Data Processing Agreement

This Data Processing Agreement (the "DPA") is entered into between Welobadge, LLC, a Delaware limited liability company with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, United States ("Welo"), and the business that has entered into the Welo Business Service Agreement (the "Business"). It forms part of the Business Service Agreement (the "Agreement").

Version: 1.0. Effective date: 5 November 2026.

1. Purpose and structure

1.1 Welo provides the Services in two distinct capacities. For some activities, Welo processes personal data on behalf of, and on the documented instructions of, the Business, as a processor. For other activities, Welo determines the purposes and means of the processing itself and acts as an independent controller. For one limited activity (the collection of data through Welo code embedded on the Business's website), the Parties may be joint controllers.

1.2 This DPA: (a) identifies which activities fall into each category (Section 3 and Annex I); (b) sets out the terms required by Article 28 of Regulation (EU) 2016/679 (the "GDPR") and of the GDPR as it forms part of the law of the United Kingdom (the "UK GDPR") for the processor activities (Sections 4 to 13); (c) sets out terms for the independent controller activities (Section 14); (d) sets out the arrangement required by Article 26 GDPR for the joint controller activity (Annex V); (e) addresses international transfers (Section 15 and Annex IV); and (f) includes terms for US state privacy laws (Annex VI).

1.3 This DPA applies only to the extent that Applicable Data Protection Law applies to the processing. Where it does not, the Parties will nonetheless apply Sections 5 (confidentiality), 7 (security) and 9 (incidents) as contractual commitments.

2. Definitions

• "Applicable Data Protection Law" means all laws on the protection of personal data applicable to the processing under the Agreement, including the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the national laws implementing Directive 2002/58/EC (the "ePrivacy Directive"), Italian Legislative Decree 196/2003 as amended, and US state consumer privacy laws to the extent applicable (including the California Consumer Privacy Act as amended, the "CCPA").
• "Customer Personal Data" means personal data that Welo processes as a processor on behalf of the Business under this DPA, as described in Part A of Annex I.
• "Welo Controller Data" means personal data that Welo processes as an independent controller, as described in Part B of Annex I.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by Welo or its Sub-processors.
• "Sub-processor" means any third party engaged by Welo to process Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR. "Service provider", "contractor", "sell" and "share" have the meanings given in the CCPA.
• Other capitalized terms have the meanings given in the Agreement.

3. Roles of the Parties

3.1 Processor activities. Welo acts as a processor for the Business when it processes Customer Personal Data to provide the following Services at the Business's request: (a) storing contact lists uploaded by the Business for review invitations; (b) sending review invitations and reminders to those contacts on the Business's behalf, and recording delivery, opening and click events for those invitations; (c) storing and processing any customer or order data that the Business provides through an integration or upload for review invitation or verification-of-purchase purposes; (d) providing the Business with reports and exports about its own invitations; and (e) processing personal data contained in Business Content that the Business uploads for its own purposes (for example, team photos), to host it in accordance with the Business's configuration.

3.2 Independent controller activities. Welo acts as an independent controller, and not as a processor, when it processes personal data for its own purposes, including: (a) operating, hosting, moderating, labeling, verifying the authenticity of, and publishing Reviews and Business Responses, and calculating ratings, including once a recipient of an invitation submits a Review; (b) Evaluations, Certification, monitoring and rechecks under the Welo Trust Standard, including personal data of the Business's owners, officers and representatives and personal data contained in evidence; (c) account administration, authentication, Authorized User management, billing, support and communications with the Business; (d) security, fraud prevention, abuse detection and the integrity of the Platform, including the maintenance of global suppression lists so that a person who has opted out of review invitations is not contacted again through Welo; (e) analytics and improvement of the Services using aggregated or pseudonymized data; (f) compliance with legal obligations and responses to authorities; and (g) the establishment, exercise or defense of legal claims. Welo's processing for these purposes is described in its Privacy Policy.

3.3 Transition from processor to controller. When a person who received an invitation clicks the invitation link and submits a Review, the personal data relating to that Review (including the fact that the Review was invited and linked to the Business) becomes Welo Controller Data. The Business acknowledges that Welo does not process Reviews on the Business's instructions and that the Business cannot instruct Welo to modify, withhold or delete authentic Reviews.

3.4 Joint controller activity. To the extent that the Badge or widget code supplied by Welo and embedded by the Business on its website collects personal data of visitors to that website (such as pseudonymous browser identifiers, page URLs, referrers and user agent) and transmits it to Welo, the Business and Welo are joint controllers of the collection and transmission of that data, and Welo is an independent controller of its subsequent processing for its own purposes (such as display metrics, plan usage measurement and fraud prevention). The arrangement in Annex V applies.

