Data Processing Addendum

Spend Back AI LLC (d/b/a “SpendBack”)

This Data Processing Addendum (“DPA”) forms part of the agreement between Spend Back AI LLC, a Florida limited liability company at 7901 4th St N, Ste 300, St. Petersburg, FL 33702 (“SpendBack”), and the client (“Client”) that accepts the SpendBack Terms of Service or signs an Order Form (the Terms of Service and any Order Form together, the “Agreement”). It governs SpendBack’s Processing of Personal Data on Client’s behalf in connection with the auditing, recovery, and protection services described in the Agreement (the “Services”). It takes effect when Client accepts the Agreement. A signature is not required.

1. Definitions

“Personal Data,” “Personal Data Breach,” “Processing,” “Controller,” “Processor,” “Data Subject,” and “Supervisory Authority” have the meanings given in Applicable Data Protection Law. “Applicable Data Protection Law” means all laws applicable to the Processing of Personal Data under the Agreement, including, as applicable, the EU and UK GDPR, the CCPA/CPRA, and other U.S. state privacy laws. “Sub-processor” means any third party engaged by SpendBack to Process Personal Data on Client’s behalf. “Platform Data” means data SpendBack obtains from an advertising or vendor platform’s API under Client’s authorization. “Exclusion List” means a list of IP addresses and similar technical identifiers of traffic sources that SpendBack has identified as invalid or wasteful for Client. “Standard Contractual Clauses” or “Clauses” means the clauses annexed to Commission Implementing Decision (EU) 2021/914. “Terms” means the SpendBack Terms of Service. Capitalized terms not defined in this DPA have the meaning given in the Terms.

2. Roles and Scope

2.1 Processor. Client is the Controller (or “business” under the CCPA) and SpendBack is the Processor (or “service provider”) for Personal Data Processed to provide the Services. Each party will comply with its obligations under Applicable Data Protection Law. The details of the Processing are in Annex I.

2.2 Where SpendBack is a Controller. SpendBack acts as an independent Controller, and this DPA does not apply, for: (a) the names and business contact details of Client’s personnel, used to administer Client’s account and the relationship (the credentials of a connected platform account, and the email address of the person who connected it, are covered by this DPA); (b) billing, payment, and tax records; (c) account-level records showing how SpendBack’s fees were calculated; and (d) security and access logs of SpendBack’s own systems. SpendBack handles that data as described in its Privacy Policy.

3. Processing Instructions

3.1 Instructions. SpendBack will Process Personal Data only on Client’s documented instructions, unless required by law (in which case SpendBack will notify Client unless legally prohibited). Client’s instructions are the Agreement, this DPA, and the settings Client selects in its SpendBack account. SpendBack will tell Client if it believes an instruction infringes Applicable Data Protection Law.

3.2 Instruction for Protection. Where Client enables Protection, Client instructs SpendBack to build Exclusion Lists from Client’s own traffic data and to transmit them, through the platform’s API, to Client’s own advertising accounts and attach them to the campaigns Client selects. That transmission is a disclosure made at Client’s direction to an account Client controls. Once an Exclusion List is in Client’s advertising account, the platform handles it under its agreement with Client. Client is responsible for that agreement and for any notice, consent, or opt-out obligation that applies to the use of Exclusion Lists.

3.3 Separation between clients. Each Exclusion List is built from Client’s own traffic and applied only in Client’s accounts. SpendBack does not pool Exclusion Lists across clients or use Client’s Personal Data for another client.

3.4 CCPA terms. SpendBack will not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the business purposes in Annex I, or outside the direct business relationship with Client; or (c) combine Personal Data with personal information from other sources, except as the CCPA permits service providers. SpendBack will notify Client if it determines it can no longer meet its obligations under the CCPA. Client may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data. SpendBack certifies that it understands and will comply with these restrictions.

3.5 Platform Data. SpendBack uses Platform Data only to provide the Services to Client. Its use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and its use of Meta Platform Data follows the Meta Platform Terms. SpendBack does not use Platform Data for its own advertising, to build profiles unrelated to the Services, or to develop models for other clients.

