Data Processing Addendum

Last updated January 23, 2026

This Data Processing Addendum (“DPA” or “Addendum”) is made between [insert] (“Customer”) and WasteNot Technologies, Inc. (“Provider”). This Addendum reflects the agreement between the parties regarding the processing and use of Personal Data by Provider, in accordance with the Applicable Data Protection Laws. The Effective Date of this DPA is the date of the last signature of a party below.

BACKGROUND

The parties have entered into a certain services agreement (the “Agreement”) pursuant to which Provider is providing Customer with certain services as described in such Agreement (“Services”), and

Provider may Process certain Personal Data to perform the Services. Therefore, the parties desire to enter into this DPA to address Provider's Processing of such Personal Data to supplement Provider’s obligations under the Agreement.

TERMS

IT IS AGREED:

1. Definitions.

Capitalized terms have the meanings set forth below, and elsewhere in this Addendum. All capitalized terms not defined herein have the meaning set out in the Agreement.

“Adequacy Decision” means a decision adopted by a competent authority with jurisdiction over Customer declaring that a jurisdiction meets an adequate level of protection of Customer Personal Data.

“Aggregated and De-identified Data” means data that is combined with other data and cannot be reasonably used to infer information about, or otherwise be linked to, an individual.

“Applicable Data Protection Laws” means those applicable federal, state and local laws, rules and regulations related to the protection, security and privacy of Personal Data, including the data security breach notification laws and data protection laws of the various states of the United States, the European Union, and other privacy, security, labor, and consumer protection laws, as they may be adopted, implemented, or amended from time to time, including, as applicable Regulation (EU) 1016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (the “GDPR”).

“Controller” or “Business” means the entity which determines the purposes and means of the Processing of Personal Data .

“Customer’s Personal Data” means any Personal Data Processed on behalf of Customer for Provider to perform the Services under the Agreement.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

“EU Standard Contractual Clauses” means Module 2 of the Standard Contractual Clauses for Processors as approved by the European Commission and available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en (as updated, amended or superseded from time to time).

“Incident” means (a) a data security breach as defined by Applicable Data Protection Laws; or (b) an unauthorized access, use, loss, theft, exfiltration, damage or acquisition of Personal Data as a result of Provider’s breach of this DPA.

“Personal Data” means data or information, that constitutes “personal data,” “personal information,” “personal identifiable information” or similar information regulated by Applicable Data Protection Laws.

“Personnel” means employees, affiliates, contractors, Sub-processors, and/or agents that Provider uses or engages to perform the Services.

“Process” or “Processing” means the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, destruction, or any other use of Personal Data.

“Processor” or “Service Provider” means the entity which Processes Personal Data on behalf of the Controller.

“Sub-processor” means any third party engaged by Provider to Process Personal Data on behalf of Customer in connection with the Agreement.

“Restricted Transfer” means the disclosure, grant of access or other transfer of any transfer of Customer Personal Data to a country or territory outside the EEA not covered by an Adequacy Decision or other countries, territories, jurisdictions restricted under Applicable Data Protection Laws.

2. Ownership and Processing of Personal Data.

2.1. Ownership of Personal Information. All Personal Data is and will remain the sole and exclusive property of Customer, as between the parties.

2.2. Role of the Parties. As between Provider and Customer, and regarding the Processing of Customer Personal Data, Customer is the Controller and Provider is the Processor. Provider will Process Personal Data on behalf of Customer and only in accordance with Customer’s documented instructions, unless in Provider’s reasonable opinion an instruction from Customer violates or infringes Applicable Data Protection Laws, in which case Provider will promptly notify Customer. Customer represents and warrants that it has all necessary authority (including any legally required consent from individuals) to transfer Customer Personal Data to Provider and to authorize Provider to Process such Customer Personal Data as permitted by this DPA and the Agreement. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data are and will be in strict compliance with the Applicable Data Protection Laws.

