This Data Processing Agreement ("DPA") is Version 1.0. It takes effect on October 9, 2026. It is the Data Processing Addendum published at fanflet.com/legal/dpa. It forms part of the agreement between Fanflet, LLC ("Fanflet") and the customer named in an Order Form ("Customer") under the Sponsor Studio Terms ("Terms"). It applies when Fanflet processes Customer Personal Data in providing the Services.

1. Scope and precedence

1.1 Scope. This DPA applies when Fanflet processes Customer Personal Data in providing the Services.

1.2 Precedence. For matters involving personal data, this DPA controls over the Terms. The Order Form controls over this DPA only for its commercial terms. Capitalized terms not defined here have the meanings in the Terms.

1.3 Definitions.

"Customer Personal Data" means personal data within Customer Data that Fanflet processes on Customer's behalf, as described in Annex 1.
"Data Protection Laws" means all privacy and data protection laws that apply to a party's processing of personal data under the Agreement, including the California Consumer Privacy Act as amended ("CCPA"), other U.S. state consumer privacy laws, and, only where they apply, the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection.
"Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data held by Fanflet or its Subprocessors.
"Subprocessor" means a third party Fanflet engages that processes Customer Personal Data.
"Controller," "processor," "service provider," "business," "data subject," "personal data," "processing," "sell," and "share" have the meanings given in the Data Protection Laws.

2. Roles of the parties

2.1 Fanflet as processor. Fanflet is the processor and service provider for Customer Personal Data. That includes Customer's User account data, personal data in Sponsor Content, and personal data in reports Fanflet prepares for Customer. Customer is the controller (or business) of that data. When Customer is itself a processor, Fanflet is the sub-processor.

2.2 Independent controllers for opt-in sharing. When an Audience Member chooses to share contact details with Customer, Fanflet collects the consent and the details through the fanflet page and delivers them to Customer. For that sharing, Fanflet and Customer each act as independent controllers. Once delivered, Opt-In Contact Data is Customer's to control under Section 15 of this DPA and Section 9.3 of the Terms. While Fanflet continues to host a copy of Opt-In Contact Data in Customer's dashboard, Fanflet processes that copy as Customer's processor.

2.3 Fanflet as controller of its own data. Fanflet is an independent controller of personal data it processes for its own business purposes, such as billing contacts, Usage Data, security logs, and the creation of Aggregate Data, as described in Fanflet's Privacy Policy and Section 9.4 of the Terms.

2.4 Customer's duties. Customer is responsible for the lawfulness of the Customer Personal Data it provides, and for giving any notices and obtaining any consents the Data Protection Laws require for Fanflet's processing under this DPA.

3. Processing instructions

3.1 Instructions. Fanflet will process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise. If the law requires other processing, Fanflet will notify Customer first unless the law prohibits notice. The Agreement, Customer's configuration of the Services, and Customer's written support requests are Customer's complete instructions. Additional instructions require written agreement.

3.2 Unlawful instructions. Fanflet will tell Customer promptly if it believes an instruction violates the Data Protection Laws, and may decline to follow it.

3.3 Details of processing. Annex 1 describes the subject matter, nature, purpose, duration, and categories of data and data subjects.

4. U.S. state privacy law terms

When acting as Customer's service provider or processor, Fanflet will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than the business purposes in the Agreement, or for any commercial purpose other than providing the Services; (c) retain, use, or disclose it outside the direct business relationship between Fanflet and Customer; or (d) combine it with personal data Fanflet receives from others or on behalf of others, or collects from its own interactions with individuals, except as the Data Protection Laws allow. Fanflet will notify Customer if it can no longer meet its obligations under the Data Protection Laws. Customer may take reasonable steps to stop and remediate unauthorized use of Customer Personal Data. Fanflet certifies that it understands these restrictions and will comply with them.

5. Personnel

Fanflet will ensure that personnel who may access Customer Personal Data are bound by confidentiality duties, receive appropriate privacy and security training, and have access only as needed for their role.

6. Security

Fanflet will maintain the technical and organizational measures described in Annex 2 and at fanflet.com/security. Fanflet may update those measures, and will not materially reduce the overall level of protection during a Subscription Term.

7. Security Incidents

7.1 Notice. Fanflet will notify Customer of a Security Incident without undue delay, and no later than 72 hours after Fanflet confirms it. Fanflet will send the notice to Customer's notice and admin contacts on the Order Form.

7.2 Content. The notice will describe, to the extent then known, the nature of the incident, the categories and approximate volume of data and data subjects affected, the likely consequences, the steps Fanflet has taken or proposes, and a contact for more information. Fanflet will update Customer as it learns more.

