This Data Processing Addendum ("DPA") forms part of the Master Service Agreement, Infrastructure Agreement, or other written agreement (the "Agreement") between Shout About Us, Inc. ("SAU") and the customer identified in the Agreement ("Customer"). It applies to the extent SAU processes Personal Data on Customer’s behalf in providing the Services. Capitalized terms not defined here have the meaning in the Agreement. In case of conflict, this DPA controls as to the processing of Personal Data.

Standard terms.This DPA is SAU’s standard and is the same for every customer. SAU does not negotiate customer-specific retention, deletion, or security terms. Clauses 12 and 13 apply automatically where the Personal Data is subject to the laws they reference and are inert otherwise. Hosting region is set in the Order Form.

1.  DEFINITIONS

• "Data Protection Law"means all laws applicable to the processing of Personal Data under the Agreement, which may include the California Consumer Privacy Act as amended ("CCPA"), other U.S. state privacy laws, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Australian Privacy Act 1988 (Cth) including the Australian Privacy Principles ("APPs").
• "Personal Data"means information relating to an identified or identifiable natural person that SAU processes on Customer’s behalf under the Agreement, as described in Annex 1.
• "Processing," "Controller," "Processor," "Business," "Service Provider," "Data Subject," "Sub-processor,"and similar terms have the meanings given in Data Protection Law. "Controller" includes "Business" and "APP entity"; "Processor" includes "Service Provider."
• "Security Incident"means a confirmed unauthorized access to, disclosure of, alteration of, or loss of Personal Data in SAU’s possession or control.
• "Retention Policy"means SAU’s Data Retention and Deletion Policy, as updated from time to time, a summary of which is published in SAU’s privacy policies, and the full version of which is available to Customer under confidentiality on request.

2.  ROLES

Customer is the Controller (or Business) of Personal Data it provides to SAU. SAU is the Processor (or Service Provider). Where Customer is itself a Processor for its own clients, Customer warrants that it has authority to engage SAU as a Sub-processor and SAU processes Personal Data on the instructions of Customer. SAU is an independent Controller only of its own business records (for example, Customer’s billing contacts and SAU’s security logs) and processes those under its own privacy policy.

3.  PROCESSING INSTRUCTIONS

SAU processes Personal Data only on Customer’s documented instructions, which consist of the Agreement, this DPA, Customer’s configuration of the Services, and Customer’s use of the API and application. SAU does not sell Personal Data, share it for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship, or combine it with Personal Data received from other sources except as permitted for a Service Provider under CCPA. SAU will inform Customer if, in SAU’s opinion, an instruction infringes Data Protection Law, and may suspend the affected processing until the instruction is amended or confirmed.

4.  CONFIDENTIALITY OF PROCESSING

SAU limits access to Personal Data to personnel and contractors who need it to perform the Services, who are bound by written confidentiality obligations, who have completed security awareness training, and who use company-managed devices. Access is role-based, uses named identities with multi-factor authentication, and is reviewed quarterly.

5.  SECURITY MEASURES

SAU maintains the technical and organizational measures in Annex 2, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256 via AWS Key Management Service); infrastructure hosted in dedicated AWS accounts with private networking, web application firewall, and intrusion detection; logging of security-relevant events retained 12 months; change management with peer review and protected branches; vulnerability management including annual third-party penetration testing; and documented incident response. SAU may update these measures provided the overall level of protection is not materially reduced.

6.  SUB-PROCESSORS

Customer authorizes SAU to engage the Sub-processors listed in Annex 3. SAU will give Customer at least 30 days notice before a new Sub-processor processes Personal Data, by email to Customer’s designated contact and by updating the list published at shoutaboutus.com/dpa. Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, Customer may terminate the affected Services without penalty. SAU imposes on each Sub-processor data protection obligations no less protective than this DPA and remains responsible for each Sub-processor’s performance.

