1. PARTIES, SCOPE, AND ROLES

This Data Processing Addendum ("DPA") is part of the PetBizHQ™ Terms and Conditions available at petbizcrm.com/terms-conditions (the "Terms") between You ("Customer") and PetBiz University, LLC, doing business as PetBizHQ™ (formerly PetBizCRM™) ("Company"). It applies whenever the Company processes Customer Personal Data to provide the Software. Capitalized terms not defined here have the meanings given in the Terms.

For Customer Personal Data, Customer is the controller (or "business" under US state law) and decides why and how the data is processed. The Company is the processor (or "service provider" or "contractor") and processes it only on Customer's behalf. If Customer is itself acting as a processor for another business, the Company acts as Customer's subprocessor, and Customer is responsible for passing on any required terms.

This DPA takes effect on the same date as the Terms and stays in effect for as long as the Company processes Customer Personal Data.

2. DEFINITIONS

"Customer Personal Data" means any personal information or personal data within Customer Data that the Company processes on Customer's behalf under the Terms. It does not include account, billing, and contact information about Customer and its users, which the Company handles as described in its Privacy Policy.

"Data Protection Laws" means all privacy and data protection laws that apply to the processing of Customer Personal Data, including US state consumer privacy laws (such as the California Consumer Privacy Act as amended by the CPRA, and the consumer privacy laws of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia), and where applicable the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), Australia's Privacy Act 1988, and Brazil's Lei Geral de Proteção de Dados ("LGPD").

"Data Subject" means the individual a piece of Customer Personal Data is about, such as a pet owner, lead, employee, or job applicant of Customer.

"Process" or "Processing" means any operation performed on Customer Personal Data, such as collecting, storing, using, sending, or deleting it.

"Security Incident" has the meaning given in the Terms.

"Subprocessor" has the meaning given in the Terms, and includes HighLevel and the providers HighLevel engages to run its platform.

"Standard Contractual Clauses" or "SCCs" means the clauses approved by the European Commission in Decision 2021/914, Module Two (controller to processor) or Module Three (processor to processor), as applicable.

"UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

3. PROCESSING ON INSTRUCTIONS

3.1 Instructions. The Company will process Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's use and configuration of the Software (including the workflows, Integrations, and AI Features Customer turns on) are Customer's complete instructions. Those instructions include authorizing the Company to de-identify and aggregate data as permitted by the Terms, and to process data through the AI Features Customer enables. Additional instructions must be in writing and agreed by the Company. If an instruction would require work outside the Software's normal functions, the Company may charge for it or decline it.

3.2 Unlawful instructions. The Company will tell Customer if it believes an instruction violates Data Protection Laws. The Company is not required to carry out that instruction.

3.3 Legal requirements. If law requires the Company to process Customer Personal Data in another way, the Company will tell Customer first unless the law forbids it.

3.4 Customer's responsibilities. Customer is responsible for having a lawful basis and all notices and consents needed to collect Customer Personal Data and have the Company process it, including for texts, calls, AI voice agents, and Integrations. Customer will not instruct the Company to process data in a way that breaks Data Protection Laws.

3.5 Sensitive data. The Software is not designed for special categories of personal data or other sensitive data (such as human health, biometric, or government ID information). Customer will not submit such data unless it first notifies the Company in writing and the parties agree on appropriate safeguards. The Software is not offered as HIPAA compliant, and the Company does not sign business associate agreements unless agreed separately in writing.

3.6 Personnel. The Company will make sure that anyone it authorizes to access Customer Personal Data, including employees and contractors, is bound by confidentiality obligations and only has the access needed for their role.

3.7 No AI training. The Company will not use Customer Personal Data to train, retrain, or fine-tune any artificial intelligence or machine learning model, as stated in the Terms.

3.8 Inability to comply. If the Company can no longer meet its obligations under this DPA, it will promptly tell Customer. Customer may then instruct the Company to stop processing the affected Customer Personal Data, and the Company will either stop or take reasonable steps to fix the problem.

4. SECURITY

4.1 Safeguards. The Company will use commercially reasonable efforts to protect Customer Personal Data with appropriate technical and organizational measures, as described in Annex 2.

