TALENTSPLIT DATA PROCESSING AGREEMENT

Important Notes

• This Data Processing Agreement (“DPA”) supplements the TalentSplit Master Services Agreement (“MSA”) and governs the processing of Personal Data by TalentSplit, Inc. (“Provider”) on behalf of Client.
• This DPA is incorporated by reference into each website purchase and each Service Order. The version of this DPA in effect at the time of acceptance (date of purchase for website purchases, or date of execution for Service Orders) governs that engagement.
• Capitalized terms not defined in this DPA have the meanings given in the MSA.

Last Updated: June 23, 2026, Version: 1.0

1. DEFINITIONS

   • “Personal Data” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined under applicable privacy laws. Personal Data is a subset of Client data as referenced in the MSA.
   • “Personal Information” has the meaning given under the California Consumer Privacy Act and California Privacy Rights Act and is treated as a subset of Personal Data under this DPA.
   • “Processing” means any operation performed on Personal Data, including collection, recording, organization, storage, use, disclosure, transmission, or deletion.
   • “Sub-Processor” means any third party engaged by Provider to process Personal Data on behalf of Client.
   • “Security Incident” means any actual or reasonably suspected unauthorized access to, acquisition of, or disclosure of Personal Data.
   • “Applicable Privacy Laws” means the California Consumer Privacy Act and California Privacy Rights Act (“CCPA/CPRA”) and any other privacy laws applicable to a specific engagement.

2. SCOPE AND APPLICABILITY

   • This DPA applies to all Personal Data Processed by Provider on behalf of Client under any Service.
   • For purposes of Applicable Privacy Laws, Provider acts as a service provider (under CCPA/CPRA) or processor (under other Applicable Privacy Laws) and Processes Personal Data only on Client’s documented instructions, including as set forth in the MSA, the applicable product description, or the Service Order.
   • If a specific engagement involves data subjects located in the European Union or United Kingdom, the Parties will execute Standard Contractual Clauses or equivalent transfer mechanisms as an addendum to this DPA.

3. DATA PROCESSING DETAILS

   • The categories of Personal Data Processed, the categories of data subjects, the nature and purpose of Processing, and the duration of Processing for each Service are set forth in Schedule 1 to this DPA.
   • Provider will not Process Personal Data for any purpose other than the performance of the Services and as instructed by Client in writing.

4. PROVIDER OBLIGATIONS

   • Provider will maintain the confidentiality of all Personal Data and will ensure that all Provider personnel authorized to Process Personal Data are bound by appropriate confidentiality obligations.
   • Provider will implement and maintain reasonable security measures consistent with industry standards to protect Personal Data, including those security measures specified in the MSA.
   • Provider will assist Client, taking into account the nature of the Processing, in fulfilling Client’s obligations to respond to data subject rights requests and to demonstrate compliance with Applicable Privacy Laws.
   • Provider will Process Personal Data only on Client’s documented instructions, except where required by applicable law, in which case Provider will inform Client of that legal requirement before Processing unless prohibited by law.

5. CCPA SERVICE PROVIDER COMMITMENTS

   • Provider will not sell or share Personal Information as those terms are defined under the CCPA/CPRA.
   • Provider will not retain, use, or disclose Personal Information outside the direct business relationship between Provider and Client, or for any commercial purpose other than the performance of the Services specified in the MSA, the applicable product description, or the Service Order.
   • Provider will not combine Personal Information received from or on behalf of Client with Personal Information received from any other source, except as permitted by the CCPA/CPRA.
   • Provider certifies that it understands and will comply with the obligations set forth in this Section 5.

6. SUB-PROCESSORS

   • Client authorizes Provider to engage the Sub-Processors listed in Schedule 2 to process Personal Data in connection with the Services.
   • Provider will impose data protection obligations on each Sub-Processor that are no less protective than those set forth in this DPA.
   • Provider will give Client at least thirty (30) days’ notice before engaging a new Sub-Processor or replacing an existing Sub-Processor. Client may object to the change on reasonable data protection grounds within that notice period, in which case the Parties will work in good faith to address the objection; if no resolution is reached, Client may terminate the affected Service in accordance with the MSA.
   • Provider remains responsible for the acts and omissions of its Sub-Processors with respect to Personal Data.

7. CLIENT SYSTEMS

   • Where Provider accesses or operates platforms, systems, or accounts owned, controlled, or contracted by Client (including Client’s own training platforms, productivity tools, or other infrastructure), such access constitutes Processing of Personal Data on Client’s behalf within Client’s existing systems and does not constitute the engagement of a new Sub-Processor.
   • Client remains responsible for the configuration and security of Client’s own systems. Provider is responsible for its access to and Processing of Personal Data within those systems.

8. DATA SUBJECT RIGHTS

   • Provider will assist Client in responding to verifiable requests from data subjects to exercise rights under Applicable Privacy Laws, including rights of access, correction, deletion, and portability.
   • If Provider receives a data subject request directly, Provider will not respond to the request other than to confirm receipt and direct the request to Client, except where required by applicable law.
   • Client is responsible for the cost of responding to data subject requests, except where the request results from Provider’s breach of this DPA.

9. SECURITY INCIDENTS

   • Provider will notify Client within seventy-two (72) hours of becoming aware of a verified Security Incident affecting Client’s Personal Data.
   • The notification will include, to the extent then known: the nature of the Security Incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the Security Incident.
   • Provider will promptly investigate each Security Incident, take reasonable steps to mitigate harmful effects, and provide Client with periodic updates and a final written report.

10. AUDIT RIGHTS

    • Upon Client’s reasonable written request, Provider will make available to Client information necessary to demonstrate Provider’s compliance with this DPA, including any third-party audit reports Provider has obtained.
    • Client may conduct a direct audit of Provider’s compliance with this DPA once per calendar year upon thirty (30) days’ prior written notice, at Client’s expense, during Provider’s normal business hours, and limited to information and systems relating to Client’s Personal Data.
    • Audits may not unreasonably interfere with Provider’s business operations and will be subject to confidentiality obligations no less protective than those in the MSA.

11. INTERNATIONAL TRANSFERS

    • Provider Processes Personal Data in the United States. Provider does not transfer Personal Data outside the United States except through its Sub-Processors, which may Process Personal Data in jurisdictions specified in Schedule 2 in accordance with their own data processing terms.
    • If a specific engagement requires the transfer of Personal Data from the European Union, United Kingdom, or other jurisdiction with cross-border transfer restrictions, the Parties will execute Standard Contractual Clauses or equivalent transfer mechanisms as an addendum to this DPA.

12. RETURN OR DELETION OF PERSONAL DATA

    • Within thirty (30) days following termination of the applicable Service or expiration of the engagement, Provider will, at Client’s election, return or securely delete all Personal Data in Provider’s possession or control, including any copies held by Sub-Processors.
    • Provider may retain Personal Data to the extent required by applicable law, in which case Provider will continue to protect such Personal Data in accordance with this DPA for so long as it is retained.

13. TERM AND TERMINATION

    • This DPA takes effect on the date of acceptance of the MSA and continues for as long as Provider Processes Personal Data on behalf of Client.
    • Obligations that by their nature should survive termination, including confidentiality, return or deletion of Personal Data, and any continuing legal retention obligations, will survive termination of this DPA.

14. LIABILITY

    • The liability of each Party under this DPA is subject to the limitations and exclusions of liability set forth in the MSA, except where such limitations are not permitted by Applicable Privacy Laws.

15. GENERAL

    • In the event of a conflict between this DPA and the MSA with respect to the Processing of Personal Data, this DPA controls. In all other respects, the MSA controls.
    • This DPA is governed by the law specified in the MSA.
    • If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions remain in full force and effect.

SCHEDULE 1: DATA PROCESSING DETAILS

Categories of Personal Data Processed, categories of data subjects, nature and purpose of Processing, and duration of Processing, by Service category:

Information Technology Services (IT Services Support, Web Security Support)

• Categories of Personal Data: system access credentials, user account identifiers, system logs, configuration data.
• Categories of data subjects: Client’s employees and authorized users.
• Nature and purpose: provision of IT support and web security services as specified in the applicable product description or Service Order.
• Duration: for the term of the applicable Service plus any retention period required by law.

Cybersecurity Services (Cyber Support, Cybersecurity Readiness Assessment)

• Categories of Personal Data: system access credentials, security event logs, configuration data, vulnerability data, employee identifiers.
• Categories of data subjects: Client’s employees, authorized users, and any individuals whose data appears in security event logs.
• Nature and purpose: provision of cybersecurity support and assessment services.
• Duration: for the term of the applicable Service plus any retention period required by law.

Project Management Support

• Categories of Personal Data: project artifacts, business communication content, identifiers of project participants, and any Personal Data within project deliverables.
• Categories of data subjects: Client’s employees, authorized users, and any individuals identified in project materials.
• Nature and purpose: provision of project management services.
• Duration: for the term of the applicable Service plus any retention period required by law.

Marketing Services (Marketing Ops Support, Marketing one-time builds)

• Categories of Personal Data: marketing platform credentials, customer lists, campaign performance data, contact data within campaign deliverables.
• Categories of data subjects: Client’s customers, prospects, and marketing audience.
• Nature and purpose: provision of marketing operations and content services.
• Duration: for the term of the applicable Service plus any retention period required by law.

Training and Awareness Services (T&A Platform Setup, T&A Platform Monthly when available)

• Categories of Personal Data: learner identifiers (names, email addresses), training completion records, role assignments.
• Categories of data subjects: Client’s employees and learners.
• Nature and purpose: provision and management of training and awareness program services.
• Duration: for the term of the applicable Service plus any retention period required by law.

Fractional CIO and Custom Engagements

• Categories of Personal Data: as scoped in the applicable Service Order.
• Categories of data subjects: as scoped in the applicable Service Order.
• Nature and purpose: as set forth in the Service Order.
• Duration: for the term of the engagement plus any retention period required by law.

SCHEDULE 2: APPROVED SUB-PROCESSORS

Provider engages the following Sub-Processors in connection with the Services. Provider will give Client at least thirty (30) days’ notice of any addition to or change in this list.

• Amazon Web Services (United States): hosting infrastructure and email delivery (Amazon SES).
• Microsoft Corporation (United States): email and document collaboration via Microsoft 365.
• Stripe, Inc. (United States): payment processing; Stripe Processes payment data only and does not Process Client business data.
• WPManageNinja LLC (United States): operates FluentCart and FluentCRM software running on Provider’s infrastructure; supports lead capture and order Processing.
• Huntress Labs, Inc. (United States): endpoint security platform used in connection with Cybersecurity Services where Provider manages Huntress on Client’s behalf.
• Zoho Corporation (United States): project management via Zoho Projects.
• Microsoft Corporation (United States): team communication via Microsoft Teams.
• Box, Inc. (United States): file storage and collaboration.

Where Provider accesses or operates platforms, systems, or accounts owned or contracted by Client (including Client’s own training platforms or other infrastructure), such access is governed by Section 7 and is not subject to this Schedule.