Data Processing Addendum

Effective October 23, 2026.

This Data Processing Addendum ("DPA") forms part of the Breaker Terms of Service (the "Terms") between Breaker Technologies, Inc. ("Breaker") and the customer that accepted the Terms ("Customer"). It applies where Breaker processes Subscriber Data on Customer's behalf and Data Protection Laws apply to that processing. Capitalized terms not defined here have the meaning given in the Terms. If this DPA conflicts with the Terms, this DPA controls as to the processing of Subscriber Data; if the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.

1. Definitions

"Data Protection Laws" means all laws that apply to the processing of personal data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), and other U.S. state privacy laws.

"Subscriber Data" has the meaning in the Terms: personal data about Customer's subscribers and contacts that Customer uploads to, collects through or generates in the Services, including email addresses, names, custom fields, tags and segments, and engagement events such as opens, clicks, bounces and unsubscribes.

"Personal data", "controller", "processor", "data subject", "processing", "supervisory authority" and "personal data breach" have the meanings given in the GDPR. "Business", "service provider", "sell" and "share" have the meanings given in the CCPA, and the GDPR terms are read as their CCPA equivalents where the CCPA applies.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor). "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.

"Subprocessor" means a third party engaged by Breaker to process Subscriber Data on Breaker's behalf.

2. Roles and scope

As between the parties, Customer is the controller (or business) of Subscriber Data and Breaker is a processor (or service provider). Customer may itself be a processor for another controller; in that case Customer warrants that it is authorized to give Breaker the instructions in this DPA on that controller's behalf, and Breaker is a subprocessor.

This DPA does not apply to personal data Breaker collects as a controller, such as Customer's account, billing and usage data and data about visitors to Breaker's own websites. The Privacy Policy covers that data.

Annex I describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

3. Customer's instructions and obligations

Documented instructions. Customer instructs Breaker to process Subscriber Data: (a) to provide, maintain, secure and support the Services as described in the Terms and the Documentation, and as Customer configures them, including sending email, hosting published pages, running automations, and serving the API and MCP server to the clients Customer connects; (b) to detect and block spam, fraud, bots and automated traffic, including by operating RealClick across customer accounts; (c) to maintain global unsubscribe and complaint suppression lists; (d) to create aggregated or de-identified data that no longer identifies Customer or any individual, which Breaker may use to build and improve deliverability, click-verification, AI and other features; (e) to improve the Services as permitted by Section 4 of the Terms; and (f) as otherwise documented in writing by Customer and accepted by Breaker, including through the settings and features of the Services. The Terms, this DPA and Customer's use of the Services are Customer's complete and final instructions.

Additional instructions. Breaker will consider reasonable additional written instructions, and may charge for work they require. Breaker will tell Customer if, in its opinion, an instruction infringes Data Protection Laws, but is not obliged to carry out a legal review.

Customer obligations. Customer is responsible for: the accuracy, quality and lawfulness of Subscriber Data and the means by which it was obtained; having a lawful basis, and any consent needed, for each subscriber, including for open and click tracking in the subscriber's jurisdiction; giving subscribers the privacy notices Data Protection Laws require; responding to data subject requests; and ensuring its instructions comply with Data Protection Laws. Customer will not upload the sensitive personal data listed in the Acceptable Use Policy.

4. Breaker's obligations

Processing on instructions. Breaker will process Subscriber Data only on Customer's documented instructions, unless required to do otherwise by law that applies to Breaker, in which case Breaker will inform Customer of that requirement before processing unless the law prohibits it.

Confidentiality. Breaker ensures that personnel authorized to process Subscriber Data are bound by written confidentiality obligations and receive appropriate training, and limits access to those who need it to perform their role.

Security. Breaker will implement and maintain the technical and organizational measures described in Annex II, and may update them provided the overall level of protection does not fall. Breaker will not re-identify any de-identified data created under this DPA.

Data subject requests. Breaker will, taking into account the nature of the processing, assist Customer with appropriate technical and organizational measures to respond to data subject requests, principally through the export, correction, suppression and deletion functions in the Services and the API. If Breaker receives a request from a subscriber of Customer, it will forward it to Customer without responding, except that Breaker will honor an unsubscribe request directly and keep a record of it, as the Terms describe.

