Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Software Subscription Agreement or other written agreement governing Customer's use of the Eventful Service (the "Agreement") between Funl Technologies, Inc., a Delaware corporation doing business as Eventful ("Eventful"), and the customer identified in the Agreement ("Customer"). This DPA applies when Eventful Processes Customer Personal Data on Customer's behalf in connection with the Service.

By executing the Agreement, or an order form that incorporates this DPA, each Party agrees to this DPA on behalf of itself and any Affiliates authorized to use the Service. If there is a conflict concerning Processing of Customer Personal Data, the following order of precedence applies: (1) applicable Standard Contractual Clauses; (2) this DPA; and (3) the Agreement.

1. Definitions

1.1 Applicable Data Protection Law. means all laws and regulations applicable to the Processing of Customer Personal Data under the Agreement, including, as applicable: the GDPR; the UK GDPR and UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); and other applicable United States state comprehensive privacy laws.

1.2 Customer Personal Data. means Personal Data contained in Customer Data that Eventful Processes on Customer's behalf as a Processor or Service Provider. Customer Personal Data does not include Personal Data for which Eventful independently determines the purposes and means of Processing, including account administration, billing, security, fraud prevention, and Eventful's own business communications, which are governed by Eventful's Privacy Policy and Applicable Data Protection Law.

1.3 Data Subject, Controller, Processor, Processing, Personal Data and Supervisory Authority. have the meanings given under Applicable Data Protection Law. "Business," "Consumer," "Contractor," "Personal Information," "Sell," "Service Provider," and "Share" have the meanings given under the CCPA.

1.4 GDPR. means Regulation (EU) 2016/679. "UK GDPR" has the meaning given in the UK Data Protection Act 2018.

1.5 Security Incident. means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by Eventful. Security Incidents do not include unsuccessful attempts or activities that do not compromise Customer Personal Data, such as pings, scans, failed login attempts, or denial-of-service attempts.

1.6 Subprocessor. means a third party engaged by Eventful to Process Customer Personal Data on Customer's behalf.

2. Scope and Roles

2.1 Roles. As between the Parties, Customer is the Controller or Business and Eventful is the Processor or Service Provider with respect to Customer Personal Data. If Customer acts as a Processor for another Controller, Eventful acts as Customer's Subprocessor, and Customer represents that its instructions and appointment of Eventful are authorized by the relevant Controller.

2.2 Processing Details. The subject matter, duration, nature, purpose, categories of Data Subjects, and types of Customer Personal Data are described in Schedule 1. The Agreement, Customer's use and configuration of the Service, and documented instructions consistent with the Agreement constitute Customer's documented instructions.

2.3 Customer Obligations. Customer is responsible for complying with Applicable Data Protection Law in its collection and use of Customer Personal Data, including providing required notices, establishing a lawful basis, responding to Data Subjects, and obtaining permissions and consents for recordings, transcription, marketing communications, cookies and tracking, badge scanning, enrichment, and transfer to connected systems. Customer will not instruct Eventful to Process Customer Personal Data unlawfully.

2.4 Sensitive Data. Customer will not submit sensitive or special-category Personal Data to the Service unless the Parties expressly agree in writing to additional safeguards. Eventful does not intend the Service for protected health information governed by HIPAA, payment-card data subject to PCI DSS, government identification numbers, financial account credentials, or information about children.

3. Processing Instructions

3.1 Instructions. Eventful will Process Customer Personal Data only on Customer's documented instructions and as necessary to provide, secure, support, and improve the Service; comply with the Agreement; or comply with applicable law. If law requires Processing beyond Customer's instructions, Eventful will notify Customer before Processing unless legally prohibited.

3.2 Unlawful Instructions. Eventful will promptly inform Customer if, in Eventful's reasonable opinion, an instruction violates Applicable Data Protection Law. Eventful may suspend the affected Processing until the Parties resolve the issue, without liability for the suspension to the extent reasonably necessary to avoid unlawful Processing.