7.  DATA SUBJECT REQUESTS

SAU will, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures in responding to requests from Data Subjects to exercise their rights (access, correction, deletion, portability, restriction, objection). If SAU receives such a request directly relating to Customer’s Personal Data, SAU will forward it to Customer within 5 business days and will not respond except to acknowledge receipt and refer the requester to Customer, unless required by law. SAU logs all requests for 24 months.

8.  RETENTION, RETURN, AND DELETION

8.1 During the term

SAU retains Personal Data only as long as needed to provide the Services and as set out in the Retention Policy. Without limitation: end-customer contact details submitted for review solicitation are deleted 90 days after the last message to that contact; records of solicitation sends and consent, which contain no contact details, are retained for 4 years; reviewer information is limited to the publicly displayed name; log data is retained for 12 months (security) and 90 days (application).

8.2 On termination

• For 30 days following the termination date, SAU makes an export of Customer’s Personal Data and exportable review and response content available in machine-readable form (CSV and JSON), and provides read-only access for that purpose. Customer is responsible for retrieving the export within that period and for notifying its own users of the termination and the export window.
• SAU deletes all Customer Personal Data from its systems within 60 days of the termination date, including primary databases, replicas, indexes, caches, analytics stores, and Sub-processor systems under SAU’s control.
• SAU provides written certification of deletion on request, generated from SAU’s deletion log.
• Backups are retained on a rolling 35-day cycle and are not accessed except for recovery; Personal Data in backups expires within 35 days after deletion from live systems. A restored backup is deleted immediately after use.

8.3 Exceptions

Deletion does not apply to: (a) aggregated or de-identified data that cannot reasonably identify Customer, any business, or any individual; (b) financial and transaction records, including Customer’s name, invoice amounts, dates, and location counts, retained for 7 years as required by law and used for no other purpose; (c) records SAU is required to retain by law or by the Agreement (for example, customer-count records); (d) data subject to a legal hold, which is deleted when the hold is lifted. SAU will notify Customer of any legal hold affecting Customer’s data where legally permitted.

9.  DATA MINIMIZATION

SAU stores only the data classes and fields defined in the Retention Policy and does not retain raw third-party responses, reviewer profile information beyond the displayed name, per-user activity streams beyond application log retention, or prompts and outputs of AI-assisted drafting beyond the final response record and 14-day diagnostic logs. Customer agrees to submit only Personal Data necessary for the Services.

10.  SECURITY INCIDENTS

SAU notifies Customer’s designated security contact of a Security Incident affecting Customer’s Personal Data within 48 hours of SAU confirming the incident. Notification includes a description of the incident, the categories and approximate volume of Personal Data and Data Subjects affected, the measures taken or proposed, and a contact. Where full details are not yet available, SAU notifies with what is known and updates as the investigation proceeds. SAU cooperates with Customer’s reasonable requests to investigate, and assists Customer with any notification Customer must make to regulators or Data Subjects. Notification is not an admission of fault.

10A.  LEGAL PROCESS

If SAU receives a subpoena, court order, regulatory demand, or other legal process seeking Personal Data or other Customer data in SAU’s possession, SAU will: (a) notify Customer promptly and before responding, unless legally prohibited; (b) provide Customer a reasonable opportunity to object, intervene, or seek a protective order; (c) disclose only the portion legally required; and (d) cooperate with Customer’s reasonable efforts to limit or resist disclosure. Customer will reimburse SAU’s reasonable costs, including reasonable attorneys’ fees and engineering time, of responding to legal process directed at Customer’s data, except where the process arises from SAU’s own breach of this DPA or the Agreement. This Clause applies with particular force to records held in connection with first-party review infrastructure, including review submissions, reviewer details, and moderation records.

11.  AUDIT

On at least 30 days written notice and no more than once in any 12-month period, Customer may audit SAU’s compliance with this DPA. SAU may satisfy an audit request by providing its most recent SOC 2 report (or, before the first report is issued, a written description of controls and confirmation of the audit engagement and target date), a completed security questionnaire, and reasonable written responses to follow-up questions. Any on-site or direct audit is at Customer’s expense, conducted by a mutually agreed independent third party under confidentiality, during business hours, and without access to other customers’ data or to production systems.