Assistance. Breaker will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to the Services and Customer cannot obtain the information elsewhere. Breaker may charge for assistance beyond what the Services and Documentation provide.

Personal data breach. Breaker will notify Customer without undue delay, and in any event within 72 hours, after confirming a personal data breach affecting Subscriber Data, by email to the address on Customer's account. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Breaker will update the notice as information becomes available and will cooperate reasonably with Customer's own notification obligations. Breaker's notice is not an admission of fault. Unsuccessful attempts, such as blocked login attempts or scans, are not breaches.

Deletion and return. Customer may export Subscriber Data from the Services at any time during the term using the export functions and the API, and should do so before terminating. After termination of the Services, Breaker will delete Subscriber Data within a reasonable period in line with its standard retention practices, except where law requires Breaker to keep it, and except for unsubscribe and complaint suppression records, which Breaker keeps so that opt-outs continue to be honored. Any copies retained in backups remain subject to this DPA until deleted.

Records and audits. Breaker will keep records of its processing of Subscriber Data as Data Protection Laws require. On written request no more than once in any 12-month period, Breaker will make available information reasonably necessary to demonstrate compliance with this DPA, in the first instance through its security documentation, questionnaire responses and any third-party audit reports or certifications it holds. If those are not reasonably sufficient, Customer or an independent auditor bound by confidentiality may audit Breaker's relevant controls on 30 days' written notice, during business hours, no more than once a year unless a supervisory authority requires otherwise or a breach has occurred, in a way that does not disrupt Breaker's business or expose other customers' data, and at Customer's cost.

5. Subprocessors

General authorization. Customer authorizes Breaker to engage the Subprocessors listed at joinbreaker.ai/subprocessors (Annex III) and to engage new or replacement Subprocessors as set out below. Breaker will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible to Customer for each Subprocessor's performance.

Notice and objection. Breaker will give Customer at least 10 days' notice before a new Subprocessor processes Subscriber Data, by updating the subprocessor page or emailing the address on Customer's account or a notification list Customer can subscribe to on that page. Customer may object on reasonable data protection grounds within that period by emailing privacy@joinbreaker.ai. The parties will discuss the objection in good faith. If Breaker cannot reasonably accommodate it, Customer may terminate the affected Services on written notice, and Breaker will refund any prepaid fees for the unexpired term as Customer's sole remedy. Breaker may engage a replacement Subprocessor without the notice period where needed to maintain the Services, provided Breaker notifies Customer as soon as practicable afterwards.

6. International transfers

Breaker is established in the United States and processes Subscriber Data there and in the countries where its Subprocessors operate. Customer authorizes those transfers, subject to this Section.

EEA transfers. Where Customer transfers personal data subject to the GDPR to Breaker, the SCCs are incorporated into this DPA and apply as follows: Customer is the "data exporter" and Breaker the "data importer"; Module Two applies; Clause 7 (docking) is included; in Clause 9, Option 2 (general written authorization) applies with the notice period in Section 5; the optional language in Clause 11(a) is not included; in Clause 13, the supervisory authority identified in Annex I.C applies; in Clause 17, Option 1 applies and the governing law is the law of Ireland; in Clause 18, the courts of Ireland have jurisdiction; Annexes I, II and III of this DPA serve as Annexes I, II and III of the SCCs.

UK transfers. Where Customer transfers personal data subject to the UK GDPR to Breaker, the SCCs as set out above apply as amended by the UK Addendum. Table 1 is completed with the parties' details in Annex I; Table 2 refers to the SCCs as completed above; Table 3 refers to Annexes I, II and III of this DPA; and in Table 4, either party may end the UK Addendum as set out in its Section 19.

Swiss transfers. Where Customer transfers personal data subject to the FADP to Breaker, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to "Member State" are read to include Switzerland; and Swiss data subjects may enforce their rights in Switzerland.

Alternative mechanisms. If Breaker adopts an alternative lawful transfer mechanism, such as certification under a data privacy framework recognized by the European Commission, Breaker may rely on it in place of the SCCs for the transfers it covers, and will say so on the subprocessor page. If a transfer mechanism is invalidated, the parties will cooperate in good faith to put a replacement in place.