3.3 Personnel. Eventful will ensure that personnel authorized to Process Customer Personal Data are subject to confidentiality obligations and receive appropriate privacy and security awareness training.

3.4 No Sale or Sharing. Eventful will not Sell or Share Customer Personal Data, retain, use, or disclose it outside the direct business relationship with Customer, or combine it with Personal Data received from or collected on behalf of another person, except as permitted by Applicable Data Protection Law and necessary to provide the Service. Eventful will not use Customer Personal Data for targeted or cross-context behavioral advertising.

4. Security

4.1 Security Measures. Eventful will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against Security Incidents, taking into account the state of the art, implementation costs, and the nature, scope, context, purposes, and risks of Processing. The current measures are described in Schedule 2.

4.2 Security Program Changes. Eventful may update its security measures from time to time, provided that updates do not materially reduce the overall protection of Customer Personal Data during the then-current Term.

4.3 Customer Responsibilities. Customer is responsible for securely configuring and using the Service, protecting credentials, managing Authorized Users and permissions, maintaining the security of Customer-controlled systems and integrations, and promptly notifying Eventful of suspected unauthorized access.

5. Security Incidents

5.1 Notification. Eventful will notify Customer without undue delay after confirming a Security Incident affecting Customer Personal Data. Notification will be sent to Customer's notice or security contact identified in the Agreement or otherwise provided to Eventful.

5.2 Information and Cooperation. To the extent reasonably available, Eventful's notice will describe the nature of the Security Incident, categories of affected data and individuals, likely consequences, measures taken or proposed, and a contact for follow-up. Eventful may provide information in phases and will take reasonable steps to contain, investigate, mitigate, and remediate the Security Incident.

5.3 No Admission. Notification or response to a Security Incident is not an admission of fault or liability. Customer is responsible for determining whether notification to regulators, Data Subjects, or others is required and for making those notifications, with Eventful providing reasonable assistance as required by Applicable Data Protection Law.

6. Data Subject Requests and Assistance

6.1 Requests. Taking into account the nature of Processing, Eventful will provide commercially reasonable assistance through appropriate technical and organizational measures to help Customer respond to requests by Data Subjects to exercise their rights. If Eventful receives a request relating to Customer Personal Data, Eventful will direct the requester to Customer and will not respond substantively unless Customer instructs Eventful or law requires it.

6.2 Compliance Assistance. Taking into account the nature of Processing and information available to Eventful, Eventful will provide reasonable assistance with Customer's obligations concerning security, breach notification, data protection impact assessments, and prior consultation with regulators.

6.3 Costs. Assistance included in the ordinary operation of the Service will be provided without additional charge. Eventful may charge reasonable fees for assistance requiring material resources beyond ordinary support, unless the assistance is required because of Eventful's breach of this DPA.

7. Subprocessors

7.1 General Authorization. Customer gives Eventful general written authorization to engage Subprocessors to provide the Service. Eventful will maintain a current list of Subprocessors in Schedule 3 to this DPA or at another location notified to Customer.

7.2 Subprocessor Obligations. Eventful will enter into a written agreement with each Subprocessor imposing data protection obligations that provide at least the level of protection required by this DPA, to the extent applicable to the services performed. Eventful remains responsible for each Subprocessor's performance of its obligations to the same extent Eventful would be responsible if performing the relevant Processing itself.

7.3 Changes and Objections. Eventful will provide at least fifteen (15) days' prior notice of a new Subprocessor, including by updating its Subprocessor list and, if Customer subscribes, sending electronic notice. Customer may object during that period on reasonable, documented data protection grounds. The Parties will work in good faith to resolve the objection. If no commercially reasonable resolution is available, Eventful may choose not to use the Subprocessor for Customer Personal Data or Customer may terminate only the affected Service by written notice and receive a prorated refund of prepaid fees for the period after termination of that affected Service.

