Data Processing Addendum

Last Updated: September 10, 2026

This Data Processing Addendum (“DPA”) forms part of the Business Services Agreement or other written agreement governing the provision of Services (the “Agreement”) between Smoov It, Inc., a Delaware corporation with a mailing address at 8415 NE 13th Street, Clyde Hill, WA 98004 (“Smoov”), and the customer identified in the Agreement (“Customer”).

This DPA applies only to the extent Smoov processes Customer Personal Data on behalf of Customer in connection with the Services.

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

If this DPA conflicts with the Agreement with respect to the processing of Customer Personal Data, this DPA controls solely to the extent of that conflict.

1. Definitions

For purposes of this DPA:

“Applicable Data Protection Law” means any law or regulation applicable to a Party’s processing of Customer Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act and its implementing regulations (“CCPA”) and other applicable U.S. state privacy laws.

Where European or United Kingdom data-protection law applies to processing under the Agreement, Applicable Data Protection Law also includes the European Union General Data Protection Regulation (“GDPR”), applicable national implementing legislation, and the United Kingdom GDPR and Data Protection Act 2018, as applicable.

“Customer Personal Data” means personal information, personal data, or similar regulated information contained within Customer Data that Smoov processes solely on behalf of Customer in connection with the Services.

“Data Subject” means an identified or identifiable individual to whom Customer Personal Data relates.

“Process” or “Processing” has the meaning assigned under Applicable Data Protection Law and includes collecting, accessing, using, storing, transmitting, analyzing, disclosing, deleting, or otherwise handling Customer Personal Data.

“Security Incident” means a confirmed unauthorized acquisition of, access to, use of, disclosure of, alteration of, or destruction of Customer Personal Data in Smoov’s possession or control that compromises the confidentiality, integrity, or availability of Customer Personal Data.

A Security Incident does not include unsuccessful attempts or activities that do not result in unauthorized access to Customer Personal Data, such as unsuccessful login attempts, port scans, pings, denial-of-service attempts, or similar unsuccessful attacks.

“Subprocessor” means a third party engaged by Smoov to Process Customer Personal Data on behalf of Customer in connection with the Services.

Terms such as “business,” “controller,” “contractor,” “consumer,” “processor,” “service provider,” “sell,” and “share” have the meanings assigned under the Applicable Data Protection Law governing the relevant Processing.

2. Roles of the Parties

With respect to Customer Personal Data processed solely on Customer’s behalf:

• Customer is the business or controller, as applicable; and
• Smoov is the service provider, contractor, or processor, as applicable.

Customer determines the purposes for which Customer Personal Data is submitted to Smoov and is responsible for ensuring that its instructions comply with Applicable Data Protection Law.

Smoov will Process Customer Personal Data only in accordance with:

1. Customer’s documented instructions;
2. the Agreement and this DPA;
3. use of the Services as configured or authorized by Customer; and
4. Applicable Data Protection Law.

If Smoov is required by law to Process Customer Personal Data other than according to Customer’s instructions, Smoov may do so and, where legally permitted, will notify Customer of that requirement.

3. Scope of Customer Personal Data; Independent Smoov Processing

This DPA applies only where Smoov Processes personal information solely on behalf of Customer.

For clarity, this DPA does not convert all information associated with a Smoov user, participant, connector, relationship, or interaction into Customer Personal Data.

3.1 Customer Personal Data

Customer Personal Data may include personal information contained in business, contact, event, or related information that Customer submits for Smoov to Process solely on Customer’s behalf.

Smoov will not use raw identifiable Customer Personal Data supplied under this processor relationship to perform services on behalf of an unrelated customer except where expressly permitted by Applicable Data Protection Law.

3.2 Information Provided Directly to Smoov

This DPA does not govern personal information an individual independently provides directly to Smoov where Smoov determines the purposes and means of that Processing in its own capacity.

Such information may include an individual’s account information, professional profile, participation information, or other information the individual provides directly to Smoov.

Smoov processes such information according to the Smoov Privacy Policy and Applicable Data Protection Law.

3.3 Authorized Workflows

Nothing in this DPA prevents Smoov from using or disclosing Customer Personal Data as reasonably necessary to perform a workflow that Customer specifically requests or authorizes.

For example, where Customer asks Smoov to facilitate a requested introduction or event, Smoov may communicate information reasonably necessary to authorized participants helping fulfill that request.

Such activity remains Processing on Customer’s behalf where applicable.

3.4 Derived and De-Identified Information

To the extent information derived solely from Customer Personal Data remains personal information and is Processed by Smoov solely on Customer’s behalf, it remains subject to this DPA.

