Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between the business customer ("Client") and Apex Marketing & E-commerce LLC, operating the Instant Edge Systems brand ("IES," "we," "us") when IES processes personal information on Client's behalf.

1. Roles and Scope

Client determines the business purposes for which its lead, customer, and prospect information is used. IES processes that information to provide the contracted website, CRM, communications, automation, review-request, and related services.

Depending on the law that applies, Client may be a controller or business and IES may be a processor, service provider, or contractor. Those labels do not expand either party's rights beyond the services actually ordered.

2. Documented Instructions

IES will process Client Personal Data only:

• to provide and support the contracted services;
• on Client's documented instructions;
• to protect the security and integrity of the service;
• to comply with applicable law; or
• as otherwise expressly agreed in writing.

IES does not acquire ownership of Client Personal Data.

3. Restricted Uses

IES will not:

• sell Client Personal Data;
• use Client Personal Data for IES's own unrelated advertising;
• combine Client Personal Data with unrelated personal information except as permitted by applicable law and necessary to provide the service;
• use a purchased, scraped, rented, or mystery-provenance contact list for messaging; or
• treat a phone number, prior-customer status, or imported record by itself as blanket consent for automated marketing SMS.

4. Confidentiality and Access

IES limits access to people and providers who need the information to deliver or support the service. Persons acting under IES authority are required to protect confidential information and use it only for authorized purposes.

5. Security

IES will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information and the services. Safeguards may include access control, least privilege, authentication, patching, logging, backup practices, vendor controls, and incident response.

No internet-connected system can be guaranteed absolutely secure. This DPA does not promise a certification or security standard that IES has not actually obtained.

6. Subprocessors

Client authorizes the subprocessors listed at /subprocessors for the purposes stated there. IES remains responsible for selecting providers appropriate to the service and for limiting their authorized use of Client Personal Data.

Where a platform provider itself selects underlying telecommunications, hosting, or infrastructure providers, those downstream providers may change under that platform's published subprocessor terms.

7. Communications Data

Client is responsible for determining whether it has the consent or other lawful basis required for the communications it instructs IES to send.

For marketing or reactivation SMS, Client must preserve the consent or lawful-basis record required for that campaign. Opt-outs and do-not-contact requests must be honored across applicable workflows.

8. Individual Rights Requests

If IES receives a privacy request relating primarily to Client-controlled data, IES may direct the requester to Client and will provide reasonable assistance available through the service so Client can respond.

Requests concerning IES's own business records may be submitted through /privacy-choices.

9. Security Incidents

IES will investigate suspected security incidents affecting Client Personal Data and will notify affected Clients without undue delay after confirming an incident that requires notice, subject to legitimate law-enforcement, containment, and investigative needs.

The parties will reasonably cooperate on legally required notices. Each party remains responsible for the obligations the applicable law places on that party.

10. Return and Deletion

On termination, Client may request an export of available Client contact and conversation data. IES will delete or de-identify Client Personal Data from systems under its control when no longer needed to provide the service, subject to legal, accounting, fraud-prevention, backup, and dispute-retention requirements.

11. Cross-Border Processing

IES and its providers may process information in the United States and other locations where the service providers operate. Client is responsible for identifying any special localization or transfer requirement applicable to the Client's industry or data before providing that data to IES.

Canada, Quebec, Mexico, and other non-U.S. jurisdictions may require additional review before activation. IES may place those enrollments into manual compliance review.

12. California and U.S. State Privacy Terms

To the extent an applicable U.S. state privacy law treats IES as a service provider, contractor, or processor for Client Personal Data, IES will:

• process the data only for the limited and specified purposes in the agreement;
• not sell the data;
• not use the data outside the direct business relationship except as permitted by applicable law;
• provide the level of privacy protection required of that role;
• notify Client if IES determines it can no longer meet a material applicable requirement; and
• reasonably cooperate with Client's lawful efforts to stop and remediate unauthorized use.

Nothing in this DPA waives a right that applicable law makes non-waivable.

13. Sensitive and Regulated Data

Unless separately agreed in writing, the service is not intended to receive:

• protected health information requiring a HIPAA business associate agreement;
• full payment-card numbers outside the payment processor;
• Social Security numbers;
• government authentication credentials; or
• other specially regulated data that requires a dedicated compliance program.

Client will not intentionally upload those categories unless IES has expressly agreed to support them.

14. Audit Information

On reasonable request, IES may provide available information reasonably necessary to demonstrate the controls described in this DPA, subject to confidentiality, security, proportionality, and protection of other customers' information.

Where applicable law requires a Client to have a right to monitor our compliance, Client may take reasonable and appropriate steps to verify compliance with this DPA, including review of available security/compliance information and, when legally required and proportionate to the risk, a mutually coordinated audit or inspection process. If Client reasonably identifies unauthorized processing, IES will cooperate with lawful steps to stop and remediate it.

This does not create a right to unrestricted access to IES systems, source code, credentials, or other customers' information.

15. Conflict

If this DPA conflicts with the Terms of Service solely on processing Client Personal Data, this DPA controls for that subject. The Terms otherwise remain in effect.

16. Contact

Instant Edge Systems Apex Marketing & E-commerce LLC, operating under the Instant Edge Systems brand Nashville, Tennessee, United States [email protected]