Data Processing Addendum

Last updated: November 3, 2026 · Version 1.0

This Data Processing Addendum ("DPA") is part of the Master Services Agreement between Zoey OS, LLC ("Zoey OS") and Customer (the "Agreement"). Capitalized terms not defined here have the meanings in the Agreement. It also applies to a business using Zoey's business services under the Business Terms of Service, with "Agreement" meaning those terms.

1. Definitions

• "Customer Personal Data" means personal data in Customer Data that Zoey OS processes for Customer in providing the Services, including End-Customer Data and, for a White Label Customer, End Client data.

• "Data Protection Laws" means all laws on personal data that apply to the processing, including, as applicable, the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws, and Canadian, Australian and New Zealand privacy law.

• "Data Subject" means the person a piece of personal data is about.

• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.

• "Process" means any operation on personal data, automated or not.

• "Subprocessor" means a third party Zoey OS engages to process Customer Personal Data.

• "Transfer Mechanism" means the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful basis for an international transfer.

2. Roles

2.1 Zoey OS as processor. For Customer Personal Data, Customer is the controller (or a processor acting for its own clients) and Zoey OS is the processor (or, for a White Label Customer's End Client data, a subprocessor). Zoey OS processes Customer Personal Data only to provide the Services.

2.2 Zoey OS as controller of its own data. Zoey OS is a separate, independent controller (and not Customer's processor) for: (a) business contact details of Customer's personnel used to run the relationship (contracts, billing, notices, support); (b) its own website, sales and marketing data, including leads from its booking and contact forms; (c) account security, fraud-prevention and service-operation data (for example, sign-in records and error logs) used to keep the Services secure; and (d) records it must keep by law. Its Privacy Policy covers that processing.

2.3 Customer's instructions. Customer's documented instructions are the Agreement, this DPA, the Order Form, the Approved Playbooks and Customer's settings in the Zoey app. Zoey OS will tell Customer if it believes an instruction breaks Data Protection Laws.

2.4 Customer's duties. Customer is responsible for having a lawful basis for the processing, giving Data Subjects the notices the law requires, and obtaining any consent needed, including consent for calls and texts (MSA Section 5.4).

3. What Zoey OS will and will not do

3.1 Zoey OS will not:

• process Customer Personal Data for any purpose other than providing the Services;

• sell or share Customer Personal Data (as the CCPA defines those terms), or use it for cross-context behavioral advertising;

• combine it with personal data from other sources, except as needed to provide the Services or as the CCPA allows;

• use it to train, fine-tune or improve AI models (MSA Section 9.6); or

• try to re-identify de-identified data.

3.2 Zoey OS makes sure everyone it lets process Customer Personal Data is bound by confidentiality.

3.3 CCPA. Zoey OS is a "service provider" (or "contractor") under the CCPA, certifies that it understands these restrictions, and will tell Customer if it can no longer meet them.

4. Subprocessors

4.1 Authorization. Customer authorizes the Subprocessors on the Subprocessor List at zoeyos.com/legal/subprocessors, which is part of this DPA (Annex 3).

4.2 Notice of changes. Zoey OS will give at least 30 days' notice before adding or replacing a Subprocessor, by email to the contacts Customer names or by Portal notice. Customers can subscribe to updates at legal@zoeyos.com.

4.3 Objection. Customer may object on reasonable data-protection grounds within 15 days of notice. The Parties will try in good faith to resolve it within 30 days. If they cannot, Customer may switch off the affected Service without the Package minimum applying, and Zoey OS refunds prepaid fees for it.

4.4 Terms with Subprocessors. Zoey OS has written terms with each Subprocessor that protect Customer Personal Data at least as well as this DPA, as far as they apply to the Subprocessor's service, and remains responsible for its Subprocessors.

4.5 Customer-provided AI key. Under the Customer-provided-key election (MSA Section 6.5), the AI Provider processes data under Customer's own agreement with it and is not Zoey OS's Subprocessor for that processing.

4.6 Platforms Customer connects. Platforms Customer connects its own accounts to (for example, Instagram, Facebook, TikTok, Google Business Profile, property-management software and marketplaces) are not Zoey OS's Subprocessors. Customer's own terms with them govern what they do with data.

