Data Processing Addendum

Last Updated: October 5, 2026

This Data Processing Addendum (the "DPA") forms part of the Terms of Engagement (the "Terms") between MMJI CHILLZ, LLC, a Delaware limited liability company operating as Linkstub ("Linkstub," "we," "us," or "our"), and the Organizer that has accepted the Terms ("Organizer," "you," or "your"). It applies when we process Organizer Personal Data on your behalf. By accepting the Terms or using the business features of the Services, you agree to this DPA. Capitalized terms used but not defined in this DPA have the meanings given in the Terms.

1. Definitions

"Applicable Data Protection Laws" means all U.S. federal and state laws and regulations relating to privacy, data protection, or data security that apply to the processing of Organizer Personal Data under the Agreement, including the California Consumer Privacy Act of 2018, as amended, and its implementing regulations (the "CCPA"), and the comprehensive consumer privacy laws of other states, such as Virginia, Colorado, Connecticut, Texas, Oregon, and others that apply (the "Other State Laws").
"Business," "Business Purpose," "Consumer," "Contractor," "Controller," "Deidentified Data," "Personal Information," "Processor," "Sell," "Service Provider," and "Share" (and related terms) have the meanings given in the Applicable Data Protection Laws, and "Personal Data" means "Personal Information" or "Personal Data" as defined in those laws.
"Organizer Personal Data" means Personal Data that we process on your behalf in providing the Services, as described in Section 2.1.
"Processing" means any operation performed on Personal Data, such as collection, storage, use, disclosure, and deletion.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Organizer Personal Data in our possession or control that requires notice to you under Applicable Data Protection Laws. Unsuccessful attempts and activities that do not compromise the security of Organizer Personal Data, such as pings, port scans, blocked log-in attempts, and denial-of-service attacks that do not result in unauthorized access to, or the loss or alteration of, Organizer Personal Data, are not Security Incidents.
"Sub-processor" means a third party that we engage to process Organizer Personal Data on our behalf in providing the Services.

2. Scope and Roles

2.1 Processing on Your Behalf

We act as your Service Provider or Processor for the following Personal Data, to the extent we process it on your behalf in providing the Services:

Contacts that you or your Authorized Users upload, paste, import, or otherwise provide to the Services;
contact records, lists, segments, and fields that the Services maintain for you, to the extent they are not Linkstub Data;
recipient information and content of messages that you send using the Messaging Tools;
information that we send, on your instructions, to your advertising accounts or providers, such as purchase reports;
information synced to the Services from Third-Party Services through Integrations that you connect; and
other Personal Data that you instruct us to process on your behalf through the Services.

2.2 Processing Outside This DPA

This DPA does not apply to, and does not limit our rights in:

Linkstub Data, including information we collect through our own checkout, registration, account, and other flows, which we process as an independent Business or Controller as described in our Privacy Policy;
Buyer Data after we make it available to you, which you process as an independent Business or Controller; and
Personal Data about you and your Authorized Users as account holders, which we process as described in our Privacy Policy.

2.3 Information in More Than One Category

The same information may be both Organizer Personal Data and Linkstub Data, for example where a person is both one of your Contacts and a buyer or user of the Services. In that case, this DPA applies to the copy or use we process on your behalf, and our rights in Linkstub Data are not limited by this DPA. Purchase reports may include Linkstub Data, which we may disclose subject to our Privacy Policy. Publicly available information, and information that we obtain from data providers or our own users independently of Organizer Personal Data, including social media profile information, is Linkstub Data and not Organizer Personal Data, to the extent permitted by Applicable Data Protection Laws. The association between your Contacts and that information, as maintained in your contact records, is Organizer Personal Data.

2.4 Your Responsibilities

You are responsible for your compliance with Applicable Data Protection Laws, including providing all notices and obtaining all consents and rights needed for us to process Organizer Personal Data as described in the Agreement, responding to requests from individuals, and the accuracy, quality, and legality of Organizer Personal Data and of the means by which you obtained it. You represent and warrant that your instructions and our processing of Organizer Personal Data in accordance with the Agreement will not cause us to violate Applicable Data Protection Laws.

3. Details of Processing

Subject matter and duration: The provision of the Services to you under the Agreement, for the term of the Agreement and any period after it during which we retain Organizer Personal Data as described in Section 13.
Nature and purpose: Storing, organizing, enriching, segmenting, displaying, analyzing, transmitting, and deleting Organizer Personal Data to provide the Services you use, including contact management, messaging, advertising reports, and Integrations, and the purposes described in Section 7.
Categories of individuals: Your contacts, customers, attendees, prospective attendees, members, subscribers, and other individuals whose Personal Data you provide or instruct us to process.
Types of Personal Data: Identifiers and contact details (such as names, email addresses, phone numbers, and postal addresses), purchase and attendance information, communication preferences and consent records, message content and engagement information, social media profile information, custom fields you define, and any other Personal Data you provide. You must not provide sensitive Personal Data except as permitted by the Terms.

