Data Processing Addendum

Last Updated: October 5, 2026

This Data Processing Addendum (this "Addendum") forms part of the Terms of Engagement (the "Agreement") between MMJI CHILLZ, LLC, a Delaware limited liability company, operating as Spotful, together with its successors and permitted assigns ("Spotful," "we," "us," or "our"), and the Venue that has accepted the Agreement ("Venue," "you," or "your"). This Addendum applies automatically when you accept the Agreement, and it applies for as long as Spotful processes Venue Personal Data. Capitalized terms used but not defined in this Addendum have the meanings given in the Agreement.

1. DEFINITIONS

For the purposes of this Addendum:

"Applicable Data Protection Law" means all laws and regulations of the United States and its states that apply to the processing of personal information under the Agreement, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and its regulations (the "CCPA"), and the comprehensive consumer privacy laws of other states, in each case as amended or replaced from time to time.
"Controller" means a person that, alone or jointly with others, determines the purposes and means of processing personal information, and includes a "business" under the CCPA.
"Processor" means a person that processes personal information on behalf of a Controller, and includes a "service provider" under the CCPA.
"Personal Information" means any information that is "personal information," "personal data," or an equivalent term under Applicable Data Protection Law.
"Security Incident" means a breach of security leading to the unauthorized acquisition of, or access to, Venue Personal Data in Spotful's possession or control that compromises its security, confidentiality, or integrity, or any equivalent term defined by Applicable Data Protection Law. Unsuccessful attempts and activities that do not compromise the security of Venue Personal Data, such as pings, port scans, and blocked log-in attempts, are not Security Incidents.
"Spotful Controller Data" means Personal Information for which Spotful is a Controller, including Host Data, information about Team Members and other users of the Services, information collected through Spotful's own booking, sign-in, account, payment, marketplace, and website flows, and information about the use of the Services.
"Subprocessor" means a person that Spotful engages to process Venue Personal Data on Spotful's behalf.
"Venue Personal Data" means Personal Information that you, or a Third-Party Service acting on your instructions, enter, upload, import, sync, or otherwise provide to the Services, or that Spotful processes on your behalf at your direction, in each case as a Processor under the Agreement, as further described in Annex 1. Venue Personal Data does not include Spotful Controller Data, even where a copy of it is also included in your customer records.

The terms "business purpose," "commercial purpose," "consumer," "de-identified," "sell," and "share" have the meanings given to them in the CCPA.

2. ROLES OF THE PARTIES

2.1 Spotful as an Independent Controller

Spotful is an independent Controller of Spotful Controller Data and processes it for its own purposes as described in its Privacy Policy. Spotful's processing of Spotful Controller Data is not subject to Sections 3 through 10 of this Addendum.

2.2 Venue as an Independent Controller of Host Data It Receives

When Spotful makes Host Data available to you in connection with a Listing or a Booking, Spotful discloses it to you as an independent Controller, and you receive it as an independent Controller. Each party is separately responsible for its own compliance with Applicable Data Protection Law for its own processing of Host Data. You must: (a) process Host Data in compliance with Applicable Data Protection Law and your own privacy notice; (b) honor requests that consumers make to you regarding your copy of Host Data; (c) honor any opt-out signal, suppression instruction, or deletion notice that Spotful passes to you, to the extent Applicable Data Protection Law requires; and (d) not sell or share Host Data, or use it for targeted advertising, except as Applicable Data Protection Law permits.

2.3 Spotful as a Processor of Venue Personal Data

With respect to Venue Personal Data, you are the Controller, and Spotful is your Processor and service provider. Venue Personal Data may include, to the extent the Services offer the relevant features, customer and contact records that you create or import, notes you add to them, the recipients and content of messages that you send through the Services, data synced from Third-Party Services that you connect, and reports or events that you direct Spotful to send to your advertising, analytics, or other accounts.

2.4 Your Responsibilities as Controller

You are responsible for the lawfulness of the collection of Venue Personal Data and of your instructions to Spotful. You represent and warrant that: (a) you have provided all notices and obtained all consents, and have all rights and lawful bases, required by Applicable Data Protection Law and other Applicable Law for Spotful to process Venue Personal Data as contemplated by the Agreement, including any consent required for the messages you send; (b) your instructions comply with Applicable Data Protection Law; and (c) you will not provide to the Services sensitive Personal Information, Personal Information of children under thirteen (13) years of age, payment card numbers, government identification numbers, or health information, except where a feature of the Services is expressly designed to receive it and Applicable Law permits it. You are responsible for responding to consumer requests relating to Venue Personal Data.

