Data Processing Addendum

“Applicable Data Protection Law” means all United States federal and state privacy, data protection, data security and communications-interception laws applicable to the Processing of Customer Personal Data under this DPA, including US State Privacy Laws, state data breach notification statutes, and state wiretapping, eavesdropping and pen register statutes as applied to online tracking technologies.

“US State Privacy Laws” means the California Consumer Privacy Act as amended by the CPRA (“CCPA”), the Virginia CDPA, the Colorado Privacy Act, the Connecticut CTDPA, the Utah UCPA, the Texas TDPSA, the Oregon OCPA, the Montana MCDPA, and any other comparable US state privacy statute in effect and applicable to the Services.

“Marketing Data” means event, identifier and attribution data generated by visitors to and users of Customer’s marketing properties, together with associated lead, contact, order and opportunity records used for conversion measurement and, where Customer subscribes to the Journey Add-on, journey and attribution reporting, as described in Annex A.

“Journey Add-on” means the optional, separately purchased customer journey and attribution add-on to the Services, which stores Journey Data so that FirstParty can present end-user journeys and attribution reporting to Customer.

“Journey Data” means the Marketing Data that FirstParty stores on a persistent basis to provide the Journey Add-on, including event, session, touchpoint, conversion, and order or lead records and associated contact identifiers (which may be stored in plain text), as described in Annex A.4. Journey Data is Customer Personal Data to the extent it contains Personal Data.

“CMP” means the consent management platform, cookie banner, or other consent or preference tool that Customer uses on its properties. “Consent Signal” means the consent or opt-out state of an end user as communicated by Customer’s CMP, including through Google Consent Mode v2.

“Customer Personal Data” means Personal Data contained within the Marketing Data that FirstParty Processes on behalf of Customer in the course of providing the Services. Customer Personal Data does not include Excluded Data.

“Excluded Data” means any data that Customer Processes on behalf of its own customers or end clients in a processor or service provider capacity, including without limitation applicant, candidate, patient, student, employee, member or subscriber records held within Customer’s own product or platform. Excluded Data is outside the scope of the Services and of this DPA. See Section 3.

“Ad Platform” means a third-party advertising, analytics, marketing or measurement platform to which Customer directs FirstParty to transmit Marketing Data, including Google Ads, Google Analytics, Meta, LinkedIn, Microsoft Advertising, TikTok, Reddit, Pinterest, Snapchat, OpenAI, Klaviyo and any other destination Customer configures. A representative list is at Annex D.

“Services” means the server-side tag management, event collection, identifier persistence and conversion forwarding services FirstParty provides under the Agreement, together with the Journey Add-on where Customer subscribes to it.

“Sub-processor” means any third party engaged by FirstParty to Process Customer Personal Data on FirstParty’s behalf in connection with the Services. The current list is set out at Annex C.

“Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household, as defined under US State Privacy Laws. It includes “Personal Information” as defined in the CCPA.

“Business”, “Service Provider”, “Consumer”, “Sell”, “Share” and “Sensitive Personal Information” have the meanings given in the CCPA. “Controller”, “Processor”, “Targeted Advertising” and “Data Protection Assessment” have the meanings given in the applicable US State Privacy Law.

“Process” or “Processing” means any operation performed on Personal Data, whether or not by automated means, including collection, use, storage, disclosure, transmission, analysis, modification and deletion.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data Processed by FirstParty, including any event constituting a “breach of the security of the system” or equivalent under an applicable state breach notification statute.

2.1 Roles. With respect to Customer Personal Data, Customer is the Business (California) and Controller (all other applicable US State Privacy Laws), and FirstParty is the Service Provider (California) and Processor (all other applicable US State Privacy Laws). Each party is independently responsible for compliance with its own obligations under Applicable Data Protection Law.

2.2 Details of Processing. The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Consumers are set out in Annex A.

2.3 Documented instructions. FirstParty Processes Customer Personal Data only on Customer’s documented instructions, unless required otherwise by law. The Agreement, this DPA, and the tag, event and destination configuration approved by Customer within its server-side container together constitute Customer’s complete and final documented instructions. Additional or alternate instructions must be agreed in writing and may be subject to additional fees.

