Last Updated: August 11, 2025

This Data Processing Agreement ("DPA") is entered into by and between Avatar First Ltd ("Provider") and the party identified as "Customer" in the Agreement ("Customer"). This DPA is incorporated into and forms an integral part of the Master SaaS and Services Agreement ("Agreement") between the parties. In the event of any conflict between the terms of the Agreement and this DPA, the terms of this DPA shall prevail with regard to the subject matter of data processing.

PART A: GENERAL DATA PROCESSING TERMS

The terms in this Part A apply to all Processing of Customer Personal Data by Provider, regardless of the geographic origin of the data.

1. Definitions

Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. In this DPA, the following terms shall have the following meanings:

• "Customer Personal Data" means any Personal Data Processed by Provider on behalf of Customer in the course of providing the Services under the Agreement.

• "Data Protection Laws" means all applicable data protection and privacy laws, including, as applicable, U.S. State Privacy Laws and European Data Protection Laws.

• "European Data Protection Laws" means the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK General Data Protection Regulation ("UK GDPR").

• "Personal Data," "Controller," "Processor," "Data Subject," and "Processing" shall have the meanings given to them in the applicable Data Protection Laws.

• "U.S. State Privacy Laws" means all applicable U.S. state-level data privacy laws, including the California Consumer Privacy Act as amended by the CPRA ("CCPA").

2. Roles, Responsibilities, and Scope

2.1 Roles. The parties acknowledge and agree that with respect to the Processing of Customer Personal Data, Customer is the Controller and Provider is the Processor.

2.2 Customer Obligations. Customer warrants that it has all necessary rights, consents, and legal bases to collect, process, and transfer the Customer Personal Data to Provider for the purposes specified in Appendix 1.

3. Provider's Core Obligations

3.1 Authorized Instructions. Provider shall Process Customer Personal Data only in accordance with Customer’s documented lawful instructions, which shall include the Agreement and this DPA.

3.2 Confidentiality. Provider shall ensure that any personnel authorized to Process Customer Personal Data are subject to strict contractual confidentiality obligations.

3.3 Security. Provider shall implement and maintain the technical and organizational measures described in Appendix 3 (Security Measures).

3.4 Subprocessor Authorization. Customer provides a general authorization for Provider to engage third-party subprocessors to provide the Services, as listed in Appendix 2 (List of Subprocessors).

4. Security Incidents and Data Subject Rights

4.1 Security Incident Notification. Provider shall notify Customer without undue delay upon becoming aware of a Personal Data Breach affecting Customer Personal Data.

4.2 General Assistance. Taking into account the nature of the Processing, Provider shall provide reasonable assistance to the Customer, at Customer's expense, to enable the Customer to respond to requests from Data Subjects seeking to exercise their rights under applicable Data Protection Laws.

5. Other Permitted Disclosures

5.1 Corporate Transactions. In the event of a merger, acquisition, or sale of substantially all of Provider's assets, Customer Personal Data may be disclosed to relevant third parties subject to appropriate confidentiality obligations.

5.2 Legal Compliance. Provider may disclose Customer Personal Data if it has a good faith belief that such disclosure is necessary to comply with a binding legal obligation or process.

6. Data Deletion

Upon termination of the Agreement, Provider will delete all Customer Personal Data from its production systems within one hundred eighty (180) days. At Customer’s written request prior to deletion, Provider will provide Customer with a final export of their data. This obligation shall not apply to backup archives, which will be securely isolated until their eventual deletion.

PART B: U.S. STATE PRIVACY LAW TERMS

The terms in this Part B apply to the Processing of Personal Data subject to U.S. State Privacy Laws.

7. Processor Obligations

7.1 Prohibitions. For the purposes of U.S. State Privacy Laws, Provider is a "Service Provider" or "Processor." Provider shall not: (a) "sell" or "share" Customer Personal Data (as those terms are defined by the CCPA); (b) retain, use, or disclose Customer Personal Data for any purpose other than for the specific business purposes specified in the Agreement; (c) retain, use, or disclose the data outside of the direct business relationship between Provider and Customer; or (d) combine Customer Personal Data with personal data received from other sources, except as permitted by law and necessary to perform the Services.

7.2 Assistance. Provider shall provide reasonable assistance to Customer to enable Customer to respond to verifiable requests from individuals under applicable U.S. State Privacy Laws.

PART C: EUROPEAN DATA PROTECTION LAW TERMS

The terms in this Part C apply only if and to the extent Customer Personal Data is subject to European Data Protection Laws.

8. Subprocessor Management

8.1 Notice and Objection. For any planned addition or replacement of a subprocessor, Provider will provide Customer with at least fifteen (15) days' prior written notice. Customer may object to a new subprocessor on reasonable data protection grounds. If the objection cannot be resolved, Customer's sole remedy shall be to terminate the Agreement. This notice period does not apply to Emergency replacements as defined in the Agreement.

8.2 Liability. Provider shall remain fully liable to Customer for the performance of a subprocessor’s data protection obligations pursuant to Article 28(4) of the GDPR.

9. Data Transfers

9.1 Transfer Mechanism. For any transfers of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of data protection, the parties agree that such transfers shall be governed by the applicable standard contractual clauses. Specifically: (a) For transfers subject to the GDPR, the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 ("EU SCCs") shall be deemed incorporated herein by reference. (b) For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office ("UK Addendum") shall be deemed incorporated herein by reference.

9.2 Transfer Assessments. The parties agree to reasonably cooperate in performing any necessary data transfer impact assessments as may be required by European Data Protection Laws.

10. Audits and Compliance

Upon Customer's reasonable written request, and no more than once annually (unless a Personal Data Breach has occurred), Provider shall make available to Customer information necessary to demonstrate compliance with its obligations under Article 28 of the GDPR. Such audits shall be conducted during normal business hours, with reasonable advance notice, at Customer's expense, and subject to a non-disclosure agreement.

Appendices

The following Appendices apply to all Services provided under this DPA.

Appendix 1: Details of Processing

(a) Categories of Data Subjects:

• Leads, prospects, clients, and potential clients of the Customer.

(b) Categories of Personal Data:

• Contact Information: Name, email address, phone number, physical address.

• Business & Project Information: Company name, job title, project requirements, budget details, property information relevant to a remodeling project.

• Communication Data: Content of email and SMS communications, call records, and notes related to interactions between the Customer and the Data Subject.

(c) Nature and Purpose of Processing:

• To provide marketing automation, client relationship management (CRM), and client acquisition services on behalf of the Customer.

• Activities include: storing and managing contact information; sending and receiving email and SMS communications for lead nurturing and appointment scheduling; facilitating and tracking customer interactions; and enabling the Customer to manage its sales pipeline and client communications.

(d) Duration of Processing:

• For the duration of the Agreement, until processing is terminated by either party in accordance with its terms.

Appendix 2: List of Subprocessors