4.2 Platform security. The Software runs on the HighLevel platform. Many security controls, including hosting, encryption, and infrastructure monitoring, are operated by HighLevel and its providers. The Company selects and relies on that platform because it maintains independently audited security programs.

4.3 Company-operated systems. For any systems the Company operates itself, including PetBizHQ Apps, the Company will maintain safeguards no less protective than those in Annex 2.

4.4 Customer's security duties. Customer is responsible for securing its own Login Credentials, managing user access within its account, enabling multi-factor authentication, and not storing data in the Software that the Terms prohibit (such as card numbers or lockbox and alarm codes outside designated secure fields).

5. SUBPROCESSORS

5.1 General authorization. Customer authorizes the Company to use the Subprocessors listed in Annex 3, which includes HighLevel, the providers HighLevel engages to run its platform, and any Subprocessors the Company engages itself to run PetBizHQ Apps.

5.2 HighLevel's providers. HighLevel publishes its subprocessor list at the address in Annex 3 and gives the Company thirty (30) days' notice before adding a new one. The Company will pass along each such notice to Customer by email or in the Software within five (5) business days after receiving it. Customer may object to a new HighLevel provider under Section 5.4. Because the Company cannot require HighLevel to change its providers, if the objection cannot be resolved, Customer's remedy is to terminate the affected part of its subscription with a pro-rated refund as described in Section 5.4.

5.3 Company's own Subprocessors. The Company will keep a current list of the Subprocessors it engages directly at petbizcrm.com/subprocessor-list. Before adding a new one to process Customer Personal Data, the Company will update that list and give at least fifteen (15) days' notice by email or in the Software.

5.4 Objections. Customer may object to a new Subprocessor, including a new HighLevel provider, on reasonable data protection grounds by writing to [email protected] within the notice period. The parties will discuss the concern in good faith. If it cannot be resolved, Customer may terminate the affected part of its subscription and receive a pro-rated refund of prepaid fees for the rest of the term, as stated in the Terms.

5.5 Flow-down and responsibility. The Company will make sure each Subprocessor it engages directly is bound by written terms that protect Customer Personal Data at least as well as this DPA. For HighLevel's providers, those terms are the contracts HighLevel maintains with them. The Company remains responsible to Customer for its Subprocessors' performance of their data protection obligations, as stated in the Terms.

6. SECURITY INCIDENTS

6.1 Notice. The Company will notify Customer of a Security Incident without undue delay, and within seventy-two (72) hours after confirming it. If the Security Incident happens at HighLevel or another Third Party Service, that period starts when the Company is informed of it.

6.2 Information. The notice will include what the Company reasonably knows at the time, such as what happened, the types of data and approximate number of Data Subjects affected, likely consequences, and steps taken. The Company will send updates as it learns more.

6.3 Response. The Company will take reasonable steps to contain the Security Incident and reduce its effects, and will reasonably help Customer meet its own legal duties to notify regulators or Data Subjects.

6.4 Not an admission. Notice of a Security Incident is not an admission of fault or liability.

6.5 Customer-caused events. This section does not apply to incidents caused by Customer or its users, such as shared passwords or a compromised Customer device.

7. ASSISTANCE AND AUDITS

7.1 Data Subject requests. Customer can access, correct, export, and delete most Customer Personal Data directly in the Software. If the Company receives a request from a Data Subject about Customer Personal Data, it will forward it to Customer promptly and will not respond except to direct the person to Customer, unless law requires otherwise. Where Customer cannot fulfill a request through the Software, the Company will provide reasonable help.

7.2 Assessments. The Company will provide reasonably available information to help Customer complete any data protection impact assessment or regulator consultation required by Data Protection Laws.

7.3 Audit information. On written request, no more than once every twelve (12) months, the Company will provide information reasonably needed to show compliance with this DPA. This may include HighLevel's published security certifications or audit summaries (such as SOC 2 Type II and ISO/IEC 27001 materials, where HighLevel makes them available to the Company) and a written response to a reasonable security questionnaire.

