Hu-manity Rights, Inc. — Cookie Compliance

Last Updated: August 20, 2026

Introduction and Incorporation

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Terms of Service between Hu-manity
Rights, Inc. (“Hu-manity,” “we,” “us”) and the customer identified on the applicable order or account (“Customer”)
(together, the “Agreement”). This DPA applies to the extent Hu-manity processes Personal Data on Customer’s behalf in the
course of providing the Cookie Compliance service (the “Service”). By subscribing to or using the Service, Customer agrees
to this DPA without further action required.

Definitions

Capitalized terms not defined in this DPA have the meanings given in the Terms of Service. In this DPA:

• “Applicable Data Protection Laws” means all data protection and privacy laws applicable to the processing of Personal
  Data under this Agreement, including, as applicable, the EU General Data Protection Regulation (“GDPR”), the UK
  GDPR and Data Protection Act 2018, and U.S. state privacy laws (including the California Consumer Privacy Act, as
  amended by the California Privacy Rights Act (“CCPA”)).
• “Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” and “Sub-processor” have the meanings
  given in the GDPR, and equivalent terms (such as “Business,” “Service Provider,” and “Consumer”) under U.S. state
  privacy laws are construed accordingly.
• “Customer Personal Data” means Personal Data processed by Hu-manity on Customer’s behalf in connection with the
  Service, as described in Annex 1.

Roles of the Parties

As between Hu-manity and Customer, Customer is the Controller (or Business) and Hu-manity is the Processor (or Service
Provider) with respect to Customer Personal Data. Each party will comply with the obligations that apply to its role under
Applicable Data Protection Laws.

Scope and Instructions

Hu-manity will process Customer Personal Data only: (a) to provide, maintain, and support the Service under the
Agreement; (b) in accordance with Customer’s documented instructions, which Customer gives by configuring and using the
Service and which this DPA and the Agreement constitute in full; and (c) as required by applicable law, in which case Hu-
manity will inform Customer of that legal requirement first, unless the law prohibits it. Hu-manity will promptly notify
Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.

The subject matter, duration, nature and purpose of processing, and categories of Data Subjects and Personal Data, are
described in Annex 1.

Confidentiality

Hu-manity will ensure that personnel authorized to process Customer Personal Data are subject to a duty of confidentiality
(whether contractual or statutory) and process Customer Personal Data only as necessary for the purposes of the
Agreement.

Security

Hu-manity will implement appropriate technical and organizational measures designed to protect Customer Personal Data
against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the risk,
including measures such as encryption of data in transit, access controls limiting personnel access on a need-to-know basis,
and use of reputable infrastructure providers (see Annex 2).

Sub-processors

Customer authorizes Hu-manity to engage the Sub-processors listed in Annex 2 to process Customer Personal Data. Hu-
manity will impose data protection obligations on each Sub-processor that are substantially similar to those in this DPA, and
remains responsible for each Sub-processor’s performance of those obligations.

If Hu-manity adds or replaces a Sub-processor, it will update Annex 2 and provide notice by email or through the Service at
least ten (10) days before the new Sub-processor begins processing Customer Personal Data (except where a shorter period
is necessary to address an urgent operational or security need). If Customer reasonably objects to a new Sub-processor on
data protection grounds within that notice period, the parties will discuss a resolution in good faith; if none is reached,
Customer’s sole remedy is to terminate the affected portion of the Service.

International Transfers

Where Hu-manity processes Customer Personal Data originating in the European Economic Area, the United Kingdom, or
Switzerland in the United States or another country not deemed to provide an adequate level of data protection, the
parties agree that the European Commission’s Standard Contractual Clauses (Controller-to-Processor, Module 2, or
Processor-to-Processor, Module 3, as applicable), and the UK International Data Transfer Addendum, are incorporated into
this DPA by reference and will apply to that transfer.

Assistance

Taking into account the nature of the processing, Hu-manity will provide Customer with reasonable assistance (including by
appropriate technical and organizational measures) to help Customer respond to requests from Data Subjects seeking to
exercise their rights under Applicable Data Protection Laws, and to help Customer meet its obligations regarding data
protection impact assessments and consultations with regulators, in each case to the extent Customer cannot reasonably
fulfil those obligations without Hu-manity’s assistance.

Personal Data Breach Notification

Hu-manity will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer
Personal Data, and will provide information reasonably available to it about the breach to help Customer meet its own
notification obligations under Applicable Data Protection Laws.

Deletion or Return of Data

On termination or expiry of the Agreement, Hu-manity will, at Customer’s election, delete or return Customer Personal
Data, except to the extent applicable law requires Hu-manity to retain some or all of it, consistent with the data retention
terms in the Terms of Service.

Audits and Information

Hu-manity will make available to Customer information reasonably necessary to demonstrate compliance with this DPA
(such as a summary of the security measures in place). Given the scale of our operations, we do not currently support on-
site audits; where Applicable Data Protection Laws require an audit right that cannot be satisfied through documentation
review, the parties will discuss a reasonable alternative in good faith.

Liability

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the
Terms of Service.

Term

This DPA remains in effect for as long as Hu-manity processes Customer Personal Data under the Agreement.

Annex 1 — Details of Processing

Annex 2 — Sub-processors

Sub-processor	Purpose	Location
Amazon Web Services, Inc.	Cloud hosting and infrastructure; transactional email delivery (sign-up verification, password reset, two-factor codes, invoices); data warehousing	Ireland / EU
Cloudflare, Inc.	Authoritative DNS for our domain; bot-detection and mitigation security services at the network edge	United States / global edge network
Help Scout, Inc.	Customer support / helpdesk	United States
KeyCDN (Cellar Networks GmbH)	Content delivery network	Switzerland / global edge network
Fathom Analytics	Privacy-focused, cookieless website analytics	Canada
Sinch Mailjet	Marketing/newsletter email delivery	France / EU
Stripe, Inc.	Payment processing	United States
Braintree (a PayPal service), including PayPal as a payment method	Payment processing	United States
Intuition Machines, Inc. (hCaptcha)	Anti-bot verification on customer registration	United States