Data Processing Agreement

1. Customer and New Breed Marketing LLC ("New Breed") hereby agree to the following Data Processing Agreement Version 3.1 (the "DPA") to their Terms and Conditions for Professional Services (the "Agreement"), dated as of September 30, 26 ("Effective Date").

2. Designation of the Parties. The parties agree that, for all data received from or on behalf of the Customer, or otherwise obtained in connection with the performance of New Breed's obligations under this DPA or the Agreement, that relates to an identified or identifiable individual, including any information that can be used to identify or contact a specific individual, such as first and last name, email address, telephone number, social security number, financial account information, credit card number, or otherwise relates to or is capable of identifying a natural person ("Customer Personal Data"), the Customer shall be the controller or business and New Breed shall be the processor or service provider, as these terms are defined under applicable privacy law. Customer Personal Data shall consist of the following data elements: name, email address, phone number, login credentials to third-party platforms (e.g., HubSpot), and employment-related information (e.g., title). Customer shall not provide or make available to New Breed other types of personal data without prior notification and approval from New Breed. Each party shall comply with all relevant privacy laws and its relevant obligations under this DPA. New Breed shall notify Customer if it believes it can no longer process Customer Personal Data in compliance with applicable law or this DPA.

3. Use of Personal Data. Customer Personal Data will be accessed, used, maintained, collected, modified, merged, shared, disclosed or otherwise processed (collectively, "Processed") by New Breed only as is necessary for New Breed to perform its obligations under this DPA and the Agreement, or as otherwise required by the Customer in writing. When processing Customer Personal Data on behalf of the Customer, New Breed shall ensure that any person acting on its behalf or under its authority processes the Customer Personal Data only in accordance with the Customer's written instructions, including as set out in the applicable Agreement and/or statement of work ("Processing Instructions"). New Breed shall not (a) Process Customer Personal Data for any purpose other than as necessary to perform its services under the Agreement and for no other business or commercial purpose; (b) "sell" or "share" Customer Personal Data (as those terms are defined under applicable law); and (c) Process Customer Personal Data outside of the business relationship between the parties. The Customer shall not provide any Processing Instructions that may infringe any applicable law.

4. Privacy and Security Policy. New Breed shall implement and maintain, at its cost and expense, commercially reasonable measures designed to protect the confidentiality of Customer Personal Data Processed by New Breed on behalf of Customer. New Breed's technical and organizational measures are further described in Exhibit A. Customer shall be responsible for the security of its own information systems and platforms, including any relevant third-party platforms (e.g., HubSpot) holding Customer Personal Data to which Customer provides New Breed with access. New Breed shall ensure that each person Processing Customer Personal Data under this DPA is subject to a duty of confidentiality with respect to the Customer Personal Data.

5. Agents and Subprocessors.

5.1 Subcontractors engaged on a specific customer engagement are identified to the affected customer directly, as described at newbreedrevenue.com/subprocessors.

5.2 New Breed shall provide Customer with 30 days' advance written notice before engaging new subprocessors. Notice under this Section may be given by email to the Customer notice address set forth in the applicable Statement of Work, in accordance with the Notices section of the Agreement. Customer may reasonably object to a new subprocessor by notifying New Breed in writing within 10 days of receiving notice. If Customer objects to a subprocessor, New Breed may, at its discretion, either: (a) not use that subprocessor, or (b) terminate the Agreement without penalty to either party upon 30 days' written notice.

5.3 New Breed shall enter into binding written contracts with all subprocessors that impose substantially the same material data protection obligations contained in this DPA.

6. Cooperation. New Breed shall provide reasonable assistance, information, and cooperation to the Customer to ensure compliance with the Customer's obligations under relevant laws with respect to: (i) data security; (ii) data breach notification; (iii) responding to requests relating to Customer Personal Data and/or the Customer's data privacy or security practices from regulators or individuals; and (iv) conducting privacy impact assessments. New Breed shall reasonably cooperate with the Customer in the Customer's efforts to monitor New Breed's compliance with this DPA and Customer will have the right, upon notice, to take reasonable and appropriate steps to stop unauthorized Processing of Customer Personal Data by New Breed. To the extent required under applicable law, New Breed, upon reasonable notice and at Customer's expense, shall cooperate with reasonable audits and inspections in connection with its obligations under this DPA.

