Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the Bayline Terms of Service (the "Agreement") between Infinite Ventures LLC, doing business as Bayline ("Bayline"), and the Customer ("Shop"). It applies automatically when the Shop accepts the Agreement. Capitalized terms not defined here have the meanings in the Agreement.

2.1 The Shop is the Controller and Business, and Bayline is the Processor and Service Provider, for Shop Personal Information.

2.2 The subject matter, nature, purpose, duration, categories of data and categories of data subjects are described in Annex 1.

2.3 The Shop is responsible for: the lawfulness of its instructions; providing all notices and obtaining all consents required for Bayline's Processing (including consents to text, call, and record calls); the accuracy of Shop Personal Information; and responding to Consumer requests.

3.1 Instructions. Bayline will Process Shop Personal Information only on the Shop's documented instructions, which are the Agreement, this DPA, and the Shop's configuration and use of the Service, unless the law requires otherwise (in which case Bayline will inform the Shop unless legally prohibited). Bayline will tell the Shop if it believes an instruction violates Data Protection Laws.

3.2 Confidentiality. Bayline will ensure that each person authorized to Process Shop Personal Information is subject to a duty of confidentiality.

3.3 Security. Bayline will implement and maintain the measures in Annex 2, which are appropriate to the risk. Bayline may update them, provided the update does not materially reduce overall protection.

3.4 Assistance. Taking into account the nature of the Processing and the information available to it, Bayline will provide reasonable assistance to the Shop in (a) responding to Consumer requests to exercise rights under Data Protection Laws, chiefly through the Service's features for viewing, exporting, correcting and deleting records; (b) meeting its security and breach-notification obligations; and (c) completing any data-protection assessment the law requires. If Bayline receives a Consumer request about Shop Personal Information directly, it will not respond except to direct the Consumer to the Shop, and will forward the request to the Shop.

3.5 Deletion and return. On termination of the Agreement, Bayline will make Shop Personal Information available for export for 30 days, and then delete it, unless the law requires retention. Copies in backups are overwritten in the normal course. During the term, the Shop may delete records using the Service; Bayline will act on a Shop's deletion instruction for an individual Consumer within the period the law requires.

3.6 Demonstrating compliance; assessments. On reasonable written request no more than once in any 12-month period (or after a Security Incident or at a regulator's direction), Bayline will make available information reasonably necessary to demonstrate compliance with this DPA, which may include written responses to a reasonable security questionnaire and summaries of policies. If the law gives the Shop a right to an assessment that this information does not satisfy, Bayline will allow a reasonable assessment by the Shop or an independent assessor bound by confidentiality, at the Shop's cost, during business hours, on 30 days' notice, in a way that does not compromise the security or confidentiality of other customers' data. Alternatively, Bayline may arrange for a qualified independent assessor, at Bayline's expense, to assess its policies and technical and organizational measures using an appropriate and accepted control standard, and provide the Shop a report.

With respect to Shop Personal Information that is subject to the CCPA (and to comparable provisions of other Data Protection Laws), Bayline:

• (a) will Process it only for the limited and specified Business Purposes of providing, maintaining, securing, supporting and improving the Service for the Shop as described in the Agreement and Annex 1, and as otherwise permitted for Service Providers by the CCPA and its regulations (including detecting security incidents, protecting against fraud or illegal activity, debugging, and building or improving the quality of the Service, provided that it does not use Shop Personal Information to build or improve services for another business or to perform services for another business);
• (b) will not Sell or Share it;
• (c) will not retain, use or disclose it for any purpose other than the Business Purposes specified in the Agreement, including for any commercial purpose other than providing the Service, or outside the direct business relationship between Bayline and the Shop;
• (d) will not combine it with personal information Bayline receives from or on behalf of another person, or collects from its own interactions with a Consumer, except as the CCPA permits for Service Providers;
• (e) will comply with applicable obligations under the CCPA and provide the same level of privacy protection as the CCPA requires of Businesses;
• (f) grants the Shop the right to take reasonable and appropriate steps to ensure that Bayline uses Shop Personal Information consistently with the Shop's CCPA obligations, and, upon notice, to stop and remediate unauthorized use;
• (g) will notify the Shop if Bayline determines it can no longer meet its obligations under the CCPA;
• (h) will not sell Shop Personal Information and will not use it to train its own AI models; and
• (i) certifies that it understands and will comply with the restrictions in this Section 4.

Where Bayline Deidentifies Shop Personal Information, it will take reasonable measures to ensure the information cannot be associated with a Consumer or household, publicly commit to maintain and use it only in Deidentified form, not attempt to re-identify it, and contractually require any recipient to do the same.

5.1 The Shop gives general authorization for Bayline to engage Subprocessors. Bayline currently uses Subprocessors in these categories: cloud hosting and database infrastructure; telecommunications carriers and messaging and voice providers; email delivery; artificial-intelligence and speech-processing providers; appointment scheduling; file and media storage; error monitoring and security tools; and customer-support tools.

5.2 A current list of Subprocessors, with their function, is available on request to support@baylinecrm.com, subject to reasonable confidentiality terms.

5.3 Bayline will (a) enter into a written contract with each Subprocessor imposing data-protection obligations no less protective than this DPA, to the extent applicable to the nature of its services; and (b) remain responsible for each Subprocessor's performance of those obligations.

5.4 Bayline will give at least 15 days' notice before adding or replacing a Subprocessor, by email to the account owner, by an in-Service notice, or by updating the list for Shops that have asked to be notified. The Shop may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if Bayline cannot reasonably accommodate it, the Shop may terminate the affected Service and receive a refund of prepaid fees for the unused period, which is its sole remedy. Where a Subprocessor must be replaced urgently for security or continuity reasons, Bayline will give notice as soon as practicable.

6.1 Bayline will notify the Shop without undue delay after confirming a Security Incident, and where feasible within 72 hours, and will provide information reasonably available to it to help the Shop meet its obligations, including the nature of the incident, the categories and approximate number of records affected, and the steps taken to contain it. Bayline may provide information in phases as it becomes available.

6.2 Bayline will take reasonable steps to contain, investigate and mitigate the Security Incident.

6.3 The Shop is responsible for notifying its End Customers, regulators and others where Data Protection Laws require. Bayline will not notify the Shop's End Customers on the Shop's behalf without the Shop's consent unless the law requires it. At the Shop's request, and subject to agreement on costs, Bayline will reasonably assist with notifications.

6.4 Bayline's notification of or response to a Security Incident is not an acknowledgment of fault or liability.

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement.

8.1 This DPA lasts for as long as Bayline Processes Shop Personal Information. If this DPA conflicts with the Agreement, this DPA controls for the Processing of Shop Personal Information.

8.2 If Data Protection Laws change in a way that requires additional contractual terms, Bayline may update this DPA to the extent needed for compliance, by notice to the Shop.

8.3 Bayline is based in the United States and the Service is intended for use in the United States. Bayline does not intentionally transfer Shop Personal Information outside the United States, although a Subprocessor may process it elsewhere in the course of providing its services.

Bayline maintains commercially reasonable administrative, technical and physical safeguards, including the following. No method of transmission or storage is completely secure, and these measures do not guarantee that Shop Personal Information will never be accessed, lost or disclosed without authorization.