3.5 No other allocation. Nothing in this DPA makes Welo a processor for any activity not listed in Section 3.1 and Annex I, Part A.

4. Processing on documented instructions

4.1 Welo will process Customer Personal Data only on the Business's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law (or, under the UK GDPR, domestic law) to which Welo is subject; in that case, Welo will inform the Business of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 The Business's instructions are: (a) this DPA and the Agreement; (b) the Business's configuration and use of the Services (for example, uploading a contact list and launching an invitation campaign); and (c) any additional written instructions agreed by the Parties that are consistent with the Agreement. Additional instructions that require material changes to the Services may be subject to additional Fees or may be declined.

4.3 Welo will immediately inform the Business if, in its opinion, an instruction infringes Applicable Data Protection Law. Welo is not obliged to provide legal advice to the Business and may suspend execution of the instruction until it is confirmed or modified.

4.4 Business responsibilities. The Business is responsible for: (a) the lawfulness of the collection of Customer Personal Data and of its disclosure to Welo; (b) having a valid legal basis for each processing it instructs, including the sending of review invitations, and for complying with the ePrivacy Directive, anti-spam and telemarketing laws as they apply to those invitations; (c) providing data subjects with the information required by Articles 13 and 14 GDPR about the disclosure of their data to Welo for review invitations; (d) the accuracy of Customer Personal Data; and (e) ensuring that its instructions comply with Applicable Data Protection Law.

5. Confidentiality

Welo will ensure that persons authorized to process Customer Personal Data (including employees, contractors and Sub-processors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to provide the Services.

6. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex I. The duration of the processing is the term of the Agreement plus the period until deletion under Section 12.

7. Security of processing

7.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Welo will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR, including the measures described in Annex II.

7.2 Welo may update the measures in Annex II, provided that the updates do not result in a material reduction of the overall level of protection.

7.3 The Business is responsible for the security of its Account credentials, its devices and its own systems, for configuring the Services appropriately, and for the security of Customer Personal Data while in transit to Welo through channels it controls.

8. Sub-processors

8.1 General authorization. The Business grants Welo a general authorization to engage Sub-processors. The Sub-processors engaged as of the effective date are listed in Annex III.

8.2 Notice of changes. Welo will maintain an up-to-date list of Sub-processors in Annex III of this DPA, as published on this page, and will inform the Business of any intended addition or replacement of a Sub-processor at least fifteen (15) days in advance by email to the Account owner or through a notification mechanism to which the Business may subscribe, thereby giving the Business the opportunity to object. In case of an urgent replacement required to maintain the security or continuity of the Services, Welo may give shorter notice, stating the reason.

8.3 Objection. The Business may object on reasonable grounds relating to data protection by written notice within the notice period. The Parties will discuss the objection in good faith. If Welo cannot provide a reasonable alternative, the Business may, as its sole remedy, terminate the affected Service by written notice, and Welo will refund prepaid Fees for the unused period of that Service.

8.4 Sub-processor obligations. Welo will impose on each Sub-processor, by contract, data protection obligations providing at least the same level of protection as those in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. Where a Sub-processor fails to fulfil its data protection obligations, Welo remains fully liable to the Business for the performance of that Sub-processor's obligations, subject to the Agreement.

8.5 Copies. On request, Welo will provide the relevant data protection terms of a Sub-processor agreement, which may be redacted to protect confidential commercial information.

9. Personal Data Breaches

9.1 Welo will notify the Business without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and in any event with sufficient time, where reasonably possible, to allow the Business to meet its own notification obligations under Articles 33 and 34 GDPR.

9.2 The notification will describe, to the extent known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point. Where the information is not available at once, Welo will provide it in phases without undue further delay.

9.3 Welo will take reasonable steps to contain, investigate and remediate the breach and will provide reasonable cooperation to the Business. Notification of a breach is not an acknowledgment of fault or liability.

9.4 The Business is responsible for deciding whether to notify supervisory authorities and data subjects for Customer Personal Data. Welo will not notify data subjects of a breach of Customer Personal Data on the Business's behalf without the Business's instruction, unless required by law.

