Data Processing Addendum

This Data Processing Addendum (the “DPA”) is issued by Tolt, Inc., a Delaware corporation with its business address at 2093 Philadelphia Pike, #2726, Claymont, DE 19703, United States (“Tolt”), for incorporation into Tolt’s Terms of Service, an order form, subscription agreement or another binding agreement for the Services (the “Agreement”). “Subscriber” means the legal person or entity accepting the Agreement for the Services. Its legal identity, principal address and acceptance record are established by that Agreement or Tolt’s account records; no Subscriber-specific signature or identifying field is required on this standing DPA.

This DPA applies when and to the extent Tolt processes Subscriber Personal Data on Subscriber’s behalf in providing the Services. It becomes binding between Tolt and Subscriber upon Subscriber’s valid acceptance of an Agreement expressly incorporating this DPA, or through another legally binding form of agreement to this DPA (the “Effective Date”). Tolt’s signature on this document confirms its standing commitment to these terms and does not, by itself, bind any Subscriber or satisfy signature requirements of an international data transfer instrument.

When incorporated into a binding Agreement, the parties agree as follows:

1. Definitions

1.1 “Applicable Data Protection Law” means privacy and data protection laws applicable to a party’s processing under this DPA, including (as applicable) the EU GDPR, UK GDPR, Swiss Federal Act on Data Protection and the California Consumer Privacy Act (“CCPA”), each as amended or replaced.

1.2 “Subscriber Personal Data” means personal data that Subscriber or its authorized users submit, collect or otherwise make available through the Services and that Tolt processes on behalf of Subscriber as a processor or subprocessor. It excludes information for which Tolt acts independently as a controller, but only to the extent that classification is correct under Applicable Data Protection Law.

1.3 “Services” means Tolt’s hosted affiliate and referral management platform and related functionality provided under the Agreement. “Subprocessor” means a third party engaged by Tolt to process Subscriber Personal Data on Subscriber’s behalf.

1.4 “Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Subscriber Personal Data. Terms such as “controller,” “processor,” “processing,” and “data subject” have the meanings given by Applicable Data Protection Law.

2. Roles, purposes and instructions

2.1 Subscriber acts as controller of Subscriber Personal Data, or as processor on behalf of another controller where applicable. Tolt acts as Subscriber’s processor (or subprocessor where Subscriber is a processor) for the processing described in Schedule 1. Subscriber is responsible for obtaining any required authorizations from its controller and for communicating lawful instructions to Tolt.

2.2 Tolt shall process Subscriber Personal Data only on documented Subscriber instructions, including those contained in the Agreement, this DPA, Subscriber’s configuration of the Services and documented support or API requests, unless law requires different processing. Where legally permitted, Tolt shall inform Subscriber before any processing required by law. Tolt shall promptly notify Subscriber if, in Tolt’s opinion, a Subscriber instruction infringes Applicable Data Protection Law.

2.3 Subscriber is responsible for establishing a lawful basis for its collection and use of Subscriber Personal Data and for providing required notices, securing applicable consents for tracking technologies, determining program settings and reviewing the accuracy of information it submits. Subscriber shall not submit special-category, highly sensitive or criminal-offence data for processing under the Services unless the parties expressly agree in writing to applicable protections.

2.4 The parties acknowledge that Tolt may act as an independent controller for certain information and activities, including Tolt account and contract administration, affiliate payment-agent activities, identity verification, sanctions screening, legally required payout and tax records, and fraud prevention across programs, as described in the Agreement and Tolt’s Privacy Policy. This DPA governs only processing on Subscriber’s behalf; each party remains responsible for its independent controller obligations to the extent they arise under Applicable Data Protection Law.

2.5 Tolt shall not use Subscriber Personal Data to train general-purpose artificial intelligence models. Where Subscriber enables an AI-powered feature, Tolt may process the data necessary to provide that feature through authorized service providers, subject to documented Subscriber instructions, this DPA and applicable confidentiality and data protection obligations.

3. Confidentiality and security

3.1 Tolt shall ensure that personnel authorized to access Subscriber Personal Data are bound by confidentiality obligations or a statutory duty of confidentiality and receive access only as necessary for their responsibilities.

3.2 Taking into account the nature, scope, context and purposes of processing, the state of the art, implementation costs and risk to individuals, Tolt shall implement and maintain appropriate technical and organizational measures, including the measures in Schedule 2. The measures are intended to preserve confidentiality, integrity, availability and resilience. Tolt may replace or improve individual measures provided that it does not materially reduce the overall protection of Subscriber Personal Data.