3. PROCESSING ON YOUR INSTRUCTIONS

3.1 Instructions

Except as permitted by Section 5 or required by Applicable Law, Spotful will process Venue Personal Data on your documented instructions. The Agreement, this Addendum, your configuration and use of the features of the Services, and any instructions you give through the Venue Tools are your complete documented instructions. Any additional instruction requires Spotful's written agreement and may be subject to additional fees. The nature and purpose of the processing, the types of Personal Information, the categories of individuals, and the duration of the processing are described in Annex 1. Your acceptance of the Agreement is also your instruction to Spotful to process Venue Personal Data for the purposes described in Section 5.

3.2 Unlawful Instructions

Spotful may notify you if it determines that an instruction infringes Applicable Data Protection Law, and may decline to follow that instruction. Spotful has no obligation to monitor or assess the lawfulness of your instructions.

4. CCPA SERVICE PROVIDER TERMS

4.1 Business Purposes

You disclose Venue Personal Data to Spotful for the following limited and specified business purposes: providing, maintaining, supporting, securing, and operating the Services for you as described in the Agreement and Annex 1, including storing and organizing your customer records, enabling you to send messages and manage Bookings, honoring opt-out and do-not-contact requests across the Services, and the other purposes permitted under Section 5 (together, the "Business Purposes").

4.2 Restrictions

To the extent the CCPA applies, and except as otherwise permitted by the CCPA and its regulations, Spotful:

will not sell or share Venue Personal Data;
will not retain, use, or disclose Venue Personal Data for any purpose, including any commercial purpose, other than the Business Purposes, or outside the direct business relationship between you and Spotful;
will not combine Venue Personal Data with Personal Information that Spotful receives from or on behalf of another person, or collects from its own interactions with a consumer, except as permitted by the CCPA and its regulations;
will comply with the obligations that apply to it as a service provider under the CCPA and provide the level of privacy protection that the CCPA requires; and
will notify you if it determines that it can no longer meet its obligations under the CCPA.

4.3 Your Rights

You may take reasonable and appropriate steps, as described in Section 9, to help ensure that Spotful uses Venue Personal Data in a manner consistent with your obligations under the CCPA. On notice, you may take reasonable and appropriate steps to stop and remediate any unauthorized use of Venue Personal Data by Spotful.

4.4 Certification

Spotful certifies that it understands the restrictions in this Section 4 and will comply with them.

5. PERMITTED USES RESERVED TO SPOTFUL

You agree that Spotful may also retain, use, and disclose Venue Personal Data, to the extent permitted by Applicable Data Protection Law, for the following purposes, each of which is a Business Purpose:

to engage Subprocessors as described in Section 6;
to build, develop, and improve the quality of the Services, including through analytics, testing, and the training and improvement of models and features, provided that Spotful does not use Venue Personal Data to perform services on behalf of another person or to build or modify a profile of a consumer for use in providing services to another person;
to detect, prevent, investigate, and respond to security incidents, fraud, abuse, spam, and malicious, deceptive, or illegal activity, and to enforce the Agreement and the Acceptable Use Policy;
to comply with Applicable Law, legal process, court orders, and requests from government authorities, and to establish, exercise, or defend legal claims;
to maintain platform-wide records of opt-out and do-not-contact requests, consisting of the contact identifier, its opt-out status, and related details of the request, and to use those records across the Services to comply with Applicable Law and carrier requirements and to help prevent messages that may be unlawful, including where a consumer has opted out of messages sent through the Services;
to create de-identified or aggregated information, as Applicable Data Protection Law defines those terms, and to use and disclose that information for any lawful purpose; and
for the other purposes specified in California Code of Regulations, title 11, section 7050(a), and in the corresponding provisions of other Applicable Data Protection Law that permit a Processor to retain, use, or disclose Personal Information.

6. SUBPROCESSORS

6.1 General Authorization

You give Spotful a general authorization to engage Subprocessors, including Spotful's affiliates and the categories of service providers described in Annex 1. Spotful will make information about its Subprocessors available to you on request or through the Services.

6.2 Subprocessor Contracts

Spotful will engage each Subprocessor under a written contract that requires the Subprocessor to meet obligations regarding Venue Personal Data that are consistent with those that Applicable Data Protection Law requires of Spotful as a Processor. Spotful remains responsible to you for the performance of its Subprocessors' obligations, subject to the limitations in the Agreement.