10. Assistance

10.1 Data subject requests. Taking into account the nature of the processing, Welo will assist the Business by appropriate technical and organizational measures, insofar as possible, in fulfilling its obligation to respond to requests to exercise data subject rights under Chapter III GDPR with respect to Customer Personal Data. Welo will promptly forward to the Business any request it receives that clearly relates to Customer Personal Data, and will not respond to it directly except to acknowledge receipt and redirect the requester, unless instructed or required by law. Requests that relate to Reviews or other Welo Controller Data will be handled by Welo as controller.

10.2 Other assistance. Taking into account the nature of the processing and the information available to Welo, Welo will provide reasonable assistance to the Business in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).

10.3 Costs. Assistance that goes beyond the functionality of the Services and the information reasonably available to Welo may be subject to reasonable charges, agreed in advance, except where the assistance is needed because of Welo's breach of this DPA.

11. Audits and information

11.1 Welo will make available to the Business all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and will allow for and contribute to audits, including inspections, conducted by the Business or an independent auditor mandated by the Business, in accordance with this Section 11.

11.2 The Business agrees that its audit right will be exercised first by reviewing the documentation Welo makes available, including this DPA, Annex II, written responses to reasonable security questionnaires (no more than once per year, unless a Personal Data Breach has occurred), and any third-party certifications or audit reports that Welo or its Sub-processors hold and are permitted to share.

11.3 Where the information in Section 11.2 is not sufficient to demonstrate compliance, or where an audit is required by a supervisory authority or follows a Personal Data Breach, the Business may conduct an audit on at least thirty (30) days' written notice, no more than once in any twelve-month period (except where required by a supervisory authority), during normal business hours, without unreasonable disruption to Welo's operations, subject to confidentiality obligations and Welo's reasonable security policies, and at the Business's expense. An auditor must not be a competitor of Welo. Audits of Sub-processors are conducted by relying on the information that the Sub-processor makes available.

12. Return and deletion

12.1 At the end of the provision of the processor Services, Welo will, at the Business's choice, delete or return all Customer Personal Data, and delete existing copies, unless Union or Member State law (or other applicable law) requires storage of the personal data.

12.2 Unless the Business requests return within thirty (30) days after the end of the Agreement, using the export functions available in the dashboard or by written request, Welo will delete Customer Personal Data from its active systems within ninety (90) days after the end of the Agreement. Copies in backups will be deleted in accordance with Welo's and its Sub-processors' backup rotation cycles and will remain protected by this DPA until deletion.

12.3 Welo may retain Customer Personal Data to the extent necessary to comply with legal obligations or to establish, exercise or defend legal claims, in which case Section 5 and Section 7 continue to apply. Welo will retain, as controller, the minimal suppression data described in Section 3.2(d).

12.4 Deletion of Customer Personal Data does not include Welo Controller Data, such as published Reviews, which are retained in accordance with the Privacy Policy and the Content Moderation and Appeals Policy.

13. Processor activities under US state privacy laws

Where the CCPA or another US state consumer privacy law applies to Customer Personal Data, the additional terms in Annex VI apply.

14. Independent controller terms

14.1 Each Party is independently responsible for its compliance with Applicable Data Protection Law with respect to the personal data that it processes as an independent controller, including providing information to data subjects, ensuring a legal basis, responding to data subject requests and notifying breaches.

14.2 Where the Business provides Welo with personal data that Welo processes as an independent controller (for example, data about its owners and representatives for an Evaluation), the Business warrants that it may lawfully provide the data to Welo for that purpose and that it has informed the data subjects of the disclosure, including by referring them to Welo's Privacy Policy.

14.3 Where Welo provides the Business with personal data that the Business then processes as an independent controller (for example, the public name of a reviewer displayed with a Review, or information about a reviewer shared to help assess a Report), the Business will process that data only for the purpose for which it was provided, in compliance with Applicable Data Protection Law, and will not use it to contact, identify, pressure or retaliate against the reviewer, except to respond through the channels provided by Welo.

14.4 The Parties will cooperate in good faith, to the extent reasonably necessary, to respond to data subject requests and supervisory authority inquiries that concern both Parties.

15. International transfers

15.1 Context. Welo is established in the United States. Customer Personal Data is primarily stored in a database hosted in the European Union (Supabase, AWS region eu-central-1, Frankfurt, Germany), but is accessed from the United States by Welo and may be processed by Sub-processors in the United States and other countries, as described in Annex III. Such access constitutes a transfer of personal data to a third country.