2.3. Details of Processing.

2.3.1. Duration. The duration of the data processing under this DPA is the term of the Agreement.

2.3.2. Purpose. The purpose of the data processing under this DPA is the provision of the Services.

2.3.3. Nature of the processing. Provider retrieves Customer’s user data, stores and reformats that data in a Snowflake data warehouse that is separate from all of the other data warehouses created for Provider’s other customers, and sends that data directly into the Customer’s ad accounts for the purposes of powering customer’s ad exclusions.

2.3.4. Type of Personal Data. The type of personal information under this DPA includes all information provided by the Customer, such as purchase data, website activity data, and marketing activity data of the Customer’s Data Subjects.

2.3.5. Instructions. The parties agree that Provider’s Processing of Customer’s Personal Data as required for provision of Services in accordance with the Agreement constitutes compliance with the written instructions of Company as required by this Section. Written instructions may also include additional written instructions provided by or on behalf of Company to Provider from time-to-time, including in emails and order forms, if and to the extent such instructions are required by Applicable Data Privacy Laws.

2.4. Restrictions on Processing. Provider and its Personnel will not Process Personal Data for any purpose other than for the specific purposes necessary of performing the Services for the duration of the Agreement unless required by law. Provider will not (and will ensure its Personnel do not) sell, share, rent, disclose, release, transfer, make available, or otherwise communicate Personal Data to any third party for any commercial purpose other than the business purpose set forth in the Agreement for monetary or other consideration of any kind. Provider will not combine Personal Data with any other data that Provider has or retains for the benefit of Provider or any other third party. “Sell”, “share”, “sale”, “business purpose”, and “commercial purpose” have the definitions set forth in Applicable Data Protection Laws. Provider may not retain any Personal Data following the cessation of any Services involving the Processing of Customer Personal Data under the Agreement and will promptly cease all Processing of Customer Personal Data for any purpose other than for storage and as otherwise permitted under this DPA. To the fullest extent technically possible in the circumstances, Provider will within a reasonable time following the termination of the Agreement, either (at its option) delete or irreversibly anonymize all Customer Personal Data within Provider’s possession. Provider and any Sub-processor may retain Customer Personal Data where required by applicable laws, for such period as may be required by such applicable laws, provided that Provider and any such Sub-processor shall Process such Customer Personal Data only as necessary to comply with applicable laws. In the event Customer becomes aware of an unauthorized use of Personal Data, it may take reasonable and appropriate steps to remediate such unauthorized use upon reasonable advance written notice to Provider. In the event such remediation prevents performance of the Services by Provider, Provider will not have any liability for such nonperformance under the Agreement.

2.5. Use of Aggregated and De-identified Data.

2.5.1. Provider may create, use, and retain Aggregated and De-identified Data derived from Personal Data, provided that:

2.5.1.1. Such data cannot be reasonably used to identify, describe, or be associated with any individual or Customer;

2.5.1.2. Provider implements technical and organizations safeguards to prevent re-identification of such data;

2.5.1.3. Provider does not attempt to re-identify such data;

2.5.1.4. Any disclosure of such data to a third party is made only in a manner that does not permit re-identification of such data; and

2.5.1.5. Provider uses such data solely in compliance with applicable law.

2.5.2. Upon the creation of such Aggregated and De-identified Data, such data shall no longer be Customer Personal Data and will be owned by Provider.

2.6. Restricted Transfers. In the event the Customer and relevant Customer Personal Data is subject to GDPR, the provisions of Exhibit B apply.

3. Data Security.

3.1. Security Program. Provider will maintain commercially reasonable technical, organizational and physical measures, safeguards and policies, which are designed to help maintain the confidentiality, integrity, availability and security of Personal Data, taking into account the nature of the Processing and Personal Information available to the Provider.

3.2. Confidentiality. Provider will ensure that its Personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities, and have executed written confidentiality agreements or are otherwise subject to confidentiality obligations.

3.3. Audit.

3.3.1. Provider will promptly respond on a confidential basis and to the extent required by Applicable Data Protection Laws, to any Customer’s written requests for information about Provider’s data security and privacy practices as Provider (acting reasonably) considers appropriate to the circumstances as reasonably necessary to demonstrate its compliance with this DPA and Applicable Data Protection Laws, which responses may be at an additional cost to Customer depending on the level of effort required.

3.3.2. In the event such responses indicate a material noncompliance by Provider with the provisions of this DPA or Applicable Data Protection Laws, subject to the restrictions of this Section 3.3 and solely to the extent required by Applicable Data Protection Laws, Provider will permit Customer (or a mutually agreed third party) to perform a data security audit as Customer may reasonably request, no more than once per calendar year, to verify that Provider is complying with the requirements under this DPA and Applicable Data Protection Laws, provided Provider reserves the right to arrange instead for a qualified and independent assessor to conduct an assessment of Provider’s safeguards and policies for compliance with this DPA and Applicable Data Protection Laws using an appropriate and accepted control standard or framework and assessment procedure. If the controls or measures to be assessed in the requested audit are addressed in an SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third party auditor within twelve (12) months of Customer’s audit request and Provider has confirmed there are no known material changes in the controls audited, Customer agrees to accept such report in lieu of requesting an audit of such controls or measures.

3.3.3. Customer will give Provider reasonable notice of any audit to be conducted under this section (which shall in no event be less than fourteen (14) days’ notice) and will use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing any destruction, damage, injury or disruption to Provider’s premises, equipment, personnel, data, and business (including any interference with the confidentiality or security of the data of Provider’s other customers or the availability of Provider’s services to such other customers). Customer must submit a detailed proposed audit plan providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Provider will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Provider security, privacy, employment or other relevant policies). Provider will work cooperatively with Customer to agree on a final audit plan.

3.3.4. In any event, to the extent permitted by Applicable Data Protection Laws, any such audit will be at Customer’s cost and may not unreasonably interfere with Provider’s operations. No audit may include the confidential information of Provider or any of Provider’s other customers.

3.3.5. In the event any such audit reveals a noncompliance with Applicable Data Protection Laws that generates liability for Customer under Applicable Data Protection Laws, Customer may take reasonable and appropriate steps to ensure compliance upon reasonable advance written notice to Provider.

3.3.6. Provider need not give access to its premises for the purposes of such an audit or inspection:

3.3.6.1. to any individual unless they produce reasonable evidence of their identity;

3.3.6.2. to any auditor whom Provider has not approved in advance (acting reasonably);

3.3.6.3. to any individual who has not entered into a non-disclosure agreement with Provider on terms acceptable to Provider;

3.3.6.4. outside normal business hours at those premises; or

3.3.6.5. on more than one occasion in any calendar year during the term of the Agreement, except for any audits or inspections which Customer is required to carry out by a supervisory authority.

3.3.7. Customer will bear any third-party costs in connection with such audit or inspection and reimburse Provider for all costs incurred by Provider and time spent by Provider (at Provider’s then-current professional services rates) in connection with any such audit or inspection.

3.3.8. Nothing in this DPA requires Provider to furnish more information about its Sub-processors in connection with such audits than such Sub-processors make generally available to their customers.

4. Applicable Data Protection Laws.

4.1. Compliance with Applicable Data Protection Laws. Provider understands its obligations under Applicable Data Protection Laws and agrees to comply with all Applicable Data Protection Laws in performing the Services under the Agreement, including providing same level of protection to the Personal Data as required by Applicable Data Privacy Laws. Provider will notify Customer if it believes it can no longer meet its obligations under Applicable Data Protection Laws.

4.2. Data Subject Requests. Provider will promptly notify Customer in the event it receives any request from a Data Subject requesting to know, access, correct, transfer, delete or stop the processing of their Personal Data , or otherwise exercise any of their rights as a Data Subject or consumer under Applicable Data Protection Laws (“Data Subject Request”). Provider will not respond directly to a Data Subject Request except if required by Applicable Data Protection Laws, and will comply with Customer’s reasonable written requests for Customer to fulfil its obligations under Applicable Data Protection Laws.

4.3. Cooperation. Given the nature of the processing of Personal Data and the Services performed in the Agreement, if and as required by Applicable Data Protection Laws, Provider will, as reasonably requested by Customer, promptly provide all information, perform all acts and otherwise reasonably cooperate with Customer to assist Customer in complying with Customer's obligations under Applicable Data Privacy Laws, which may be at an additional cost to Customer to the extent permitted by Applicable Data Protection Laws.

5. Sub-processors.

5.1. Appointment of Sub-processors. Customer provides general authorization to Provider’s use of Sub-processors listed on Exhibit A to provide processing activities on Personal Data on behalf of Customer in accordance with this DPA. Provider will enter into a written agreement with each Sub-processor and, to the extent that the Sub-processor performs the same data Processing activities provided by Provider under this DPA, Provider will impose on the Sub-processor the same contractual obligations that Provider has under this DPA. Provider will remain responsible for its Subprocessors’ compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Provider to breach any of Provider’s obligations under this DPA.

5.2. Notification and Objection. Provider will notify Customer in writing at least 30 days before Provider engages a new Sub-processor. If Customer has a reasonable, good-faith objection to the new Sub-processor based on data protection concerns, Customer must notify Provider in writing within such 30-day period specifying the grounds for objection. Upon receiving such an objection, Provider will use commercially reasonable efforts to address Customer’s concerns by providing additional information or implementing reasonable safeguards. If Provider in its discretion determines that it cannot accommodate the objection, then Customer’s sole and exclusive remedy will be to terminate the affected Services for which Provider has engaged the Sub-processor. Failure to object within the 30-day period will be deemed acceptance of the new Sub-processor.

6. Data Security Incidents.

In the event that Provider or any of its Personnel become aware of an Incident, Provider will notify Customer promptly without undue delay and take appropriate measures to address the Incident, including measures to mitigate any adverse effects resulting from the Incident. Provider will reasonably assist Customer in complying with its requirements as requested in writing by Customer, taking into account the nature of the Processing and the Personal Data available to Provider.

7. LIMITATION OF LIABILITY.

Each party’s liability, in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the “Limitation of Liability” section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party under the Agreement and this DPA together.

8. Termination.

This DPA will continue in force until the termination of the Agreement. Upon the termination or expiration of the Agreement, Provider will, at the direction of Customer, delete or return all Personal Data in its possession or control as soon as practicable, unless retention of Personal Data is required by law.

9. Entire Agreement.

This Addendum is hereby incorporated into and forms part of the Agreement. If there is a conflict between the Agreement and this DPA, the terms of this DPA will prevail with respect to the subject matter hereof, including the Processing of Personal Data.

Exhibit A

Authorized Sub-processors

Snowflake
Amazon Web Services
Tolt

Exhibit B

EU Attachment

1. Processing of Customer’s Personal Data. In addition to Customer’s obligations under Section 2.2 of the DPA, Customer covenants, represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, and (where applicable) Article 9 and/or Article 10 of the GDPR, there is, and will be throughout the term of the Agreement, a valid legal basis and (where applicable) condition for the Processing by Provider of Customer Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing).

2. Sub-processing. Customer authorizes Provider to appoint Sub-processors in accordance with Section 5 of the DPA.

3. Data Protection Impact Assessment And Prior Consultation. Provider, taking into account the nature of the Processing and the information available to Provider, shall provide reasonable assistance to Customer, at Customer’s cost, with any data protection impact assessments and prior consultations with supervisory authorities which Customer reasonably considers to be required of it by Article 35 or Article 36 of the GDPR, in each case solely in relation to Processing of Customer Personal Data by Provider.