7.3 Cooperation. Fanflet will take reasonable steps to contain and remediate the incident and will reasonably assist Customer in meeting Customer's own notification duties.

7.4 Publicity. Fanflet will not name Customer in any public statement about a Security Incident without Customer's consent, unless the law requires it.

7.5 No admission. Notice of a Security Incident is not an admission of fault or liability.

8. Subprocessors

8.1 Authorization. Customer authorizes Fanflet to use the Subprocessors listed in Annex 3 and on Fanflet's public list at fanflet.com/legal/subprocessors (the "Subprocessor List").

8.2 Change alerts. Customer may subscribe one or more email addresses to alerts of changes to the Subprocessor List. Email privacy@fanflet.com with the subject line "Subprocessor alerts." or follow the instructions on that page. Fanflet will use a subscribed address only to send those notices. Fanflet will also send change alerts to Customer's notice contacts on the Order Form.

8.3 Notice of new Subprocessors. Fanflet will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessor List and sending a change alert. If Fanflet must replace a Subprocessor urgently for security or for continuity of the Services, Fanflet will give notice as soon as practicable, and Customer's objection right under Section 8.4 still applies.

8.4 Right to object. Customer may object to a new Subprocessor on reasonable data protection grounds by written notice to privacy@fanflet.com before the 30-day notice period ends. For an urgent replacement, Customer may object within 30 days after Fanflet's notice. The parties will discuss the objection in good faith, and Fanflet may propose a change in configuration or a different Subprocessor. If the parties cannot resolve the objection within 30 days after Customer's notice, Customer may terminate the affected Order Form by written notice and receive a pro-rata refund of prepaid Fees for the unused part of the Subscription Term. Customer will not owe a termination fee.

8.5 Removal. Fanflet may stop using a Subprocessor at any time without advance notice and will update the Subprocessor List.

8.6 Flow-down and responsibility. Fanflet puts data protection terms in place with each Subprocessor for the services that Subprocessor provides, and remains responsible for each Subprocessor's performance of those services under this DPA. The Subprocessor List links each provider's terms.

9. Assistance

9.1 Data subject requests. If Fanflet receives a request from a data subject about Customer Personal Data, Fanflet will forward it to Customer promptly and will not respond except to confirm that the request was forwarded, unless the law requires otherwise. Taking into account the nature of the processing, Fanflet will provide reasonable assistance, including through the export and deletion functions in the Services, so Customer can respond.

9.2 Assessments. Fanflet will provide information it reasonably has on hand that Customer needs for a data protection impact assessment, or for a consultation with a regulator, about the Services.

9.3 Cost. Assistance under this Section 9 is included in the Fees. If a request is excessive, the parties will agree on a reasonable fee in advance.

10. Government requests

If a government authority asks Fanflet for Customer Personal Data, Fanflet will try to redirect the authority to Customer. Fanflet will notify Customer promptly unless the law prohibits notice. Fanflet will disclose only what the law requires, after a reasonable challenge to any request Fanflet believes to be unlawful or overbroad.

11. Audits

11.1 Questionnaire and reports. Once every 12 months, on written request, Fanflet will first provide the security descriptions it publishes at fanflet.com/security, will answer one reasonable security questionnaire, and will provide any third-party audit report or certification Fanflet holds, subject to the confidentiality terms of that report. Fanflet does not currently hold its own SOC 2 report or ISO 27001 certification.

11.2 Further audits. If the information under Section 11.1 does not reasonably show compliance with this DPA, or if the law or a regulator requires an audit, or after a Security Incident affecting Customer's personal data, Customer may conduct a remote or on-site audit. Customer may do so no more than once every 12 months, on at least 30 days' written notice, during business hours, at Customer's cost, and under confidentiality terms. An audit will not access other customers' data and will not unreasonably disrupt the Services.

11.3 Findings. Fanflet will address a material finding of non-compliance with this DPA at its own cost, and will do so promptly.

12. Return and deletion

For 30 days after an Order Form ends, Customer may export Customer Personal Data at no charge under Section 8.8 of the Terms. Within 30 days after that export period ends, Fanflet will delete Customer Personal Data from its active systems, unless the law requires Fanflet to keep it. Customer Personal Data that remains in backups is deleted as those backups expire under Fanflet's retention schedule. The schedule is described in the Privacy Policy.

Fanflet will not restore deleted Customer Personal Data from backups except to recover from an incident, and will then delete that restored copy again under this section. Data Fanflet must keep by law remains protected by this DPA until Fanflet deletes it. On request, Fanflet will provide a written certificate of deletion.

13. Location and international transfers

13.1 Location. Fanflet's primary storage of Customer Personal Data is in the United States (Supabase, AWS us-east-1). Fanflet's backups are stored in a backup provider's Eastern North America region. Content delivery, bot protection, and similar edge functions may process data in transit at network locations worldwide. The current list of Subprocessors is at fanflet.com/legal/subprocessors.

13.2 Transfers from Europe, the United Kingdom, and Switzerland. When a transfer of personal data from the European Economic Area, the United Kingdom, or Switzerland needs a transfer tool, the parties incorporate Annex 4 by reference. Annex 4 is part of this DPA. Customer does not need a separate signature for Annex 4 to apply.

14. Sensitive data and health information

The Services are not designed for protected health information under HIPAA, patient information, or other sensitive personal data. Customer will not submit that data, and will not configure surveys, forms, or contact gates to collect it. Fanflet does not offer a Business Associate Agreement under HIPAA, and no business associate agreement applies. If Fanflet becomes aware that such data has been submitted, Fanflet may delete it after notice to Customer.

15. Opt-in sharing terms (controller to controller)

15.1 Fanflet's duties. Fanflet will (a) present a clear consent control and consent text before any Audience Member's contact details are shared with Customer; (b) share only details from Audience Members who give affirmative opt-in consent; (c) keep a record of each consent, including the time, the page, and the consent text version, and provide that record on request; and (d) pass along to Customer, without undue delay, any withdrawal of consent or deletion request Fanflet receives about data already delivered.

15.2 Customer's duties. As an independent controller, Customer will (a) provide its own privacy notice and handle data subject requests about its copy; (b) use Opt-In Contact Data only in a way that is consistent with the consent given; (c) comply with CAN-SPAM, the TCPA, and the Data Protection Laws; (d) honor opt-outs and withdrawals promptly; (e) not sell the data or disclose it to third parties except service providers acting for Customer; and (f) protect it with reasonable security.

15.3 Consent text. Fanflet may update the consent text. Fanflet will give Customer at least 30 days' notice of a material change to that text.

16. Liability

Liability under this DPA is subject to the caps in Section 15 of the Terms. For Fanflet's obligations under this DPA, the data super-cap in Section 15.3 of the Terms applies instead of the general cap. An amount paid under that super-cap also counts toward the general cap, and Fanflet's total liability for all claims combined will not exceed two times the Fees paid and payable in the 12 months before the event giving rise to the liability. Nothing in this DPA limits a right of a data subject that the law does not allow a contract to limit.

17. Term and changes

This DPA lasts for as long as Fanflet processes Customer Personal Data under the Agreement. Fanflet may update this DPA only as Section 19.4 of the Terms describes, except that Fanflet may make a change the Data Protection Laws require, on 30 days' notice. If such a change materially harms Customer, Customer may terminate the affected Order Form and receive a pro-rata refund.

18. Notices

Privacy questions, subprocessor objections, and alert subscriptions under this DPA go to privacy@fanflet.com.

Legal notices go to Fanflet, LLC, PO Box 381, Holly Springs, NC 27540, with an email copy to legal@fanflet.com. Service of process is made on Fanflet's registered agent. The registered agent is for service of process only, and is not an address for notices under this DPA.

Other notices follow Section 19.1 of the Terms. Administrative, billing, and support email goes to hello@fanflet.com.

Annex 1. Details of processing

Item	Description
Subject matter	Provision of Sponsor Studio and Sponsor Producer Services under the Agreement.
Nature of processing	Hosting, storage, display, analysis, reporting, export, transmission, and deletion.
Purpose	To provide, secure, and support the Services for Customer, as the Agreement describes.
Duration	The Subscription Term, plus the 30-day export period and the deletion periods in Section 12.
Data subjects	Customer's Users; individuals named or shown in Sponsor Content; Audience Members whose Opt-In Contact Data Fanflet hosts for Customer; Speakers associated with Customer's Sponsored Seats (name and seat data).
Categories of personal data	User names, business emails, roles, and login data; names and images in Sponsor Content; Opt-In Contact Data (name, business email, title, organization, and consent record); Speaker names and Sponsored Seat details; aggregated engagement metrics linked to Customer's content.
Sensitive data	None. Section 14 prohibits it.
Subprocessors	See Annex 3 and fanflet.com/legal/subprocessors.
Location	Primary storage in the United States (Supabase, AWS us-east-1). Backup storage in Eastern North America. Edge delivery may occur on Subprocessors' worldwide networks (Section 13.1).

