DATA PROCESSING AGREEMENT Version: 2026-10-01 Last updated: October 1, 2026 This Data Processing Agreement ("DPA") forms part of the Terms of Use between you ("Customer", "Controller", "you") and Zylvie / Deep Roots Media, LLC (EIN: 88-1124384) ("Zylvie", "Processor", "we", "us", "our") and applies when Zylvie processes Personal Data on your behalf in connection with the Zylvie platform and related services (the "Services"). By accepting this DPA (including by clicking accept, checking a box, or continuing to use the Services after notice), you agree to its terms. This DPA is a signed written agreement for purposes of GDPR Article 28 and similar laws. 1. DEFINITIONS "Applicable Data Protection Law" means the EU GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, and other applicable privacy laws. "Customer Personal Data" means Personal Data that you upload to, collect through, or otherwise process via the Services (for example, your buyers' and leads' names, emails, payment-related identifiers, order details, and custom field responses). "GDPR" means Regulation (EU) 2016/679. "Personal Data", "Controller", "Processor", "Sub-processor", "Processing", and "Data Subject" have the meanings in the GDPR (or nearest equivalents under other laws). "SCCs" means the European Commission Standard Contractual Clauses (Decision (EU) 2021/914), Module 2 (Controller to Processor), including the UK International Data Transfer Addendum where UK GDPR applies. Capitalized terms not defined here have the meaning in the Terms of Use. 2. ROLES OF THE PARTIES 2.1 You are the Controller of Customer Personal Data. Zylvie is the Processor. 2.2 Where you process Customer Personal Data on behalf of your own customers, you remain responsible as Controller toward those Data Subjects, and Zylvie acts as your Processor (and, where required, as your Sub-processor). 2.3 Zylvie may also process certain data as an independent Controller (for example, account billing, platform security, product analytics about your use of Zylvie, and our own marketing). That Controller processing is governed by our Privacy Policy, not this DPA. 3. DETAILS OF PROCESSING (Art. 28(3)) 3.1 Subject matter: provision of the Services (hosted storefronts, checkout, subscriptions, delivery, affiliates, analytics, emails, and related features). 3.2 Duration: for the term of your account and as needed afterward for deletion, backups, legal retention, or dispute resolution. 3.3 Nature and purpose: hosting, storing, transmitting, displaying, analyzing (as instructed by the Services' features), and otherwise Processing Customer Personal Data solely to provide the Services and under your documented instructions. 3.4 Types of Personal Data: may include name, email, phone, billing/shipping address, IP address, device/browser data, purchase history, subscription status, custom form fields, tax IDs you collect, and payment metadata processed via payment providers (card numbers are handled by Stripe/PayPal; Zylvie does not store full payment card numbers). 3.5 Categories of Data Subjects: your customers, leads, affiliates, partners, and other end users who interact with your Brands on the Services. 3.6 Your instructions: this DPA, the Terms of Use, your configuration of the Services (including integrations you enable), and other written instructions you provide that are consistent with the Services. 4. PROCESSOR OBLIGATIONS Zylvie shall: (a) process Customer Personal Data only on documented instructions from you, unless required by law (in which case we will notify you unless legally prohibited); (b) ensure persons authorized to process Customer Personal Data are bound by confidentiality; (c) implement appropriate technical and organizational measures under GDPR Article 32, taking into account the state of the art, costs, nature, scope, context, and risks; (d) respect the Sub-processor conditions in Section 5; (e) taking into account the nature of processing, assist you by appropriate technical and organizational measures, insofar as possible, with Data Subject requests under Chapter III GDPR; (f) assist you in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of processing and information available to us; (g) at your choice, delete or return Customer Personal Data after the end of the provision of Services relating to processing, and delete existing copies unless law requires storage; (h) make available information necessary to demonstrate compliance with Article 28 and allow for audits as described in Section 8; (i) promptly notify you after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide information reasonably available to help you meet your notification obligations. 5. SUB-PROCESSORS 5.1 You provide general written authorization for Zylvie to engage Sub-processors to process Customer Personal Data for the Services. 