2.4 Unlawful instructions. FirstParty will notify Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend performance of the affected instruction until it is confirmed, amended or withdrawn.

2.5 No Sale or Share. FirstParty will not: (a) Sell or Share Customer Personal Data; (b) retain, use or disclose Customer Personal Data for any purpose other than performing the Services, or as otherwise permitted by the CCPA; (c) retain, use or disclose Customer Personal Data outside the direct business relationship between the parties; or (d) combine Customer Personal Data with Personal Information received from or on behalf of any other person, or collected from its own interactions with a Consumer, except as permitted under the CCPA. FirstParty certifies that it understands and will comply with these restrictions.

2.6 Customer responsibilities. Customer is solely responsible for:

• the accuracy, quality and legality of Customer Personal Data and the means by which it was acquired;
• establishing and maintaining a valid legal basis, and where required obtaining and honoring valid end-user consent, for the collection of Marketing Data and its transmission to each Ad Platform;
• the selection, deployment, configuration, maintenance and correct operation of its CMP, including its implementation of Google Consent Mode v2, its default consent states and regional settings, and the transmission of accurate Consent Signals to the Services;
• ensuring that, where the law requires consent before tracking, no tag, script or event subject to that requirement fires before the end user has consented, and that declining is as available to the end user as accepting;
• maintaining accurate and complete privacy notices, including any notice at collection required under the CCPA, describing the Processing (including, where Customer uses the Journey Add-on, the association of browsing and purchase activity with identifiable individuals) and each category of third party to which Personal Data is disclosed; and
• its own agreements and data protection terms with each Ad Platform.

2.7 Tracking technologies and interception statutes. The Services operate tracking technologies on Customer’s web properties at Customer’s direction. Customer acknowledges that the deployment of such technologies is subject to state wiretapping, eavesdropping and pen register statutes as those statutes have been applied to online tracking. Customer is responsible for determining what disclosures and consents are required in the jurisdictions where its users are located, and for obtaining them. FirstParty makes no representation that any particular configuration of the Services satisfies those requirements.

2.8 Consent integration. At initial setup, FirstParty configures the Services to detect and respect Consent Signals communicated through Google Consent Mode v2 and to adjust the collection, storage and forwarding of Marketing Data based on those signals. Customer instructs FirstParty to Process Marketing Data in accordance with the Consent Signals the Services receive. The Services do not independently determine whether consent is legally required, whether it was validly obtained, or what an end user chose.

2.9 Dependence on Customer’s CMP. The consent integration operates as designed only if Customer’s CMP is correctly installed, configured and maintained and correctly implements Google Consent Mode v2. If Customer has no CMP, or its CMP is misconfigured, does not support or incorrectly implements Google Consent Mode v2, loads late, fails to block tags before consent, fails to detect opt-out preference signals, or is changed after setup by Customer or any third party, the Services may Process Marketing Data without a valid consent, or may fail to Process data Customer expects. Such Processing is performed on Customer’s instructions under Section 2.3 and is not a breach of this DPA by FirstParty. FirstParty has no obligation to monitor Customer’s properties or CMP.

2.10 No legal advice. Any setup, configuration, audit, review or recommendation FirstParty provides in connection with consent or privacy compliance is informational only, is not legal advice, and does not transfer any compliance responsibility to FirstParty.

2.11 Extension of Customer. FirstParty Processes Customer Personal Data solely as a tool operated on Customer’s behalf. FirstParty has no right to, and does not, use the contents of communications between Customer and its end users, or any Customer Personal Data, for its own purposes.

3.1 The Services are designed to measure Customer’s own marketing properties and signup or lead funnels. Many FirstParty customers operate platforms in which they act as a processor or service provider for their own customers. Data of that kind is Excluded Data and is outside the scope of this DPA.

3.2 Customer will not configure, transmit, or otherwise cause Excluded Data to be sent to FirstParty or to any Ad Platform through the Services.

3.3 If FirstParty becomes aware that Excluded Data has been transmitted to it, FirstParty will promptly notify Customer and will, at Customer’s direction, delete the data or cease Processing it.