3.3 Tolt shall restrict personnel access to Subscriber Personal Data to authorized persons with a business need; use encryption in transit and at rest for production personal data; protect administrative access with authentication and role-based controls; monitor relevant security events; and maintain backup and incident-response procedures. Subscriber is responsible for its own user credentials, configured integrations, access permissions and choices about tracking and disclosure under its control.

4. Breach notification and assistance

4.1 Tolt shall notify Subscriber without undue delay after becoming aware of a Personal Data Breach affecting Subscriber Personal Data, and in any event within 72 hours after awareness. Tolt may notify the email address of Subscriber’s account administrator or its designated privacy contact. To the extent known, the initial notice will describe the nature of the incident, affected categories of personal data and individuals, likely consequences, a contact point, and containment or remediation steps. Tolt may supplement the notice as additional information becomes available.

4.2 Tolt shall take reasonable steps to contain and investigate the Personal Data Breach and to mitigate its effects. Taking account of the nature of processing and information available, Tolt shall assist Subscriber with applicable regulatory and individual notices. Notice under this section is not an admission of fault or liability.

4.3 Tolt shall promptly refer to Subscriber requests from individuals concerning Subscriber Personal Data where it can identify the relevant Subscriber, and shall not independently respond on Subscriber’s behalf unless authorized or legally required. Taking account of the processing and available information, Tolt shall reasonably assist Subscriber in fulfilling access, correction, deletion, restriction, portability and other applicable rights requests.

4.4 Tolt shall reasonably assist Subscriber with security assessments, data protection impact assessments and prior consultations with regulators where required by Applicable Data Protection Law, to the extent related to Tolt’s processing and proportionate to the information available to Tolt.

5. Subprocessors

5.1 Subscriber grants general written authorization for Tolt to use the Subprocessors listed at https://tolt.com/subprocessors as of the Effective Date, to the extent each provider processes Subscriber Personal Data for the Services. That page identifies service functions and processing geographies and is incorporated by reference into this DPA. A provider connected and independently contracted by Subscriber for its own program is not Tolt’s Subprocessor merely because the Services integrate with it.

5.2 Tolt shall provide at least 30 calendar days’ advance written notice of an intended addition or replacement of a Subprocessor that processes Subscriber Personal Data, by email to an account or designated contact or through another documented notification channel. Subscriber may object within that period on reasonable data protection grounds by writing to compliance@tolt.com. Tolt shall consider the objection and use commercially reasonable efforts to resolve it, including through an alternative where practicable. If no suitable resolution is available, Subscriber may terminate the affected Services by written notice and receive a refund of prepaid fees for the unused portion of those Services.

5.3 Tolt shall enter into written arrangements with Subprocessors imposing data protection obligations materially equivalent to those applicable to Tolt under this DPA, to the extent appropriate for the delegated processing. Tolt remains responsible to Subscriber for the performance of its Subprocessors’ obligations under this DPA, subject to mandatory law and the Agreement.

6. Return, deletion and retention

6.1 During the term, Subscriber may access, export, correct or delete Subscriber Personal Data using available dashboard features and APIs, or request reasonable assistance. Upon termination or expiration of the Services, Tolt shall, at Subscriber’s choice, return or delete Subscriber Personal Data, subject to applicable law. Where Subscriber has not given an alternative valid instruction, Tolt will delete Subscriber Personal Data from active systems within 30 calendar days after account closure, subject to the exceptions in Section 6.2.

6.2 Personal data remaining in backups may be retained until those backups are overwritten or expire under the ordinary backup lifecycle; such data shall remain protected and shall not be restored for ordinary business use. Tolt may separately retain records to the extent necessary to comply with applicable law, enforce legal claims or perform processing for which it is independently a controller, including payout, tax, identity-verification and fraud-prevention records, in each case subject to Applicable Data Protection Law. On reasonable request, Tolt shall confirm completion of applicable deletion obligations.

7. Compliance, records and audits

7.1 Tolt shall make available information reasonably necessary to demonstrate compliance with the processor duties applicable under this DPA, including current security descriptions, subprocessor details and suitable independent assurance materials to the extent available.