12.  INTERNATIONAL TRANSFERS AND HOSTING

SAU hosts the Services in the region specified in the Order Form (United States unless otherwise stated). Where Customer transfers Personal Data to SAU from a jurisdiction that restricts international transfers, the following apply automatically:

• EEA.The Standard Contractual Clauses adopted by European Commission Decision 2021/914, Module Two (controller to processor) where Customer acts as a Controller, or Module Three (processor to sub-processor) where Customer acts as a Processor on behalf of its own clients, are incorporated by reference, with Customer as data exporter and SAU as data importer; Clause 7 (docking) applies; Clause 9(a) option 2 (general authorization, 30 days notice) applies; Clause 11 optional language does not apply; Clause 17 option 1 with the law of Ireland; Clause 18 courts of Ireland. Annexes I to III of the SCCs are completed by Annexes 1 to 3 of this DPA.
• United Kingdom.The UK International Data Transfer Addendum to the EU SCCs (version B1.0) is incorporated, with Table 1 and Table 3 completed by the Agreement and this DPA and either party able to end the Addendum as set out in Section 19 of it.
• Switzerland.The SCCs apply as adapted to the Swiss Federal Act on Data Protection.

SAU will conduct and document a transfer impact assessment for EEA and UK transfers on request and will notify Customer if it becomes unable to comply with the SCCs.

13.  AUSTRALIAN PRIVACY PRINCIPLES

Where Customer discloses to SAU Personal Data that is subject to the Privacy Act 1988 (Cth), SAU undertakes to handle that Personal Data in accordance with the APPs as if SAU were an APP entity. Customer’s disclosure is made in reliance on this undertaking as the contractual protection required under APP 8.1. SAU acknowledges that Customer remains accountable under APP 8.1 for SAU’s acts and practices in relation to that Personal Data, and SAU will indemnify Customer against liability Customer incurs under APP 8.1 arising from SAU’s breach of this undertaking, subject to an aggregate cap of two times the fees paid or payable by Customer in the 12 months preceding the claim. This clause does not apply to Personal Data not subject to the Privacy Act 1988.

14.  CUSTOMER OBLIGATIONS

Customer is responsible for: the lawfulness of its instructions and of the Personal Data it provides; obtaining and retaining any consents required for Personal Data it submits, including for review solicitation by email or SMS; the security of its own systems, credentials, and API tokens; designating and maintaining a security contact and a Sub-processor notice contact; and notifying its own users of termination and the export window.

14A.  CUSTOMER INDEMNITY FOR FIRST-PARTY REVIEW OPERATIONS

Where Customer uses first-party review infrastructure, Customer will defend, indemnify, and hold harmless SAU and its officers, directors, employees, and contractors against any third-party claim, demand, proceeding, loss, or expense (including reasonable attorneys’ fees) arising from or relating to: (a) Customer’s review guidelines, content policies, or terms of service; (b) any moderation decision made by or on behalf of Customer, including any decision to publish, decline to publish, edit, remove, or retain a review; (c) content published on or removed from Customer’s review platform; (d) any claim by a consumer, business, or regulator concerning the accuracy, fairness, or lawfulness of Customer’s review platform or its operation; and (e) the instructions Customer gives SAU in connection with the foregoing. SAU operates the infrastructure and records Customer’s decisions; Customer determines the rules and makes the decisions. This indemnity does not apply to the extent a claim arises from SAU’s own breach of this DPA or the Agreement.

15.  LIABILITY AND TERM

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except as stated in Clauses 13 and 14A. This DPA takes effect on the effective date of the Agreement and remains in force until SAU has deleted all Customer Personal Data in accordance with Clause 8.

Annex 1.  DESCRIPTION OF PROCESSING

Annex 2.  TECHNICAL AND ORGANIZATIONAL MEASURES

Annex 3.  SUB-PROCESSORS

The current Sub-processor list is published at shoutaboutus.com/dpa. Changes are notified per Clause 6.

Annex 4.  CONTACTS