Customer Data Processing Addendum

CUSTOMER DATA PROCESSING ADDENDUM

This Customer Data Processing Addendum (including its exhibits and appendices, the “Addendum”) is entered into between Market4Play (as defined below) and the entity accepting this Addendum (“Customer”) (each a “Party,” together the “Parties”) and forms part of the Customer’s agreement governing use of the Services (the “Agreement”).

Effective as of the effective date of the Agreement (the “Effective Date”), this Addendum is incorporated into and made part of the Agreement. If there is any conflict between the Agreement and this Addendum, this Addendum controls to the extent of the conflict. Where applicable, the Standard Contractual Clauses (defined below) control over any inconsistent term of this Addendum.

Except as otherwise defined here, capitalized terms have the meanings given in the Agreement.

Definitions

For purposes of this Addendum:

1.1 Account

means any accounts or instances created by or on behalf of Customer (or its Affiliates) within the Services.

1.2 Affiliate

means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party.

1.3 Applicable Data Protection Laws

means all data protection and privacy laws and regulations applicable to the Processing of Customer Personal Data, including those listed in Exhibit B (as applicable and as updated over time).

1.4 Contracted Processor

means any third party appointed by or on behalf of Market4Play to Process Customer Personal Data in connection with the Services.

1.5 Customer Personal Data

means Personal Data contained within Customer Data that Market4Play Processes on behalf of Customer to provide the Services under the Agreement. Customer Personal Data does not include Customer’s account administration information (e.g., billing and administrative contact data) that Market4Play Processes as a controller.

1.6 Data Exporter” and “Data Importer

have the meanings assigned in Exhibit A.

1.7 GDPR

means the EU GDPR and/or UK GDPR (as applicable), as defined in Exhibit B.

1.8 Jurisdiction Specific Terms

means additional terms that apply to the extent Customer Personal Data is protected by Applicable Data Protection Laws in the jurisdictions identified in Exhibit B.

1.9 Restricted Transfer

means a transfer of Customer Personal Data to a “third country” or international organization where an approved transfer mechanism is required under Applicable Data Protection Laws.

1.10 SCCs” / “Standard Contractual Clauses

means the standard contractual clauses approved or adopted by the relevant authority for Restricted Transfers, as described in Exhibit B.

1.11 Services

means the services and related activities provided by Market4Play under the Agreement in connection with Customer’s Account (including platform features, communications tooling, automation, analytics, and support services). Services exclude any processing where Market4Play acts as an independent controller (for example, operating its public website, sales inquiries, and general account administration).

1.12 Sub-Processor

means a processor engaged by Market4Play (a processor) to Process Customer Personal Data (i.e., a direct processor of a processor). For clarity, Contracted Processors are Sub-Processors.

Terms such as “Controller,” “Processor,” “Processing,” “Personal Data,” “Personal Data Breach,” and related terms have the meanings given under Applicable Data Protection Laws.

Scope and Applicability

2.1 Duration

This Addendum begins on the Effective Date and remains in effect for as long as Market4Play Processes Customer Personal Data under the Agreement.

2.2 Scope

This Addendum applies to the Processing of Customer Personal Data by Market4Play on behalf of Customer. Processing of Personal Data outside this scope is not governed by this Addendum.

2.3 Exhibits and Appendices

This Addendum includes:

Exhibit A — Details of Processing
Appendix I to Exhibit A — Technical & Organizational Measures (TOMs)
Exhibit B — Jurisdiction Specific Terms
Appendix I to Exhibit B — Supplemental Clauses to SCCs (if applicable)

Roles and Instructions

3.1 Roles

Market4Play acts as a Processor of Customer Personal Data. Customer acts as the Controller (or, where applicable, a Processor to its own customers, with Market4Play acting as a Sub-Processor).

3.2 Market4Play Commitments

Market4Play will:

a) comply with Applicable Data Protection Laws when Processing Customer Personal Data;
b) Process Customer Personal Data only on Customer’s documented instructions (including instructions embodied in the Agreement and this Addendum), to provide and improve the Services;
c) notify Customer if Market4Play reasonably believes Customer’s instruction violates Applicable Data Protection Laws.

3.3 International Processing

Customer authorizes Market4Play and its Sub-Processors to Process and transfer Customer Personal Data globally as necessary to provide the Services, subject to approved transfer mechanisms where required.