Information that has been lawfully aggregated or de-identified so that it no longer constitutes personal information under Applicable Data Protection Law is not Customer Personal Data for purposes of this DPA.

Nothing in this DPA restricts Smoov from using such lawfully aggregated or de-identified information as permitted by the Agreement and Applicable Data Protection Law.

For avoidance of doubt, Smoov will not characterize identifiable Customer Personal Data as “Derived Data” merely to avoid the protections of this DPA.

4. Specific Processing Purposes

Customer instructs Smoov to Process Customer Personal Data only as reasonably necessary for the following specific business purposes, as applicable to the Services Customer purchases or enables:

1. Account Administration — creating, authenticating, maintaining, and supporting Customer and Authorized User accounts;
2. Provision of the Services — providing the products and services Customer purchases or enables;
3. Requested Workflows — facilitating Customer-requested introductions, invitations, events, meetings, or other professional interactions;
4. Communications — sending or facilitating Customer-authorized communications;
5. Authorized Integrations — Processing information through integrations Customer authorizes;
6. Customer Support — diagnosing issues, responding to support requests, and maintaining the Services;
7. Security and Abuse Prevention — authenticating users, securing the Services, detecting fraud or misuse, investigating Security Incidents, and protecting Smoov, Customer, and users; and
8. Service Quality and Improvement — internally analyzing use of the Services to maintain and improve the quality, reliability, security, and functionality of the Services provided to Customer, only to the extent permitted by Applicable Data Protection Law.

Customer discloses Customer Personal Data to Smoov solely for these limited and specified purposes and any other purpose expressly documented by Customer and accepted by Smoov in writing.

5. Processing Restrictions

Smoov will not:

1. sell Customer Personal Data as defined by Applicable Data Protection Law;
2. share Customer Personal Data for cross-context behavioral advertising as defined by Applicable Data Protection Law;
3. retain, use, or disclose Customer Personal Data for purposes other than the specific business purposes described in Section 4, Customer’s documented instructions, or purposes otherwise expressly permitted by Applicable Data Protection Law;
4. retain, use, or disclose Customer Personal Data outside the direct business relationship between Smoov and Customer except where expressly permitted by Applicable Data Protection Law;
5. use raw identifiable Customer Personal Data supplied by Customer to perform services on behalf of an unrelated customer except as expressly permitted by Applicable Data Protection Law;
6. combine Customer Personal Data with personal information Smoov receives from another person or collects from its independent interaction with a Data Subject where such combination is prohibited by Applicable Data Protection Law;
7. attempt to re-identify information that has been validly de-identified where prohibited by Applicable Data Protection Law; or
8. Process Customer Personal Data in a manner materially inconsistent with Customer’s documented lawful instructions.

Nothing in this Section prohibits Processing reasonably necessary to detect or prevent fraud, abuse, malicious activity, or security incidents, or other Processing expressly permitted under Applicable Data Protection Law.

6. Compliance with Applicable Data Protection Law

Smoov will:

• comply with Applicable Data Protection Law applicable to Smoov’s role as a processor, service provider, or contractor;
• provide Customer Personal Data with the level of privacy protection required of Smoov under Applicable Data Protection Law;
• notify Customer if Smoov determines it can no longer meet a material obligation applicable to Smoov under this DPA or Applicable Data Protection Law; and
• reasonably cooperate with Customer where legally required to allow Customer to take appropriate steps to stop and remediate unauthorized Processing.

Nothing in this DPA requires Smoov to comply with obligations legally applicable only to Customer in Customer’s capacity as controller or business.

7. Customer Obligations

Customer represents, warrants, and covenants that:

1. Customer has provided all notices and obtained all rights, permissions, authorizations, consents, or other lawful bases necessary for Smoov to Process Customer Personal Data as contemplated by the Agreement and this DPA;
2. Customer’s instructions to Smoov comply with Applicable Data Protection Law;
3. Customer will not provide Customer Personal Data that the Services are not designed or authorized to Process;
4. unless separately agreed in writing, Customer will not submit:
   • protected health information governed by HIPAA;
   • Social Security numbers;
   • government-issued identity-document numbers;
   • payment-card credentials outside Smoov’s authorized payment flow;
   • financial-account credentials;
   • biometric identifiers;
   • precise geolocation;
   • information concerning children;
   • or other specially regulated or highly sensitive information unnecessary for the Services;
5. Customer is responsible for the accuracy, quality, and lawfulness of Customer Personal Data and the means by which Customer acquired it; and
6. Customer will not instruct Smoov to contact or Process information concerning an individual where Customer knows such Processing would violate that individual’s legally enforceable privacy or communication preference.