3.6 Service statistics. SpendBack may create aggregated, de-identified statistics about the operation of the Services that do not identify Client or any individual. These are not created from Platform Data.

4. Confidentiality

SpendBack ensures that persons authorized to Process Personal Data are bound by confidentiality obligations.

5. Security

SpendBack implements the technical and organizational measures described in Annex II, including encryption in transit and at rest and access controls limited to authorized personnel, and will not materially reduce them during the term.

6. Sub-processors

6.1 Client gives general authorization for SpendBack to engage Sub-processors. The categories of Sub-processor in use at the effective date are in Annex IV. The list of named Sub-processors is available to Client on written request to privacy@spendback.ai, under confidentiality. For transfers under the Standard Contractual Clauses, that named list, as updated under Section 6.3, is the agreed list of Sub-processors.

6.2 SpendBack will: (a) impose data-protection obligations on each Sub-processor that are no less protective than this DPA, including, for any Sub-processor that receives access credentials, the restrictions in Section 3; and (b) remain liable for its Sub-processors’ performance.

6.3 SpendBack will give Client at least 30 days’ prior notice of the addition or replacement of a Sub-processor. Client may object on reasonable data-protection grounds within 15 days of the notice. The parties will work in good faith to resolve the objection. If they cannot, Client may terminate the affected Services by written notice; fees earned before termination and fees under Section 13.3 of the Terms remain payable.

7. Data Subject Requests

Taking into account the nature of the Processing, SpendBack will assist Client by appropriate technical and organizational measures in responding to Data Subject requests (access, rectification, erasure, restriction, portability, objection, opt-out). If a Data Subject makes a request directly to SpendBack, SpendBack will promptly redirect it to Client.

8. Personal Data Breach

SpendBack will notify Client without undue delay, and in any event no later than seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Client’s Personal Data, including a breach at a Sub-processor. The notice will describe, as far as known, the nature of the breach, the data and accounts affected, and the steps taken. SpendBack will take reasonable steps to contain and remedy the breach, will revoke or rotate affected access credentials, and will provide further information as it becomes available.

9. Assistance

SpendBack will provide reasonable assistance to Client with data protection impact assessments and consultations with Supervisory Authorities, to the extent required by Applicable Data Protection Law and taking into account the information available to SpendBack.

10. Deletion and Return

10.1 On termination or expiry of the Services, SpendBack will, at Client’s election, delete or return the Personal Data Processed on Client’s behalf within 30 days. Access credentials for a connected account are deleted when Client disconnects that account. Deletion requests may be made at any time to privacy@spendback.ai.

10.2 SpendBack may retain: (a) data it is required by law to keep; (b) data it holds as Controller under Section 2.2; (c) the evidence submitted with Claims made for Client before termination, which may include IP addresses and click identifiers, for as long as fees may fall due under the Agreement and for 5 years after; and (d) the record of which Exclusion Lists were attached to which campaigns on which days, for the same period. Data under (c) and (d) is kept solely to verify, collect, and defend SpendBack’s fees. Retained data stays subject to the confidentiality and security terms of this DPA and is not used for any other purpose.

10.3 Exclusion Lists already in Client’s advertising accounts remain under Client’s control. SpendBack will remove them on request where the platform allows.

11. Audits

SpendBack will make available information reasonably necessary to demonstrate compliance with this DPA and, no more than once per year and upon reasonable prior notice, allow for and contribute to audits conducted by Client or an independent auditor mandated by Client, subject to confidentiality and to minimizing disruption to SpendBack’s operations. SpendBack may first satisfy audit requests with existing third-party reports and written responses to security questionnaires. Client may audit more often where a Supervisory Authority requires it or following a Personal Data Breach.

