Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the MyPocketCrew Terms of Service (the "Agreement") entered into by and between Mason Moose LLC ("MyPocketCrew", "we", "us", or "Processor") and the account holder ("Customer", "you", or "Controller").

1. Definitions

1.1 "Applicable Privacy Laws" means all data protection and privacy laws applicable to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), state privacy statutes in Virginia, Colorado, Connecticut, Oregon, Texas, and Utah, and (where applicable) the General Data Protection Regulation (GDPR).

1.2 "Customer Personal Data" means any personal data or personal information uploaded, entered, or submitted to the Service by or on behalf of Customer regarding Customer's clients, end-customers, or business contacts.

1.3 "Controller", "Processor", "Service Provider", "Process", and "Personal Data" shall have the meanings assigned under Applicable Privacy Laws.

2. Scope and Roles

2.1 Role of Parties. Customer is the Controller of Customer Personal Data, and MyPocketCrew is the Processor (or Service Provider) operating under Customer's instructions.

2.2 Purpose of Processing. MyPocketCrew shall process Customer Personal Data solely to provide, maintain, and secure the Service in accordance with Customer's instructions set forth in the Agreement, this DPA, and Customer's configuration of the Service.

3. Processor Obligations & Statutory Restrictions

3.1 No Selling or Sharing. MyPocketCrew shall not:

(a) "Sell" or "Share" Customer Personal Data (as defined under Applicable Privacy Laws);

(b) Retain, use, or disclose Customer Personal Data for any purpose other than the specific business purpose of performing the Service;

(c) Retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and MyPocketCrew; or

(d) Combine Customer Personal Data with personal data received from or on behalf of other third parties, except as permitted by Applicable Privacy Laws.

3.2 Confidentiality. MyPocketCrew shall ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations.

3.3 Security Measures. MyPocketCrew shall implement appropriate technical and organizational measures to protect Customer Personal Data against unauthorized access, destruction, loss, or alteration, including encryption at rest and in transit, access controls, and row-level database isolation.

4. Subprocessors

4.1 Authorized Subprocessors. Customer grants MyPocketCrew general authorization to engage subprocessors to provide components of the Service. Our current subprocessor list is maintained at Section 7 of our Privacy Policy.

4.2 Subprocessor Flow-Down. MyPocketCrew shall execute a written contract with each subprocessor imposing data protection obligations no less restrictive than those in this DPA. Solely to the extent required by Applicable Privacy Laws, MyPocketCrew remains responsible to Customer for its subprocessors' compliance with their data protection obligations under this DPA; provided, however, that any liability arising under or relating to this DPA or subprocessor acts or omissions shall be strictly subject to the disclaimer of indirect damages and the aggregate liability cap set forth in Section 13 (Limitation of Liability) of the Terms of Service.

5. Consumer Rights & Assistance

5.1 Data Subject Requests. If a data subject submits a request to exercise privacy rights directly to MyPocketCrew regarding Customer Personal Data, MyPocketCrew shall direct the data subject to submit their request to Customer. MyPocketCrew shall provide reasonable assistance to Customer to fulfill Customer's obligations under Applicable Privacy Laws.

6. Audit & Deletion

6.1 Deletion or Return. Upon termination of the Agreement or Customer's account deletion request, MyPocketCrew shall delete or de-identify Customer Personal Data in accordance with the Agreement, subject to retention requirements for legal compliance, tax records, and signature verification audit trails.