3.4 Nothing in this DPA appoints FirstParty as a sub-processor of Customer’s own customers or end clients.

4.1 Independent capacity. Each Ad Platform determines the purposes and means of its own Processing of data it receives and, in respect of that data, acts as a service provider to Customer or as a third party under that Ad Platform’s own terms, not as a Sub-processor of FirstParty. Ad Platforms are listed at Annex D for transparency, not as Sub-processors under Section 8.

4.2 Direct relationship. Customer is responsible for entering into and maintaining any required data protection terms directly with each Ad Platform, including as applicable the Google Ads Data Processing Terms, the Meta Business Tools Terms, and the LinkedIn Ads Agreement.

4.3 FirstParty’s role. FirstParty’s role with respect to Ad Platforms is limited to transmitting Marketing Data to the destinations and in the payload configuration instructed by Customer. FirstParty does not control, and is not responsible for, an Ad Platform’s Processing of data once received.

5.1 FirstParty treats Customer Personal Data as confidential and ensures that persons authorized to Process it are bound by an appropriate obligation of confidentiality, whether contractual or statutory.

5.2 FirstParty limits access to Customer Personal Data to personnel who require it to perform the Services, and applies the principle of least privilege to administrative access to the infrastructure described in Annex B.

6.1 Measures. FirstParty implements and maintains the technical and organizational measures set out in Annex B, taking into account the state of the art, the costs of implementation, the nature and purposes of Processing, and the risk to Consumers.

6.2 Architecture. The core Services are designed to Process Customer Personal Data transiently: events are received, transformed and forwarded to configured Ad Platforms without FirstParty creating a persistent database of Customer Personal Data, other than the limited operational logging described in Annex A.6 and Annex B.5. Where Customer subscribes to the Journey Add-on, Customer instructs FirstParty to store Journey Data persistently for the purposes and periods set out in Section 15 and Annex A, using the measures described in Annex B.

6.3 Changes. FirstParty may update the measures in Annex B from time to time, provided the updated measures do not materially decrease the overall level of protection of Customer Personal Data.

6.4 Customer assessment. Customer is responsible for independently determining whether the measures in Annex B meet its requirements and obligations under Applicable Data Protection Law.

7.1 Assistance. Taking into account the nature of the Processing, FirstParty provides reasonable assistance to Customer, insofar as it is able, in fulfilling Customer’s obligations to respond to verifiable Consumer requests to know, access, delete, correct, or opt out of the Sale, Sharing, or use for Targeted Advertising of Personal Data.

7.2 Requests received directly. If FirstParty receives a Consumer request relating to Customer Personal Data, it will not respond substantively except to acknowledge receipt and direct the Consumer to Customer, and will forward the request to Customer without undue delay.

7.3 Deletion requests. On receiving a verified deletion request from Customer, FirstParty will delete any Customer Personal Data within its possession or control and, where technically feasible, transmit a corresponding deletion request to those Ad Platforms that expose an API supporting one. FirstParty cannot compel deletion within an Ad Platform.

7.4 Limits of assistance. Customer Personal Data Processed by the Services consists substantially of pseudonymous online identifiers and hashed values that FirstParty cannot, without additional information supplied by Customer, associate with an identified Consumer. FirstParty’s assistance obligations are limited accordingly. Journey Data may include plain-text contact identifiers; where Customer supplies the email address or phone number a verified request relates to, FirstParty will locate, provide, correct or delete matching Journey Data as Customer instructs. Records held in Customer’s CRM, consent management platform, or an Ad Platform are within Customer’s or that platform’s control, not FirstParty’s.

8.1 General authorization. Customer grants FirstParty general authorization to engage Sub-processors to Process Customer Personal Data, subject to this Section 8. The current list is set out at Annex C.

8.2 Flow-down. FirstParty enters into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for each Sub-processor’s performance.

8.3 Notice and objection. FirstParty will provide at least thirty (30) days’ notice by email to Customer’s designated contact, and by updating Annex C, before authorizing a new Sub-processor. Customer may object on reasonable data protection grounds within fifteen (15) days of notice. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Services without penalty, and FirstParty will refund any prepaid fees covering the remainder of the terminated term.

8.4 Add-on Sub-processors. Sub-processors identified in Annex C as used only for the Journey Add-on Process Customer Personal Data only for Customers that subscribe to the Journey Add-on. By subscribing to the Journey Add-on, Customer specifically authorizes those Sub-processors.