5.2 The current list of Sub-processors is published at https://zylvie.com/subprocessors and is incorporated into this DPA. By accepting this DPA you authorize those Sub-processors. 5.3 Zylvie will impose data-protection obligations on Sub-processors that are no less protective than those in this DPA, to the extent applicable to the Sub-processor's services. 5.4 Zylvie will give at least thirty (30) days' prior notice of intended additions or replacements of Sub-processors by updating https://zylvie.com/subprocessors and/or emailing your account email, so you may object on reasonable data-protection grounds before the change takes effect. If you object and the parties cannot resolve the objection, you may terminate the affected Services as your sole remedy. 5.5 Zylvie remains responsible for Sub-processors' performance of their obligations as if performed by Zylvie. 6. INTERNATIONAL TRANSFERS 6.1 You acknowledge that Zylvie is established in the United States and that Customer Personal Data may be processed in the United States and other countries where Zylvie or its Sub-processors operate. 6.2 Where GDPR (or UK/Swiss law) requires a transfer mechanism for Customer Personal Data transferred to Zylvie outside the EEA/UK/Switzerland, the parties agree that the SCCs (Module 2) are incorporated by reference into this DPA, with you as data exporter and Zylvie as data importer. Annexes are completed as follows: - Annex I: parties and processing details as set out in this DPA and your account information; - Annex II: security measures described in Section 4(c) and our Privacy Policy; - Annex III: Sub-processors at https://zylvie.com/subprocessors. 6.3 Where the UK GDPR applies, the UK International Data Transfer Addendum to the SCCs is incorporated. 6.4 If Zylvie certifies under the EU-U.S. and/or Swiss-U.S. Data Privacy Framework (DPF), transfers may also rely on DPF where applicable. SCCs remain available as a backup mechanism. 6.5 You instruct Zylvie to enter into SCCs (Module 3) or equivalent terms with Sub-processors where required for onward transfers. 7. CCPA / CPRA AND U.S. STATE PRIVACY LAWS 7.1 To the extent the CCPA/CPRA or similar U.S. state laws apply to Customer Personal Data, you are the "Business" and Zylvie is a "Service Provider" / "Processor". 7.2 Zylvie shall not: (a) sell or share Customer Personal Data (as those terms are defined under CCPA/CPRA); (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes of providing the Services, or as otherwise permitted by law; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship with you; or (d) combine Customer Personal Data with personal information from other sources except as permitted for a Service Provider under CCPA/CPRA. 7.3 Zylvie will notify you if it determines it can no longer meet its obligations under this Section. You may take reasonable steps to stop and remediate unauthorized use. 8. AUDITS Upon reasonable written notice, no more than once per twelve (12) months (unless required by a supervisory authority or following a Personal Data Breach), Zylvie will make available information reasonably necessary to demonstrate compliance with this DPA, which may include security documentation, certifications, or questionnaire responses. On-site audits are subject to reasonable confidentiality, scheduling, and cost allocation. 9. YOUR RESPONSIBILITIES You are responsible for: (a) the lawfulness of your instructions and of your collection and use of Customer Personal Data; (b) providing required notices and obtaining consents; (c) configuring the Services appropriately (including GDPR cookie consent and other storefront settings); and (d) not instructing Zylvie to process data in violation of Applicable Data Protection Law. 10. LIABILITY; ORDER OF PRECEDENCE Liability under this DPA is subject to the limitations in the Terms of Use, except to the extent prohibited by Applicable Data Protection Law. If there is a conflict between this DPA and the Terms of Use regarding Processing of Customer Personal Data, this DPA controls. If SCCs conflict with this DPA, the SCCs control for the relevant transfers. 11. TERM This DPA takes effect on the date you first accept it (or the date printed above for the current version, if later accepted) and continues for as long as Zylvie processes Customer Personal Data on your behalf. Provisions that by nature should survive (confidentiality, liability, deletion) will survive termination. 12. CONTACT Privacy and DPA questions: privacy@zylvie.com Postal: Zylvie / Deep Roots Media, LLC, 953 N Normandie Ave, Los Angeles, CA 90028, United States Acceptance record: When you accept this DPA in the Services, we store your account identity, the DPA version, timestamp, IP address, and user agent as evidence of agreement.