Data Processing Addendum

Effective October 11, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Pezley Portal LLC (“Processor,” “Pezley Portal”) and the customer entity that accepts the Pezley Portal Terms of Service (“Controller,” “Customer”). It applies when Processor processes personal data on behalf of Controller in connection with the Pezley Portal service.

1. Definitions

“Personal Data” means information relating to an identified or identifiable individual that Controller submits to or that is generated through the service on Controller’s instructions, including data about Controller’s crew and end customers.

“Process” (and “Processing”) has the meaning given in applicable data protection law.

Other capitalized terms not defined here have the meanings in the Terms of Service.

2. Roles and scope

1. Controller is the controller (or business) of Personal Data it puts into Pezley Portal and determines the purposes and means of Processing outside Processor’s standard product instructions.
2. Processor Processes Personal Data only on documented instructions from Controller, including through Controller’s use of product features, configurations, and the Terms, unless required by law (in which case Processor will inform Controller unless prohibited).
3. Controller is responsible for providing any required notices and obtaining any required consents from data subjects (including crew and end customers).

3. Processor obligations

Processor will:

• Process Personal Data only to provide, secure, and support the service, as permitted by the Terms and this DPA;
• ensure personnel authorized to Process Personal Data are bound by confidentiality obligations;
• implement appropriate technical and organizational security measures as described in Section 5;
• assist Controller with reasonable requests regarding data subject rights, security, and impact assessments, taking into account the nature of Processing and information available to Processor;
• at Controller’s choice, delete or return Personal Data upon termination of the subscription, subject to Section 8 and backup rotation;
• make available information reasonably necessary to demonstrate compliance with this DPA.

4. Subprocessors

Controller authorizes Processor to engage subprocessors listed in the Privacy Policy (Subprocessors section) and to engage replacements or additions. Processor will impose data protection obligations on subprocessors substantially protective of Personal Data. Processor remains responsible for subprocessors’ performance of their obligations.

Processor will provide notice of material subprocessor changes when practicable (for example by updating the Privacy Policy or notifying account administrators).

5. Security

Processor maintains measures designed to protect Personal Data, including:

• logical tenant separation for company workspaces;
• role-based access controls within the product;
• encryption of data in transit (TLS);
• access controls and monitoring for production systems;
• incident response procedures.

Controller is responsible for securing its accounts, devices, and credentials and for configuring roles appropriately within its workspace.

6. Personal data breaches

Processor will notify Controller without undue delay after becoming aware of a confirmed security incident that results in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed on Controller’s behalf (“Personal Data Breach”), and will provide information reasonably available to assist Controller in meeting its breach notification obligations.

7. International transfers

Personal Data may be Processed and stored in the United States and other locations where Processor or its subprocessors operate. Controller instructs Processor to transfer Personal Data as needed to provide the service.

8. Deletion on termination

Upon termination or expiration of the subscription, Processor will delete or de-identify Controller’s Personal Data from active systems within a commercially reasonable period, except where retention is required by law or permitted by the Terms and Privacy Policy (including encrypted backups until rotation).

Controller should export any records it needs before termination using available product features.

9. Conflict and order of precedence

If there is a conflict between this DPA and the Terms regarding Processing of Personal Data, this DPA controls. If Controller and Processor execute a separate written data processing agreement, that agreement controls to the extent of the conflict.

10. Contact

Data protection inquiries: privacy@pezleyportal.com
Pezley Portal LLC · 10129 N Rock Creek Rd · Centertown, MO 65023