7. Cross Border Data Transfers. The Customer understands and acknowledges that New Breed may Process Customer Personal Data in several jurisdictions, including the United States. It is the obligation of the Customer to notify New Breed if any Customer Personal Data relates to residents of the European Union, or any other jurisdiction with specific cross-border data transfer restrictions. Where such restrictions exist, the parties shall enter into Standard Contractual Clauses, or a similar mechanism, in order to legitimize such a transfer. Where New Breed otherwise transfers Customer Personal Data outside of its country of origin, New Breed shall ensure that such transfer (and any onward transfer): (i) is pursuant to a written contract including provisions relating to security and confidentiality of any Customer Personal Data; (ii) is made pursuant to a legally enforceable mechanism for such cross-border data transfers of Customer Personal Data under relevant laws; (iii) is made in compliance with this DPA; and (iv) otherwise complies with relevant privacy laws.

8. Breaches. In the event of any access or acquisition of Customer Personal Data by an unauthorized third party, New Breed shall notify the Customer of the data breach without undue delay. New Breed warrants that if there has been a breach of Customer Personal Data, all responsive steps will be documented, and New Breed will reasonably cooperate with the Customer in the Customer's handling of the matter, including reasonably responding to and attempting to mitigate any damages caused by the breach.

9. Information Management.

9.1 The duration of New Breed's Processing of Customer Personal Data shall be the duration of the Agreement unless otherwise instructed by Customer in writing.

9.2 Upon Customer's written request, and in any event upon termination or expiration of the Agreement, New Breed shall securely delete or return Customer Personal Data within thirty (30) days of the request or of the effective date of termination, whichever occurs first. Customer may request deletion or return at any time by contacting security@newbreedrevenue.com. Deletion shall be carried out in accordance with the destruction methods set out in Exhibit B.

9.3 Where Customer Personal Data resides in systems owned or controlled by Customer or by Customer's own vendors, including Customer's HubSpot portal(s), analytics properties, and cloud environments, New Breed's obligations under Section 9.2 are limited to ceasing Processing, removing New Breed user and service account access, and deleting or returning any copies of such data held in systems controlled by New Breed. Retention and deletion of data within Customer-controlled systems remains Customer's responsibility as controller.

9.4 Notwithstanding Section 9.2, New Breed may retain Customer Personal Data (a) where retention is required by applicable law, and (b) in the categories and for the periods set out in Exhibit B, for the establishment, exercise, or defense of legal claims. Customer Personal Data retained under this Section 9.4 shall: (i) remain subject to this DPA, including the confidentiality and security obligations in Sections 3 and 4; (ii) be held in archival form and not Processed for any purpose other than the purpose for which it is retained; (iii) be accessible only to New Breed personnel with a legitimate need; and (iv) be securely deleted upon expiry of the applicable retention period. New Breed shall, upon Customer's written request, identify the categories of Customer Personal Data retained under this Section and the applicable retention periods.

9.5 Exhibit B sets out New Breed's retention periods and destruction methods for Customer Personal Data. New Breed's internal policies and procedures do not modify this DPA. In the event of a conflict between any internal New Breed policy and this DPA, this DPA governs.

10. Indemnification. The Customer agrees that it shall reimburse, indemnify, and hold New Breed harmless for all costs incurred in responding to and/or mitigating damages relating to a third-party claim brought against New Breed regarding the Customer's Processing of Customer Personal Data where such Processing is consistent with this DPA and the Processing Instructions.

11. Limitation of Liability; Order of Precedence. This DPA is entered into pursuant to, and forms part of, the Agreement. Each party's liability arising out of or relating to this DPA, whether in contract, tort, or any other theory of liability, is subject to and counts toward the aggregate limitations of liability and the exclusions of damages set forth in the Agreement, and nothing in this DPA shall be construed to increase, expand, or create any liability beyond the limitations set forth in the Agreement. In the event of a conflict between this DPA and the Agreement with respect to the Processing of Customer Personal Data, this DPA shall control; in all other respects, the Agreement shall control.