6.3 New Subprocessors and Objections

Spotful will give you notice of a new or replacement Subprocessor where Applicable Data Protection Law requires it, by updating its Subprocessor information, by email, through the Venue Tools, or by other reasonable means. You may object to the change on reasonable grounds relating to data protection by notifying Spotful in writing within the period stated in the notice, or, if none is stated, promptly. If you object, Spotful may, in its discretion, propose a reasonable alternative. If Spotful does not do so, your sole and exclusive remedy is to stop using the features of the Services that involve the Subprocessor or to terminate the Agreement.

7. CONFIDENTIALITY AND SECURITY

7.1 Personnel

Spotful will require the persons it authorizes to process Venue Personal Data to be subject to a duty of confidentiality with respect to it.

7.2 Security Measures

Spotful will use administrative, technical, and organizational measures designed to protect Venue Personal Data, appropriate to the nature of the Venue Personal Data and the risks of the processing. Spotful may update these measures from time to time. You are responsible for your own security, including the security of your accounts, credentials, and devices, your configuration of the Services, and your Team Members' access.

7.3 Security Incidents

Spotful will notify you of a Security Incident within the time and to the extent required by Applicable Data Protection Law. Spotful will provide information about the Security Incident that is reasonably available to it and that you reasonably need to meet your own notification obligations, and may provide that information in stages as it becomes available. Spotful's notification of, or response to, a Security Incident is not an acknowledgment of fault or liability. Unless Applicable Law requires otherwise, you are responsible for notifying affected individuals, regulators, and other persons about a Security Incident involving Venue Personal Data, and Spotful may notify them where it determines that Applicable Law requires it to do so.

8. ASSISTANCE

8.1 Consumer Requests

Taking into account the nature of the processing, Spotful will provide reasonable assistance, through appropriate technical and organizational measures and insofar as possible, to help you respond to requests from consumers to exercise their rights under Applicable Data Protection Law regarding Venue Personal Data. Spotful may provide this assistance by making self-service features available in the Venue Tools. If Spotful receives a request from a consumer that identifies you, Spotful may refer the consumer to you, and may respond to the request itself to the extent it relates to Spotful Controller Data. You will inform Spotful of any consumer request made under Applicable Data Protection Law regarding Venue Personal Data that Spotful must comply with, and provide the information necessary for Spotful to comply with it, and Spotful will comply with the request to the extent Applicable Data Protection Law requires of a service provider or Processor.

8.2 Assessments and Other Assistance

Spotful will provide information reasonably available to it that you reasonably need to conduct data protection assessments that Applicable Data Protection Law requires of you regarding Spotful's processing of Venue Personal Data, and will provide other assistance that Applicable Data Protection Law requires a Processor to provide.

8.3 Costs

Spotful may charge you reasonable fees for assistance that goes beyond the self-service features of the Services, to the extent Applicable Data Protection Law permits.

9. AUDITS AND COMPLIANCE INFORMATION

9.1 Compliance Information

On your reasonable written request, Spotful will make available to you information in its possession or control that is reasonably necessary to demonstrate its compliance with its obligations under Applicable Data Protection Law and this Addendum, including written responses to reasonable security and privacy questionnaires.

9.2 Assessments

Where Applicable Data Protection Law requires Spotful to allow and cooperate with assessments, Spotful will do so by providing the information described in Section 9.1 or, at Spotful's option, a report of an assessment conducted by a qualified and independent assessor of Spotful's choosing using an appropriate and accepted control standard or framework. Any other assessment that Applicable Data Protection Law requires must be conducted on reasonable advance written notice, during normal business hours, no more than once in any twelve-month period unless required following a Security Incident or by a regulator, in a manner that does not unreasonably interfere with Spotful's operations or compromise the security or confidentiality of other customers' data, by an assessor bound by confidentiality obligations acceptable to Spotful, and at your expense.

9.3 Unauthorized Use

If you reasonably believe that Spotful is using Venue Personal Data in a manner not permitted by this Addendum, you may notify Spotful in writing with reasonable detail, and you may take reasonable and appropriate steps to stop and remediate the unauthorized use, including by instructing Spotful to stop the specified use while Spotful reviews the notice, or by deleting or ceasing to provide the affected Venue Personal Data. If Spotful determines that the use is not permitted, it will take reasonable steps to stop and remediate it.

10. RETURN AND DELETION

10.1 During the Agreement

During the term of the Agreement, you may export or delete Venue Personal Data using the features of the Venue Tools, to the extent those features are available, or by contacting Spotful.

10.2 After the Agreement Ends

After the Agreement ends, at your written direction, Spotful will delete or return Venue Personal Data, unless retention is required by Applicable Law. Spotful may retain Venue Personal Data in backups and archives until it is deleted or overwritten in the ordinary course, and may retain Venue Personal Data to the extent it is needed for a purpose described in Section 5, in each case subject to this Addendum for as long as it is retained. If you do not give a direction, Spotful may delete Venue Personal Data after the Agreement ends in accordance with its retention practices.

10.3 Spotful Controller Data

This Section 10 does not apply to Spotful Controller Data, which Spotful retains as described in its Privacy Policy, even where a copy of it is also included in your customer records.

11. INTERNATIONAL PROCESSING

Venue Personal Data may be processed in the United States and in other countries where Spotful, its affiliates, and its Subprocessors operate. You authorize these transfers, and you are responsible for any notice or consent that Applicable Law requires for them.

12. GENERAL

12.1 Liability

Spotful's liability arising out of or relating to this Addendum is subject to the exclusions and limitations of liability in the Agreement, to the extent permitted by Applicable Data Protection Law, and counts toward, and is not in addition to, the aggregate limit on Spotful's liability under the Agreement. Nothing in this Addendum limits your liability. Your indemnification obligations in the Agreement apply to claims arising out of your breach of this Addendum, your instructions, and your processing of Host Data and Venue Personal Data.

12.2 Order of Precedence

If this Addendum conflicts with the Agreement regarding the processing of Venue Personal Data, this Addendum controls to the extent of the conflict. In all other respects, the Agreement controls.

12.3 Changes in Law

Spotful may modify this Addendum as described in the Agreement, including to address changes in Applicable Data Protection Law, guidance, or the Services. If Applicable Data Protection Law requires additional contract terms for the processing of Venue Personal Data, the parties agree that those terms are incorporated into this Addendum to the minimum extent required.

12.4 Assignment and Successors

This Addendum follows the Agreement. If Spotful assigns or transfers the Agreement as described in the Agreement, including to an affiliate or a successor to the business that operates the Services, Spotful may assign or transfer this Addendum, and transfer Venue Personal Data and Spotful Controller Data, to the assignee or successor without your consent, and you will be bound to the assignee or successor on the terms of this Addendum.

12.5 Term

This Addendum remains in effect for as long as Spotful processes Venue Personal Data, and the provisions that by their nature should survive will survive its end.

ANNEX 1: DETAILS OF PROCESSING

Subject Matter and Duration

The subject matter of the processing is Spotful's provision of the Services to you under the Agreement. The processing continues for the term of the Agreement and any later period described in Section 10.

Nature and Purpose of Processing

Spotful may collect, record, organize, structure, store, adapt, retrieve, consult, use, combine as permitted in Section 4, analyze, transmit, disclose at your direction, restrict, erase, and otherwise process Venue Personal Data to:

host, store, organize, display, and allow you to search, segment, edit, export, and delete your customer and contact records;
enable you to create, schedule, send, and track emails, text messages, and other communications, and to process replies, delivery information, and opt-out requests;
enable you to create and manage Bookings and Quotes, and to record notes and related information;
exchange data with Third-Party Services that you connect, and send reports, events, or other data to accounts or destinations that you designate;
provide support, maintain, secure, and operate the Services; and
carry out the purposes described in Section 5.

Categories of Individuals

Individuals whose Personal Information you provide to the Services or that Spotful processes on your behalf, which may include your customers and prospective customers, Hosts and guests whose details you enter, recipients of your messages, contacts in lists you import or sync, and your business contacts.

Types of Personal Information

The Personal Information you choose to provide or direct Spotful to process, which may include names, email addresses, phone numbers, postal addresses, company and job information, event and booking details, purchase and visit history, communication preferences and consent records, message content and delivery and engagement information, notes, custom fields, identifiers from connected Third-Party Services, and online identifiers.

Sensitive Personal Information

Not intended to be processed. See Section 2.4.

Categories of Subprocessors

Spotful may engage Subprocessors in the following categories: hosting, database, and storage providers; email and text-message delivery providers and wireless carriers; payment processors; analytics, monitoring, and error-reporting providers; customer support and relationship management providers; security, fraud-prevention, and bot-detection providers; content-safety and artificial intelligence providers; mapping and location providers; and Spotful's affiliates that provide personnel, systems, or services to support the Services.