8. Return and Deletion

8.1 During the Term. The Service may provide Customer tools to access, export, correct, or delete Customer Personal Data. Customer is responsible for using available tools before expiration or termination.

8.2 At End of Services. Upon expiration or termination of the Agreement, Eventful will, at Customer's written choice and subject to the Agreement, return or delete Customer Personal Data within the period specified in Schedule 1, unless law requires retention. Customer Personal Data in backups may remain until overwritten through Eventful's ordinary backup cycle, provided it is protected, put beyond active use, and deleted according to Eventful's retention practices.

9. Audits and Information

9.1 Compliance Information. Upon reasonable written request, Eventful will provide information reasonably necessary to demonstrate compliance with this DPA, which may include security documentation, questionnaires, summaries of independent assessments, or other appropriate evidence then available.

9.2 Audits. If the information under Section 9.1 is insufficient to demonstrate compliance, Customer may conduct one audit per twelve-month period, and additional audits following a Security Incident or where required by a Supervisory Authority. Audits must be conducted on at least thirty (30) days' notice, during normal business hours, without unreasonable disruption, by Customer or an independent auditor that is not Eventful's competitor and is bound by confidentiality obligations.

9.3 Limitations and Costs. Audits will be limited to systems and records relevant to Customer Personal Data and will not provide access to other customers' information, Eventful trade secrets, or information that would compromise security. Customer will bear its audit costs and reimburse Eventful's reasonable costs for audits requiring material resources, unless the audit identifies a material breach by Eventful.

10. International Transfers

10.1 Transfer Mechanisms. Eventful may Process Customer Personal Data in the United States and other countries where Eventful or its Subprocessors operate. Each Party will comply with Applicable Data Protection Law governing international transfers. If a valid adequacy decision or another lawful transfer mechanism applies, that mechanism will govern before the Standard Contractual Clauses.

10.2 EU Standard Contractual Clauses. For a restricted transfer subject to the GDPR that is not covered by another lawful mechanism, the European Commission Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("EU SCCs") are incorporated by reference and deemed executed as follows: Module Two applies when Customer is a Controller and Eventful is a Processor; Module Three applies when Customer is a Processor and Eventful is a Subprocessor; Clause 7 (docking) applies; Option 2 in Clause 9 applies with a fifteen-day notice period; the optional language in Clause 11 does not apply; in Clause 17, Option 1 applies and the governing law is Ireland; and the courts of Ireland are selected under Clause 18. Schedule 1 completes Annex I, Schedule 2 completes Annex II, and Schedule 3 completes Annex III.

10.3 UK Transfers. For a restricted transfer governed by the UK GDPR, the EU SCCs as completed by this DPA apply together with the UK International Data Transfer Addendum. The Parties incorporate by reference: "Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses." The information in Schedules 1 through 3 completes the applicable tables. Neither Party may terminate the UK Addendum solely because the ICO issues a revised approved addendum; the revised version will apply as provided in its mandatory clauses.

10.4 Switzerland. For restricted transfers governed by Swiss data protection law, the EU SCCs apply with references to the GDPR interpreted to include the Swiss Federal Act on Data Protection, references to EU Member States interpreted to include Switzerland, and the competent Swiss authority and courts substituted where required.

10.5 Supplementary Measures. Eventful will provide reasonable information needed for Customer's transfer assessment and will implement supplementary measures reasonably necessary for the applicable transfer, taking into account the nature of the Processing and available safeguards.

10.6 Government Requests. Unless legally prohibited, Eventful will notify Customer of a legally binding government request for Customer Personal Data. Eventful will review requests for legal validity, challenge requests it reasonably believes are unlawful, and disclose only the minimum data legally required.

11. United States State Privacy Terms

11.1 Service Provider and Contractor Status. To the extent the CCPA applies, Eventful acts as Customer's Service Provider and Contractor for Customer Personal Information. Customer discloses Customer Personal Information to Eventful only for the limited and specified business purposes described in the Agreement and Schedule 1.