12. Artificial Intelligence and Automated Processing. New Breed may engage third-party artificial intelligence and machine learning services as subprocessors to perform services under the Agreement, subject to the notice and objection rights in Section 5 (Agents and Subprocessors). New Breed shall contractually require that any such subprocessor does not use Customer Personal Data to train, fine-tune, or otherwise improve any model made available to third parties. Customer Personal Data submitted to such services shall be Processed solely to generate outputs for New Breed in connection with the services.

Supersedes: Version 3.0 (August 20, 2026), Version 2.0 (November 18, 2025), and Version 1.0 (March 1, 2024)

Exhibit A - Security Measures

New Breed maintains the following technical and organizational measures in support of its obligations under Section 4 (Privacy and Security Policy) of this DPA, as of the Effective Date:

• Endpoint protection and anti-malware deployed across company devices (Malwarebytes ThreatDown).
• Full-disk encryption on company endpoints.
• Two-step verification enforced on New Breed Google Workspace accounts.
• Role-based access controls on systems used to Process Customer Personal Data.
• Contractual confidentiality obligations binding all personnel with access to Customer Personal Data.
• Engagement of artificial intelligence and SaaS subprocessors under written agreements that, where applicable, prohibit use of Customer Personal Data for model training.

In development (not represented as operational controls as of the Effective Date):

SOC 2 examination (Type I targeted 2026; Type II targeted 2027) and a formal recurring security awareness training program. New Breed does not currently hold SOC 2, ISO 27001, or HITRUST certification, and does not deploy data loss prevention (DLP) tooling.

Exhibit B - Retention

Retention and Disposition of Customer Personal Data

This Exhibit sets out New Breed's retention periods and destruction methods for Customer Personal Data, as referenced in Section 9 of this DPA.

B.1 Retention Trigger. Unless otherwise specified, retention periods run from the project close date recorded in New Breed's professional services management system. Where no formal project close record exists, the date of last billable activity applies. Where a period runs from a different trigger, that trigger is stated in the table below.

B.2 Retention Schedule.

Data retained under the six-year and seven-year categories above is retained under Section 9.4 and is subject to the restrictions set out in that Section.

B.3 Access Revocation at Contract Close. Within five (5) business days of contract close, New Breed removes all New Breed user and service account access to Customer platforms, revokes all Customer-issued credentials and OAuth tokens in New Breed's credential management systems and in the source systems, and records each revocation with a timestamp and the identity of the operator performing it.

B.4 Destruction Methods.

• Revocation of credentials in the source system together with deletion from New Breed's credential management system, with the revocation event logged.
• Permanent deletion from New Breed's active and archival storage systems.
• Configuration of platform-level retention and deletion settings for recording and communications services.
• For physical media, where applicable, sanitization in accordance with NIST SP 800-88 Rev. 1.
• Certificates of destruction provided where required by this DPA or the Agreement.

B.5 Suspension for Legal Hold. The retention periods in this Exhibit are suspended, in whole or in part, for any category of data relevant to anticipated or active litigation, a regulatory inquiry, or a formal dispute. Normal retention and disposition resume only upon written release of the hold. Where a legal hold prevents New Breed from completing a deletion requested by Customer under Section 9.2, New Breed shall notify Customer of that fact and of the affected categories of data.

B.6 Application of Data Protection Law. Where an engagement is subject to:

• GDPR: New Breed's obligations as processor under Article 28 and the terms of this DPA are authoritative for end-customer personal data.
• CCPA / CPRA: New Breed shall assist Customer in responding to consumer deletion requests within timeframes that permit Customer to meet its statutory response obligations, including the forty-five (45) day period extendable to ninety (90) days with notice.
• Other applicable data protection law: where such law requires a shorter retention period or a faster deletion timeline than this Exhibit provides, that law governs for the affected data.