4. Instructions

We process Organizer Personal Data on your behalf in accordance with your documented instructions. The Agreement, your settings and configurations in the Services, and your use of the Services' features are your complete documented instructions. Additional instructions require our written agreement. We may decline to follow any instruction that we believe violates Applicable Data Protection Laws or the Agreement, and we may inform you if we believe an instruction violates Applicable Data Protection Laws, but we are not obligated to review your instructions for legal compliance.

5. CCPA Service Provider Terms

To the extent the CCPA applies to Organizer Personal Data and you are a Business:

you disclose Organizer Personal Data to us for the limited and specified Business Purposes of providing the Services described in the Agreement and the purposes described in Section 7;
we will not Sell or Share Organizer Personal Data. Disclosures that you instruct us to make to your advertising accounts or providers, such as purchase reports, are made on your behalf and at your direction, are subject to the consent and opt-out controls described in our Privacy Policy, and are your responsibility under Section 13 of the Terms;
we will not retain, use, or disclose Organizer Personal Data for any purpose, including a commercial purpose, other than the Business Purposes specified in the Agreement, or as otherwise permitted by the CCPA;
we will not retain, use, or disclose Organizer Personal Data outside the direct business relationship between you and us, except as permitted by the CCPA;
we will not combine Organizer Personal Data with Personal Information that we receive from or on behalf of another person, or that we collect from our own interactions with the Consumer, except as permitted by the CCPA;
we will comply with the obligations of the CCPA that apply to us as a Service Provider and provide the level of privacy protection the CCPA requires;
you may take reasonable and appropriate steps to help ensure that we use Organizer Personal Data in a manner consistent with your obligations under the CCPA, as described in Section 14;
we will notify you if we determine that we can no longer meet our obligations under the CCPA;
upon notice, you may take reasonable and appropriate steps to stop and remediate any unauthorized use of Organizer Personal Data, such as by instructing us to stop the processing or delete the relevant data;
you will inform us of any Consumer request under the CCPA that we must comply with and provide the information we need to comply with it; and
we certify that we understand and will comply with the restrictions in this Section 5.

6. Other State Law Processor Terms

To the extent Other State Laws apply to Organizer Personal Data and you are a Controller, we will, as required by those laws:

process Organizer Personal Data in accordance with your instructions as described in Section 4;
ensure that each person processing Organizer Personal Data is subject to a duty of confidentiality, as described in Section 8;
engage Sub-processors under written contracts as described in Section 10;
assist you as described in Sections 11 and 12;
delete or return Organizer Personal Data as described in Section 13; and
make available information and allow assessments as described in Section 14.

7. Permitted Uses

You authorize us to process Organizer Personal Data for the following purposes, in addition to providing the Services to you, to the extent permitted by Applicable Data Protection Laws:

to build, maintain, and improve the Services and our technology, including developing and improving features, models, and analytics, provided that we do not use Organizer Personal Data to perform services on behalf of another person;
to detect, prevent, investigate, and respond to security incidents, fraud, spam, abuse, and deceptive, malicious, or illegal activity;
to comply with laws, regulations, legal process, and the rules of carriers, card networks, and other providers, and to establish, exercise, or defend legal claims;
to create Deidentified Data or aggregated data, which we may use and disclose for any purpose, provided that we take the measures required by Applicable Data Protection Laws for Deidentified Data;
to maintain suppression, opt-out, and do-not-contact records, including records that apply across the Services, and to use them to honor opt-outs, comply with law and provider rules, and prevent unwanted or unlawful messaging, to the extent permitted by Applicable Data Protection Laws;
to engage Sub-processors under Section 10; and
for any other purpose permitted for Service Providers or Processors under Applicable Data Protection Laws.

8. Confidentiality of Personnel

We require personnel who are authorized to process Organizer Personal Data to be subject to a duty of confidentiality with respect to it.

9. Security

We use administrative, technical, and organizational measures designed to protect Organizer Personal Data, taking into account the nature of the data and the risks of processing. We may update these measures from time to time. No method of transmission or storage is completely secure, and we do not guarantee the security of Organizer Personal Data. You are responsible for your own security practices, including protecting account credentials and the security of Organizer Personal Data before it reaches the Services and after you export it.

