GrowTribe Data Processing Addendum

Addendum form — requires completion and signature. Complete, verify and sign the applicable schedules with the customer. This form is not a completed transfer mechanism or evidence that its described controls have been deployed.

1. Parties, scope and instructions

This addendum forms part of the Creator Service Agreement between Fireside Solutions LLC ("Fireside") and the Customer named in its Order. It applies to personal information Fireside processes on Customer's behalf to provide the agreed GrowTribe services ("Customer Personal Data").

Customer determines the purposes and essential means of its community processing; Fireside processes Customer Personal Data only on documented lawful instructions. If Customer acts for another controller, it must identify that controller and establish authority to give those instructions. Independent processing by either party must be separately described and supported; this addendum does not convert independent purposes into processor activities.

The agreement, completed schedules and authorized service requests constitute instructions. Fireside will inform Customer if, in its opinion, an instruction infringes applicable data protection law and suspend the affected instruction while the parties resolve it. If law requires other processing, Fireside will notify Customer before processing unless legally prohibited.

2. Confidentiality, purpose limits and security

Fireside will ensure authorized personnel are subject to confidentiality duties and access Customer Personal Data only as needed for authorized responsibilities. Fireside will implement and maintain the technical and organizational measures specified in Schedule B, appropriate to the processing risks.

Fireside will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it for unrelated advertising or general-purpose model training, or retain, use or disclose it outside the agreed business purposes and direct business relationship except as law permits. Where US service-provider/contractor restrictions apply, Fireside will not combine it with data from other sources except as permitted by applicable law. Fireside certifies it understands and will comply with those restrictions to the extent they apply. Customer may take reasonable steps to verify compliance and stop or remediate unauthorized use, subject to appropriate confidentiality safeguards.

3. Subprocessors

Schedule C lists the initially authorized subprocessors, their services and processing locations. Fireside will give at least 30 days' written notice of a proposed addition or replacement before it receives Customer Personal Data. Customer may object within that period on reasonable data-protection grounds. The parties will seek an alternative or mitigation; if none is feasible, Customer may terminate the affected service before the change takes effect and receive unused prepaid fees for it.

Fireside will bind subprocessors to obligations no less protective for the relevant processing and remains responsible for their performance of those obligations. No blank schedule authorizes an unidentified provider. Provider terms and actual capabilities must support this commitment before signing.

4. Rights, incidents and legal requests

Fireside will promptly route requests relating to Customer-controlled information to Customer and assist with access, correction, deletion, portability, objection, restriction, consent withdrawal and applicable appeals. Fireside may respond directly where instructed or legally required. Each party will handle requests about its independent processing. Verification must be proportionate.

Fireside will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, using the incident contact in Schedule B. Available information will include the nature and scope, affected categories, likely consequences, measures taken and a contact for follow-up. Fireside may provide details in stages without delaying the initial notice. It will cooperate with containment, investigation, remediation and legally required notices. Notice is not an admission of fault. Customer's notices and Fireside's independent legal duties remain distinct.

Fireside will notify Customer of governmental demands for Customer Personal Data unless prohibited, assess their lawful scope and disclose only what is required. The parties will cooperate with applicable impact assessments, regulatory consultations and security obligations, taking account of the processing and information available to Fireside.

5. International processing

Schedule C identifies actual storage, remote access and support locations. Transfers requiring a safeguard will not proceed until the parties document a valid mechanism and necessary supplementary measures. If relevant, attach the correct EU Standard Contractual Clauses module, completed annexes and applicable UK addendum or other lawful mechanism. This document is not a substitute for those instruments; member assent is not a default transfer mechanism.

6. Return, deletion and records

At Customer's choice on termination, Fireside will return or delete Customer Personal Data under Schedule D, including subprocessor copies. The schedule must specify export format/window, active-system deletion, backup cycles and evidence of completion. Retention required by law is limited to the affected information and period; Fireside will protect it, restrict use and explain the legal basis unless prohibited. Independent records must have their own lawful retention basis.

If retained backups are restored, applicable deletion instructions must be reapplied before ordinary reuse. A login deletion or database-row removal alone is not confirmation of completed erasure. Children’s information, legal holds and required transaction records need the specific treatment in Schedule D.

7. Accountability and audits

Fireside will provide information reasonably necessary to demonstrate compliance and notify Customer if it can no longer meet applicable obligations. Customer or an independent auditor may conduct proportionate audits, including inspections where needed, with reasonable notice, confidentiality and protections for other customers' information. Reasonable alternatives may satisfy routine requests; notice or frequency limits may not obstruct a regulator, incident investigation or mandatory right. Costs and logistics must not defeat meaningful verification.

This addendum prevails over conflicting service terms for personal-data matters. Mandatory law and binding transfer instruments prevail where required. Liability follows the reviewed service agreement without restricting nonwaivable rights.

Schedules — required before execution

Schedules must contain actual agreed particulars, not only these headings. Fireside contact: dorian@fireside.solutions; 952 Patience Drive, Florissant, Missouri 63034. Customer contacts and both signatures: as completed in the Order.