9.1 FirstParty will notify Customer without unreasonable delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Personal Data.

9.2 The notification will describe, to the extent known and updated as further information becomes available: the nature of the Security Incident, including where possible the categories and approximate number of Consumers and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a point of contact for further information.

9.3 FirstParty will provide reasonable cooperation and assistance in connection with Customer’s obligations under applicable state breach notification statutes. Customer is solely responsible for determining whether notification is required and for making any such notification. FirstParty will not make any public statement or regulatory notification that identifies Customer without Customer’s prior written consent, unless required by law.

9.4 FirstParty’s notification of or response to a Security Incident is not an acknowledgement of fault or liability.

10.1 Processing under this DPA includes Processing of Personal Data for purposes of Targeted Advertising, which may require Customer to conduct and document a data protection assessment under the Virginia CDPA, the Colorado Privacy Act, the Connecticut CTDPA, the Texas TDPSA, or other applicable US State Privacy Laws, and to conduct risk assessments under the CCPA regulations as and when those requirements take effect.

10.2 FirstParty provides reasonable assistance and such information as is reasonably available to it to support any such assessment. Customer remains responsible for conducting, documenting and retaining it.

11.1 On termination or expiry of the Agreement, or earlier on Customer’s written request, FirstParty will cease Processing Customer Personal Data and will, at Customer’s election, delete or return all Customer Personal Data then in its possession or control, and delete existing copies, within thirty (30) days, unless retention is required by law.

11.2 Where retention is legally required, FirstParty will isolate and protect the data from further Processing except as required by that law, and will inform Customer unless prohibited from doing so. FirstParty may also retain Customer Personal Data to the extent reasonably necessary to preserve evidence of, or establish, exercise or defend, a pending or reasonably anticipated legal claim, subject to the same protections.

11.3 Customer Personal Data transmitted to an Ad Platform is retained and deleted according to that Ad Platform’s own retention policies and Customer’s settings within that platform. FirstParty cannot delete it on Customer’s behalf.

11.4 Customer is responsible for exporting any configuration or container versions, and any journey or attribution reports, it wishes to retain before termination takes effect.

11.5 Journey Data and backups. The thirty (30) day period in Section 11.1 applies to Journey Data from the date Customer’s Journey Add-on subscription ends, whether or not the rest of the Agreement continues. Copies of deleted data held in encrypted backups are not restored to production and are overwritten in the ordinary course of backup rotation, which may occur after the thirty (30) day period.

12.1 Documentation. FirstParty makes available the information reasonably necessary to demonstrate compliance with its obligations under this DPA, including this DPA and its Annexes, and responses to a reasonable written security questionnaire no more than once in any twelve (12) month period.

12.2 Standard audit method. Customer’s audit right is satisfied by the documentation described in Section 12.1, together with any then-current third-party audit reports or certifications held by FirstParty’s Sub-processors, which FirstParty will provide on request where it is permitted to do so.

12.3 On-site audit. Where Applicable Data Protection Law entitles Customer to an on-site audit that cannot be satisfied under Section 12.2, or following a confirmed Security Incident affecting Customer Personal Data, Customer may audit FirstParty’s compliance on at least thirty (30) days’ prior written notice, no more than once in any twelve (12) month period. Audits will be conducted during normal business hours, will not unreasonably interfere with FirstParty’s operations, will be subject to reasonable confidentiality obligations, and will not include access to any data or systems of FirstParty’s other customers. Customer bears the reasonable costs of any on-site audit, including FirstParty’s time and expenses, unless the audit reveals a material breach of this DPA by FirstParty.

13.1 Processing location. The core Services are hosted on Google’s infrastructure in a region located in the central United States. Journey Data is stored in a PostgreSQL database in a United States region. Customer instructs FirstParty to Process Customer Personal Data in the United States. FirstParty will not Process Customer Personal Data outside the United States without Customer’s prior written consent.

13.2 United States scope. This DPA is scoped to the Processing of Personal Data subject to United States federal and state law. It does not address the EU General Data Protection Regulation, the UK GDPR, the Swiss FADP, Canadian PIPEDA, or any other non-US privacy regime, and no such terms are implied.