Smoov is not responsible for determining whether Customer had an adequate lawful basis for Customer’s original collection of Customer Personal Data except to the extent Applicable Data Protection Law expressly imposes that responsibility on Smoov.

8. Confidentiality

Smoov will ensure that personnel authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations.

Smoov will limit personnel access to Customer Personal Data to persons whose access is reasonably necessary to provide, maintain, secure, or support the Services or otherwise perform Smoov’s obligations.

The confidentiality provisions of the Agreement also apply to Customer Personal Data.

9. Security

Smoov will maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Personal Data against unauthorized access, acquisition, disclosure, alteration, destruction, or loss.

Smoov’s technical safeguards include encryption of data in transit and at rest, and authentication and access controls designed to restrict access to authorized use.

Smoov may update its security measures over time provided that such changes do not materially decrease the overall level of protection afforded to Customer Personal Data.

No security measure eliminates all risk, and this DPA does not constitute a representation that a Security Incident can never occur.

Additional security terms agreed in writing between the Parties will control if they conflict with this Section.

10. Security Incidents

Smoov will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data where notification is required by Applicable Data Protection Law or this DPA.

To the extent reasonably available and applicable, notice will include:

• the nature of the Security Incident;
• categories of Customer Personal Data affected;
• categories of affected Data Subjects;
• known or reasonably anticipated consequences;
• measures taken or planned to investigate, contain, remediate, or mitigate the Security Incident; and
• a Smoov contact for reasonable follow-up.

Smoov may provide information in phases as facts become available.

Notification of a Security Incident is not an admission of fault, liability, or violation of law.

Smoov will take commercially reasonable measures to contain, investigate, remediate, and mitigate a Security Incident within its control.

Customer is responsible for determining whether Customer must notify regulators, Data Subjects, or other third parties unless Applicable Data Protection Law expressly assigns that obligation to Smoov.

Unsuccessful attempts that do not result in unauthorized access to Customer Personal Data are not Security Incidents requiring individual notification.

11. Data Subject and Consumer Requests

Taking into account the nature of the Processing, Smoov will provide reasonable assistance to Customer where Customer cannot reasonably fulfill a legally valid Data Subject request without Smoov’s assistance.

This may include requests to:

• access or know;
• correct;
• delete;
• obtain a portable copy of;
• restrict or object to Processing of; or
• otherwise exercise rights concerning Customer Personal Data,

to the extent required by Applicable Data Protection Law.

If Smoov receives a request directly from a Data Subject concerning Customer Personal Data Smoov processes solely on Customer’s behalf, Smoov may:

1. direct the Data Subject to Customer;
2. notify or forward the request to Customer; or
3. act according to Customer’s documented instructions,

as permitted or required by Applicable Data Protection Law.

Smoov will not independently respond to the substance of a request concerning Customer Personal Data except where Customer authorizes it or law requires Smoov to do so.

Customer remains responsible for evaluating the validity of requests and providing legally required responses in its capacity as business or controller.

12. Deletion and Return

During the term, Smoov will delete Customer Personal Data in response to Customer’s valid documented deletion instruction where required under the Agreement or Applicable Data Protection Law.

Following termination or expiration of the applicable Services, Customer may request return or deletion of Customer Personal Data.

Unless retention is required or permitted by Applicable Data Protection Law, Smoov will permanently delete applicable Customer Personal Data from its active systems promptly and in any event within thirty (30) days after an applicable valid deletion request or expiration of any agreed data-export period.

Residual copies may temporarily remain where:

• maintained in secure backup or disaster-recovery systems;
• retained by a Subprocessor through its ordinary deletion or retention cycle;
• required for legal, tax, accounting, fraud-prevention, security, or dispute-resolution purposes; or
• deletion is not technically immediate despite reasonable deletion measures.

Any retained Customer Personal Data remains protected under this DPA and will not be used for another purpose except as legally permitted.

Smoov may retain information that has been lawfully aggregated or de-identified so that it no longer constitutes personal information under Applicable Data Protection Law.

13. Subprocessors

Customer grants Smoov general authorization to engage Subprocessors to Process Customer Personal Data as reasonably necessary to provide the Services.

Smoov will enter into written agreements with Subprocessors requiring data-protection obligations applicable to the relevant Processing that are materially consistent with Smoov’s obligations under this DPA and Applicable Data Protection Law.

Smoov remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law and this DPA.