11.2 Restrictions. Eventful will not: (a) Sell or Share Customer Personal Information; (b) retain, use, or disclose it for any purpose other than the specified business purposes, as otherwise permitted by the CCPA, or outside the direct business relationship; or (c) combine it with Personal Information received from another person or collected from Eventful's own interactions with a Consumer, except as permitted by the CCPA.

11.3 Compliance and Monitoring. Eventful will comply with applicable obligations under the CCPA and provide the same level of privacy protection required of Customer for the relevant Customer Personal Information. Customer may take reasonable and appropriate steps to verify Eventful's compliance and to stop and remediate unauthorized use. Eventful will notify Customer if it determines it can no longer meet its CCPA obligations.

11.4 Other State Laws. Where another U.S. state privacy law applies and uses different terminology, the Parties' obligations will be interpreted to provide equivalent controller-processor protections, including processing instructions, confidentiality, security, assistance, deletion, audit, and Subprocessor requirements to the extent required by that law.

12. Liability; General

12.1 Liability. Each Party's liability arising out of or relating to this DPA, including the EU SCCs and UK Addendum to the extent legally permitted, is subject to the exclusions and limitations of liability in the Agreement. Nothing in this DPA limits liability to the extent limitation is prohibited by Applicable Data Protection Law or the applicable Standard Contractual Clauses.

12.2 Termination. This DPA remains effective for as long as Eventful Processes Customer Personal Data. Termination of the Agreement automatically terminates this DPA, except provisions that must survive to protect Customer Personal Data or comply with Applicable Data Protection Law.

12.3 Updates. Eventful may update this DPA to reflect changes in law, regulatory guidance, or Processing practices, provided an update does not materially reduce protections for Customer Personal Data during the then-current Term. Eventful will provide reasonable notice of a material update.

12.4 Governing Law. Except where Applicable Data Protection Law or Standard Contractual Clauses require otherwise, this DPA is governed by the governing-law and dispute-resolution provisions of the Agreement.

12.5 Electronic Acceptance. This DPA may be accepted through execution of the Agreement or an order form incorporating it, electronic signature, or other legally binding electronic acceptance. The Parties agree that the completed Standard Contractual Clauses are executed on the same date and by the same authorized representatives as the Agreement.

Schedule 1 — Processing Details and SCC Annex I

Parties

Data exporter: Customer and authorized Customer Affiliates. Data importer: Funl Technologies, Inc. dba Eventful.

Eventful address

Funl Technologies, Inc. dba Eventful, 525 Junction Road, Suite 6500, Madison, WI 53717, United States.

Eventful privacy contact

Eventful Privacy Team, hello@heyeventful.com.

Customer details

As identified in the Agreement or applicable order form.

Activities relevant to transfer

Provision, operation, security, support, maintenance, and improvement of the Service under Customer's instructions.

Frequency

Continuous or as initiated by Customer's use and configuration of the Service.

Duration

For the Term and any limited post-termination retention period described below.

Deletion period

Following expiration or termination of the Agreement, Eventful will return or delete Customer Personal Data from active production systems within thirty (30) days, unless applicable law requires retention. Residual copies in routine backups are deleted in the ordinary course of Eventful's backup cycle within ninety (90) days, during which they remain protected, isolated, and put beyond active use.

Hosting and processing locations

United States (Amazon Web Services, us-west-2 region), together with other countries in which Eventful's authorized Subprocessors operate, as identified in Schedule 3.

EU supervisory authority

The authority determined under Clause 13 of the applicable EU SCCs.

Nature and purposes of Processing

• Hosting, storing, organizing, transmitting, retrieving, and displaying Customer Personal Data.
• Operating customer accounts, access controls, workflows, registrations, approvals, communications, and connected integrations.
• Processing event, webinar, conference, attendee, contact, and engagement information as configured by Customer.
• Processing badge images and extracted badge information when Customer uses badge-scanning functionality.
• Processing recordings, audio, video, transcripts, summaries, prompts, and generated content when Customer enables applicable functionality.
• Synchronizing data with Customer-authorized CRM, calendar, communication, website, email, enrichment, analytics, AI, or distribution services.
• Providing technical support, troubleshooting, security, fraud prevention, diagnostics, maintenance, and service improvement consistent with Customer's instructions.

