Data Processing Addendum

Version: 12 November 2026

This Data Processing Addendum (DPA) forms part of the Agreement between Performance Hub Inc, 251 Little Falls Drive, Wilmington, DE 19808, United States (Performance Hub), and the Customer identified in the applicable Order. It applies where Performance Hub processes personal data on the Customer's behalf in supplying the Services. It does not reclassify account, billing or other independently determined processing described in the Privacy Policy.

1. Definitions and roles

Applicable Data Protection Law means privacy, data-protection and biometric law applicable to the relevant processing and party, including the GDPR, UK GDPR and applicable US state privacy laws where their scope requirements are met. Customer Personal Data is personal data in Customer Data that Performance Hub processes on the Customer's behalf. Personal Data Breach means a security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. An unsuccessful attempt without compromise is not by itself such a breach.

For the processing in Annex A, the Customer acts either as controller or applicable equivalent, or as an authorised processor acting for another controller. Performance Hub acts as processor or subprocessor, as applicable. A Customer acting for another controller must have authority to appoint Performance Hub and issue the relevant instructions. Actual activities and law determine the roles; a contractual label does not override them.

The DPA takes priority over inconsistent commercial terms concerning Customer Personal Data. Mandatory international-transfer terms take priority over this DPA. Capitalised terms otherwise have the meanings in the Customer Terms.

2. Instructions and permitted purposes

We may process Customer Personal Data only on your documented lawful instructions to supply the contracted Services, including the processing description, enabled features and agreed deployment configuration. Those instructions include the Agreement, Order, completed Enterprise Deployment Schedule and instructions issued through authorised controls or support. A technical ability to enable a destination does not authorise a transfer that breaches a binding processing restriction.

We will immediately inform you if, in our opinion, an instruction infringes Applicable Data Protection Law. We may suspend the affected instruction while the issue is resolved. If a law recognised for that purpose by Applicable Data Protection Law requires processing outside your instructions, we will notify you before that processing unless that law prohibits notice on important public-interest grounds. We will limit processing to the permitted legal requirement. For GDPR processing, the Article 28 exception concerns Union or Member State law; for UK GDPR processing, it concerns the applicable domestic law. A foreign legal demand does not by itself authorise processing or retention contrary to Applicable Data Protection Law or mandatory transfer terms.

You are responsible for the lawful collection, content, purpose and instructions within your control, required information to individuals, and the legal basis for using a feature. We are responsible for the obligations Applicable Data Protection Law places on us. Your duty to obtain consent or another basis does not excuse our own unlawful processing.

The DPA does not authorise selling Customer Personal Data, cross-context behavioural advertising, building an unrelated identity database, or using Customer Personal Data to train a general-purpose model for our own or a provider's independent purposes. Customer-directed training or fine-tuning requires a specific lawful instruction and supported arrangement. A provider's retention, abuse monitoring and other processing must be accurately described and compatible with the agreed purposes and applicable law.

3. Personnel and security

People authorised by us to process Customer Personal Data must be subject to confidentiality obligations and access restrictions appropriate to their roles. We will implement technical and organisational measures appropriate to the processing risk, as required by Applicable Data Protection Law. Annex B records the measures and the deployment allocation; it does not represent a certification or a guarantee against every incident.

We may update measures as technology or risk changes without materially reducing the agreed level of protection. Material changes to a specific contractual measure or agreed processing boundary require the applicable contractual process. You must secure systems, permissions and credentials within your control; we remain responsible for systems and functions within ours.

Performance Hub staff access for remote support must be initiated and authorised by the Customer for the relevant purpose and scope. Automatic management, telemetry and other flows must be separately identified in the deployment record. They do not create a standing permission for staff support access.

4. Subprocessors and connected services

You provide general written authorisation for the subprocessors identified in the agreed, versioned register in Annex C, solely for their recorded functions and permitted locations. A model catalogue or list of commercially available integrations is not itself that register.

We will give written notice of a proposed addition or replacement at least 15 calendar days before the new subprocessor begins the relevant processing. You may object during that period on reasonable data-protection grounds, with details of the concern. We will seek a lawful resolution, such as a different processor or configuration. If no permitted solution is available, the affected processing must not proceed under the disputed arrangement; either party may terminate the affected Services, with a refund of unused prepaid charges for the period after termination where the change prevents our continued supply. A shorter notice period requires a valid specific authorisation or other lawful basis consistent with any applicable transfer clauses; an emergency does not automatically override them.

We will impose written obligations on each subprocessor that provide the protection required for its processing, including confidentiality, security, restricted purposes, rights assistance, deletion and lawful transfers. We remain responsible for performance of those obligations to the extent required by law and any applicable transfer clauses.

A provider engaged directly and independently by you may be your processor or another recipient. That determination depends on the actual arrangement. Use of your own API key does not by itself eliminate our role, and use of a Performance Hub API key does not mean you have contracted directly with an upstream provider. If a selected integration's independent processing is incompatible with this DPA, do not send Customer Personal Data to it until a lawful, disclosed arrangement is established.

5. Assistance and individual requests

Taking account of the processing and information available to us, we will provide assistance required by Applicable Data Protection Law for individual rights requests, security duties, breach assessment and notification, impact assessments and prior consultation with authorities. You remain responsible for decisions about your own processing and responses to individuals except where the law places a duty directly on us.

If a person sends us a request concerning your processing, we will direct or forward it appropriately and assist as required. We will not make an independent substantive decision on your behalf unless authorised or legally required. A person need not become a customer or accept a commercial agreement to exercise statutory rights.

Optional work outside the included Services may be charged only at rates agreed in advance and where lawful. Fees must not be used to delay a mandatory response, and we will not charge you for remedying our own failure to meet the DPA.

6. Personal Data Breaches

We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and within any shorter period that Applicable Data Protection Law imposes on us. The notice will provide the available information needed for your applicable duties, including the nature of the incident, affected data and people where known, likely consequences, mitigation and a contact for further information. We may provide details in stages as they become available, without undue delay.

We will take the steps required of us to contain, investigate and address the breach and provide required cooperation. Notification is not an admission of fault. Each party is responsible for notifications that the law requires it to make; neither party may prevent the other from meeting a statutory duty. You should notify us of a suspected compromise involving our Services and preserve relevant evidence within your control.

7. Evidence, assessments and audits

We will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, as required by Applicable Data Protection Law or mandatory transfer clauses. Existing reports, documentation and written responses may be used where they adequately address the requirement; no independent certification is promised unless expressly identified and held.

Audit arrangements must protect other customers, personal data, confidential information and service security. The parties will agree reasonable notice, scope and safeguards where practicable. An independent auditor must have suitable qualifications and confidentiality obligations. These arrangements must not obstruct a regulator, a legally necessary investigation, or a mandatory audit right; there is no blanket once-per-year limit that overrides such rights.

Costs of optional additional audit work may be agreed where lawful. Each party bears its own costs of remedying its noncompliance. A commercial dispute does not suspend mandatory cooperation.

8. Return, deletion and retention

At the end of the relevant processing, we will, at your choice, return or delete Customer Personal Data and delete copies, except information retained under a legal requirement recognised by Applicable Data Protection Law and consistent with mandatory transfer terms. The limits on legal-compulsion exceptions in section 2 also apply to retention. You should communicate the choice before service ends; if no choice is made after an opportunity to do so, deletion is the default, subject to applicable law and any required transition period. Return means an appropriate available format or other agreed lawful format, not a promise of bespoke conversion.

Any unavoidable delay in removing isolated backup copies must be recorded in the agreed retention schedule and lawful for the relevant data. During that period the copies remain protected, are not used for another purpose, and are deleted on the applicable schedule. Restoring a backup must not permanently reinstate information subject to a valid deletion requirement. Biometric or other statutory deletion deadlines take priority over backup convenience.

Legally retained information must be limited to the required scope and duration, isolated from ordinary use where appropriate, protected under the DPA, and deleted when the legal requirement ends. We will provide the deletion confirmation required by applicable transfer clauses or law. Your removal of a source record does not necessarily remove indexes, transcripts, templates or other derived records; the parties must implement the relevant deletion instruction across the systems they control.

9. International transfers

Processing locations and permitted access must be recorded in Annex A, Annex C and any Enterprise Deployment Schedule. Selecting a region, enabling a model or authorising support is an operational instruction, not by itself a lawful international-transfer mechanism or an individual's consent.

Before a restricted transfer, the parties must establish the mechanism required by the applicable law, complete the relevant assessments and implement necessary safeguards. Annex D specifies the standard transfer arrangements for eligible EU/EEA and UK transfers. They may be used only where suitable for the actual parties and processing. If they are not suitable, an applicable alternative must be completed before the transfer occurs. Nothing asserts that Performance Hub has an adequacy certification or registration that it has not actually obtained.

For transfers governed by other laws, we will provide the contractual protections applicable to our role, including required comparable protection, purpose limits and cooperation. You remain responsible for customer-side notices, permissions and other requirements within your control. Particular locations or sectors may require a separate instrument or prohibit a proposed route; the Agreement does not override that requirement.

10. US state service-provider and processor terms

Where applicable US state law treats us as a service provider, contractor or processor, the limited purposes and business activities are those in Annex A. We will comply with the obligations applicable to that role and provide the level of privacy protection the relevant law requires. We will not sell or share Customer Personal Data as those terms are defined by the applicable law, retain, use or disclose it outside the specified purposes or the direct business relationship except as legally permitted, or combine it with other sources except where permitted for the authorised service and by the applicable law.

You may take reasonable and appropriate steps to verify that processing is consistent with those obligations and, after notice, stop and remediate unauthorised use, subject to lawful security and confidentiality safeguards. We will notify you if we determine that we can no longer meet applicable role restrictions and will cooperate with lawful remediation or cessation. We certify that we understand and will comply with these restrictions where that certification is required. This section is not a blanket declaration that every separate activity performed by either party is exempt from state privacy law.

11. Contact, responsibility and duration

Contact Performance Hub through support, identifying the request as a privacy, security or DPA matter, by telephone on +1 (302) 244-5288, or by mail at the company address above. The Customer's contact is the authorised privacy or administrative contact identified in its Order or processing record. Keep that contact current and able to receive incident and subprocessor notices.

The Customer Terms, including their liability limits and the customer indemnity, govern commercial liability between the parties to the extent compatible with this DPA, mandatory law and transfer instruments. Neither customer instructions nor third-party model disclaimers remove our non-excludable processor duties. This DPA remains effective while we process or retain Customer Personal Data for the Customer.

Annex A — Processing description and deployment record

The parties' recorded Order, enabled service configuration and completed deployment record identify which of the following processing is actually instructed. Categories not used in a deployment are not authorised merely by appearing here. The record must be specific enough to establish the permitted purposes and recipients.

Required deployment record

The deployment record forms part of this DPA through the accepted Order, Enterprise Deployment Schedule or a versioned service-processing record agreed by the parties. For each enabled service it identifies the purpose, data categories, retention/deletion including backup expiry, hosting and access countries, model/provider identity and role, recipients/subprocessors, permitted external tools, support access, transfer mechanism and any local-only restriction. The agreed version and acceptance must be recorded. Omission of a required detail does not authorise an otherwise restricted processing activity or destination.

Annex B — Security measures and allocation

The following measures apply to the relevant processing according to the risk, purchased deployment and responsibilities described below. The accompanying deployment record identifies the implementation of each applicable measure and any additional safeguards. Where an SCC Annex II is required, that record must contain the specific technical and organisational measures applicable to the transfer.

Annex C — Authorised subprocessor register

The register incorporated into the accepted DPA must identify each actual subprocessor's legal name, service, processing function, relevant data, countries of processing/access and applicable transfer safeguard. It must identify the version accepted, the notice contact and the date an addition becomes authorised. Model developers and execution hosts must be distinguished where different.

Customer-contracted destinations are recorded separately with their actual role. A supplier or model appearing in a general catalogue is not, by that fact alone, authorised to receive Customer Personal Data. Providers may process only the data and purposes within their authorised scope. Section 4 governs changes.

Annex D — International-transfer arrangements

D1. EU/EEA transfers

Before a restricted EU/EEA transfer for which the European Commission's Decision (EU) 2021/914 standard contractual clauses are the appropriate mechanism, the parties must execute the applicable unmodified clauses with the selections below and the required completed annexes, including through binding electronic acceptance where valid. The official clauses are available from EUR-Lex. The executed instrument forms part of the Agreement and prevails over inconsistent terms. This DPA alone does not substitute for that instrument.

The parties must document the required destination-law assessment and any supplementary measures. If the chosen clauses are not legally suitable for the importer or processing, or adequate protection cannot be provided, the transfer may occur only under another valid mechanism that meets the applicable requirements. The commercial liability cap does not amend the mandatory clauses or data subjects' rights.

D2. UK restricted transfers

Before a UK restricted transfer for which the approved UK Addendum is the appropriate mechanism, the parties must execute the ICO's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0 in force 21 March 2022, as lawfully revised. The official ICO guidance and instrument identify the approved form. The executed Addendum must include its unmodified mandatory Part 2 and the completed tables below; it forms part of the Agreement and prevails as its terms require.

Table 1 records the same parties, contacts and signatures as D1 and the effective date of execution. Table 2 records the selected EU SCC version, module and options in D1. Table 3 records the completed Annexes I–III/authorisation record. Table 4 selects neither party for the optional right to end the Addendum solely following an ICO revision. This selection does not remove termination or suspension rights that mandatory law or the instrument otherwise provides. The Addendum's required UK modifications and hierarchy apply.

D3. Other jurisdictions

The parties must meet any applicable additional local contract, notice, consent, accountability or transfer-assessment requirements before enabling the relevant route. A valid EU or UK instrument does not automatically satisfy Japan, Singapore, Australia, New Zealand, UAE/free-zone, Swiss or other transfer requirements. Any required jurisdiction-specific attachment must be completed and accepted before the relevant processing begins.