5. Security

5.1 Zoey OS maintains the measures in Annex 2, appropriate to the risk.

5.2 Zoey OS may update those measures if the update does not lower overall protection.

6. Personal Data Breaches

6.1 Zoey OS will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach.

6.2 The notice will include, as far as then known: what happened; the categories and approximate numbers of Data Subjects and records; likely consequences; and the measures taken or proposed. Zoey OS will add information as it learns more, take reasonable steps to contain the breach, and help Customer meet its own notification duties.

6.3 Notifying Customer is not an admission of fault.

7. Help with Data Subject requests and assessments

7.1 Zoey OS will help Customer, through the Services' features or otherwise, respond to Data Subject requests (access, deletion, correction, portability, objection and others).

7.2 If a Data Subject contacts Zoey OS directly about Customer Personal Data, Zoey OS will tell Customer within 5 business days and will not respond itself except to direct the person to Customer, unless the law requires.

7.3 Zoey OS will give reasonable help with data protection impact assessments and consultations with authorities, at Customer's reasonable cost.

8. Return and deletion

8.1 When the Agreement ends, Zoey OS makes Customer Personal Data available for export for 30 days (MSA Section 14.7(c)), then deletes it from production systems within 30 days.

8.2 Backup copies are deleted as backups expire, within to confirm: BACKUP RETENTION — the repo shows nightly encrypted backups with a 30-day lifecycle for Communications and provider snapshots kept 7 to 28 days; confirm the longest retention across every system. Until then they stay protected by this DPA and are not used.

8.3 Zoey OS will confirm deletion in writing on request.

8.4 Zoey OS may keep data the law requires it to keep, protected by this DPA, for as long as required.

9. Audits

9.1 Zoey OS keeps records needed to show it complies with this DPA.

9.2 Once a year, on written request, Zoey OS will answer a reasonable security questionnaire and provide available summaries of its controls.

9.3 If that is not enough to meet a legal requirement, Customer's independent auditor (bound by confidentiality) may audit, with at least 30 days' notice, during business hours, limited to Customer's data and the relevant controls, at Customer's cost, and without access to other customers' data or to the restricted areas in Addendum 1 Section 3.

10. International transfers

10.1 Zoey OS processes Customer Personal Data in the United States (MSA Section 8.3).

10.2 EU / EEA. For transfers from the EEA to a country without an adequacy decision, the Parties agree to the EU Standard Contractual Clauses, to confirm: MODULE TWO (controller to processor) / MODULE THREE (processor to processor), incorporated by reference, with these choices: to confirm: Clause 7 docking: yes/no; to confirm: Clause 9 option and notice period; to confirm: Clause 11 redress option; to confirm: Clause 13 supervisory authority; to confirm: Clause 17 governing law; to confirm: Clause 18 courts. Annex 1 is Annex I.B of the SCCs and Annex 2 is Annex II.

10.3 UK. For UK transfers, the UK International Data Transfer Addendum to the EU SCCs applies, with to confirm: TABLE 1–4 DETAILS.

10.4 Switzerland. For Swiss transfers, the EU SCCs apply with the changes the Swiss FADP requires: to confirm: DETAILS.

10.5 Government requests. If a government asks Zoey OS for Customer Personal Data, Zoey OS will try to redirect it to Customer, tell Customer (unless the law forbids it), and disclose only what the law compels. to confirm: whether to state that no government request has been received

11. Health information

PHI is processed only under a signed BAA (MSA Section 5.5(b)). The BAA governs PHI if it conflicts with this DPA.

12. Precedence and term

12.1 This DPA ranks under MSA Section 15.7(b). If the SCCs conflict with this DPA, the SCCs win.

12.2 This DPA lasts as long as Zoey OS processes Customer Personal Data.

ANNEX 1 — DETAILS OF PROCESSING

ANNEX 2 — TECHNICAL AND ORGANIZATIONAL MEASURES

Stated measures were found in the repo's architecture and status docs on 2026-11-03 (sources listed in README). Bracketed items need confirmation before this Annex is signed.

ANNEX 3 — SUBPROCESSORS

The current list is the Business Subprocessor List at zoeyos.com/legal/subprocessors (draft: 10_Subprocessor_List_Business_v1_DRAFT.md).

The Zoey V2 consumer app has its own documents at zoeyos.com/legal/consumer.