15.2 Transfer mechanisms. Welo will not transfer Customer Personal Data outside the European Economic Area, the United Kingdom or Switzerland unless the transfer complies with Chapter V GDPR (or the corresponding UK or Swiss provisions). To the extent that a transfer of Customer Personal Data from the Business to Welo is a restricted transfer:

• (a) where Welo is certified under the EU-US Data Privacy Framework (and, for the United Kingdom, the UK Extension, and for Switzerland, the Swiss-US Data Privacy Framework) and the transfer falls within the scope of its certification, the transfer will rely on the relevant adequacy decision;
• (b) otherwise, the SCCs are incorporated into this DPA by reference and apply as described in Annex IV: Module Two (controller to processor) for Customer Personal Data, and Module One (controller to controller) for personal data that the Business transfers to Welo as an independent or joint controller;
• (c) for transfers subject to the UK GDPR, the UK Addendum applies, completed as described in Annex IV; and
• (d) for transfers subject to Swiss law, the SCCs apply with the adaptations described in Annex IV.

15.3 Onward transfers. Welo will ensure that transfers to Sub-processors in third countries are subject to a valid transfer mechanism, such as the Sub-processor's certification under the Data Privacy Framework or SCCs (Module Three, processor to processor).

15.4 Transfer impact assessment. Welo will provide the Business with reasonable information about the laws and practices of the United States relevant to the transfers, and about the supplementary measures in Annex II, to assist the Business in assessing the transfers. Welo will notify the Business if it has reason to believe that it is or has become subject to laws or practices that prevent it from fulfilling its obligations under the SCCs.

15.5 No transfer authorization by this DPA alone. This DPA does not by itself authorize any transfer. Transfers are lawful only where a valid mechanism under Chapter V GDPR applies and its conditions are met.

15.6 Changes in law. If a transfer mechanism is invalidated, amended or replaced (including if the European Commission adopts specific standard contractual clauses for importers already subject to the GDPR under Article 3(2)), the Parties will cooperate in good faith to implement an appropriate alternative mechanism, and Welo may update Annex IV accordingly on notice.

16. Liability

Each Party's liability arising out of or relating to this DPA is subject to the limitations and exclusions in the Agreement, to the extent permitted by Applicable Data Protection Law. Nothing in this DPA limits either Party's liability to data subjects under Article 82 GDPR or under the SCCs, or any liability that cannot be limited by law.

17. Term, precedence and changes

17.1 This DPA remains in effect for as long as Welo processes Customer Personal Data or the Agreement is in effect, whichever is longer.

17.2 In the event of a conflict: (a) the SCCs (and the UK Addendum) prevail over this DPA and the Agreement; (b) this DPA prevails over the Agreement and the other Incorporated Policies with respect to the processing of personal data; and (c) the Privacy Policy is an information notice and does not prevail over this DPA.

17.3 Welo may update this DPA to reflect changes in law, guidance of supervisory authorities, the Services or Sub-processors, provided that the update does not materially reduce the protection of Customer Personal Data. Material changes will be notified in accordance with the Agreement.

17.4 This DPA is governed by the law that governs the Agreement, except where Applicable Data Protection Law or the SCCs require otherwise.

Annex I. Description of the processing

Part A. Processor activities (Customer Personal Data)

Item	Description
Subject matter	Provision of review invitation, related reporting and hosting functions to the Business under the Agreement.
Nature of processing	Collection by upload or integration, storage, organization, deduplication against the Business's previous uploads and Welo's suppression list, use to generate and send invitation emails and reminders, recording of delivery and engagement events, reporting, export and deletion.
Purposes	To invite the Business's customers to leave a review on Welo about a genuine experience, and to provide the Business with information about its invitation campaigns.
Categories of data subjects	Customers and prospective customers of the Business whose details the Business uploads; individuals appearing in Business Content uploaded for the Business's purposes.
Types of personal data	Name; email address; telephone number (where provided); order or interaction reference and date (where provided); language; invitation token; delivery, opening, click and unsubscribe events; technical data relating to the invitation email (for example, IP address and user agent recorded on click). Images of individuals contained in Business Content.
Special categories	None intended. The Business must not upload special categories of personal data or data relating to criminal convictions.
Frequency	Continuous for the duration of the Agreement, as initiated by the Business.
Duration and retention	For the term of the Agreement, subject to Section 12.
Sub-processors	See Annex III.

