DATA PROCESSING ADDENDUM
Last updated on November 23 2022
This Hypehound Data Processing Addendum (“Addendum”) amends and forms a partof the written or electronic agreement(s) (the “Agreement”) by and between the legal
entity subject to the Agreement (“Customer”) and Hypehound Inc. (“Hypehound”), an
Ontario, Canada corporation with offices at 124D 250 Fountain Place, Ottawa, Ontario,
K1N9N7, governing the Customer’s use of Hypehound’s products and services (the“Service”). Capitalized terms not otherwise defined in this Addendum shall have thesame definitions as in the Agreement or the meaning ascribed to the corresponding
terms in the Data Protection Legislation.**Definitions
1. “Business”, “Controller”, “Processor”, “Processing/Process/ Processed”, and“Service Provider” shall be given the meanings given to them by the applicable
Data Protection Legislation.
2. “Data Subject” means the identified or identifiable natural person to whom
Personal Information relates.
3. “Data Subject Request” means the exercise by Data Subjects of their rights inaccordance with applicable Data Protection Legislation in respect of Personal
Information.
4. “Data Protection Legislation” means, collectively: (i) the GDPR, (ii) theCalifornia Consumer Privacy Act, as amended by the California Privacy Rights
Act of 2020, codified at Cal. Civ. Code §§ 1798.100 – 1798.199.100 (“CCPA”),(iii) any legislation, and/or regulation implementing or made pursuant to them or
which amends, replaces, re-enacts or consolidates any of them, (iv) applicabledata breach notification statutes, and (v) all other applicable laws relating toProcessing of Personal Information and privacy that may exist in any relevant
jurisdiction, to the extent applicable to the relevant Personal Information orProcessing thereof under the Agreement.
5. “EEA” means the European Economic Area.
6. “GDPR” stands for “General Data Protection Regulation” and means: (i) theRegulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 (“EU GDPR”); (ii) the EU GDPR as it forms part of United Kingdom(“UK”) law by virtue of Section 3 of the European Union (Withdrawal) Act 2018(“UK GDPR”); and (iii) any applicable implementing or supplementary legislationin any member state of the EEA or the UK (including the UK Data Protection Act2018).

7. “Personal Information” means information that constitutes “Personal Data,”“Personal Information,” “Personally Identifiable Information,” or similar
information as defined by applicable Data Protection Legislation that HypehoundProcesses pursuant to the Agreement.
8. “Personal Data Breach” means a breach of Hypehound’s security that has
resulted in the accidental or unlawful destruction, acquisition, loss, alteration,
unauthorized disclosure of, or access to, Personal Information in Hypehound’s
possession, custody or control. Personal Data Breaches do not include
unsuccessful attempts or activities that do not compromise the security of
Personal Information, including unsuccessful log-in attempts, pings, port scans,denial of service attacks, or other network attacks on firewalls or networkedsystems.
9. “Relevant Body” (i) in the context of the UK and the UK GDPR, means the UK
Information Commissioner’s Office and/or UK Government (as and whereapplicable); and/or (ii) in the context of the EEA and EU GDPR, means theEuropean Commission.
10. “Restricted Country” (i) in the context of the UK, means a country or territory
outside the UK; and (ii) in the context of the EEA, means a country or territory
outside the EEA (which shall, as and where applicable, be interpreted in line withArticle FINPROV.10A(1) of the Trade and Cooperation Agreement between theEU and the UK), that the Relevant Body has not deemed to provide an‘adequate’ level of protection for Personal Information pursuant to a decision
made in accordance with Article 45(1) of the GDPR.
11. “Restricted Data Transfer” means the disclosure, grant of access or othertransfer of Personal Information to: (i) in the context of the EEA, any country orterritory outside the EEA which does not benefit from an adequacy decision bythe European Commission pursuant to Article 45 of the GDPR; and (ii) in thecontext of the UK, any country or territory outside the UK which does not benefit
from an adequacy decision by the UK Information Commissioner’s Officepursuant to Article 45 of the GDPR.
12. “Security Measures” means the technical and organizational security measures
to be applied by Processor in respect of the Personal Information, as set out inAppendix 2.
13. “Standard Contractual Clauses” or “SCCs” means (i) where the GDPR applies,
the clauses annexed to European Commission Implementing Decision (EU)2021/914 of 4 June 2021, available athttps://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN (“EU SCCs”); and (ii) where the UK GDPR applies, the International
Data Transfer Addendum to the EU Commission Standard Contractual Clauses
issued by the UK Information Commissioner under Section 119A(1) Data

Protection Act 2018 (“UK IDTA”) (in each case, as updated, amended orsuperseded from time to time).
