknowledges that Company’s Security Measures, as specified in the Trust Center and summarized in Attachment 3, may evolve with technical progress, provided overall security is not degraded. Customer remains responsible for secure use of the Services (e.g., credentials, in-transit protection to/from the Services, password hygiene, backups).

Company will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach, provide information/assistance as it becomes known or is reasonably requested, and use reasonable efforts to mitigate and remedy. Where required, Company will document facts, effects, and remediation. Any notification assistance beyond 8 hours of effort or the average monthly fees paid by Customer (whichever applies per the DPA) will be at Customer’s expense.

9. Sensitive Data

Customer agrees not to (and not to permit Users to) transmit, request, provide access to, submit, store, or include any Sensitive Information through the Services. Company may immediately terminate the Agreement, without refund, for violation of this paragraph.

10. Audits

Upon request, Company will provide audit report summaries/certifications and reasonably complete questionnaires to verify compliance (“Audit Information”). For Transfer Mechanism compliance, Customer agrees to leverage existing documentation where sufficient. If reasonably necessary to demonstrate GDPR compliance, Company shall allow and contribute to audits/inspections by Customer or its mandated auditor during normal hours, at Customer’s expense, and subject to obligations herein.

11. Sub-Processing

• Company Affiliates. Customer consents to Processing by Company Affiliates listed in the Processing Details Attachment (and any additional Affiliate Processors if Customer purchases additional Services).
• Sub-processors. Customer consents to Sub-processors listed at meetmarigold.com/sub-processors-privacy/. Company may add Sub-processors in accordance with applicable Transfer Mechanisms or Applicable Privacy Laws. Sign up for Privacy Updates to receive advance notices.
• Objection. Customer may object on reasonable data-protection grounds within 10 days of notice. Parties will discuss alternatives in good faith for 30 days; failing resolution, Company will not appoint/replace the Sub-processor, or Customer may terminate (in whole or part) on written notice within 10 days after the resolution period.
• Sub-processor DPAs. Company will maintain written DPAs with Sub-processors with measures no less protective than this DPA and remains fully liable for their performance. Redacted copies can be provided upon written request.

12. Redress

Any cooperation/assistance by Company to address or resolve disputes caused by Customer’s acts/omissions under Transfer Mechanisms or Applicable Privacy Laws shall be at Customer’s expense.

13. DPIAs & TIAs

Where required by Applicable Privacy Laws or Transfer Mechanisms, Company will assist Customer with DPIAs/TIAs and, where legally required, consultations with data protection authorities for high-risk Processing.

14. Liability

All claims/remedies arising under this DPA (including fines, law breaches, or Transfer Mechanism obligations) are subject to the Agreement’s limitations/exclusions of liability and aggregate caps. Customer’s maximum recovery for Sub-processor-caused losses is limited to Company’s recovery from that Sub-processor where lower than the Agreement cap. Aggregate caps apply across the Agreement and all DPAs. No party limits liability with respect to any individual’s data protection rights.

15. General

• Termination. This DPA and Transfer Mechanisms terminate with the Agreement; Company will continue to ensure Transfer Mechanism compliance for retained Customer Data until deletion is requested.
• Modifications & Severability. Parties will negotiate amendments in good faith to maintain compliance when laws change; if not agreed, Company may terminate the Agreement and applicable Ordering Documents. Any unenforceable part does not affect the remainder.
• Order of Precedence. For privacy matters: (1) applicable Transfer Mechanism(s); (2) body of this DPA; (3) the Agreement. For all other contractual matters, the Agreement controls.
• Entire Agreement. This DPA and the Agreement constitute the entire understanding regarding its subject matter and may be executed in counterparts, including electronically.

Attachment 1

Application of Transfer Mechanism(s) — Annex I

Attachment 2 — Processing Details Attachment

Attachment 3 — Marigold Security Measures

Last Updated: May 22, 2025