13.3 Customer representation and geographic limitation. Customer represents that it does not direct the Services to collect or Process Personal Data of individuals located in the European Economic Area, the United Kingdom, or Switzerland. Customer is responsible for implementing any geographic suppression, consent gating, or regional routing at the collection layer necessary to give effect to this representation. If Customer requires the Services to Process Personal Data subject to a non-US privacy regime, the parties must first execute a written amendment containing the transfer mechanism and terms required by that regime. Contact support@gofirstparty.com.

13.4 Government access requests. If FirstParty receives a subpoena, court order, warrant, or other legally binding request from a governmental or regulatory authority for disclosure of Customer Personal Data, FirstParty will, unless legally prohibited, notify Customer without undue delay so Customer may seek a protective order or other remedy, and will disclose only the minimum amount of data legally required.

14.1 Customer discloses Customer Personal Data to FirstParty solely for the limited and specified business purposes set out in Annex A. Such disclosure is not a Sale or Share and is not made in exchange for monetary or other valuable consideration.

14.2 FirstParty complies with its obligations as a Service Provider (California), Processor (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana) or equivalent designation under each applicable US State Privacy Law, and provides the same level of privacy protection as required of Customer thereunder.

14.3 FirstParty will notify Customer if it determines that it can no longer meet its obligations under Applicable Data Protection Law. On such notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

14.4 Sensitive data. Customer will not transmit to FirstParty, or configure the Services to collect, any Sensitive Personal Information or sensitive data as defined under any US State Privacy Law, including Personal Data revealing racial or ethnic origin, religious beliefs, health or mental health condition, sexual orientation, citizenship or immigration status, precise geolocation, government identifiers, account log-in or financial account numbers, genetic or biometric data, or Personal Data of a known child under 16. This includes Personal Data from which such characteristics can be inferred, such as page URLs, page titles, search terms or event names that reveal a health condition or treatment, and information identifying a Consumer as having requested or obtained specific video materials, unless Customer has obtained the consent required by law. The Services are not designed to Process such data, and FirstParty has no obligation to detect or filter it.

14.5 Customer disclosures to Ad Platforms. Customer’s disclosure of Personal Data to an Ad Platform for cross-context behavioral advertising or Targeted Advertising may constitute a Sale or Share by Customer under Applicable Data Protection Law, notwithstanding that no Sale or Share occurs between Customer and FirstParty. Customer is solely responsible for the resulting notice, disclosure and opt-out obligations, including maintaining a compliant “Do Not Sell or Share My Personal Information” mechanism and disclosing the categories of third parties in its notice at collection.

14.6 Opt-out signals. Customer is responsible for detecting and honoring Consumer opt-out requests, including opt-out preference signals such as Global Privacy Control, at the collection layer, and for ensuring that events subject to an opt-out are not transmitted to the Services. FirstParty honors opt-out and consent state that Customer transmits to the Services in the agreed format, and configures the Services to suppress or redact fields accordingly. FirstParty is not responsible for opt-out signals that are not detected by Customer’s consent management platform or not transmitted to the Services.

15.1 Instructions to store. Where Customer subscribes to the Journey Add-on, Customer instructs and authorizes FirstParty to store Journey Data, including plain-text contact identifiers, and to link events, sessions, touchpoints, conversions, orders and leads relating to the same Consumer within Customer’s own data, solely to present customer journey and attribution reporting to Customer.

15.2 Purpose limitation. FirstParty will use Journey Data only to provide the Journey Add-on and related support to Customer, to maintain its security and integrity, and as required by law. Without limiting Section 2.5, FirstParty will not: (a) Sell or Share Journey Data, or rent, trade or otherwise make it available to any third party for that third party’s own purposes; (b) use Journey Data for FirstParty’s own advertising or marketing, or for Targeted Advertising; (c) make Journey Data, or any report, profile, audience or inference derived from it, available to any other FirstParty customer; (d) link or combine Journey Data with the data of any other customer, or build any cross-customer identity graph or profile of a Consumer; (e) use Journey Data for cross-customer benchmarking; or (f) use Journey Data to train artificial intelligence or machine learning models that are made available to anyone other than Customer.