12. International Transfers

12.1 Personal Data is hosted and Processed in the United States.

12.2 Where the Processing involves a transfer of Personal Data from the EEA to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses, Module Two (Controller to Processor), completed as follows: Clause 7 (docking clause) applies; Clause 9, Option 2 (general written authorization) applies with the notice period in Section 6.3; the optional language in Clause 11 does not apply; Clause 17, Option 1 applies and the governing law is that of Ireland; under Clause 18(b) disputes are resolved by the courts of Ireland; Annex I and Annex II of the Clauses are completed with Annex I and Annex II of this DPA; and the competent Supervisory Authority is the one determined under Clause 13.

12.3 For transfers from the United Kingdom, the Standard Contractual Clauses apply as amended by the UK International Data Transfer Addendum issued by the Information Commissioner’s Office, with Tables 1 to 3 completed from this DPA and neither party able to end the Addendum under Table 4. For transfers from Switzerland, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

12.4 If the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

13. Liability and Order of Precedence

Each party’s liability under this DPA is subject to the limitations of liability in the Agreement. If this DPA conflicts with the Agreement on data-protection matters, this DPA controls. This DPA is governed by the law governing the Agreement, except where the Standard Contractual Clauses provide otherwise, and remains in effect for as long as SpendBack Processes Personal Data on Client’s behalf.

Annex I: Description of Processing

Annex II: Technical and Organizational Measures

• Encryption of Personal Data in transit (HTTPS/TLS) and at rest.

• Access controls: role-based access limited to authorized personnel with a need to know.

• Credentials: OAuth tokens stored encrypted, server-side only, never exposed to the browser; tokens with permission to change advertising accounts are used only to create, update, and remove Exclusion Lists; tokens are deleted when an account is disconnected.

• Change records: a log is kept of the Exclusion Lists pushed to Client’s accounts.

• Segregation: Client’s traffic data and Exclusion Lists are logically separated from other clients’ data.

• Data minimization: tracking technology designed to capture event-level signals only and not directly identifying information.

• Sub-processor management: written data-protection and confidentiality terms, and oversight.

• Incident response: procedures for detection, escalation, containment, credential rotation, and notification of Personal Data Breaches.

• Deletion: verified deletion within 30 days of request or termination, subject to Section 10.2.

Annex III: Plain-Language Summary

This Annex summarizes how SpendBack handles Client data. It does not expand or limit the obligations in the body of this DPA, which controls if there is any conflict.

What we do with your data

• We use it to audit your spend, to recover money for you, and, if you turn Protection on, to keep your budget away from the invalid traffic sources we find. We also use spend and recovery totals to calculate what you owe us.

• We never sell your data. We never give it to data brokers or to advertising platforms for their own purposes. We never use one client’s data to serve another client.

• If you turn Protection on, we send lists of bad traffic sources to your own ad accounts, and only there. This means we hold permission to make that one kind of change in your accounts. We do not touch your budgets, bids, or creatives.

How your credentials and data are protected

• You grant access yourself, through the ad platform’s own consent screen. We never ask for your password.

• Access tokens and data are encrypted in transit and at rest, stored server-side only, and restricted to personnel who need them.

Who touches your data

• SpendBack personnel who need it to deliver the Services.

• Third-party processors engaged to carry out the audits and other Services on our behalf, under a written data-processing agreement no less protective than this DPA. We remain fully liable for their performance (Section 6).

• Our hosting and support providers, in the categories listed in Annex IV.

Your exit is always open

• Disconnect any ad account at any time. Stored access credentials for that account are deleted automatically, and you can also revoke access in your Google, Meta, or TikTok settings.

• On request or termination, your data is deleted or returned within 30 days. We keep only what the law requires, our own billing records, and the evidence behind claims we filed for you while fees on them may still fall due (Section 10).

• If a security incident affects your data, we tell you within 72 hours of becoming aware of it (Section 8).

Annex IV: Sub-processor Categories

Named Sub-processors are available on request under Section 6.1. SpendBack’s payment processor handles Client’s payment details for SpendBack as Controller and is not a Sub-processor under this DPA.