Legal

    Data Privacy Addendum

    Effective October 22, 2026

    This Data Privacy Addendum (“Addendum”) forms part of the Master Services Agreement between Neural Ads LLC (“Neural Ads”) and the company named in that agreement (“Company”) (the “MSA”). This Addendum covers the Processing of Company Personal Information to the extent that the US Privacy Laws apply. In the event of any inconsistency between the other terms of the MSA and this Addendum, this Addendum will prevail. Capitalized terms used but not defined in this Addendum shall have the meaning ascribed in the MSA.

    1. Definitions.

      1. “Company Personal Information” means any Personal Information that Company makes available to Neural Ads pursuant to the MSA.

      2. “Consumer” means a natural person to whom Personal Information relates.

      3. “Controller” means the party that alone or jointly with others determines the purpose and means of the Processing of Personal Information.

      4. “Personal Information” means any information relating to a Consumer that is subject to protection under the US Privacy Laws and includes information that is referred to as “personal data” and similar terms as may be defined in the US Privacy Laws.

      5. “Subprocessor” means a vendor used by Neural Ads in the Processing of Company Personal Information on Company’s behalf when Neural Ads acts as a Processor.

      6. “US Privacy Laws” means privacy laws, regulations, or guidance applicable to the Processing of Personal Information in any relevant United States jurisdiction, including the California Consumer Privacy Act, as amended, including by the California Privacy Rights Act and implementing regulations (“CCPA”) and any other similar applicable laws that are in effect during the term of the MSA.

      7. The following terms have the meaning assigned to them in US Privacy Laws: “Business,” “Cross-Context Behavioral Advertising,” “Personal Information,” “Process,” “Processor,” “Sale” (or “Sell”), “Service Provider,” “Share,” “Targeted Advertising,” and “Third Party”. References in this Addendum to “Controller” and “Processor” include “Business” and “Service Provider,” respectively.

    2. Party Roles. As to Company Personal Information, Company is a Controller. Neural Ads is:

    • A Processor, except when Processing Company Personal Information of California residents for Cross-Context Behavioral Advertising.

    • A Third Party when Neural Ads Processes Company Personal Information of California residents for Cross-Context Behavioral Advertising, as dictated by the CCPA.

    1. Neural Ads’ Obligations as Processor. This Section 3 applies when Neural Ads Processes Company Personal Information as a Processor (i.e., when Neural Ads is not acting as a Third Party under the CCPA).

      1. Nature and Purpose of Processing. Neural Ads Processes Company Personal Information to provide Company the Services and as otherwise described in the MSA, including ad targeting, audience suppression, frequency capping, measurement, fraud detection and prevention.

      2. Company Instructions. Neural Ads will Process Company Personal Information to provide the Services and as further described in Section 3.1. Company instructs Neural Ads to Process such Company Personal Information for these purposes and other purposes permitted by US Privacy Laws. Neural Ads will ensure that any person authorized to Process Company Personal Information under this Addendum is bound by appropriate obligations of confidentiality.

      3. Assistance. Taking into account the nature of its Processing, Neural Ads will assist Company, to the reasonable extent required by US Privacy Laws, to meet Company’s obligations under US Privacy Laws, including responding to Consumer requests to exercise their rights under US Privacy Laws or to assist with data protection impact assessments, cybersecurity audits, and breach notice obligations.

      4. Data Deletion. On termination of the MSA, Company instructs Neural Ads to delete Company Personal Information without undue delay, unless applicable law requires further storage.

    2. Neural Ads’ Obligations as Third Party under CCPA. This Section 4 applies in lieu of Section 3 when Neural Ads Processes Company Personal Information of California residents used for Cross-Context Behavioral Advertising.

      1. Neural Ads will (a) not Sell or Share such Company Personal Information; (b) not retain, use, or disclose such Company Personal Information outside of the direct business relationship with Neural Ads or for purposes other than those set forth this Addendum, unless otherwise permitted by the CCPA; (c) upon notice from Company of its reasonable belief that Neural Ads is Processing Company Personal Information in an unauthorized manner, cooperate with Company in good faith to stop or remediate unauthorized use of such Company Personal Information, as necessary, such as by providing documentation verifying certain practices; and (d) notify Company promptly if Neural Ads determines it can no longer meet its obligations under the CCPA.

      2. Neural Ads will comply with the obligations that apply to its role as a Third Party under the CCPA and provide Company Personal Information with the level of privacy protection required by the CCPA.

      3. Company makes Company Personal Information available to Neural Ads for the limited and specified purpose of providing Company with the Services and as otherwise described in this Addendum. Neural Ads will not Process Company Personal Information for any other purpose unless such Processing is explicitly permitted or required by US Privacy Laws or other applicable law.

      4. At reasonable intervals during the term of the MSA but no more than once every 12 months, Neural Ads will, upon written request, provide information or documentation necessary to demonstrate its compliance with this Addendum. If such information or documentation reveals unauthorized use of Company Personal Information, Company and Neural Ads will promptly work together in good faith to agree on reasonable and appropriate steps to stop and remediate such unauthorized use.

    3. Company Obligations. Company will comply with its obligations as a Controller under US Privacy Laws with respect to the Processing of Personal Information and provide all notices and obtain any consents required by US Privacy Laws to permit Neural Ads to Process Personal Information in accordance with this Addendum. Company will provide Consumers with a clear and conspicuous ability to opt out of the Sale, Sharing, or Processing of Personal Information for Targeted Advertising and will not provide Neural Ads with Personal Information of any Consumer who has opted out.

    4. Subprocessors. Neural Ads may engage the Subprocessors set forth at [URL]. Before disclosing Company Personal Information to any new Subprocessor, Neural Ads will provide Company advance notice and where required by US Privacy Laws, Company may object to such Subprocessor during the notice period. If the objection cannot be resolved, either party may terminate use of the Services and the MSA without penalty. Neural Ads agreements with Subprocessors will include protections consistent with those set forth in this Addendum.

    5. Audit. Upon Company’s reasonable request, Neural Ads will provide information reasonably necessary to demonstrate compliance with this Addendum (e.g., a certificate issued for security verification reflecting the outcome of an audit or other documentation). Company may conduct an audit to verify Neural Ads’ compliance with this Addendum by reviewing such documentation. In addition, in response to a reasonable request from Company and solely as necessary to fulfill Company’s obligations under US Privacy Laws, Company may engage a reputable and independent third-party auditor to verify Neural Ads’ compliance with this Addendum. Any such audit will (a) occur not more than once every 12 months; (b) be at Company’s expense; (c) be subject to reasonable confidentiality and scope limitations set forth by Neural Ads; (d) take place during regular business hours; and (e) not unreasonably interfere with Neural Ads’ business operations.

    6. Data Security. Neural Ads will maintain technical and organizational measures designed to protect Company Personal Information against any breach of security leading to the accidental or unlawful destruction, use, loss, alteration or unauthorized disclosure of Company Personal Information (“Security Breach”). To the extent required by US Privacy Laws, Neural Ads will promptly inform Company of any Security Breach. To the extent possible, such notice will include information about the nature of the Security Breach, the category and approximate number of affected individuals, anticipated consequences of the Security Breach, and any actual or proposed remedies to mitigate potential adverse effects.