7.2 Upon reasonable written notice and at reasonable intervals, and additionally where there are material indications of non-compliance, Tolt shall permit and contribute to audits of processing under this DPA by Subscriber or an independent auditor bound by confidentiality. The parties shall first seek to address audit requests through documentation and remote review. Any onsite inspection shall be scheduled reasonably, conducted during normal business hours, and protect the confidentiality, security and rights of other subscribers. Nothing in this section restricts mandatory audit rights under the EU SCCs or Applicable Data Protection Law.

7.3 Each party shall maintain records required of it by Applicable Data Protection Law and provide cooperation reasonably necessary for the other party to comply with obligations relevant to Subscriber Personal Data.

8. International data transfers

8.1 Subscriber acknowledges that the Services are operated primarily using infrastructure in the United States and may involve Subprocessors processing data in other locations as listed on the subprocessor page. Each party shall comply with Applicable Data Protection Law governing transfers of personal data across borders.

8.2 Where the EU GDPR requires an appropriate safeguard for a restricted transfer to Tolt and no applicable adequacy decision or other lawful transfer mechanism covers that transfer, the parties shall use the unmodified EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, using the module and options in Schedule 3. They become operative for a particular transfer only when the relevant parties are legally bound to them and their mandatory annex details and signatures or legally equivalent execution formalities have been completed. This standing DPA alone does not constitute completed SCCs for a particular Subscriber.

8.3 Where the UK GDPR requires an appropriate safeguard for a restricted transfer, the parties shall enter into the UK International Data Transfer Addendum to the EU SCCs (or another valid mechanism), completing the applicable tables and executing it in a legally binding manner. For restricted transfers under Swiss law, the parties shall agree the required Swiss adaptations to the EU SCCs or another valid mechanism. The parties will reasonably assist with documented transfer assessments and supplementary safeguards where required by law.

8.4 If a legally required transfer mechanism becomes invalid or insufficient, the parties shall cooperate promptly to implement a lawful replacement or supplementary safeguards. Where a transfer can no longer lawfully continue, it shall be suspended as legally required.

9. United States state privacy laws

9.1 Where Subscriber is a “business” and Tolt acts as its “service provider” or “contractor” under the CCPA with respect to Subscriber Personal Data, Subscriber provides Subscriber Personal Data to Tolt solely for the specific business purposes stated in Schedule 1. Tolt shall not sell or share such personal information (as “sell” and “share” are defined by the CCPA) and shall not retain, use or disclose it for purposes outside those specified in this DPA or otherwise permitted under the CCPA.

9.2 Tolt shall not retain, use or disclose CCPA-covered Subscriber Personal Data outside the direct business relationship between Subscriber and Tolt or combine it with personal information received from another source or collected in Tolt’s own interactions, except as expressly permitted by the CCPA and regulations. Tolt shall comply with applicable CCPA service-provider or contractor obligations, ensure authorized persons are subject to confidentiality, and require its qualifying subcontractors to meet applicable contractual requirements.

9.3 Subscriber may take reasonable and appropriate steps to help ensure Tolt processes CCPA-covered Subscriber Personal Data consistently with Subscriber’s obligations, including reasonable requests for compliance information and appropriate remediation. Tolt shall notify Subscriber if it determines that it can no longer meet applicable CCPA requirements, and Subscriber may take reasonable and appropriate steps to stop and remediate unauthorized use of personal information after notice to Tolt.

9.4 For other applicable US state privacy laws, each party shall comply with mandatory duties applicable to its role. The independent-controller activities described in Section 2.4 are not converted into processor activities by this section.

10. Term, order of precedence and other provisions

10.1 This DPA applies from its Effective Date for so long as Tolt processes Subscriber Personal Data on Subscriber’s behalf under the Agreement. This is Tolt’s standing standard addendum and does not require a separate Subscriber signature on this document where a binding Agreement validly incorporates the DPA. Prior agreements continue as provided in their own terms unless expressly replaced by agreement of the parties.

10.2 If provisions conflict, the following order applies solely for processing covered by this DPA: (a) mandatory EU SCCs, UK Addendum or applicable Swiss transfer provisions; (b) this DPA and Schedules; and (c) the Agreement. Mandatory rights of individuals and regulators are not limited by contractual terms.

10.3 Except for liabilities, remedies, governing law and forum prescribed by mandatory transfer terms or Applicable Data Protection Law, the liability limitations, governing law and dispute-resolution provisions of the Agreement govern this DPA. No new indemnity is created solely by this DPA.

10.4 Notices to Tolt under this DPA shall be sent to compliance@tolt.com and notices to Subscriber to the privacy contact or account administrator recorded in the Agreement. Tolt may execute this standing DPA once and distribute an identical signed copy to multiple Subscribers. Each Subscriber must be bound through a valid Agreement or another binding acceptance process. Separately applicable EU SCCs, UK transfer terms and Swiss safeguards require completion, execution and identification of the relevant parties as specified by those instruments; Tolt’s standalone signature cannot replace those formalities.

Schedule 1: Description of processing

This schedule applies uniformly to the Services; Subscriber enables the specific features it uses within its account.

Schedule 2: Technical and organizational measures

Tolt shall maintain the following technical and organizational measures for Subscriber Personal Data, subject to the scope of the applicable feature and a risk-based approach. The specific services and locations in use are identified on Tolt’s published Subprocessor page.

Identity and access management. Production and administrative access is controlled through named accounts, authentication, access privileges associated with job responsibilities and procedures for granting and removing access. Tolt provides role-based access controls, two-factor sign-in and single sign-on for supported Subscriber access workflows; administrative changes are recorded in audit logs.

Encryption. Personal data transmitted through the dashboard, partner portal, APIs and supported service connections is protected in transit by HTTPS/TLS or equivalent industry-standard encryption. Tolt protects stored production personal data using encryption at rest in its managed infrastructure and storage services.

Application, API and webhook security. Tolt uses authenticated API access, controls over service secrets and safeguards around changes to production services. Outgoing webhooks delivered through Svix carry cryptographic signatures that recipients may verify before accepting a payload. Subscriber is responsible for maintaining secrecy of its credentials and validating received webhook signatures.

Operational monitoring and auditability. Tolt maintains logs and monitoring for service operations, error investigation and security-relevant events. Access to operational logs is restricted to authorized personnel, and Subscriber-facing audit logs record supported account and administrative changes.

Availability, backups and recovery. Production data is backed up and operated on infrastructure designed for service continuity and recovery from operational incidents. Backup copies are subject to access controls and retention/overwrite procedures. Tolt retains protected copies only for the backup lifecycle or as otherwise permitted by the Agreement and applicable law.

Vulnerability testing and remediation. Tolt performs ongoing security monitoring and vulnerability remediation and commissions independent penetration testing of relevant systems. Summaries or assurance materials may be made available to Subscriber upon reasonable request, subject to confidentiality and security restrictions. Tolt does not represent that it holds a SOC 2 report unless and until one has actually been issued.

Personnel confidentiality. Persons permitted to process Subscriber Personal Data are bound by contractual or statutory confidentiality requirements and receive guidance on authorized access and appropriate handling of such data.

Incident response. Tolt maintains procedures for identifying, escalating, investigating, containing and mitigating security incidents and for notifying Subscribers of confirmed Personal Data Breaches in accordance with Section 4.

Data minimization and Subscriber controls. Subscriber can configure partner access, program settings and (where available) customer identity visibility, and use supported interfaces to access, correct, export and delete program records. Tolt processes no more Subscriber Personal Data than is necessary for the documented services and instructions, subject to lawful independent-controller activities.

Subprocessor governance. Tolt documents its Subprocessors at https://tolt.com/subprocessors and contracts for data protection obligations appropriate to their delegated services, with advance notification and objections managed as described in Section 5.

Subscriber may request reasonable security documentation, including the applicable control description and penetration-test summary, at compliance@tolt.com. Security measures apply in the relevant environment and may evolve as long as the overall level of protection does not materially decrease. No unissued certification or specific backup-retention period is represented by this Schedule.

Schedule 3: Conditional international transfer terms

This Schedule specifies the selected transfer terms and the manner of completing them. A legally binding transfer mechanism requires completion of the prescribed party information and relevant annexes, plus valid execution or acceptance by all required parties. The provisions below do not by themselves identify or bind an individual Subscriber as data exporter.

A. EU Standard Contractual Clauses (if applicable)

A.1 For an EU restricted transfer requiring SCCs, the parties will use the unmodified Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (official text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914). Module Two applies where Subscriber is controller and Tolt is processor; Module Three applies where Subscriber is processor and Tolt is subprocessor. Only the relevant module applies to a given transfer. The SCCs form part of the applicable transfer contract once properly completed and entered into by the parties.

A.2 Selections: Clause 7 (docking clause) is included. Clause 9(a), Option 2 (general written subprocessor authorization) is selected with at least 30 days’ prior notice as described in Section 5. Clause 11(a)’s optional independent dispute-resolution body is not selected. Clause 17, Option 1 selects the laws of Ireland; Clause 18(b) selects the courts of Dublin, Ireland. The selected law and jurisdiction concern the EU SCCs only, not the general Agreement.