Personnel and Confidentiality

Market4Play will take reasonable steps to ensure that personnel with access to Customer Personal Data:

are reliable and appropriately trained;
have access limited to what is necessary (least privilege); and
are bound by confidentiality obligations.

Security of Processing

Market4Play will implement and maintain appropriate administrative, technical, and organizational security measures consistent with Appendix I to Exhibit A, taking into account the nature of the Processing, risks to individuals, state of the art, and implementation costs.

Sub-Processors

6.1 Authorization

Customer authorizes Market4Play to use Sub-Processors to provide the Services, including those listed on Market4Play’s Subprocessors page.

6.2 Changes and Notice

Market4Play will provide notice of material Sub-Processor changes as required by Applicable Data Protection Laws and will maintain an updated list.

6.3 Objection

Customer may object to a new Sub-Processor by written notice within 30 days of notice, identifying the Sub-Processor and stating a reasonable basis. The Parties will work in good faith to find a commercially reasonable solution. If no solution is available, Customer may terminate the affected Services upon written notice, and Market4Play will stop Processing Customer Personal Data for those terminated Services.

6.4 Flow-Down Terms

Market4Play will require Sub-Processors to protect Customer Personal Data with terms providing at least the level of protection in this Addendum, appropriate to the services provided.

6.5 Liability

Market4Play remains responsible for its Sub-Processors’ performance of their data protection obligations to the extent required by Applicable Data Protection Laws.

Data Subject Requests

Taking into account the nature of the Processing, Market4Play will assist Customer with reasonable technical and organizational measures to respond to Data Subject requests (access, deletion, correction, portability, etc.) under Applicable Data Protection Laws.

If Market4Play receives a Data Subject request relating to Customer Personal Data, Market4Play will:

notify Customer promptly;
not respond unless instructed by Customer or required by law; and
comply with Customer’s lawful instructions regarding the request.

Personal Data Breaches

8.1 Notification

Market4Play remains responsible for its Sub-Processors’ performance of their data protection obligations to the extent required by Applicable Data Protection Laws.

contain and mitigate the incident; and
notify Customer without undue delay and, where feasible, within 72 hours of awareness.

8.2 Information and Assistance

Market4Play remains responsible for its Sub-Processors’ performance of their data protection obligations to the extent required by Applicable Data Protection Laws.

Market4Play will provide information reasonably necessary for Customer to meet breach-notification obligations, including:

nature of breach;
categories/approximate number of affected individuals/records (where feasible);
likely consequences;
measures taken or proposed

8.3 No Admission

Notification does not constitute an admission of fault or liability.

Assessments and Prior Consultation

Where required by Applicable Data Protection Laws, Market4Play will provide information reasonably needed to support Customer’s DPIAs (Data Protection Impact Assessments) or prior consultations—limited to Market4Play’s Processing of Customer Personal Data and information available to Market4Play.

Deletion or Return of Customer Personal Data

Upon Customer’s request and consistent with how the Services function, Market4Play will provide reasonable means to delete or return Customer Personal Data after termination/expiration of the Services, except where retention is required by law.

Backup archives are excluded from immediate deletion, provided they are securely isolated and protected from further Processing except as required by law.

Audit Rights

Market4Play will make available information reasonably necessary to demonstrate compliance with this Addendum and will allow audits/inspections as required by Applicable Data Protection Laws, subject to:

reasonable advance notice;
confidentiality;
minimal disruption; and
reimbursement of reasonable costs/time at Market4Play’s then-current professional services rates where legally permitted.

Jurisdiction Specific Terms

Where Customer Personal Data is subject to jurisdiction-specific requirements listed in Exhibit B, those additional terms apply.

Restricted Transfers

Restricted Transfers will be conducted using an approved transfer mechanism (e.g., SCCs, UK Addendum, adequacy decisions, or other lawful mechanisms) as described in Exhibit B.

If authorities adopt updated SCCs, the Parties agree those may replace prior SCCs where applicable, and Market4Play may update Exhibits to reflect the change.