15.3 De-identified data. To the extent FirstParty derives de-identified information from the operation of the Services, FirstParty will take reasonable measures to ensure it cannot be associated with a Consumer or household, publicly commits to maintain and use it only in de-identified form and not to attempt to re-identify it, and will contractually obligate any recipient to do the same, as required by the CCPA.

15.4 Consent-based storage. The Journey Add-on stores only Marketing Data that the Services collect in accordance with the Consent Signals they receive under Section 2.8. Sections 2.6, 2.7 and 2.9 apply fully to Journey Data.

15.5 Segregation. Journey Data is logically segregated by customer, and access controls prevent any other FirstParty customer from accessing Customer’s Journey Data.

15.6 Retention. Journey Data is retained for as long as Customer’s Journey Add-on subscription is active, unless Customer instructs earlier deletion, and is then deleted in accordance with Section 11.

16.1 Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Any reference in the Agreement to the liability of a party means that party’s aggregate liability under the Agreement and this DPA together.

16.2 Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Law, including any Consumer’s statutory right to damages or statutory penalties.

16.3 Allocation of responsibility. FirstParty’s obligations are limited to the correct technical operation of the Services in accordance with Customer’s documented instructions. Customer retains sole responsibility for: the lawfulness of the collection and transmission of Marketing Data; the accuracy and completeness of consent signals transmitted to the Services; the configuration and operation of its consent management platform; its privacy notices; and the Processing of data by any Ad Platform. Any tracking audit, assessment, configuration review or recommendation FirstParty provides is informational, does not constitute legal advice, and does not transfer compliance responsibility to FirstParty.

16.4 Privacy Claims. Any claim, demand, arbitration, lawsuit, investigation or proceeding by a Consumer, class, regulator or other third party alleging that the collection, recording, interception, storage or transmission of data on or from Customer’s properties violated any privacy, consent, wiretapping, eavesdropping, pen register, video privacy or similar law, including where the Services operated on Consumer data because Customer’s CMP did not transmit an accurate Consent Signal, is a “Privacy Claim” under the Agreement. Privacy Claims are allocated to Customer, and are subject to Customer’s defense and indemnification obligations and the limitations of FirstParty’s liability, as set out in the Agreement. Nothing in this DPA, including FirstParty’s obligations under Sections 2, 6, 7 or 15, expands FirstParty’s liability for Privacy Claims.

17.1 FirstParty may update this DPA from time to time. The current version is always available at gofirstparty.com/dpa, with the version number and last-updated date shown at the top.

17.2 FirstParty will not make a change that materially reduces Customer’s rights or FirstParty’s obligations under this DPA except: (a) to reflect a change in Applicable Data Protection Law, a regulatory decision, or guidance from a supervisory or enforcement authority; (b) to reflect a change to the Services, a new feature, or a new Sub-processor; or (c) for reasons of clarity, accuracy or correction of an error.

17.3 For any material change, FirstParty will provide at least thirty (30) days’ notice by email to Customer’s designated contact and by posting the updated version. If Customer objects to a material change on reasonable data protection grounds, Customer may terminate the affected Services without penalty before the change takes effect, and FirstParty will refund any prepaid fees covering the remainder of the terminated term. Continued use of the Services after the effective date of a change constitutes acceptance of it.

17.4 Non-material changes, including corrections, clarifications and additions to Annex D, take effect on posting.

18.1 Term. This DPA takes effect when Customer accepts the Agreement or begins using the Services, and continues until the later of expiry or termination of the Agreement and the date FirstParty ceases all Processing of Customer Personal Data.

18.2 Order of precedence. In the event of a conflict between this DPA and the Agreement with respect to the Processing of Customer Personal Data, this DPA prevails, except that the provisions of the Agreement governing consent compliance, limitation of liability and indemnification prevail as to Privacy Claims. In all other respects the Agreement continues in full force.

18.3 Governing law. This DPA is governed by the laws of the State of Nevada, without regard to its conflict of laws principles, and the parties submit to the exclusive jurisdiction of the state and federal courts located in Clark County, Nevada.

18.4 Notices. Data protection notices to FirstParty should be sent to support@gofirstparty.com. Notices to Customer will be sent to the administrative or billing contact on Customer’s account. Customer may designate a separate privacy contact by writing to the address above.

18.5 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect.