Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Franchise Builder US Terms of Service and applies to the extent that Franchise Builder US ("Processor", "we", "us") — a trade name of Grant Search US, Inc. — processes Personal Data on behalf of a Franchisor or Franchisee (each, a "Controller") in its capacity as a data processor under applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy and data protection laws.

This DPA specifically covers the platform's handling of third-party customer data — Personal Data belonging to the end-customers of franchisees, which the platform processes on behalf of the franchisor or franchisee who acts as the Controller for that data. This includes customer names, email addresses, phone numbers, addresses, purchase history, loyalty data, and other customer information stored in the Franchisee CRM and related tools.

Controller: The Franchisor or Franchisee is the Controller of third-party customer data and determines the purposes and means of processing. The Controller is responsible for:

• Obtaining proper consent from their customers for data collection and processing
• Providing privacy notices to their customers
• Responding to customer inquiries about their data
• Ensuring compliance with applicable privacy laws in their jurisdiction
• Maintaining a lawful basis for processing customer data

Processor: Franchise Builder US is the Processor and processes third-party customer data only on behalf of and per the documented instructions of the Controller. The Processor is responsible for:

• Processing customer data only as instructed by the Controller through the platform's configuration
• Maintaining appropriate technical and organizational security measures
• Assisting the Controller with data subject requests through the Privacy Rights Portal
• Not processing customer data for any purpose other than providing the Service
• Ensuring personnel authorized to process customer data are bound by confidentiality obligations

The platform may process the following categories of third-party customer Personal Data on behalf of Controllers:

• Identity Data: Customer names, email addresses, phone numbers
• Contact Data: Postal addresses, preferred contact methods
• Transaction Data: Purchase history, total spend, visit frequency, loyalty tier
• Marketing Data: Campaign engagement, email open rates, preferences
• Special Categories (if applicable): Biometric data from Virtual Discovery Day recordings (sentiment, attention) — only when explicitly enabled by the Controller and with participant consent

The Processor maintains a public-facing Privacy Rights Portal where end-customers of franchisees may submit Data Subject Requests (DSRs) including:

• Right to Access: Request a copy of their Personal Data held by the platform
• Right to Delete: Request erasure of their Personal Data across all franchisee databases
• Right to Rectification: Request correction of inaccurate Personal Data
• Right to Data Portability: Request their data in a machine-readable format
• Right to Object: Object to processing for direct marketing purposes

The Processor will process DSRs within 30 days of receipt. Delete requests result in permanent anonymization of the customer's records across all affected franchisee databases. The Processor will notify the Controller of any DSR affecting their franchisees' customer data.

The Processor implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit (TLS) and at rest
• Row-Level Security (RLS) to isolate franchisee customer data
• Access controls and authentication for all platform users
• Regular security assessments and vulnerability monitoring
• Automated PII/PCI scanning for documents stored in the Vault
• 30-day automatic deletion of biometric metadata from Virtual Discovery Day recordings
• Audit trails for signature and disclosure events

In the event of a Personal Data breach affecting the Controller's data, the Processor shall notify the Controller without undue delay, and in any case within 72 hours after the Processor confirms that a Data Breach has occurred and affected the User's data. The 72-hour notification period begins after the platform confirms a Data Breach has occurred and affected the User's data — not upon initial suspicion or unverified alert. The Processor shall provide the Controller with at least the following information: (a) a description of the nature of the breach, (b) the categories and approximate number of data records concerned, (c) the name and contact details of the Processor's data protection officer or other contact point, (d) a description of the likely consequences of the breach, and (e) a description of the measures taken or proposed to address the breach and mitigate its possible adverse effects. The Processor shall take all reasonable steps to remediate the breach and prevent similar incidents from occurring.

The Processor may engage sub-processors to assist in providing the Service. The Controller acknowledges that the following categories of sub-processors may process third-party customer data:

• Cloud hosting providers (data storage and compute infrastructure)
• AI model providers (for content generation features)
• Email delivery providers (for campaign and notification emails)
• Payment processors (for subscription billing only — not for franchisee-to-franchisor payments)

The Processor remains liable for the acts and omissions of its sub-processors to the same extent as if the Processor were performing the processing itself.

Vicarious Liability for Sub-Processor Performance: The Processor expressly acknowledges and agrees that it is vicariously liable to the Controller for the performance of all sub-processors — including cloud hosting providers, AI model providers (including InvokeLLM and its underlying LLM providers), email delivery providers, and payment processors — with respect to data protection, security, and privacy obligations under this DPA and applicable law. This means that the Processor shall be fully liable to the Controller for any breach of data protection or security obligations committed by a sub-processor, as if the Processor had committed the breach itself. The Controller's right to seek redress from the Processor for sub-processor failures is direct and does not require the Controller to first pursue the sub-processor. The Processor's indemnification, defense, and hold-harmless obligations under these Terms extend to all claims arising from sub-processor acts and omissions, and the limitation of liability caps in the Terms shall not apply to the Processor's vicarious liability for sub-processor data protection breaches (consistent with Section 10.1 of the Terms, which excludes indemnification obligations from the liability caps).

Sub-Processor Objection Right (GDPR Article 28): The Processor shall notify the Controller of any intended addition or replacement of a sub-processor at least 10 days in advance, giving the Controller the opportunity to object. The Controller may object to the appointment of a new sub-processor by providing written notice to the Processor within the 10-day objection period. If the Controller objects, the Processor shall not appoint the proposed sub-processor and shall either (a) select an alternative sub-processor, or (b) if no reasonable alternative is available, the Controller may terminate the affected portion of the Service without penalty. Notifications of sub-processor changes will be sent to the email address on file for the Controller's account. The Controller is responsible for ensuring that the email address on file is current and monitored.

The Processor retains third-party customer data for the duration of the Controller's subscription and for a reasonable period thereafter to allow for data export. Upon termination of the Controller's subscription:

• The Controller may request a full export of all customer data within 30 days
• After the 30-day export window, customer data will be permanently deleted or anonymized
• Biometric metadata from Discovery Day recordings is automatically purged 30 days after the event
• Audit logs and compliance records may be retained as required by law

Regulatory Retention Exception: Notwithstanding the deletion timelines above, the Processor and Controller acknowledge that certain data may be legally required to be retained for regulatory compliance purposes — including but not limited to FTC Rule 436 (16 C.F.R. Part 436), which requires franchisors to retain franchise disclosure records for a minimum of three (3) years. Where the Processor or Controller is legally required to retain data beyond the standard deletion timelines, such data shall be retained only for the period required by law and shall be deleted promptly upon expiration of the legal retention requirement. This exception supersedes any contrary deletion timeline in this DPA to the extent necessary for regulatory compliance.

If the Controller operates an education-based or child-facing franchise, the Controller must enable the "Minor Data Mode" in the Franchisee CRM settings. This mode:

• Requires age-verification gates before collecting data from any customer
• Requires verifiable parental consent (per COPPA 16 CFR Part 312) before processing data from customers under 13
• Restricts data processing for minor records to essential operational purposes only
• Disables marketing campaigns targeting minor records
• Enforces enhanced deletion rights for parental guardians

The Controller is solely responsible for obtaining verifiable parental consent and for compliance with COPPA and applicable child privacy laws. The Processor provides the tools to facilitate compliance but does not verify parental consent on the Controller's behalf.

For Controllers and their customers located in the EU, UK, or Switzerland, the Processor ensures cross-border data transfers comply with applicable laws through the EU-U.S. Data Privacy Framework and Standard Contractual Clauses, as described in the Terms of Service. The Controller is responsible for ensuring their customers' data is transferred lawfully, and the Processor provides the necessary safeguards to facilitate such transfers.

The Controller has the right to audit the Processor's compliance with this DPA, subject to reasonable notice and confidentiality obligations. The Processor will make available all information reasonably necessary to demonstrate compliance and will contribute to audits conducted by the Controller or their designated auditor.

Regulatory Audits — Limited Scope: In addition to full security audits, the Controller may conduct limited "Regulatory Audits" up to twice annually for the specific purpose of satisfying state franchise examiner inquiries, regulatory compliance reviews, or governmental data protection authority investigations. A Regulatory Audit is a scoped, targeted review that does not require a full security assessment. For a Regulatory Audit, the Processor shall provide relevant logs, records, and documentation for a specific franchisee's records (identified by franchisee ID or name) within fifteen (15) business days of a written request from the Controller. The scope of a Regulatory Audit is limited to: (a) access logs for the specified franchisee's data; (b) data processing records for the specified franchisee; (c) disclosure receipts and compliance snapshots for the specified franchisee; and (d) any other records specifically requested by the state franchise examiner or regulatory authority. Regulatory Audits do not require the execution of a full NDA and are subject only to a standard confidentiality acknowledgment. The Processor shall not unreasonably refuse or delay a Regulatory Audit request. This provision is designed to ensure that franchisors can respond to state franchise examiner inquiries without triggering the cost and complexity of a full SOC 2 security audit for each regulatory request.

The Processor may update this DPA from time to time to reflect changes in applicable law or platform capabilities. Material changes will be communicated to Controllers through the platform. Continued use of the Service after changes constitutes acceptance of the updated DPA.

For Controllers and their customers targeting UK-based franchisees or end-users, the Processor provides the following UK AI Safety & Fairness Warranty in alignment with UK regulatory guidance for AI systems, including the UK government's "AI Regulation: A Pro-Innovation Approach" white paper and the Information Commissioner's Office (ICO) guidance on AI and data protection.

Safety Warranty: The Processor warrants that its AI-powered tools (including lead scoring, content generation, and compliance analysis) are designed and operated with appropriate safety measures, including human oversight controls, pre-deployment testing, bias auditing, and post-market monitoring. The Processor maintains an AI Risk Management System (AIRMS) documenting risk identification, estimation, mitigation, and ongoing monitoring per EU AI Act Article 9 and UK regulatory expectations.

Fairness Warranty: The Processor warrants that its AI systems do not unlawfully discriminate against individuals based on protected characteristics under the Equality Act 2010. Lead scoring algorithms are subject to regular bias audits, and all automated decision-making processes include a human-in-the-loop approval gate for weight changes, a right to explanation under GDPR Article 22, and a manual review request mechanism.

Transparency: The Processor provides clear, conspicuous AI disclosures to all users interacting with AI-powered features, including AI-generated content watermarks, AI presenter disclosures, and explicit notification when automated decision-making is used in lead qualification. UK-based data subjects are informed of their right to request human review of any automated decision.

Accountability: The Processor designates a legal custodian responsible for AI system governance and compliance. The Processor maintains technical documentation, conformity assessments, and algorithmic drift logs available for audit by the Controller or UK regulatory authorities upon reasonable request.