GlowLocal Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between GlowLocal LLC (“GlowLocal”) and the applicable customer (“Customer”) governing Customer’s use of the GlowLocal Services (the “Agreement”).

This DPA applies to the extent GlowLocal processes Personal Information on behalf of Customer in connection with the Services.

Capitalized terms not defined in this DPA have the meanings provided in the Agreement or applicable privacy law.

1. Roles and Scope

Customer determines which Authorized Users and participating locations use GlowLocal and the information provided to the Services.

To the extent applicable under the California Consumer Privacy Act, as amended (“CCPA”), GlowLocal will act as a service provider or contractor with respect to Personal Information processed on behalf of Customer.

“Customer Personal Information” means Personal Information that GlowLocal receives from or processes on behalf of Customer in providing the Services.

The categories of Customer Personal Information and purposes of processing are described in Schedule A below.

Customer discloses Customer Personal Information to GlowLocal only for the limited and specified business purposes described in this DPA and Schedule A.

Customer is responsible for ensuring that it has the authority and any required notices, permissions, or other legal basis necessary to provide Customer Personal Information to GlowLocal.

GlowLocal is not designed to collect or maintain Customer end-consumer databases, and Customer should not provide sensitive personal information or consumer information that is unnecessary for use of the Services.

2. Processing Restrictions

GlowLocal will process Customer Personal Information only:

• to provide, operate, maintain, secure, and support the Services;
• to perform Customer’s instructions;
• for the specific purposes identified in Schedule A; or
• as otherwise permitted or required by applicable law.

GlowLocal will not:

• sell or share Customer Personal Information as those terms are defined by applicable privacy law;
• retain, use, or disclose Customer Personal Information for purposes other than the purposes described in this DPA, except as permitted by applicable law;
• use Customer Personal Information for an unrelated commercial purpose;
• use Customer Personal Information outside the direct business relationship between GlowLocal and Customer, except as permitted by applicable law; or
• combine Customer Personal Information with Personal Information obtained from other sources except where permitted by applicable privacy law.

GlowLocal will provide Customer Personal Information with the level of privacy protection required of a service provider or contractor under applicable law.

3. Privacy Requests

GlowLocal will reasonably assist Customer in responding to applicable requests from individuals regarding their Personal Information, including requests to access, know, correct, or delete information.

If GlowLocal receives such a request directly relating to Customer Personal Information, GlowLocal may:

1. direct the individual to Customer; or

2. respond on Customer’s behalf in accordance with Customer’s instructions and applicable law.

When Customer instructs GlowLocal to delete or correct Customer Personal Information in connection with a valid privacy request, GlowLocal will take reasonable steps to comply and, where required, instruct applicable subprocessors to do the same.

4. Security

GlowLocal will maintain commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Customer Personal Information processed through the Services.

Such safeguards are designed to protect Customer Personal Information against unauthorized or unlawful access, acquisition, destruction, loss, alteration, use, or disclosure.

If GlowLocal confirms a security incident involving unauthorized access to or acquisition of Customer Personal Information, GlowLocal will notify Customer without undue delay and provide reasonably available information necessary to assist Customer in evaluating its obligations.

Customer remains responsible for maintaining appropriate access controls, safeguarding account credentials, and promptly removing Authorized Users who should no longer have access to the Services.

5. Subprocessors

Customer authorizes GlowLocal to engage third-party service providers and subprocessors as reasonably necessary to provide the Services.

These providers may support functions including:

• hosting and infrastructure;
• artificial intelligence;
• search and data retrieval;
• analytics;
• communications;
• security; and
• software operations.

GlowLocal’s current providers may include Google, Firecrawl, and other providers used in operating the Services.

GlowLocal will enter into written agreements with subprocessors that process Customer Personal Information on GlowLocal’s behalf imposing data-protection obligations required by applicable privacy law, including, where applicable, the requirements imposed on service providers and contractors under the CCPA.

GlowLocal may add, replace, or remove subprocessors as its technology and Services evolve.

6. Compliance and Customer Rights

GlowLocal will comply with applicable obligations imposed on service providers or contractors under applicable privacy law in connection with Customer Personal Information.