A.3 Annex I.A: Parties. Tolt is the data importer: Tolt, Inc., 2093 Philadelphia Pike, #2726, Claymont, DE 19703, United States; privacy contact compliance@tolt.com; importer role: processor (Module Two or Three). For each covered transfer, Subscriber is the data exporter, in the role of controller (Module Two) or processor (Module Three), and must be identified by legal name, registered address, privacy contact, applicable signature or electronic acceptance and relevant dates in the executed transfer documentation. The activities of the parties are operation of Subscriber’s affiliate/referral program and provision of Tolt Services, respectively. Annex I.A must be signed or otherwise validly executed as permitted under applicable law; the standing Tolt signature alone is not sufficient.

A.4 Annex I.B: Description of transfer. The categories of individuals and personal data, purpose, nature, frequency, duration and location of transfer are as specified in Schedule 1. Transfers are continuous or event-driven from Subscriber systems, authorized integrations or the Services to Tolt in the United States. No special-category data is intended. Onward transfers are limited to authorized recipients and Subprocessors for their relevant processing activities as described in Section 5.

A.5 Annex I.C: Competent authority. For each covered transfer, the parties must identify the competent EU supervisory authority in Annex I.C under Clause 13 of the SCCs, based on the data exporter’s EU establishment or applicable Article 3 and representative status. It must be recorded in the transfer documentation before relying on those SCCs; it is not inferred solely from the law chosen under Clause 17.

A.6 Annex II: Technical and organizational measures. Schedule 2 and Section 4 set out the measures and data-subject assistance relevant to Tolt’s processing; any additional transfer-specific supplementary measures, if required by a transfer impact assessment, must be documented for the covered transfer. Clause 9(a), Option 2 permits general written subprocessor authorization, and the current authorized list is at https://tolt.com/subprocessors. Under Option 2, the specific-authorization-only Annex III form need not be completed.

A.7 In any conflict between the EU SCCs and this DPA or the Agreement, the EU SCCs control for covered transfers. Obligations under Clauses 14 and 15, including the assessment of destination-country law and handling of public authority requests, apply without reduction by this DPA.

B. UK Addendum (if applicable)

B.1 Where a UK restricted transfer requires appropriate safeguards, the parties shall separately complete and legally enter into the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, template B.1.0 published by the UK Information Commissioner’s Office and revised under its Mandatory Clauses, or use another lawful mechanism. The UK Addendum applies only after the mandatory party information and Tables 1 to 4 are completed in the relevant transfer documentation.

B.2 When the UK Addendum is used: Table 1 identifies Subscriber and Tolt and their applicable contact details and legally binding acceptance; Table 2 specifies the relevant EU SCC module (Two or Three) and elections in Part A; Table 3 specifies the information in the completed SCC Annex I and Schedule 1 and Annex II/Schedule 2, together with the authorized Subprocessors; Table 4 specifies the parties entitled to end the Addendum under Section 19. These tables must be completed for the relevant transfer and cannot be replaced by Tolt’s standing signature alone.

B.3 Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

B.4 Official UK Addendum and guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/. The UK Addendum prevails in the event of a conflict for covered UK transfers.

C. Swiss transfers (if applicable)

C.1 If Swiss law requires appropriate safeguards for a restricted transfer, the parties shall apply the EU SCCs with the modifications necessary under the Swiss Federal Act on Data Protection and guidance of the Swiss Federal Data Protection and Information Commissioner (FDPIC), or another valid transfer mechanism. The parties will identify the affected transfers, parties, competent authority and required adaptations in a legally binding transfer record. Parallel EU GDPR protections continue to apply where required.

Execution by Tolt, Inc.

Tolt executes this DPA as its standing data processing terms for the Services. A signed copy may be distributed to any Subscriber and becomes binding on that Subscriber through valid acceptance of the Agreement incorporating it or another binding acceptance process. The signature below does not by itself satisfy mandatory execution and annex-completion requirements for any restricted international transfer. Those requirements are addressed through separate, completed transfer documentation where applicable.

Tolt’s signature below evidences its execution of these standing terms. There is no Subscriber signature block on this document.

Entity: Tolt, Inc. Authorized signatory: Daniel Gjokaj Title: Chief Executive Officer Signature: signed through DocuSign, in the signed PDF Date: 4 November 2026