4. Restricted Transfers

4.1. Subject to Paragraph 4.2, to the extent that any Processing by either Provider or any Sub-processor of Customer Personal Data involves a Restricted Transfer, the parties agree that: Customer – as “data exporter”; and Provider – as “data importer”, shall enter into the Standard Contractual Clauses in respect of that Restricted Transfer and the associated Processing in accordance with Paragraph 4.2.

4.2. In respect of any EU Standard Contractual Clauses entered into pursuant to Paragraph 4.1:

4.2.1. The official text of the EU Standard Contractual Clauses is incorporated by reference.

4.2.2. Parties elect OPTION 2 in Clause 9 of such EU Standard Contractual Clauses.

4.2.3. Clause 17 of such EU Standard Contractual Clauses shall be populated as follows: “The Clauses shall be governed by the law of the jurisdiction in which the data exporter is established.”

4.2.4. Clause 18(b) of such EU Standard Contractual Clauses shall be populated as follows: “The Parties agree that those shall be the courts of the jurisdiction in which the data exporter is established.”

4.2.5. Appendix 1 to such EU Standard Contractual Clauses shall be populated with the corresponding information (or, in respect of Restricted Transfers to Sub-processors, the applicable subset thereof) from Annex I to Exhibit B; and

4.2.6. Appendix 2 to such EU Standard Contractual Clauses shall be populated as follows: “The technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) are those established and maintained under Section 3 of the DPA.”

4.2.7. Appendix 3 to such EU Standard Contractual Clauses shall be populated as follows: “The controller has authorised the use of the following sub-processors: All Sub-processors as listed in Exhibit A of the DPA.”

4.2.8. If Provider is authorized by Customer to subcontract any of its obligations under this Agreement, Provider will downstream these obligations by entering into an appropriate onward transfer agreement, incorporating Module 3 of the EU Standard Contractual Clauses (Processor-to-Processor) with any such subcontractor for any such disclosure.

4.3. The EU Standard Contractual Clauses shall be deemed to come into effect under Paragraph 4.1 automatically upon the commencement of the relevant Restricted Transfer. If the European Commission substitutes or modifies the relevant EU Standard Contractual Clauses, or if they are deemed invalid at any point during the term of this Agreement, then Provider agrees to promptly execute such updated EU Standard Contractual Clauses or comply with such other cross-border data transfer mechanism deemed compliant by the relevant data protection authority(ies) in order to allow Customer Personal Data to be transferred to Provider and any Affiliate or Sub-processor of Provider by Customer or its Affiliates.

ATTACHMENT 1 TO EXHIBIT B

EXPLANATORY NOTE:

It must be possible to clearly distinguish the information applicable to each transfer or category of transfers and, in this regard, to determine the respective role(s) of the Parties as data exporter(s) and/or data importer(s). This does not necessarily require completing and signing separate appendices for each transfer/category of transfers and/or contractual relationship, where this transparency can achieved through one appendix. However, where necessary to ensure sufficient clarity, separate appendices should be used.

ANNEX I

A. LIST OF PARTIES

Data exporter(s):

1. Name: _______________
Address: _______________
Contact person’s name, position and contact details: _______________
Activities relevant to the data transferred under these Clauses: Performance of the Software Services pursuant to the Agreement.
Role (controller/processor): Controller
Signature and date: _______________

Data importer(s):

1. Name: WasteNot Technologies, Inc.
Address: 2117 Kenilworth Avenue, Wilmette, IL 60091
Contact person’s name, position and contact details: John Joe Smith, CEO/Founder, johnjoe@wastenot.io
Activities relevant to the data transferred under these Clauses: Performance of the Services pursuant to the Agreement and as further described in the Documentation
Role (controller/processor): Processor
Signature and date: _______________

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred
………………………..

Categories of personal data transferred
………………………..

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
………………………..

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
…………………………

Nature of the processing
…………………………

Purpose(s) of the data transfer and further processing
………………………..

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
……………………..

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
……………………..

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority of the jurisdiction in which the data exporter is established