Categories of Data Subjects

• Customer employees, contractors, administrators, and Authorized Users.
• Customers, prospects, leads, contacts, account representatives, and business partners of Customer.
• Event, webinar, meeting, podcast, or conference registrants, invitees, attendees, speakers, guests, and participants.
• Visitors to Customer-controlled webpages or digital experiences using Eventful functionality.
• Other individuals whose Personal Data Customer submits to or collects through the Service.

Types of Personal Data

• Identifiers and contact information, such as name, business email, telephone number, company, title, and account identifiers.
• Professional and organizational information, such as employer, department, role, account, industry, and CRM identifiers.
• Event and engagement information, such as registration, approval, attendance, check-in, RSVP, interaction, activity, and attribution data.
• Badge photographs and information extracted or enriched from badges or business identifiers.
• Audio, video, recordings, transcripts, summaries, comments, prompts, and other content submitted to or generated through the Service.
• Technical and usage information associated with Customer's configured use of the Service, such as IP address, device/browser information, timestamps, logs, page activity, and integration events.
• Customer configuration, custom fields, connected-system data, support communications, and files submitted by Customer.

Sensitive data

No sensitive or special-category Personal Data is intentionally required. Customer will not provide such data unless expressly agreed in writing with appropriate safeguards.

Schedule 2 — Technical and Organizational Measures / SCC Annex II

Eventful maintains technical and organizational measures appropriate to the nature and risks of the Processing, including the following.

Governance and risk management

Documented security responsibilities; periodic risk review; security policies appropriate to the size and nature of Eventful's operations; and management oversight of material risks.

Access control

Role-based and least-privilege access; unique user accounts; authentication controls; prompt removal or adjustment of access when roles change; and periodic review of privileged access.

Encryption

Encryption of Customer Personal Data in transit using industry-standard transport encryption and at rest where supported by Eventful's production infrastructure and service providers.

Application and infrastructure security

Secure configuration practices; separation of production environments from development where appropriate; change controls; logging and monitoring; and protections against common application and infrastructure threats.

Vulnerability management

Reasonable processes to identify, assess, prioritize, and remediate vulnerabilities and security updates based on severity and risk.

Availability and resilience

Backup, recovery, monitoring, and continuity measures appropriate to the Service and Eventful's operational maturity.

Incident response

Documented processes to identify, investigate, contain, remediate, and communicate Security Incidents, including internal escalation and preservation of relevant information.

Personnel security

Confidentiality obligations, access limited by role, security awareness, and appropriate offboarding procedures.

Subprocessor management

Reasonable security and privacy diligence before engagement; written data protection terms; and periodic reassessment based on risk.

Data lifecycle

Measures supporting collection limitation, controlled access, retention, export, and deletion consistent with the Agreement, this DPA, Customer instructions, and legal obligations.

Physical security

Reliance on production hosting providers with appropriate physical and environmental protections; reasonable controls for Eventful-controlled work environments and devices.

Testing and assurance

Periodic review or testing of relevant controls and remediation of identified issues according to risk. Eventful does not represent that it holds a certification unless expressly stated in writing.

Schedule 3 — Subprocessors / SCC Annex III

The following Subprocessors are engaged by Eventful to Process Customer Personal Data in connection with the Service. Processing locations below are drawn from each provider's published data processing agreement, sub-processor list, or trust documentation as of the date of this DPA. Several providers process Customer Personal Data in a default or customer-selected region with optional data residency; where that applies, the default or primary location is stated. Eventful monitors these locations against each provider's then-current terms and updates this Schedule as its Subprocessors change.

Questions about this DPA or Eventful's Subprocessors can be directed to hello@heyeventful.com.