7. CCPA and U.S. state privacy laws

Where the CCPA applies, Breaker is a service provider to Customer, and Customer discloses Subscriber Data to Breaker only for the limited and specified business purposes in Section 3 and Annex I. Breaker will not: (a) sell or share Subscriber Data; (b) retain, use or disclose Subscriber Data for any purpose other than those business purposes, including for any commercial purpose other than providing the Services, or outside the direct business relationship between Breaker and Customer; or (c) combine Subscriber Data with personal data Breaker receives from or on behalf of another person, or collects from its own interaction with a consumer, except as the CCPA regulations permit a service provider to do (for example to detect security incidents and fraud, to perform internal uses that build or improve the Services, or to comply with law). Breaker does not use Subscriber Data to enrich any contact records it holds for its own purposes or on behalf of other customers.

Breaker will comply with the CCPA and give Subscriber Data the level of privacy protection it requires; will notify Customer if it determines it can no longer meet its obligations under the CCPA; and grants Customer the right to take reasonable and appropriate steps to ensure Breaker uses Subscriber Data consistently with Customer's obligations, and to stop and remediate unauthorized use. Breaker will cooperate with Customer in responding to verifiable consumer requests. Breaker certifies that it understands and will comply with these restrictions.

Where another U.S. state privacy law applies, this DPA is the contract between controller and processor that the law requires, and the terms above apply with the equivalent meanings under that law.

8. Liability, term and general

Liability. Each party's liability under or in connection with this DPA, including the SCCs, is subject to the exclusions and limits of liability in the Terms, which apply in aggregate across the Terms and this DPA. Nothing in this Section limits a data subject's rights under the SCCs or a party's liability that cannot be limited by law.

Term. This DPA takes effect when Customer accepts the Terms and continues until Breaker deletes all Subscriber Data under Section 4, even if the Terms terminate earlier.

Changes. Breaker may update this DPA where required by a change in Data Protection Laws or an approved transfer mechanism, with notice as the Terms describe. Other changes require written agreement.

Governing law. This DPA is governed by the law that governs the Terms, except where the SCCs or Data Protection Laws require otherwise.

Annex I: Description of the processing

A. Parties. Data exporter: Customer, whose name and address are those on its Breaker account; contact: the account owner's email address; role: controller. Data importer: Breaker Technologies, Inc., 1401 Lavaca St #918, Austin, TX 78701, United States; contact: privacy@joinbreaker.ai; role: processor.

B. Description of the transfer.

C. Competent supervisory authority. The supervisory authority of the EU Member State in which Customer (the data exporter) is established or, if Customer is not established in the EU, the authority of the Member State in which Customer's representative is established or in which the data subjects are located, as Clause 13 of the SCCs provides.

Annex II: Technical and organizational measures

Breaker maintains the following measures. They are reviewed at least annually and updated as the threat landscape and the Services change.

• Encryption. TLS 1.2 or higher for data in transit between subscribers, Customer, AI clients and the Services; encryption at rest for databases, object storage and backups using the cloud provider's managed encryption.
• Access control. Role-based access on a least-privilege basis; multi-factor authentication for Breaker staff on production systems and administrative consoles; unique accounts, no shared credentials; access reviewed when roles change and on departure; production access logged.
• Credential storage. Customer passwords stored as salted hashes; API keys stored hashed and shown once at creation; OAuth tokens encrypted at rest.
• Tenant separation. Subscriber Data is logically separated by account, and every API and MCP request is scoped to the authenticated account.
• Logging and monitoring. Centralized application and infrastructure logging, alerting on errors and anomalous activity, and retention of security logs for investigation.
• Vulnerability management. Dependency and infrastructure patching on a defined cadence, with critical fixes expedited; security review of significant changes before release; a security contact at security@joinbreaker.ai for responsible disclosure.
• Backups and resilience. Automated backups; infrastructure hosted in redundant cloud availability zones.
• Personnel. Confidentiality obligations for all staff and contractors; security awareness training; background checks where lawful.
• Vendor management. Subprocessors assessed before engagement and bound by written data protection terms; the list in Annex III kept current.
• Data minimization and deletion. Engagement event logs and server logs retained only as long as needed for security, deliverability, maintenance and legal purposes; deletion on termination under Section 4.

Annex III: Subprocessors

The current list is published at joinbreaker.ai/subprocessors.