7.4 Audits. If Data Protection Laws require more than the information in 7.3, or a regulator requests it, Customer may audit the Company's own systems and practices at Customer's expense, with at least thirty (30) days' notice, during normal business hours, under a confidentiality agreement, and without access to other customers' data. For processing performed by HighLevel or its providers, the Company will, at Customer's request and expense, exercise the audit and information rights the Company has under HighLevel's data processing agreement and share the results with Customer, subject to any confidentiality limits HighLevel imposes.

7.5 Fees. Help beyond what the Software provides, and any audit under 7.4, may be billed at the Company's then-current hourly rate.

8. INTERNATIONAL TRANSFERS

8.1 Where data is stored. Customer Personal Data is stored and processed mainly in the United States. Some support and operations may be performed from other countries, such as by HighLevel's affiliate in India, under HighLevel's contracts.

8.2 European Economic Area. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and treated as signed. Customer is the data exporter and the Company is the data importer. Module Two applies to controller-to-processor transfers and Module Three to processor-to-processor transfers. For the SCCs: Clause 7 (docking) applies; Clause 9(a) uses Option 2 (general written authorization) with the notice process in Section 5; the optional language in Clause 11 does not apply; for Clause 13 the competent supervisory authority is as determined under the GDPR, or if none, the Irish Data Protection Commission; Clauses 17 and 18 are governed by the laws of, and disputes resolved in the courts of, Ireland; and Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA.

8.3 Switzerland. For transfers subject to Swiss data protection law, the SCCs apply as described in 8.2 with these changes: references to the GDPR mean the Swiss Federal Act on Data Protection; the competent authority is the Swiss Federal Data Protection and Information Commissioner; Clause 17 is governed by Swiss law; Clause 18 disputes are resolved in Swiss courts; and Data Subjects in Switzerland may bring claims in Switzerland.

8.4 United Kingdom. For transfers subject to UK data protection law, the SCCs as described in 8.2 and the UK Addendum are incorporated by reference and treated as signed. In the UK Addendum: Table 1 is completed by Annex 1; Table 2 uses the SCC selections in 8.2; Table 3 is completed by Annexes 1 and 2; in Table 4, neither party may end the UK Addendum early; the competent authority is the UK Information Commissioner; and the SCCs are governed by the laws of, and disputes resolved in the courts of, England and Wales, without preventing Data Subjects from bringing claims elsewhere in the UK.

8.5 Canada. For Customer Personal Data subject to PIPEDA or Canadian provincial law, the Company will provide a comparable level of protection to that required in Canada, and Customer is responsible for telling Data Subjects that their information may be stored and processed in the United States.

8.6 Australia and Brazil. For Customer Personal Data subject to Australia's Privacy Act 1988, the Company will handle it consistently with the Australian Privacy Principles. For Customer Personal Data subject to Brazil's LGPD, the parties will rely on a valid adequacy decision or the standard contractual clauses adopted by Brazil's data protection authority, which are incorporated by reference where needed and completed using the Annexes of this DPA.

8.7 Data Privacy Framework. HighLevel states that it is certified under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework. Where a transfer to HighLevel is covered by that certification, it may be relied on. The Company will tell Customer if it learns HighLevel can no longer meet those requirements.

8.8 Updates and alternatives. If authorities adopt new versions of the SCCs or the UK Addendum, the parties agree to use the new version, and the Company may update the Annexes to match. If a transfer mechanism is invalidated, the parties will cooperate to use another valid mechanism.

8.9 Government access requests. As of the effective date of this DPA, the Company has not received any government order to disclose Customer Personal Data, has not built any "backdoor" or similar way for any government to access its systems or Customer Personal Data, and is not aware of any law requiring it to do so. If the Company receives a government request for Customer Personal Data, it will review it for legal validity, challenge requests it reasonably believes are unlawful, disclose only the minimum required, and notify Customer unless the law forbids it. The Company will not voluntarily give Customer Personal Data to a government authority without Customer's agreement.

9. US STATE PRIVACY LAW TERMS

Where a US state privacy law applies to Customer Personal Data, the Company acts as Customer's service provider, contractor, or processor and will:

• not sell or share Customer Personal Data, as those terms are defined in that law;
• not retain, use, or disclose Customer Personal Data for any purpose other than providing the Software under the Terms, or as that law otherwise permits;
• not retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and the Company;
• not combine Customer Personal Data with personal information it receives from anyone else, except as that law permits;
• comply with that law and provide the same level of privacy protection it requires;
• tell Customer if it can no longer meet its obligations under that law;
• allow Customer to take reasonable and appropriate steps to stop and fix any unauthorized use of Customer Personal Data; and
• help Customer respond to consumer rights requests as described in Section 7.1.