Part B. Independent controller activities (Welo Controller Data), for information

Activity	Main data	Typical legal basis (GDPR)
Reviews: submission, authenticity checks, moderation, publication, ratings	Reviewer name or display name, email, country, review text and rating, media, invitation token, hashed IP, user agent, form timing, risk signals, moderation records	Art. 6(1)(f) legitimate interests in operating an authentic review platform; Art. 6(1)(b) for the reviewer's use of the service; Art. 6(1)(c) where required by law
Evaluation, Certification and monitoring	Identity and role of owners, officers and representatives; documents and evidence; correspondence; public information	Art. 6(1)(b) (contract with the Business, as regards its representatives acting for it) and Art. 6(1)(f) legitimate interests in reliable certification and consumer protection
Accounts, billing and support	Authorized User identity and contact data, login and security events, billing records	Art. 6(1)(b), 6(1)(c), 6(1)(f)
Security, fraud prevention and suppression lists	Technical identifiers, risk signals, opt-out records	Art. 6(1)(f), 6(1)(c)
Badge and widget telemetry (after collection)	Pseudonymous visitor and session identifiers, page and referrer URLs, user agent, events	Art. 6(1)(f), subject to any consent required for device storage under the ePrivacy Directive (see Annex V)

Annex II. Technical and organizational measures

The following measures describe Welo's implementation as of the effective date of this DPA.

• Hosting and data location: the production database, authentication and file storage are provided by Supabase and hosted in AWS region eu-central-1 (Frankfurt, Germany). The application is hosted by Vercel.
• Encryption in transit: HTTPS/TLS for connections between users and the Platform and between the Platform and its Sub-processors.
• Encryption at rest: storage encryption provided by the hosting Sub-processors for databases and stored files.
• Access control: role-based access for Welo administrators with separate permission scopes; row-level security policies in the database restricting what anonymous and authenticated users can read; privileged credentials stored as server-side secrets and not exposed to browsers; access limited to personnel who need it to provide the Services.
• Authentication: account authentication with email verification.
• Logging and accountability: audit records of administrative and AI-assisted changes to records, including the previous and new values of changed fields; records of moderation decisions; email delivery and webhook event logs.
• Data minimization and pseudonymization: IP addresses associated with review submissions are stored in hashed form; private evidence is not published; analytics identifiers are pseudonymous.
• Abuse prevention: rate limiting, honeypot fields, duplicate detection and risk scoring on public forms; monthly invitation limits; global suppression of recipients who unsubscribe.
• Monitoring: error monitoring through Sentry to detect and correct malfunctions.
• Resilience: database backups provided by Supabase.
• Personnel: personnel and contractors with access to personal data are bound by confidentiality obligations in accordance with Section 5.
• Incident response: suspected incidents are escalated, contained, investigated and documented, and Businesses and authorities are notified as required by Section 9.
• Supplementary measures for transfers: EU data residency for the primary database; encryption in transit; access limited to personnel who need it; Welo will challenge requests from public authorities that it considers unlawful or overbroad where it has grounds to do so, and will notify the Business where permitted.

Annex III. Sub-processors

Welo uses the following Sub-processors for the processor activities described in Annex I, Part A. Welo keeps this list up to date on this page in accordance with Section 8.

Sub-processor	Function	Location of processing	Transfer mechanism
Supabase	Database, authentication, file storage and server functions	European Union (AWS eu-central-1, Frankfurt, Germany); the provider may access data from other countries for support and operations	Standard Contractual Clauses or the EU-US Data Privacy Framework, as provided in the provider's data processing terms
Vercel	Application hosting and delivery	United States and global delivery network	Standard Contractual Clauses or the EU-US Data Privacy Framework, as provided in the provider's data processing terms
Resend	Delivery of review invitation and service emails	United States	Standard Contractual Clauses or the EU-US Data Privacy Framework, as provided in the provider's data processing terms
Sentry	Error monitoring; may incidentally process personal data contained in error reports	United States	Standard Contractual Clauses or the EU-US Data Privacy Framework, as provided in the provider's data processing terms

Providers that Welo uses only for its own controller purposes (for example, Stripe for payments, Mux for review videos, Crisp for support, OpenAI for AI-assisted features, analytics and advertising providers, and print-and-mail providers used for Welo's own outreach) are not Sub-processors of Customer Personal Data and are described in the Privacy Policy.

