This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer using Visby.ai ("Customer") and Adsby B.V., Singel 542 1017, Amsterdam 1017 AZ, Netherlands ("Visby", "we", "us"). It sets out how Visby processes Personal Data on behalf of the Customer and applies to the extent Applicable Data Protection Law governs that processing.

1. Definitions

Terms such as "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR. In this DPA:

• Applicable Data Protection Law means the laws on privacy and data protection that apply to the processing of Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, the Turkish Personal Data Protection Law No. 6698 ("KVKK") and US state privacy laws, each as amended.

• Services means the Visby.ai platform described in the Terms of Service.

• Connected Services means the third-party services the Customer chooses to connect to Visby.ai: Google Analytics, Google Search Console, Google Merchant Center, Bing Webmaster Tools, Shopify, and other services Visby may add later.

• Customer Data means the domains the Customer adds, the data Visby retrieves from Connected Services on the Customer's behalf, and the scores, reports, tasks and content Visby generates from them for the Customer.

• Personal Data means any information relating to an identified or identifiable natural person that is contained in Customer Data.

• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed by Visby.

• Sub-processor means a third party engaged by Visby to process Personal Data on the Customer's behalf, as listed in Annex III.

• DPF means the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, as applicable.

• SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

• EEA means the European Economic Area.

2. Scope, Roles and Order of Precedence

2.1 Visby as processor. For Personal Data contained in Customer Data, the Customer is the controller (or a processor acting for another controller) and Visby is the processor. Visby does not expect Customer Data to contain Personal Data: the data Visby retrieves from Connected Services is statistical and aggregated and does not identify individuals (see Annex I).

2.2 Visby as controller. Visby acts as an independent controller for the data it needs to run its business: account details of the Customer's users (name, email address, company information), billing information, and website and usage data, including cookie data. That processing is described in the Privacy Policy and Cookie Policy and is not governed by this DPA.

2.3 Each party's compliance. Each party complies with the Applicable Data Protection Law that applies to its role.

2.4 Order of precedence. This DPA forms part of the Terms of Service. If it conflicts with the Terms of Service on the protection of Personal Data, this DPA prevails. Where SCCs apply, they prevail over both.

3. Nature, Purpose and Duration of Processing

3.1 Purpose. Visby processes Customer Data only to provide the Services to the Customer: measuring the Customer's AI visibility and performance, generating the Customer's reports, tasks and recommendations, and improving those outputs for that Customer. Annex I describes the subject matter, nature, categories of data and data subjects in detail.

3.2 Duration. Processing lasts for the term of the Customer's subscription and then as long as Section 12 allows.

3.3 What Visby does not do. Visby does not:

• use Customer Data for its own purposes, advertising or profiling;

• use Customer Data, including Connected Services data and domain information, in anonymous or aggregated reports, benchmarks or statistics;

• use Customer Data to train artificial intelligence models;

• send Customer Data to third-party AI providers. The prompts Visby submits to AI platforms to measure visibility are generic queries; they contain no Customer Data and no Personal Data;

• sell or share Customer Data.

4. Customer Instructions and Responsibilities

4.1 Documented instructions. Visby processes Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's use and configuration of the Services (adding domains, connecting or disconnecting Connected Services) are the Customer's complete instructions. Further instructions must be agreed in writing.

4.2 Unlawful instructions. Visby tells the Customer without delay if it believes an instruction infringes Applicable Data Protection Law. Visby may suspend the affected processing until the Customer confirms or changes the instruction.

4.3 Customer responsibilities. The Customer is responsible for the accuracy and legality of the domains it adds and the connections it establishes, and for having a lawful basis and giving any notices required for the processing it instructs.

4.4 No special category data. The Services are not designed for special categories of personal data (such as health, biometric, genetic, religious, political or sexual-life data) or data about criminal convictions. The Customer will not submit such data to Visby.

5. Confidentiality

Visby ensures that everyone it authorises to process Personal Data is bound by a duty of confidentiality, by contract or by law, and processes Personal Data only as needed to provide the Services.

6. Security

6.1 Measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, Visby implements and maintains the technical and organisational measures described in Annex II, designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

6.2 Review. Visby reviews these measures regularly and may update them, provided the updates do not reduce the overall level of protection.