14. “Subprocessors” means the relevant subprocessors listed onhypehound.io/subprocessors.
15. “Supervisory Authority” means: (i) in the context of the EU GDPR, any
authority within the meaning of Article 4(21) of the EU GDPR; and (ii) in thecontext of the UK GDPR, the UK Information Commissioner’s Office.
16. “UK” means the United Kingdom of Great Britain and Northern Ireland.
Data Protection
1. In the course of Hypehound providing the Service under the Agreement,
Customer may from time-to-time provide or make available Personal Information
to Hypehound for the limited and specific purposes of providing the Service
under the Agreement. The Parties acknowledge and agree that, in relation to any
such Personal Information provided or made available to Hypehound forProcessing by Hypehound under the Agreement, the Customer will be theController and Hypehound will be the Processor for the purposes of the GDPR
and the Customer will be the Business and Hypehound will be the Service
Provider for purposes of the CCPA.
2. When Hypehound Processes Personal Information in the course of providing theService, Hypehound will:a. process the Personal Information as a Data Processor, for the purpose ofproviding the Service in accordance with documented instructions from theCustomer (provided that such instructions are commensurate with thefunctionalities of the Service), to perform Hypehound’s obligations andexercise Hypehound’s rights under the Agreement, including to maintainrecords relating to the Service and comply with any legal or self-regulatory
obligations relating to the Service, and as may subsequently be agreed toby the Customer. Hypehound is prohibited from retaining, using, ordisclosing Personal Information provided by Customer (“Customer Data”)
for any purpose other than for the specific purpose of performing theServices specified in the Agreement. If Hypehound is required byapplicable laws to Process the Personal Information for any otherpurpose, Hypehound will provide the Customer with prior notice of thisrequirement, unless Hypehound is prohibited by such laws from providing
such notice;b. not sell, rent, release, disclose, disseminate, make available, transfer, orotherwise communicate Customer Data to any third party for monetary orother valuable consideration. Hypehound shall not share, as defined byapplicable Data Protection Legislation, any Customer Data;c. commencing January 1, 2023, Hypehound will not combine any Personal
Information that Hypehound receives from, or on behalf of, Customer withinformation that it receives from, or on behalf of, another source provided
that Hypehound may combine Personal Information as authorized by Data
Protection Legislation.
d. notify the Customer if, in Hypehound’s opinion, the Customer’s instruction
for the Processing of Personal Information infringes applicable Data
Protection Legislation;e. notify the Customer promptly, to the extent permitted by law, uponreceiving an inquiry or complaint from a Supervisory Authority relating to
Hypehound’s Processing of the Personal Information;
f. upon Customer’s written request, provide Customer with such assistanceas may be reasonably necessary and technically feasible in fulfilling its
legal obligations under Data Protection Legislation, including dataprotection impact assessments and prior consultations with Supervisory
Authorities which Hypehound reasonably considers to be required of it by
Data Protection Legislation, in each case solely in relation to Processingof Personal Information by, and taking into account the nature of theProcessing by, and information available to, Hypehound;g. upon the Customer’s written request, provide the Customer with suchreasonable assistance as may be necessary and technically possible,taking into account the nature and circumstances of the processing and
Hypehound’s role as a processor, to allow the Customer to fulfill its
obligation to respond to Data Subject Requests;
h. upon receipt of any Data Subject Request that relates to Personal
Information that Hypehound Processes for the Customer, Hypehound may
advise the Data Subject to submit the request to Customer and Customer
is solely responsible for responding to any such requests. Hypehound’s
notification of or response to a Data Subject Request under this Section is
not an acknowledgement by Hypehound of any fault or liability withrespect to the Data Subject Requests;
i. implement and maintain appropriate technical and organizational
measures designed to protect the Personal Information and ensure a levelof security appropriate to the risk. Hypehound’s measures comprise those
documented in the Security Measures listed in Appendix 2;
j. provide the Customer, upon the Customer’s reasonable written request,
with up-to-date attestations, reports or extracts thereof, where available,from a source charged with auditing Hypehound’s data protectionpractices (e.g., external auditors, internal audit, data protection auditors),

or suitable certifications, to enable the Customer to assess compliancewith the terms of this Addendum;
k. reasonably ensure its employees, agents, and service providers, comply
with the obligations and restrictions applicable to Hypehound underapplicable Data Protection Legislation. Hypehound shall reasonably notify
Customer if it makes a determination that it can no longer meet its
obligations. Upon such notification, Customer may take reasonable steps
to remediate any unauthorized use of Customer Data;l. notify the Customer promptly upon becoming aware of and confirming any
Personal Data Breach impacting Customer Data. The Customer is solely
responsible for complying with Data Breach notification laws applicable to
the Customer and fulfilling any third-party notification obligations related to
any Personal Data Breach. Hypehound’s notification of, or response to, a
Personal Data Breach under this Section is not an acknowledgement byHypehound of any fault or liability with respect to the Personal DataBreach;m. ensure that its personnel who access the Personal Information havecommitted themselves to confidentiality or are under appropriate statutory
obligations of confidentiality; andn. upon termination of the Agreement or expiry of Service involving theProcessing of Personal Information, Hypehound shall cease all
Processing of Personal Information related to such Service except as set
out in this Section. Hypehound will promptly initiate its process to delete oranonymize the Personal Information, subject to Hypehound retaining any
copies required by applicable laws (and in that case, for such period as
may be required by such applicable laws). If the Customer requests acopy of such Personal Information within 30 days of termination,
Hypehound will provide the Customer with a copy of such PersonalInformation.