Annex IV. International transfer terms

A. EU Standard Contractual Clauses

• Modules: Module Two (controller to processor) for Customer Personal Data; Module One (controller to controller) for personal data transferred to Welo as independent or joint controller.
• Parties: data exporter: the Business; data importer: Welo. Contact details, signatures and dates: as set out in the Agreement and the Account; acceptance of the Agreement constitutes execution of the SCCs.
• Clause 7 (docking clause): not used.
• Clause 9 (sub-processors): Option 2 (general written authorization), with the notice period stated in Section 8.2 of this DPA.
• Clause 11 (redress): the optional language is not used.
• Clause 13 (supervision): where the Business is established in the EU, the supervisory authority of the Member State of establishment; where the Business is not established in the EU but is subject to the GDPR under Article 3(2), the supervisory authority of the Member State where its representative under Article 27(1) GDPR is established.
• Clause 17 (governing law): the law of Ireland.
• Clause 18 (forum): the courts of Ireland.
• Annex I.A, I.B, I.C and II of the SCCs: completed by Annex I, Annex II and Section 1 of this Annex.
• Annex III of the SCCs: Annex III of this DPA.

B. Note on importers subject to Article 3(2) GDPR

Where Welo is itself subject to the GDPR under Article 3(2) for a given processing, the European Commission has indicated that the 2021 SCCs are not designed for that scenario and that separate clauses are being prepared; as of the effective date of this DPA, those clauses have not been adopted. Pending their adoption, the Parties rely on the 2021 SCCs as described above to the extent applicable, and will implement the new clauses under Section 15.6 when available.

C. United Kingdom

For restricted transfers subject to the UK GDPR, the UK Addendum (version B1.0, in force from 21 March 2022, as amended) applies. Table 1: the Parties' details are those in Section A above. Table 2: the Approved EU SCCs, with the modules and options selected in Section A. Table 3: Annexes as set out in this DPA. Table 4: either Party may end the UK Addendum as provided in its Section 19.

D. Switzerland

For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the following adaptations: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; references to "Member State" include Switzerland so that data subjects in Switzerland can bring claims in their place of habitual residence; and references to the GDPR are understood as references to the Swiss Federal Act on Data Protection where applicable.

Annex V. Joint controller arrangement for embedded Badge and widget code

1. Scope. This Annex applies to the collection of personal data from visitors to the Business's websites by the Badge or widget code supplied by Welo and the transmission of that data to Welo (the "Joint Processing"). Each Party is an independent controller of any processing before or after the Joint Processing.

2. Responsibilities of the Business. As operator of the website on which the code is embedded, the Business is responsible for: (a) deciding whether to embed the code and on which pages; (b) providing visitors, through its privacy notice and cookie banner, with information about the embedded Welo component, the data collected, the purposes and a link to Welo's Privacy Policy; and (c) obtaining, where required by the national law implementing Article 5(3) of the ePrivacy Directive or by Applicable Data Protection Law, the visitor's consent before the code stores or reads information on the visitor's device and before the Joint Processing takes place, and keeping a record of that consent.

3. Responsibilities of Welo. Welo is responsible for: (a) designing the code so that it collects only the data described in Welo's Privacy Policy; (b) providing the Business with the information it needs to inform visitors; (c) providing, where technically feasible, a configuration or integration that allows the Business to prevent the code from storing identifiers or transmitting data until consent is obtained; (d) the security of the data once received; and (e) responding to data subject requests concerning the data held by Welo.

4. Data subject requests. Data subjects may exercise their rights against either Party. Each Party will forward to the other, without undue delay, any request that concerns the other Party's responsibilities.

5. Essence of the arrangement. The Business will make the essence of this arrangement available to visitors, for example in its privacy notice, as required by Article 26(2) GDPR. Welo will publish it in its Privacy Policy.

6. Breaches. Each Party will notify the other without undue delay of a breach affecting the Joint Processing.

Annex VI. US state privacy law terms

To the extent that the CCPA or another US state consumer privacy law applies to Customer Personal Data, Welo acts as a "service provider" or "processor" and:

• (a) will process Customer Personal Data only for the limited and specified business purposes described in Annex I, Part A;
• (b) will not sell or share Customer Personal Data;
• (c) will not retain, use or disclose Customer Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement, or outside the direct business relationship between the Parties, except as permitted by applicable law;
• (d) will not combine Customer Personal Data with personal data that it receives from or on behalf of another person, or collects from its own interaction with the consumer, except as permitted by applicable law (including for detecting security incidents and preventing fraud);
• (e) will comply with applicable obligations and provide the same level of privacy protection as required by applicable law, and will notify the Business if it can no longer meet its obligations;
• (f) grants the Business the right to take reasonable and appropriate steps to ensure that Welo uses Customer Personal Data consistently with the Business's obligations, and to stop and remediate unauthorized use, in accordance with Section 11; and
• (g) certifies that it understands and will comply with these restrictions.

Welo's own processing as an independent controller (for example, of Reviews) is not subject to this Annex.