GlowLocal will notify Customer if GlowLocal determines that it can no longer meet material obligations applicable to its processing of Customer Personal Information under the CCPA or another applicable privacy law.

Customer may take reasonable and appropriate steps to verify that GlowLocal is processing Customer Personal Information consistently with this DPA and applicable privacy requirements.

Upon reasonable written request, GlowLocal will provide information reasonably necessary to demonstrate compliance with this DPA.

Such requests will ordinarily be limited to no more than once in any 12-month period unless:

• required by law or a regulatory authority;
• reasonably necessary following a confirmed security incident; or
• Customer has reasonable grounds to believe GlowLocal is materially violating this DPA.

The parties will work in good faith to use documentation, questionnaires, certifications, reports, or other reasonable methods before requiring an intrusive audit of GlowLocal’s systems.

To the extent required by applicable privacy law, GlowLocal will reasonably cooperate with Customer in connection with legally required privacy risk assessments, cybersecurity audits, and applicable automated decisionmaking technology obligations by providing relevant information within GlowLocal’s possession, custody, or control.

If Customer reasonably determines that GlowLocal is using Customer Personal Information in an unauthorized manner, Customer may notify GlowLocal and require reasonable steps to stop and remediate the unauthorized processing.

7. Retention and Deletion

GlowLocal will retain Customer Personal Information only for as long as reasonably necessary to provide the Services or satisfy applicable legal, security, accounting, fraud-prevention, dispute-resolution, or compliance obligations.

Upon expiration or termination of the Agreement, GlowLocal may promptly delete Customer Personal Information from its active production systems unless retention is required or permitted by applicable law.

Customer should obtain any information it wishes to retain before its access to the Services ends.

Customer Personal Information may remain temporarily in routine backups or archival systems until those systems are overwritten, deleted, or returned to active use in accordance with GlowLocal’s ordinary retention processes.

Any Customer Personal Information retained following termination remains subject to the protections of this DPA for as long as GlowLocal retains it.

8. General

If there is a conflict between this DPA and the Agreement regarding the processing or protection of Customer Personal Information, this DPA will control solely with respect to that issue.

Except as modified by this DPA, the Agreement remains unchanged.

This DPA automatically terminates when GlowLocal no longer processes Customer Personal Information on behalf of Customer, except for provisions that by their nature apply to information retained after termination.

No separate signature is required if the Agreement expressly incorporates this DPA by reference.

________________

Schedule A — Processing Details

Individuals Whose Information May Be Processed

Customer Personal Information may relate to:

• Customer employees and corporate users;
• franchisees;
• franchisee employees;
• location operators;
• contractors;
• interns;
• other Authorized Users; and
• individuals who may incidentally appear in content uploaded as evidence of mission or opportunity completion.

Categories of Personal Information

Depending on use of the Services, GlowLocal may process:

• name;
• business email address;
• business telephone number;
• job title or role;
• company or franchise affiliation;
• business/location address;
• account identifiers and permissions;
• login and authentication information;
• IP address and device/browser information;
• platform activity and engagement;
• missions and opportunities completed;
• GlowPoints;
• GlowScore;
• leaderboard and ranking information;
• uploaded photographs, images, text, or other completion evidence; and
• communications with GlowLocal.

Specific Purposes of Processing

GlowLocal processes Customer Personal Information as reasonably necessary to:

• create and administer Authorized User accounts;
• authenticate users and manage permissions;
• configure participating locations;
• operate and provide the GlowLocal platform;
• personalize Services for Customer and participating locations;
• generate and administer grassroots marketing roadmaps and missions;
• identify relevant local opportunities, vendors, and potential partners;
• generate AI-assisted recommendations and playbooks;
• track mission and opportunity participation and completion;
• process uploaded evidence of completion;
• calculate GlowPoints, GlowScore, and rankings;
• operate Customer leaderboards;
• provide Customer administrators with participation analytics and reporting;
• provide technical support and customer service;
• maintain the security and integrity of the Services; and
• comply with applicable legal obligations.

Duration

GlowLocal may process Customer Personal Information for the duration of the Agreement and thereafter only as permitted by this DPA, the Agreement, or applicable law.