7. Sub-processors

7.1 General authorisation. The Customer authorises Visby to engage the Sub-processors listed in Annex III.

7.2 Flow-down. Visby binds each Sub-processor by a written contract that imposes data protection obligations equivalent to those in this DPA. Visby remains responsible to the Customer for each Sub-processor's performance of those obligations.

7.3 Changes. Visby gives the Customer at least 30 days' notice by email before it adds or replaces a Sub-processor, and updates Annex III. Notice goes to the email address of the Customer's account.

7.4 Objection. The Customer may object in writing to support@visby.ai within the notice period, on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Services before the change takes effect.

7.5 Infrastructure providers. Annex III also lists providers that support the Services without processing Personal Data. They are not Sub-processors.

8. International Transfers

8.1 Location. Visby is established in the Netherlands. Customer Data is hosted in the United States by the Sub-processors listed in Annex III.

8.2 Transfer mechanisms. Visby transfers Personal Data originating from the EEA, the United Kingdom or Switzerland to a country without an adequacy decision only where the recipient is either:

• certified under the applicable DPF, in which case the transfer relies on the relevant adequacy decision; or

• bound by the SCCs (Module 3, processor to processor), together with the UK Addendum or Swiss adaptations where those laws apply, or by another transfer mechanism that Applicable Data Protection Law recognises.

8.3 If a mechanism fails. If a DPF certification lapses or an adequacy decision is withdrawn, invalidated or suspended, Visby will promptly put the SCCs or another valid mechanism in place for the affected transfers and inform the Customer.

8.4 Other restricted transfers. Where Applicable Data Protection Law restricts any other transfer under this DPA, the terms in Annex IV apply.

9. Data Subject Requests

9.1 Requests received by Visby. If a data subject contacts Visby about Personal Data in Customer Data (access, correction, deletion, restriction, portability or objection), Visby forwards the request to the Customer without undue delay and does not respond to it directly unless the Customer instructs it to or the law requires it.

9.2 Assistance. Taking into account the nature of the processing, Visby helps the Customer respond to such requests, by appropriate technical and organisational measures, within 10 business days of the Customer's written request to support@visby.ai.

10. Assistance with Compliance

Taking into account the nature of the processing and the information available to it, Visby assists the Customer with its obligations on security of processing, Personal Data Breach notification, data protection impact assessments and prior consultation with supervisory authorities. Visby does this by providing the information it holds about the processing and by answering reasonable questions in writing.

11. Personal Data Breach

11.1 Notification. Visby notifies the Customer of a Personal Data Breach without undue delay and in any event within 72 hours after becoming aware of it. Notice goes to the email address of the Customer's account.

11.2 Content. To the extent known, the notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures Visby has taken or proposes to address it and limit its effects. Visby may provide this information in phases as it becomes available.

11.3 Response. Visby takes reasonable steps to contain and investigate the breach, and cooperates with the Customer so that the Customer can meet its own notification duties to supervisory authorities and data subjects.

12. Deletion and Return

12.1 Deletion after termination. Within 90 days after the Customer's account is closed or the Terms of Service end, Visby deletes Customer Data or irreversibly anonymises it so that it no longer relates to an identifiable person.

12.2 Copy on request. Before that 90-day period ends, the Customer may ask in writing at support@visby.ai for a copy of its Customer Data, and Visby will provide one.

12.3 Disconnected services. When the Customer disconnects a Connected Service, Visby deletes the data it retrieved from that service within 30 days.

12.4 Legal retention. Visby may keep Personal Data to the extent the law requires. It keeps protecting that data under this DPA and uses it only for the legally required purpose.

13. Audits and Compliance Information

13.1 Documentation first. On written request, Visby makes available the information necessary to demonstrate its compliance with this DPA, including written descriptions of its security measures and answers to reasonable security and data protection questions.

13.2 Audit. If that information does not reasonably satisfy the Customer, the Customer or an independent auditor bound by confidentiality may audit Visby's compliance with this DPA, on these conditions:

• at most once a year, unless Applicable Data Protection Law or a supervisory authority requires more;

• at least 30 days' written notice to support@visby.ai, with an agreed scope and plan;

• during business hours, without unreasonable disruption to Visby's operations;

• at the Customer's cost.

13.3 Supervisory authorities. Nothing in this Section limits the powers of a supervisory authority.

14. Liability

Each party's liability under this DPA is subject to the exclusions and limitations in the Terms of Service. This does not limit liability that the law does not allow to be limited, and it does not affect the rights of data subjects under Applicable Data Protection Law, including Article 82 GDPR.

