DPA Updated Date: June 30, 2025.

This Data Processing Agreement (the “DPA”) between Cobrand and Customer is incorporated into and forms part of the Agreement between Cobrand and Customer and shall be effective on: i) the effective date of the Master Services Agreement; or ii) if Customer has entered an Agreement with Cobrand prior to the DPA updated data above, the DPA shall be effective on the DPA updated date and shall replace any previously-agreed data protection and security terms (the “Effective Date”).

1. Definitions

“Account Information” means information referring to Customer and its Authorized Users (business users) that is provided or generated as part of Customer’s account creation, use, or maintenance. For avoidance of doubt, Account Information does not include Customer Personal Data.

“Applicable Data Protection Laws” means all laws, rules, regulations, or other governmental requirements, as amended, applicable to Cobrand’s processing of Customer Personal Data.

“Customer Personal Data” means Personal Data collected by Cobrand in relation to the Agreement or otherwise on or behalf of Customer.

“GDPR” means the General Data Protection Regulation (EU) 2016/679 (the “EU GDPR”) or, where applicable, the “UK GDPR” as defined in the Data Protection Act 2018.

“Personal Data” means any information relating to an identified or identifiable individual that is processed in connection with the Services, or as similar terms are defined in Applicable Data Protection Laws.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data.

“Standard Contractual Clauses” or “SCCs” means Module Two (controller to processor) and/or Module Three (processor to processor) of the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

“Subprocessor” means third-party processors, which may include Cobrand affiliates, appointed by Cobrand to process Customer Personal Data in connection with its provision of the Services.

“UK Addendum” means the template addendum, version B.1.0 issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018.

“US Privacy Laws” means, to the extent applicable, federal and state laws relating to data protection, the Processing of Customer Personal Data, privacy and/or data protection in force from time to time in the United States.

1.2 The terms “controller”, “business”, “processor”, “data subject”, “process”, “supervisory authority” “sell”, and “service provider” shall have the same meaning as set out in the Applicable Data Protection Laws.

2. Relationship with the Agreement

2.1 This DPA supplements and (in case of contradictions) supersedes the Agreement with respect to any processing of Customer Personal Data.

3. Cobrand Processing of Personal Data

3.1 The Parties acknowledge and agree that, with regard to the processing of Customer Personal Data in connection with the Services and as between Customer and Cobrand, Customer shall act as controller or business and Cobrand shall act as processor or service provider.

3.2 Cobrand shall act as controller for Personal Data collected from its customers solely for purposes of comprising Account Information and/or securing or administering the services under the Agreement(“Cobrand Personal Data”). If Cobrand connects, enriches, or otherwise processes copies of Cobrand Personal Data in connection with Customer Personal Data, the combined data shall be considered Customer Personal Data and Cobrand shall act as processor. Cobrand shall process Cobrand Personal Data as set out in Cobrand’s privacy policy.

3.3 Cobrand shall Process Customer Personal Data only on behalf of and in strict accordance with Customer’s instructions according to the Agreement and in accordance with Cobrand’s role as processor or service provider under Applicable Data Protection Law. Cobrand shall treat Customer Personal Data as Confidential Information as defined in the Agreement. Customer instructs Cobrand to process Customer Personal Data to: i) provide the Services in accordance with the Agreement and applicable order form; and ii) as reasonably further instructed by Customer in accordance with this DPA. Cobrand shall immediately inform Customer if, in Cobrand’s reasonable opinion, an instruction by Customer would result in Cobrand processing Customer Personal Data in violation of Applicable Data Protection Law.