REVUP Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the REVUP Revenue Platform Terms of Service or other agreement (the Agreement) between REVUP LLC (REVUP) and the Customer named in the Agreement. It applies when REVUP processes Customer Personal Data on the Customer's behalf. If this DPA conflicts with the Agreement, including any Order or Pilot Program Agreement, on the processing of personal data, this DPA prevails, unless an Order expressly names the section of this DPA it changes.

1. Definitions

1.1 Capitalized terms not defined here have the meanings in the Agreement.

1.2 Data Protection Laws means all laws on privacy and personal data that apply to a party's processing under the Agreement, including, where applicable, Regulation (EU) 2016/679 (GDPR); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (UK GDPR); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (CCPA) and other US state privacy laws; the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL); and the Saudi Personal Data Protection Law issued by Royal Decree M/19 of 1443H, as amended by Royal Decree M/148 of 1444H, and its regulations (Saudi PDPL).

1.3 Customer Personal Data means personal data in Customer Content that REVUP processes on the Customer's behalf in providing the Service, including Contact Data, personal data in content and connected channel data, and the personal data of the Customer's Authorized Users to the extent it is processed within Customer Content.

1.4 Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the GDPR, and equivalent terms in other Data Protection Laws (for example business and service provider under the CCPA) are read accordingly.

1.5 Subprocessor means a third party engaged by REVUP that processes Customer Personal Data.

2. Roles and instructions

2.1 Roles. The Customer is the controller (or business) of Customer Personal Data, and REVUP is its processor (or service provider). Where the Customer is itself a processor for a third party, REVUP is a subprocessor and the Customer confirms that its instructions are authorized by that third party.

2.2 Instructions. REVUP processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's configuration and use of the Service (for example uploading contacts, connecting channels, scheduling posts and sending campaigns) are the Customer's complete instructions, including with regard to transfers of Customer Personal Data to the locations described in section 12. REVUP will immediately tell the Customer if, in its opinion, an instruction breaches Data Protection Laws, and may suspend that processing until the instruction is changed. If the law requires REVUP to process Customer Personal Data otherwise, REVUP will tell the Customer first unless the law forbids it.

2.3 Customer responsibilities. The Customer is responsible for the lawfulness of the Customer Personal Data and its instructions, including having a lawful basis, giving the notices and obtaining the consents Data Protection Laws and messaging laws require (in particular for marketing email, SMS and WhatsApp), and honoring data subjects' choices. The Customer will not instruct REVUP to process special categories of personal data, government identifiers, financial account numbers or children's personal data unless the parties agree in writing.

2.4 Details of processing. Schedule 1 describes the subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects.

3. CCPA terms

Where the CCPA applies, REVUP processes Customer Personal Data only for the limited and specified business purposes listed in Schedule 1 (the "Purpose" row) and will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than those business purposes, including not for a commercial purpose other than providing the Service, except for the internal uses the CCPA regulations permit to service providers (section 3A); (c) retain, use or disclose it outside the direct business relationship between REVUP and the Customer; or (d) combine it with personal information REVUP receives from or on behalf of others or collects from its own interactions with consumers, except as the CCPA permits. REVUP will comply with the CCPA, provide the same level of privacy protection the CCPA requires of businesses, notify the Customer if it can no longer meet its obligations, and allow the Customer to take reasonable steps to stop and remediate unauthorized use. REVUP certifies that it understands and will comply with these restrictions.

3A. REVUP's internal uses

The Customer authorizes REVUP to use Customer Personal Data for the following purposes of its own, to the extent Data Protection Laws allow a processor or service provider to do so: (a) detecting and preventing security incidents, fraud and abuse of the Service, including keeping full IP addresses of tracking-link clicks for 7 days; (b) deriving misuse patterns as Aggregated Data under section 5.3 of the Terms of Service; (c) building and improving the Service using de-identified or aggregated data that cannot identify any Customer or individual; and (d) complying with law. Where REVUP acts for these purposes as a controller under the GDPR or similar laws, it does so under its Privacy Policy.

4. REVUP personnel

REVUP ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality, is instructed on data protection, and has access only as needed for their role. REVUP's policy is that its test (staging) environment uses demo data only and that Customer Personal Data is not copied into it.

5. Security

5.1 REVUP implements and maintains the technical and organizational measures in Schedule 2, appropriate to the risk, to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

5.2 REVUP may update these measures as technology and threats change, provided that the update does not materially reduce the overall protection.

6. Subprocessors

6.1 General authorization. The Customer authorizes REVUP to engage Subprocessors. REVUP's current Subprocessors are listed at letsrevup.com/subprocessors/ (Schedule 3).

6.2 Notice of changes. REVUP will give at least 30 days' notice of a new Subprocessor by updating the list and notifying Customers who have subscribed to updates at info@letsrevup.com (subject "Subprocessor updates"). The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if REVUP cannot reasonably accommodate it, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.

6.3 Obligations. REVUP imposes on each Subprocessor, by written contract, data protection obligations that provide at least the level of protection required by Data Protection Laws (and, where the GDPR applies, the same data protection obligations as Article 28(3) requires), and remains liable for each Subprocessor's performance of those obligations.