Annex 2. Security measures

Fanflet maintains the following measures, appropriate to the size of its business and the nature of the data. The public description is at fanflet.com/security. Where this annex and that page differ on a technical fact, that page controls.

Area	Measures
Encryption	TLS for connections in transit. Encryption at rest for the database and for file storage. Database backups are encrypted with a key Fanflet holds before upload.
Data isolation	Row-level security policies separate each account's data.
Access control	Role-based access and administrative authentication with privilege checks. Personnel have least-privilege access, and access is removed when it is no longer needed.
Minimization	A phone number used for the text-message bookmark is stored only as a keyed one-way hash (HMAC-SHA256). The phone number itself is not stored. Identifiable event detail is kept for 90 days.
Secure development	Code review before a production release. Regular security reviews of code and infrastructure. Dependencies are monitored, and known vulnerabilities are patched.
Logging and monitoring	Identifiable event detail and staff account-access logs are kept for the periods in the Privacy Policy. Those periods are 90 days. Fanflet monitors for anomalous activity.
Backups and recovery	The database provider takes a daily backup and keeps it for 7 days. Fanflet takes its own database backup every 6 hours, encrypts it with a Fanflet-held key, and keeps that backup for 30 days. Stored files are copied nightly to separate backup storage, and the provider encrypts those copies at rest. File archives and copies taken before an account erasure expire under the retention schedule in the Privacy Policy. A production backup was restored into a separate test environment on September 13, 2026. Fanflet plans to repeat that test every quarter.
Vendor management	Fanflet puts data protection terms in place with each Subprocessor and reviews that provider's security posture before engagement and on a recurring basis. The public list links each provider's terms.
Incident response	A written incident response procedure, including the notice in Section 7, which Fanflet sends no later than 72 hours after it confirms a Security Incident.
Personnel	Confidentiality obligations, and security awareness training, for anyone with access to Customer Personal Data.
Hosting	Primary database and file storage in the United States (Supabase, AWS us-east-1). Backups in Eastern North America. Edge delivery through providers' worldwide networks.

Annex 3. Subprocessors

Public list. Fanflet's current Subprocessors, including purpose, the personal data involved, location, and a link to each provider's terms, are published at fanflet.com/legal/subprocessors. That page is the list this DPA incorporates.

Change alerts. Customer may subscribe by emailing privacy@fanflet.com with the subject line "Subprocessor alerts." Fanflet will give at least 30 days' notice before a new Subprocessor processes Customer Personal Data. Customer may object under Section 8.4.

Customer-enabled integrations. HubSpot, Zapier, AI assistants that use Fanflet's connector, and Google sign-in receive data only when Customer or a User enables them. Customer directs those transfers, so those providers are not Fanflet Subprocessors of Customer Personal Data. They are listed on the public page for transparency.

Fanflet marketing tools. Google Tag Manager, Google Analytics, and the Meta pixel are used for Fanflet's own marketing. They load only on Fanflet marketing pages and on the exact path /start, and only where the cookie choice on that page allows them. They are not Subprocessors of Customer Personal Data.

Annex 4. International transfer terms

The parties incorporate the following by reference. They apply when a transfer of personal data from the European Economic Area, the United Kingdom, or Switzerland needs a transfer tool.

The Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914. Module Two applies when Customer is a controller and Fanflet is a processor. Module Three applies when Customer is a processor and Fanflet is a sub-processor.
The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018. It applies to transfers from the United Kingdom and to the modules named above.

For those Clauses:

Clause 7 (the docking clause) is included.
Clause 9 uses Option 2 (general written authorization), with the notice period in Section 8.
The optional independent redress body in Clause 11 is not used.
Clause 17: the Clauses are governed by the law of Ireland.
Clause 18: disputes under the Clauses go to the courts of Ireland.
Annex I of the Clauses is completed by Sections 1 and 2 of this DPA, by Annex 1 of this DPA, and by the details of Customer's account.
Annex II of the Clauses is completed by Annex 2 of this DPA and by fanflet.com/security.
Annex III of the Clauses is the list at fanflet.com/legal/subprocessors.

If the Clauses or the UK Addendum conflict with the rest of this DPA on a transfer, the Clauses or the UK Addendum control.

For a transfer from Switzerland, references in the Clauses to the GDPR are read as references to the Swiss Federal Act on Data Protection, and references to the European Union or a Member State are read to include Switzerland, where the transfer requires that reading.