3. The Customer shall ensure that it is entitled to give access to the relevant
Personal Information to Hypehound so that Hypehound may lawfully Process
Personal Information in accordance with the Agreement on the Customer’sbehalf. The Customer shall:a. comply with its obligations under the Data Protection Legislation whicharise in relation to this Addendum, the Agreement and the receipt of theService;b. not do or omit to do anything which causes Hypehound (or anySubprocessor) to breach any of its obligations under the Data Protection
Legislation; andc. to the extent Customer receives any inquiry or request regarding
Hypehound’s compliance with Data Protection Legislation, reasonably
inform Hypehound of the inquiry or request and any necessary
information.
4. In the course of providing the Service, the Customer acknowledges and agrees
that Hypehound may use Subprocessors to Process the Personal Information.
Hypehound’s use of any specific Subprocessor to Process the Personal
Information must be in compliance with Data Protection Legislation and must be
governed by a contract between Hypehound and the Subprocessor. Hypehoundwill notify the Customer of any changes to the list of Subprocessors at
hypehound.io/subprocessors concerning the addition or replacement of other
Subprocessors. Customer acknowledges it needs to review the list after being
notified and may object to such changes in writing setting out its reasonable
concerns in detail within 14 days from the date of the notification. If the Customer
does not object to such changes, Hypehound shall have the right to continue toProcess the Personal Information in accordance with the terms of thisAddendum, including using the relevant subprocessors. If the Customer objects,
Hypehound shall consult with the Customer, consider the Customer’s concerns ingood faith and inform the Customer of any measures taken to address theCustomer’s concerns. If the Customer upholds its objection and/or demands
significant accommodation measures which would result in a material increase incost to provide the Services, Hypehound shall be entitled to increase the fees for
the Service or, at its option, terminate the Agreement.
5. As part of providing the Service, Data Subject’s Personal Information will beProcessed in the United States. Such Processing will be completed incompliance with relevant Data Protection Legislation.
6. Customer acknowledges and hereby agrees that Hypehound may transfer to,access and process Personal Information in a Restricted Country, as necessary
to provide the Service in accordance with the Agreement. Hypehound will makeany such Restricted Data Transfers in compliance with the applicable Data
Protection Legislation. If Hypehound’s compliance with Data Protection
Legislation applicable to Restricted Data Transfers is affected by circumstancesoutside of Hypehound’s control, including if a legal instrument for Restricted Data
Transfers is invalidated, amended, or replaced, then Customer and Hypehoundwill work together in good faith to reasonably resolve such non-compliance.
7. Solely to the extent required to ensure the legality of Restricted Transfers, in theevent that the transfer of Personal Information from Controller to Hypehoundinvolves a transfer of Personal Information, that is subject to GDPR or UK GDPR,
to a Restricted Country, the SCCs shall be incorporated by reference and form anintegral part of this Addendum with Controller as “data exporter” and Hypehoundas “data importer.” For the purposes of the EU SCCs: (i) Module Two (controllerto processor) terms shall apply and the module one, three and four terms shallbe deleted; (ii) Clause 7 (Docking Clause) shall not apply; (iii) in Clause 9, Option
2 shall apply and the “time period” shall be 14 days; (iv) in Clause 11, theoptional language shall not apply; (v) in Clause 17 (Option 1), the EU SCCs shallbe governed by Irish law; (vi) in Clause 18(b), disputes shall be resolved beforethe courts of Ireland; (vii) Annex 1 and 3 of the EU SCCs shall be populated withthe information set out in Appendix 1; and (viii) Annex 2 of the EU SCCs shall bedeemed populated with the information set out in Appendix 2 . For the purposesof the UK IDTA: (i) the Appendices or Annexes of the UK IDTA shall be populatedwith the relevant information set out in this DPA; and (ii) the UK IDTA shall begoverned by the laws of, and disputes shall be resolved before the courts of,England and Wales. If and to the extent the applicable SCCs conflict with any
provision of this Addendum regarding the transfer of Personal Information from
Customer to Hypehound, the SCCs shall prevail to the extent of such conflict.