6.4 Third-Party Platforms are not Subprocessors. Platforms and tools that the Customer chooses to connect (for example LinkedIn, Meta, X, TikTok, Google, Shopify or the Customer's email service) receive data at the Customer's direction under the Customer's own relationship with them. They are not REVUP's Subprocessors.

7. Data subject requests

REVUP will, taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures in responding to requests from data subjects to exercise their rights. The Service lets the Customer access, correct, export and delete Customer Personal Data and manage opt-outs itself. If REVUP receives a request directly that relates to Customer Personal Data, it will forward it to the Customer without undue delay and will not respond except to confirm forwarding, unless the Customer authorizes it or the law requires otherwise.

8. Personal data breaches

8.1 REVUP will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, so that the Customer can meet its own notification duties.

8.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. REVUP will provide further information as it becomes available and reasonably cooperate with the Customer's obligations to notify authorities and data subjects.

8.3 REVUP's notification is not an admission of fault or liability.

9. Assistance

REVUP will provide reasonable assistance, taking into account the information available to it, with the Customer's data protection impact assessments and prior consultations with supervisory authorities relating to the Service.

10. Deletion and return

During the subscription term and the 30-day Export Window after it (Terms of Service section 6.7), the Customer may export (return) and delete Customer Personal Data using the Service; on request during that window REVUP will provide an export in a common machine-readable format. At the end of the Export Window, REVUP will delete Customer Personal Data, except where the law requires retention. Encrypted backups are overwritten within a further 14 days. REVUP will confirm deletion in writing on request.

11. Audits

REVUP will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. On written request no more than once a year (or after a personal data breach, or where a supervisory authority requires it), REVUP will answer a reasonable security questionnaire and provide relevant policies and point the Customer to the third-party certifications and audit reports its Subprocessors publish (for example Microsoft Azure's), where the Subprocessor allows them to be shared. Where the Customer reasonably needs more, the Customer (or an independent auditor it appoints and that is bound by confidentiality) may conduct an audit, including an inspection, at its cost, with at least 30 days' notice, during business hours, without access to other customers' data, subject to confidentiality, and in a way that does not unreasonably disrupt REVUP.

12. International transfers

12.1 REVUP processes Customer Personal Data in the United States and, through Subprocessors, in the locations listed in Schedule 3.

12.2 EEA, UK and Switzerland. This section applies only once Schedule 4 is completed; until then REVUP does not accept Customer Personal Data subject to these laws without a separate signed agreement. Where Customer Personal Data subject to the GDPR, UK GDPR or Swiss law is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, with the UK International Data Transfer Addendum and Swiss amendments where applicable, which are incorporated by reference with the elections in Schedule 4. If REVUP self-certifies to the EU-US Data Privacy Framework (and, for UK and Swiss data, the UK Extension and the Swiss-US Data Privacy Framework), it may rely on that instead. Annex I of the Standard Contractual Clauses is completed by Schedule 1, Annex II by Schedule 2 and Annex III by Schedule 3.

12.3 UAE and Saudi Arabia. Where the UAE PDPL or the Saudi PDPL applies to a transfer of Customer Personal Data out of the UAE or Saudi Arabia, REVUP will cooperate with the Customer to put in place the safeguards those laws require, which may include contractual clauses in the form required by the competent authority.

13. Liability and term

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws do not allow it. This DPA lasts as long as REVUP processes Customer Personal Data.

Schedule 1: Details of processing

Schedule 2: Technical and organizational measures

• Hosting: Microsoft Azure, United States region, with the provider's physical and environmental security and certifications.
• Encryption: TLS for data in transit; encryption at rest provided by the hosting platform; additional application-level encryption of stored channel access tokens, credentials and AI keys; secrets kept in a managed key vault.
• Tenant isolation: each Customer's data is separated by workspace with database-level row security, and automated tests are designed to check that new tables and routes enforce isolation.
• Access control: role-based access (User and Admin); two-step sign-in available to all users and enforceable by Admins; single-use, expiring invitation and password reset links; sign-in rate limiting; access for REVUP personnel and service identities limited to what their role needs.
• Change control: code review and automated tests before release; a separate test environment that uses demo data; production releases require approval by a named person; infrastructure managed as code.
• Logging and monitoring: audit log of user actions per workspace; security and access logs kept for a limited period.
• Resilience: automated database backups retained for 14 days; a restore drill was last passed in October 2026 and is repeated periodically.
• Deletion: workspace and user deletion procedures with deletion records; channel token revocation on disconnect; data deletion callback for Meta.
• AI: AI providers contractually prohibited from training on Customer Content; prompts include only the material needed for the requested result.
• Vendor management: written data protection terms with each Subprocessor.
• Incident response: a procedure for assessing and notifying personal data breaches.

Schedule 3: Subprocessors

See the separate Subprocessor List (document 05), published at letsrevup.com/subprocessors/.

Schedule 4: Standard Contractual Clauses elections

Not yet in effect. REVUP does not currently accept Customer Personal Data subject to the GDPR, UK GDPR or Swiss data protection law under this DPA. Customers who need these terms should contact info@letsrevup.com.