Categories of Subprocessors used to provide the Services are identified in Annex C. Smoov will make a current list of Subprocessors available to Customer upon request.

Changes to Subprocessors

Smoov may add or replace Subprocessors.

Where required by Applicable Data Protection Law or an applicable enterprise agreement, Smoov will provide reasonable notice of a new Subprocessor that will materially Process Customer Personal Data.

Customer may object in writing on reasonable, documented data-protection grounds within ten (10) business days after receiving such notice.

The Parties will work in good faith to resolve the objection.

If they cannot reasonably resolve it, Smoov may:

• modify the affected Processing;
• provide a commercially reasonable alternative;
• elect not to use the proposed Subprocessor for Customer; or
• permit Customer to terminate only the affected portion of the Services.

Such termination will be Customer’s exclusive remedy for an unresolved good-faith Subprocessor objection unless Applicable Data Protection Law requires otherwise.

14. Audits, Verification, and Regulatory Cooperation

Smoov will make available information reasonably necessary to demonstrate its compliance with this DPA and Applicable Data Protection Law applicable to its role as processor, service provider, or contractor.

Customer may take reasonable and appropriate steps to verify Smoov’s Processing of Customer Personal Data, subject to the protections below.

Except following a material Security Incident involving Customer Personal Data, a regulator request, or where Applicable Data Protection Law requires more frequent review:

• Customer may exercise formal audit rights no more than once in any twelve-month period;
• Customer must provide at least thirty (30) days’ prior written notice;
• audits must occur during normal business hours;
• audits must be reasonably scoped to Customer Personal Data and Smoov’s obligations under this DPA;
• Customer and any auditor must comply with reasonable confidentiality and security requirements;
• an auditor may not be a direct competitor of Smoov;
• an audit must not materially interfere with Smoov’s operations or compromise another customer’s confidentiality or system security; and
• Customer bears its own audit costs unless Applicable Data Protection Law expressly requires otherwise.

Where reasonable, Smoov may satisfy an audit request first by providing then-available security documentation, questionnaires, certifications, summaries of independent assessments, policies, or other appropriate materials.

If such information is legally insufficient for Customer’s required verification, the Parties will cooperate on additional reasonable verification measures.

Smoov will also provide reasonable cooperation concerning Customer cybersecurity audits, privacy risk assessments, or similar legally required assessments to the extent required by Applicable Data Protection Law and relevant to Smoov’s Processing of Customer Personal Data.

15. Unauthorized Processing and Remediation

If Customer reasonably believes Smoov is Processing Customer Personal Data in material violation of this DPA or Applicable Data Protection Law, Customer will notify Smoov with reasonably sufficient detail.

Smoov will investigate the allegation and, if unauthorized Processing is confirmed, take reasonable and appropriate steps to stop and remediate the unauthorized Processing.

Where reasonably necessary to demonstrate remediation, Smoov will provide appropriate documentation confirming that the identified unauthorized Processing has ceased.

Nothing in this Section gives Customer access to information belonging to another customer or requires Smoov to compromise the security or confidentiality of its systems.

16. Government and Legal Requests

If Smoov receives a legally binding government, regulatory, or law-enforcement request specifically seeking Customer Personal Data, Smoov may disclose information as required by law.

To the extent legally permitted, Smoov will notify Customer before disclosure so that Customer may seek protective treatment or other appropriate relief.

Smoov will disclose only Customer Personal Data reasonably responsive to the legally binding request.

Nothing requires Smoov to challenge a lawful request or incur material legal expense on Customer’s behalf unless separately agreed.

17. Privacy Risk Assessments and Automated Processing

To the extent Applicable Data Protection Law requires Customer to conduct a privacy risk assessment, cybersecurity audit, or assessment concerning automated processing relating to Smoov’s Processing of Customer Personal Data, Smoov will provide reasonable information within its possession necessary for Customer to complete that assessment.

Customer remains responsible for determining whether Customer’s use of the Services constitutes processing subject to a particular assessment, notice, opt-out, or other legal requirement.

Nothing in the Services authorizes Customer to use Smoov to make legally regulated decisions concerning employment, credit, housing, healthcare, insurance, education, or another legally significant decision unless Smoov has expressly agreed in writing that the Services support such use.

18. International Data Transfers

Smoov is based in the United States and may Process Customer Personal Data in the United States and other locations in which authorized Subprocessors operate.

If Applicable Data Protection Law requires a legally recognized transfer mechanism for a transfer of Customer Personal Data, the Parties will cooperate in good faith to implement the applicable mechanism.

If the GDPR or UK GDPR applies and the relevant transfer requires Standard Contractual Clauses, the Parties will enter into or incorporate the then-applicable Standard Contractual Clauses, UK International Data Transfer Addendum, or other legally recognized mechanism appropriate to the Parties’ roles and transfer.

Smoov will not represent that a particular international transfer mechanism applies where the underlying Processing does not require it.

19. Liability

Each Party’s liability arising from or relating to this DPA is subject to the exclusions and limitations of liability contained in the Agreement.

This DPA does not independently create an additional or separate liability cap.

Multiple claims under the Agreement and this DPA do not create multiple aggregate liability caps unless an Order Form expressly provides otherwise.

Nothing in this Section limits liability to the extent such limitation is prohibited by Applicable Data Protection Law.

20. Term

This DPA becomes effective when the Agreement becomes effective and remains in force for as long as Smoov Processes Customer Personal Data subject to this DPA.

Sections that must survive to protect Customer Personal Data or give effect to deletion, confidentiality, liability, and other post-termination obligations will survive for as long as necessary.

21. Changes in Law

If a change in Applicable Data Protection Law requires amendment of this DPA, the Parties will cooperate in good faith to make changes reasonably necessary to maintain compliance.

Neither Party is required to accept amendments unrelated to the legal change.

22. Contact

Privacy and data-protection notices under this DPA may be directed to:

Smoov It, Inc.
8415 NE 13th Street
Clyde Hill, WA 98004
United States

Email: info@smoov.co

ANNEX A — Details of Processing

Subject Matter

Processing of Customer Personal Data as necessary to provide the relationship-infrastructure Services purchased or enabled by Customer.

Duration

For the term of the applicable Services and any limited period afterward reasonably necessary to return, export, delete, secure, or legally retain Customer Personal Data as described in the Agreement and this DPA.

Nature and Purpose of Processing

Processing may include hosting, storing, authenticating, communicating, supporting, securing, and otherwise handling Customer Personal Data as reasonably necessary to provide the Services Customer purchases or enables, including Customer-requested workflows and authorized integrations, as permitted by Applicable Data Protection Law.

Categories of Data Subjects

Depending on Customer’s use of the Services, Data Subjects may include Customer personnel, professional contacts, event participants, and other individuals whose information Customer lawfully submits.

Categories of Customer Personal Data

Depending on Customer’s use, Customer Personal Data may include professional contact information, account information, participation information, communications, and other professional information Customer lawfully submits through the Services.

Sensitive Personal Data

The Services are not designed for Customer to submit sensitive personal information unnecessary to professional relationship workflows, including Social Security numbers, financial-account credentials, government identification numbers, medical records, biometric data, or precise geolocation, unless expressly agreed by Smoov in writing.

Frequency

Continuous or intermittent according to Customer’s use of the Services during the applicable term.

ANNEX B — Security Measures

Smoov maintains safeguards designed to protect Customer Personal Data proportionate to the Services and risks presented by Processing.

Current measures include:

Encryption

Customer Personal Data is encrypted in transit and at rest.

Authentication

Smoov uses authentication and access controls designed to restrict access to authorized use.

Access and Confidentiality

Access to Customer Personal Data is limited to authorized use in connection with providing, maintaining, supporting, or securing the Services.

Personnel authorized to Process Customer Personal Data are subject to confidentiality obligations.

Infrastructure Security

Smoov uses service providers to operate and protect the Services.

Security Incident Response

Smoov maintains processes designed to investigate, contain, remediate, and respond to confirmed unauthorized access to Customer Personal Data.

Data Deletion

Smoov supports deletion of Customer Personal Data from active systems in accordance with the DPA, subject to narrow legal, security, backup, and service-provider retention exceptions.

Subprocessor Management

Smoov evaluates and engages third-party service providers necessary to operate the Services and contractually requires appropriate data-protection obligations where those providers Process Customer Personal Data on Smoov’s behalf.

Smoov may modify its technical and organizational measures as its infrastructure evolves, provided that it will not materially reduce the overall protection of Customer Personal Data during an applicable Services term.

ANNEX C — Categories of Subprocessors

Smoov may engage Subprocessors in the following categories as reasonably necessary to provide the Services. A provider is a “Subprocessor” under this DPA only to the extent it Processes Customer Personal Data on Smoov’s behalf.

Smoov will make a current list of Subprocessors available to Customer upon request.

Third-party providers may independently process certain information in their own capacity where their services require it. Such independent processing is governed by the applicable provider’s legal terms and Applicable Data Protection Law.