RepeatAce Data Processing Addendum

Last updated: 5 November 2026

1. Parties and scope#

This Data Processing Addendum ("DPA") forms part of the RepeatAce Terms of Service between Tackr Flow Inc., a Wyoming corporation doing business as RepeatAce ("RepeatAce"), and the business that uses the Service ("Customer"). It applies when RepeatAce processes Customer Personal Data on Customer's behalf to provide the Service. Capitalized terms not defined here have the meanings in the Terms of Service.

What this DPA does not cover. RepeatAce's own processing of information about Customer's account and Authorized Users for billing, account security, communications with Customer and legal compliance is described in the RepeatAce Privacy Policy and is not processing on Customer's behalf. Security, fraud prevention and opt-out handling for Customer Personal Data are part of the Service and covered by this DPA, except where the law places an obligation on RepeatAce directly.

Definitions.

• "Customer Personal Data" means personal information in Customer Data that RepeatAce processes on Customer's behalf, mainly about End Customers, people they refer, and contacts in Network Ace jobs.
• "Privacy Laws" means U.S. federal and state laws on the privacy and security of personal information that apply to the processing, including the California Consumer Privacy Act as amended and comparable state laws, where they apply.
• "Subprocessor" means a third party RepeatAce engages to process Customer Personal Data on Customer's behalf. A business that receives a job through Network Ace is not a Subprocessor; it receives information as a separate business, at Customer's direction.
• "Security Incident" means a breach of security leading to unauthorized access to, or accidental or unlawful loss, alteration or disclosure of, Customer Personal Data. Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked log-in attempts, are not Security Incidents.

2. Roles and instructions#

2.1 Roles. For Customer Personal Data, Customer is the business (controller) and RepeatAce is its service provider (processor).

2.2 Purposes and instructions. RepeatAce processes Customer Personal Data only for the purposes in the Annex: to provide, secure and support the Service. The Terms of Service, this DPA, and Customer's settings and actions in the Service are Customer's documented instructions. RepeatAce will tell Customer if it believes an instruction breaks Privacy Laws, and may decline to follow that instruction.

2.3 Service provider commitments. RepeatAce will not:

• sell or share Customer Personal Data, as those terms are defined in the California Consumer Privacy Act;
• retain, use or disclose Customer Personal Data for any purpose other than the purposes in the Annex, including for targeted advertising;
• retain, use or disclose Customer Personal Data outside the direct business relationship with Customer; or
• combine Customer Personal Data with personal information it receives from or on behalf of others, except as Privacy Laws permit for a service provider.

RepeatAce will comply with applicable Privacy Laws, provide the same level of privacy protection they require, and notify Customer if it determines it can no longer meet its obligations under them. Customer may then take reasonable steps to stop and remedy unauthorized use, including suspending the affected processing.

2.4 De-identified data. RepeatAce may create de-identified data from Customer Personal Data for the purposes in section 7.2 of the Terms of Service, only as Privacy Laws permit. De-identification is carried out within each customer's own data; RepeatAce combines only data that is already de-identified, and does not combine identifiable Customer Personal Data from different customers for this purpose unless applicable law and Customer's documented instructions permit it. RepeatAce will take reasonable measures to keep the data de-identified, publicly commit not to re-identify it, and contractually require any recipient to do the same.

2.5 Customer's responsibilities. Customer is responsible for the lawfulness of the Customer Personal Data it provides and its instructions, including any notices and the permissions required by section 5 of the Terms of Service.

3. Security, personnel and Subprocessors#

3.1 Security. RepeatAce maintains reasonable administrative, technical and physical safeguards appropriate to the nature of Customer Personal Data, including the commitments on personnel, Subprocessors and Security Incidents in this DPA. RepeatAce will not materially reduce the overall protection those safeguards provide.

3.2 Personnel. RepeatAce limits access to Customer Personal Data to personnel and contractors who need it to provide the Service and who are bound by confidentiality obligations.

3.3 Subprocessors. Customer authorizes RepeatAce to use the Subprocessors listed in the Annex. RepeatAce will:

• enter into a written agreement with each Subprocessor imposing data protection obligations that are, in substance, at least as protective as those in this DPA for the services it provides;
• remain responsible to Customer for its Subprocessors' performance of those obligations; and
• give at least 15 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the list in the Annex and emailing each account owner.

Where a Subprocessor must be replaced urgently for security or continuity reasons, RepeatAce may make the change sooner and will notify account owners as soon as practicable. Customer may object to a new Subprocessor on reasonable data protection grounds within 15 days of notice. If the parties cannot resolve the objection, Customer may cancel the affected Service and receive a refund of prepaid fees for the unused period.

4. Assistance, Security Incidents, deletion and audits#

4.1 Requests from individuals. RepeatAce will promptly forward to Customer any request it receives from an individual to access, correct or delete Customer Personal Data, and will not respond except as Customer instructs or the law requires. RepeatAce will honor requests to stop messages directly, as described in the Terms of Service. RepeatAce will give Customer reasonable help to respond to requests, including through features of the Service.

4.2 Other assistance. RepeatAce will give Customer reasonable information and help needed for Customer's compliance with Privacy Laws, including for security assessments, risk assessments and Security Incident notifications.

4.3 Security Incidents. RepeatAce will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data, and in any event within any shorter period the law requires. Notice will not be delayed to complete an investigation. The first notice will describe what is known at the time, and RepeatAce will provide updates as more becomes known, including the nature of the incident, the categories of data and individuals affected, likely consequences and the measures taken. RepeatAce will take reasonable steps to contain and remedy the incident. The parties will coordinate on notifications to individuals and regulators. Each party will make the notifications the law requires of it, and RepeatAce will not name Customer publicly in connection with an incident without Customer's consent unless the law requires it.

4.4 Return and deletion. For 30 days after the account end date, Customer may request an export of Customer Personal Data. RepeatAce deletes Customer Personal Data from the production systems of the Service within 90 days after the account end date. Backups expire on their regular schedule, are not restored for ordinary use, and remain protected by this DPA until they expire. RepeatAce may keep, for only as long as needed and protected by this DPA: opt-out and suppression records, consent evidence, records needed for legal claims, legal holds or Security Incidents, and information the law requires it to keep. Kept information is used only for the purpose for which it was kept and is deleted when that purpose ends.

4.5 Compliance information and audits. Once a year, on 30 days' written notice, Customer may request information reasonably needed to demonstrate RepeatAce's compliance with this DPA, such as answers to a reasonable security questionnaire and summaries of Subprocessors' independent security reports where available. If that information is not sufficient to show compliance, or if a regulator requires it, or after a Security Incident, Customer may request an audit by Customer or an independent auditor bound by confidentiality, at a mutually agreed time, during business hours, limited to records and systems relevant to Customer Personal Data, without access to other customers' data, and at Customer's cost unless the audit reveals a material breach of this DPA by RepeatAce. Instead of an audit, RepeatAce may provide a current independent assessment covering the same scope.

4.6 General. This DPA lasts as long as RepeatAce processes Customer Personal Data on Customer's behalf. The single aggregate limitation of liability in section 8.5 of the Terms of Service applies to this DPA. If this DPA conflicts with the Terms of Service on processing Customer Personal Data, this DPA controls.

Annex: Details of processing#