10. Sub-processors

10.1 General Authorization

You give us general authorization to engage Sub-processors, including our Affiliates and providers of hosting, storage, messaging, email delivery, payments, analytics, data enrichment, artificial intelligence, customer support, and other services. We will engage Sub-processors under written contracts that impose obligations on them that are consistent with the obligations of Applicable Data Protection Laws that apply to us under this DPA. We remain responsible for our Sub-processors' performance as required by Applicable Data Protection Laws.

10.2 Changes and Objections

We may add or replace Sub-processors, subject to any notice and objection rights under Applicable Data Protection Laws. Where those laws require, we will give you notice and a reasonable opportunity to object before a new or replacement Sub-processor begins processing Organizer Personal Data. We may provide notice through the Services, by email, or by other reasonable means. Where Applicable Data Protection Laws give you a right to object, you may object in writing on reasonable data protection grounds within a reasonable time after notice. If we do not resolve the objection, your sole remedy is to stop using the affected features or to close your organization under the Terms.

11. Assistance

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance, as required by Applicable Data Protection Laws, through features of the Services or otherwise:

to help you respond to requests from individuals to exercise their rights regarding Organizer Personal Data. If we receive such a request directly, we may refer the individual to you, and we may act on it ourselves where Applicable Data Protection Laws or the Terms permit; and
to help you meet your obligations relating to security, breach notification, and data protection assessments.

Where Applicable Data Protection Laws permit, you will reimburse our reasonable costs of providing assistance beyond the self-service features of the Services.

12. Security Incidents

We will notify you of a Security Incident without undue delay, and in any event within any time required by Applicable Data Protection Laws, after we confirm it. We will provide information about the Security Incident that is reasonably available to us and that you need to meet your notification obligations, and we may update it as it becomes available. Our notification of or response to a Security Incident is not an acknowledgement of fault or liability. You are responsible for any notices to individuals, regulators, or others that Applicable Data Protection Laws require of you, and you will consult with us before referring to Linkstub in any such notice.

13. Deletion and Return

You may export or delete Organizer Personal Data through the features of the Services while your organization is active. After the Agreement ends, we may delete Organizer Personal Data, or, where Applicable Data Protection Laws require and you ask us in writing within a reasonable time, return or delete it, except that we may retain Organizer Personal Data (a) as required by law; (b) to the extent Applicable Data Protection Laws permit, in backups and archives until they are deleted in the ordinary course, and for the purposes in Section 7; and (c) as Deidentified Data or aggregated data. This DPA continues to apply to Organizer Personal Data that we retain.

14. Compliance Information and Assessments

Upon your reasonable written request, and no more than once in any twelve-month period unless Applicable Data Protection Laws require otherwise, we will make available information reasonably necessary to demonstrate our compliance with this DPA, which may consist of written responses to reasonable questionnaires, certifications, summaries of policies, or summaries of assessments. Where Other State Laws give you a right to conduct an assessment, we may satisfy it by arranging, at our option, for a qualified and independent assessor to assess our policies and measures using an appropriate and accepted control standard or framework. We will provide the assessment report upon request where Applicable Data Protection Laws require it; otherwise, we may provide a summary. Any information we provide under this Section is Linkstub Confidential Information. Where Applicable Data Protection Laws permit, you will bear the costs of any assessment you request.

15. Location of Processing

We, our Affiliates, and our Sub-processors may process Organizer Personal Data in the United States and in other countries.

16. Liability

Our liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in the Terms, to the extent permitted by Applicable Law, and counts toward, and is not in addition to, the aggregate limit on our liability under the Terms. Nothing in this DPA limits your liability. Section 24 (Indemnification) of the Terms applies to claims, fines, and losses arising from your breach of this DPA, from your instructions to us, and from your collection, use, disclosure, or other processing of Organizer Personal Data and Buyer Data.

17. General

17.1 Term

This DPA remains in effect for as long as we process Organizer Personal Data on your behalf.

17.2 Order of Precedence

If there is a conflict between this DPA and the Terms with respect to the processing of Organizer Personal Data, this DPA controls, except that Section 23 (Limitation of Liability) of the Terms always applies.

17.3 Changes

We may update this DPA as described in the Terms, including to reflect changes in Applicable Data Protection Laws or the Services.

17.4 Assignment

We may assign or transfer this DPA, together with the Terms and any related Organizer Personal Data, to an Affiliate or successor as described in the Terms.

17.5 Contact

Questions about this DPA may be sent to legal@linkstub.com.