No Sale of Customer Personal Data

Market4Play does not receive Customer Personal Data as “consideration” for Services in a way that constitutes a “sale” under Applicable Data Protection Laws. Customer retains all rights in Customer Personal Data. Market4Play will not take actions that cause Processing under this Addendum to be characterized as selling Customer Personal Data.

Updates and Online Hosting

Market4Play may host and update exhibits/appendices online, provided Customer receives notice where required. If Customer objects within 14 days of notice (where this mechanism applies), the Parties will work in good faith to resolve. If unresolved, Customer may terminate affected Services.

If a hosted exhibit/appendix is designated as controlling, the online version will govern.

Liability

Each Party’s liability under this Addendum is subject to the limitations and exclusions in the Agreement, except where prohibited by Applicable Data Protection Laws.

General Terms

Notice / Contacts:

The Parties will use the contacts listed in Exhibit A for privacy, security, and breach communications.

Entire Agreement (DPA): This Addendum supersedes any prior data processing addendum between the Parties related to the Services.

Review. The Parties will review this Addendum periodically and when Processing materially changes.

Severability. If any provision is unenforceable, the remainder remains effective, and the invalid provision is replaced by an enforceable one that best matches the original intent.

Non-Compliance. If Market4Play can no longer meet obligations under this Addendum or required transfer mechanisms, Market4Play will promptly notify Customer and, if requested, cease Processing or take reasonable remedial steps.

Authority. The individual accepting this Addendum represents they have authority to bind the relevant Party.

Regulatory Disclosure. Either Party may disclose this Addendum to regulators where required.

Exhibit B — DETAILS OF PROCESSING

A. List of Parties

Name and Address:

Data Importer (Processor): Market4Play

Mailing Address: 1603 Capitol Ave. Suite 310, Cheyenne, Wyoming 82001

Support Phone: (833) 712-7529

Data Exporter (Controller): Customer

Activities Relevant to Processing:

Processing necessary to provide the Services (including collecting, storing, organizing, transmitting, contacting, and managing Customer Personal Data) for lead capture, communications, appointment booking, marketing automation, reporting, and customer relationship workflows—consistent with the Agreement.

Roles:

Customer is Controller; Market4Play is Processor; or

Customer is Processor; Market4Play is Sub-Processor (as applicable)

B. Details of Processing

Subject Matter:

Provision of Services under the Agreement.

Nature and Purpose:

Processing Customer Personal Data to deliver the Services per Customer’s instructions.
Duration: For the term Customer uses the Services and as otherwise described in the Agreement and this Addendum.

Duration:

For the term Customer uses the Services and as otherwise described in the Agreement and this Addendum.

Categories of Data Subjects:

Customer’s leads, prospects, clients, employees/contractors (as applicable), and end users submitted by Customer.

Categories of Personal Data:

Contact details, communications metadata/content, appointment data, form/survey responses, CRM notes, and other data Customer submits into the Services.

Special Categories:

Not intended/expected unless Customer explicitly requests and the Parties implement appropriate safeguards.

APPENDIX I TO EXHIBIT A — TECHNICAL & ORGANIZATIONAL MEASURES (TOMs)

Market4Play maintains a security program designed to be “simple to use, hard to break, and built to scale” (without being cute about it). At minimum, Market4Play will implement measures such as:

Encryption in transit (TLS 1.2+) and encryption at rest where supported
Access controls (role-based access, least privilege, MFA where available)
Monitoring/alerting for availability and suspicious activity
Vulnerability management (patching, scanning, periodic testing)
Logging/audit trails for administrative actions
Backup and recovery procedures appropriate to the Services
Sub-Processor due diligence and contractual security obligations

EXHIBIT B — JURISDICTION SPECIFIC TERMS

This Exhibit applies only to the extent the relevant Applicable Data Protection Laws govern the Processing of Customer Personal Data.

Include the jurisdictions you actually support/need (commonly: EEA, UK, Switzerland, U.S. state privacy laws, Canada, Australia, Brazil), and specify the transfer mechanism order of precedence for each.

APPENDIX I TO EXHIBIT B — SUPPLEMENTAL SCC CLAUSES

If you rely on SCCs and want Schrems II-style supplemental commitments (request scrutiny, narrow disclosure, transparency), you can include an exhibit like the one you pasted—just ensure it matches your actual operational reality (no “we’ve never received orders” promises unless you’re comfortable standing behind them).