The Company certifies that it understands and will comply with these restrictions.

10. DELETION, LIABILITY, AND PRECEDENCE

10.1 Return and deletion. When the Terms end, Customer may export Customer Personal Data during the thirty (30) day Export Period described in the Terms. After that, the Company will delete Customer Personal Data from active systems within thirty (30) days, and will require its Subprocessors to delete or return it as well, unless law requires some data to be kept. Copies in backups are kept securely isolated and protected from any further processing until they are overwritten in the platform's normal backup rotation. The Company will confirm deletion in writing on request. Integration Data follows the shorter timelines in the Terms. If Customer completes a Transfer, Customer Personal Data moves with the account as described in the Terms.

10.2 Liability. Each party's liability under this DPA, including under the SCCs and UK Addendum to the extent law allows, is subject to the Limitation of Liability section of the Terms, including the separate cap for Data Claims.

10.3 Order of precedence. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA controls. If the SCCs or UK Addendum conflict with this DPA or the Terms, the SCCs or UK Addendum control for the transfers they cover.

10.4 Changes. The Company may update this DPA when Data Protection Laws change or to reflect new Subprocessors or features, using the notice process in the Terms. An update will not reduce the overall protection of Customer Personal Data during Customer's current paid term. Where a change is required by law or by a change HighLevel makes to its own data processing terms, the Company may give shorter notice, matching the notice it receives, and Customer may terminate the affected part of its subscription with a pro-rated refund if it reasonably objects.

10.5 Contact. Privacy questions and notices under this DPA go to [email protected].

10.6 General. This DPA replaces any earlier data processing terms between the parties. The parties will review it when the processing, the data involved, or the risks change in a meaningful way. Either party may share this DPA with a privacy regulator on request. If any part of this DPA is found unenforceable, it will be replaced with a valid term that comes as close as possible to the original intent, and the rest stays in effect. Each person accepting this DPA confirms they have authority to bind their party.

ANNEX 1: DETAILS OF PROCESSING

ANNEX 2: SECURITY MEASURES

The platform-level measures below are those HighLevel publishes for its platform. The Company does not operate them directly and relies on HighLevel's independently audited programs.

Platform (operated by HighLevel and its providers)

• Hosting on Google Cloud Platform and Amazon Web Services, with physical security managed by those providers
• Encryption at rest using AES-256 and encryption in transit using TLS 1.2 or higher
• Role-based access controls, signed encrypted session tokens, and two-factor authentication available to users
• Backups on AWS and Google Cloud with frequent recovery points for disaster recovery
• Third-party vulnerability scans and penetration testing at least yearly, plus a patch management process
• User action and audit logging through Google Cloud Operations and AWS CloudWatch
• Version-controlled system configuration, standardized container images, and automatic updates
• An in-house security team plus a third-party managed security provider for monitoring
• Uptime monitoring and endpoint protection
• SOC 2 Type II and ISO/IEC 27001 programs, as published by HighLevel
• Data export tools and public APIs for portability, and admin settings for data retention

Company practices (operated by PetBizHQ)

• Access to customer accounts limited to team members who need it for their role, removed promptly when no longer needed
• Multi-factor authentication required for all Company team member logins
• Confidentiality agreements with all employees and contractors who access Customer Personal Data
• Integration access tokens and API keys stored only in encrypted fields or secret managers, never in plain text, chat, or shared documents
• Security and privacy training for team members at onboarding and at least yearly
• Written incident response steps matching Section 6
• For PetBizHQ Apps: encrypted hosting, access logging, least-privilege service accounts, and vendor review before adding any new Subprocessor

ANNEX 3: SUBPROCESSORS

Part A: HighLevel and its providers. HighLevel's current list is published at gohighlevel.com/sub-processors (last updated September 2025 when checked). As of that list:

Part B: Company's own Subprocessors (PetBizHQ Apps). See our current list at petbizcrm.com/subprocessor-list.