Miscellaneous
1. In the event of any conflict or inconsistency between the provisions of theAgreement and this Addendum, the provisions of this Addendum shall prevail.
For avoidance of doubt and to the extent allowed by applicable law, any and all
liability under this Addendum, including limitations thereof, will be governed by
the relevant provisions of the Agreement.
2. The Customer acknowledges and agrees that Hypehound may amend thisAddendum from time to time by posting the relevant amended and restated
Addendum on Hypehound’s website, available at https://hypehound.io/dpa andsuch amendments to the Addendum are effective as of the date of posting. The
Customer’s continued use of the Service after the amended Addendum is posted
to Hypehound’s website constitutes the Customer’s agreement to, andacceptance of, the amended Addendum. If the Customer does not agree to any
changes to the Addendum, the Customer should cease use of the Serviceimmediately.
3. Save as specifically modified and amended in this Addendum, all of the terms,provisions and requirements contained in the Agreement shall remain in full force
and effect and govern this Addendum. If any provision of the Addendum is held
illegal or unenforceable in a judicial proceeding, such provision shall be severedand shall be inoperative, and the remainder of this Addendum shall remain
operative and binding on the parties.
4. The terms of this Addendum shall be governed by and interpreted in accordancewith the laws of the State of California and the laws of the United States
applicable therein, without regard to principles of conflicts of laws. The parties

irrevocably and unconditionally submit to the exclusive jurisdiction of the courts of
the State of California with respect to any dispute or claim arising out of or inconnection with this Addendum.
Appendix 1 - Data Processing Details
This Appendix includes certain details of the Processing of Personal Information: (i) as
required by Article 28(3) of the GDPR; and (ii) where applicable, to populate Appendix 1to the Standard Contractual Clauses.
Hypehound’s activities and purpose of the Processing
Hypehound provides a service for managing partial payments.
Subject matter and duration of the Processing of Personal Information
The subject matter and duration of the Processing of Personal Information as part of theService under the Agreement. Start date is the date Personal Information is first
Processed by Processor. End date is the date of termination or expiry of the Agreement.
The frequency of the processing is continual and ongoing during the term of theAgreement.
The nature and purpose of the Processing of Personal Information
The processing of certain Personal Information by the Processor on behalf of theController in relation to allowing access of the Controller’s users to the Processor’s
partial payment management platform.
The categories of Personal Information to be Processed
Personal Information that Hypehound receives as described at:https://www.hypehound.io/privacy-policy
The categories of Data Subjects to whom Personal Information relates
Data Subjects about whom Hypehound collects Personal Information in its provision ofService as a Processor, including Customer’s customers (“Buyers”). Data Subjects
about whom Personal Information is transferred to Hypehound in connection with its
Service as a Processor by, at the direction of, or on behalf of Customer, includingBuyers.
Appendix 2 – Security MeasuresAs from the effective date of the Addendum, Hypehound will implement and maintainthe security measures set out in this Appendix 2 (“Security Measures”).
1. Physical Access Control: Hypehound shall take reasonable measures to prevent
physical access by unauthorized persons to facilities where Personal Informationis Processed. Safeguards implemented at data processing facilities arecontrolled by third-party vendors and may include security personnel, alarmsystems, access control systems, and video/CCTV surveillance.
2. System Access Control: Hypehound shall take reasonable measures to prevent
unauthorized access to systems processing Personal Information. Safeguards
implemented may include multi-factor authentication, change management
processes, and system-level logging.
3. Data Access Control: Hypehound shall take reasonable measures to allow for
Personal Information to be accessed and/or managed by authorized personnel
only and protect against Personal Information being read, modified, or removed
without authorization. Safeguards implemented include encryption while data isat rest.
4. Transmission Control: Hypehound shall take reasonable measures to prevent thedisclosure of Personal Information during transmission. Safeguards implemented
include encryption of data while in transit over public networks.
5. Data Availability Control: Hypehound shall take reasonable measures to protect
against accidental destruction or loss of Personal Information, Safeguards
implemented may include regular backups of Personal Information, restoration
testing of Personal Information backups, replication of Personal Information
backups across multiple sites, and disaster recovery plans.
6. Data Segregation Control: Hypehound shall take reasonable measures tosegregate Personal Information on a per customer basis. Safeguards
implemented may include application-level controls for logical separation of
Personal Information.
Hypehound may update or modify such Security Measures from time to time, provided
that such updates and modifications do not materially decrease the overall security of
the Service.