15. Changes to this DPA

15.1 Material changes. Visby gives the Customer at least 30 days' notice by email before a material change to this DPA takes effect. If the Customer objects on reasonable grounds and the parties cannot agree, the Customer may terminate the affected Services before the change takes effect.

15.2 Minor changes. Visby may make corrections and clarifications that do not reduce the protection of Personal Data (for example typographical fixes or updated contact details) without notice. Changes to Annex III follow Section 7.

16. Term, Governing Law and Contact

16.1 Term. This DPA takes effect when the Customer accepts the Terms of Service and applies for as long as Visby processes Personal Data on the Customer's behalf. Sections that by their nature should continue to apply after termination do so.

16.2 Signed copy. Customers that need a signed copy of this DPA can request one at support@visby.ai.

16.3 Governing law. This DPA is governed by the laws of the Netherlands, and the competent courts of Amsterdam have jurisdiction, in line with the Terms of Service.

16.4 Contact. Adsby B.V., Singel 542 1017, Amsterdam 1017 AZ, Netherlands. Email: support@visby.ai.

Annex I: Details of Processing

Annex II: Technical and Organisational Measures

Visby maintains the following measures.

• Encryption. Data is encrypted in transit and at rest.

• Access control. Access to systems and data is restricted through access controls and authentication requirements, and limited to people who need it to provide and support the Services.

• Authentication. Users sign in with their own Visby account or with Google. Users can enable two-factor authentication, which sends a verification code to their email address at sign-in.

• Payments. Payments are processed by Stripe. Visby does not store card details.

• Monitoring tools. Error-monitoring and analytics tools are configured so that they receive anonymous data and no information that identifies individuals.

• Hosting. Customer Data is hosted with the infrastructure providers listed in Annex III, under data processing terms that include their own security commitments.

• Assessment and updates. Visby carries out regular security assessments and keeps its systems and dependencies updated.

• Incident handling. Visby handles Personal Data Breaches under Section 11.

Annex III: Sub-processors and Infrastructure Providers

Sub-processors. These providers host or handle Customer Data and account data.

Stripe, Brevo and Google sign-in process account and billing data for Visby as an independent controller (Section 2.2). They are listed here for transparency.

Infrastructure providers that do not process Personal Data. These providers support the Services and receive no Personal Data, so they are not Sub-processors.

Visby will update this Annex under Section 7.

Annex IV: Regional Terms

These terms apply in addition to the main DPA when the named law applies to the processing.

United Kingdom. References to the GDPR include the UK GDPR, and the competent supervisory authority is the Information Commissioner's Office. Transfers of UK Personal Data to Sub-processors in the United States rely on the UK Extension to the EU-U.S. DPF where the Sub-processor is certified, and otherwise on the International Data Transfer Agreement or the UK Addendum to the SCCs.

Switzerland. References to the GDPR include the Swiss Federal Act on Data Protection, and the competent authority is the Federal Data Protection and Information Commissioner. Transfers of Swiss Personal Data to Sub-processors in the United States rely on the Swiss-U.S. DPF where the Sub-processor is certified, and otherwise on the SCCs with the adaptations required for Swiss law.

Türkiye (KVKK). Where KVKK applies, the Customer is the data controller (veri sorumlusu) and Visby is the data processor (veri işleyen). Visby processes Personal Data only on the Customer's instructions, takes the security measures described in Annex II, and notifies the Customer of a Personal Data Breach under Section 11. The Customer is responsible for the lawful basis of any transfer of Personal Data abroad, including to Visby in the Netherlands and to the Sub-processors in Annex III. On request, Visby will sign any additional agreement and provide any information KVKK requires for these transfers.

United States (state privacy laws). Where the California Consumer Privacy Act (as amended by the CPRA) or another US state privacy law applies, Visby acts as the Customer's service provider or processor and:

• processes Personal Data only for the business purposes in Section 3;

• does not sell or share Personal Data;

• does not retain, use or disclose Personal Data outside its direct business relationship with the Customer or for any purpose other than those in Section 3, and does not combine it with data from other sources;

• tells the Customer if it can no longer meet its obligations under those laws;

• allows the Customer to take reasonable steps to stop and remedy unauthorised use of Personal Data, and provides the information described in Section 13 to demonstrate compliance.

Other jurisdictions. If another law requires additional terms for processing under this DPA, the parties will cooperate in good faith to agree them.