Data Processing Addendum

XATHARI DATA PROCESSING ADDENDUM (DPA)

‍

EFFECTIVE DATE: September 4, 2026

LAST REVISED: September 4, 2026

‍

This Data Processing Addendum (“DPA”) is entered into by and between Xathari, LLC, a California limited liability company with its principal place of business at 785 Oak Grove Rd, Ste E2 PMB4045, Concord, CA 94518 (“Xathari”), and the entity or individual subscribing to or using Xathari’s digital signage media services, ad serving platform, Customer Engagement Platform (“CEP”), or website properties (“Customer”).

This DPA is incorporated into and forms an integral part of the Xathari Master Terms of Service (“Master ToS”), Hardware-as-a-Service Agreement (“HaaS Agreement”), Digital Publisher Agreement, or applicable Order Form (collectively, the “Agreement”).

‍

1. DEFINITIONS & INTERPRETATION

• 1.1 “Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under the Agreement, including, as applicable:
  
  • (a) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”);
  • (b) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”);
  • (c) the United Kingdom Data Protection Act 2018 and the EU GDPR as incorporated into UK law (“UK GDPR”);
  • (d) the Swiss Federal Act on Data Protection (“FADP”); and
  • (e) any other regional, state, or national privacy statutes applicable to the parties.
• 1.2 “Customer Personal Data” means any Personal Data processed by Xathari on behalf of Customer in connection with the performance and delivery of the Services under the Agreement.
• 1.3 "Personal Data", "Controller", "Processor", "Data Subject", "Process/Processing", "Personal Data Breach", and "Supervisory Authority" shall have the meanings given to them under the EU GDPR or CCPA/CPRA, as context dictates.
• 1.4 “Sub-processor” means any third-party processor, cloud provider, infrastructure host, ad tech partner, or contractor engaged by Xathari to assist in processing Customer Personal Data under the Agreement.
• 1.5 “Standard Contractual Clauses” or “SCCs” means the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries, incorporating Module 2 (Controller-to-Processor) and Module 3 (Processor-to-Processor), as applicable.

‍

2. SCOPE & ROLES OF THE PARTIES

• 2.1 Roles: The parties acknowledge and agree that with respect to Customer Personal Data, Customer acts as a Controller (or Business under CCPA/CPRA) and Xathari acts as a Processor (or Service Provider under CCPA/CPRA).
• 2.2 Customer Instructions: Xathari shall process Customer Personal Data solely for the limited and specified business purposes outlined in the Agreement and this DPA, and strictly in accordance with Customer’s documented legal instructions. Xathari shall immediately inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.
• 2.3 Customer Compliance: Customer warrants that it has obtained all necessary consents, provided all legally required public notices, and possesses a valid legal basis under Applicable Data Protection Laws to collect, transfer, and authorize Xathari’s processing of Customer Personal Data.
• 2.4 CCPA Service Provider Obligations: To the extent Xathari processes Personal Information as a "Service Provider" under the CCPA/CPRA, Xathari certifies that it understands the restrictions of Cal. Civ. Code § 1798.140(ag) and shall not: (a) sell or share Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than the specific business purpose(s) set out in the Agreement and described in Annex I of this DPA; (c) retain, use, or disclose Personal Information outside of the direct business relationship between Xathari and Customer; or (d) combine Personal Information received from Customer with Personal Information received from another source, except as permitted under the CCPA/CPRA. Xathari shall comply with all obligations applicable to service providers under the CCPA/CPRA and shall provide the same level of privacy protection as the CCPA/CPRA requires of businesses. Xathari shall notify Customer promptly, and in any event within five (5) business days, if it determines it can no longer meet its obligations under this Section 2.4. Customer shall have the right to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data by Xathari, and to otherwise ensure that Xathari uses Personal Information consistent with the CCPA/CPRA, including through reasonable audit or review rights exercised in accordance with Section 8 of this DPA.
• 2.5 Programmatic Advertising Disclosures: Xathari operates its programmatic advertising exchange integrations in its capacity as a business acting on its own behalf. Xathari shall not disclose Customer Personal Data to advertising exchange or demand partners for cross-context behavioral advertising except where the Agreement or an Order Form authorizes that disclosure for Customer's campaigns. Where authorized, Customer acknowledges that exchange and demand partners act as independent third parties rather than Sub-processors, and Xathari shall transmit applicable opt-out preference signals with each bid request.

‍

3. TECHNICAL & ORGANIZATIONAL SECURITY MEASURES (TOMs)

• 3.1 Security Safeguards: Xathari shall implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access.
• 3.2 Minimum Standards: Xathari’s security controls shall include, at a minimum:
  
  • (a) Encryption of Customer Personal Data at rest using AES-256 (or equivalent high-grade encryption standards);
  • (b) Encryption of Customer Personal Data in transit across public networks using TLS 1.2 or TLS 1.3;
  • (c) Strict role-based access control (RBAC) and Multi-Factor Authentication (MFA) for administrative and engineering access;
  • (d) Automated threat monitoring, edge DDoS mitigation, and vulnerability patching; and
  • (e) Logical separation of tenant data within Xathari’s cloud environment.

‍

4. INTERNATIONAL DATA TRANSFERS & ADEQUACY MECHANISMS

• 4.1 Cross-Border Transfers: To the extent Customer Personal Data originating from the European Economic Area (EEA), United Kingdom (UK), or Switzerland is transferred to Xathari or Sub-processors located in countries outside these jurisdictions that do not benefit from an adequacy decision, such transfers shall be governed by:
  
  • (a) EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension, and the Swiss-U.S. DPF, in each case only for so long as Xathari or the relevant Sub-processor maintains an active self-certification under the applicable framework; and/or
  • (b) Standard Contractual Clauses (SCCs) incorporated into this DPA by reference, specifically Module 2 (Controller-to-Processor) where Customer is a Controller, and Module 3 (Processor-to-Processor) where Customer is a Processor. For purposes of the SCCs: the optional docking clause in Clause 7 does not apply; under Clause 9(a), Option 2 (general written authorisation) applies with the notice period stated in Section 5.3 of this DPA; the optional language in Clause 11(a) does not apply; under Clause 17, the SCCs are governed by the law of Ireland; under Clause 18(b), disputes shall be resolved before the courts of Ireland; and the information required by Annexes I, II, and III to the SCCs is set out in Annexes I, II, and III of this DPA.
• 4.2 UK Addendum: For transfers governed by UK GDPR, the UK International Data Transfer Addendum to the Standard Contractual Clauses (as defined in Section 1.5 and incorporated in Section 4.1(b)) (Version B1.0) shall apply. The information required by Tables 1 to 3 of the UK Addendum is set out in this DPA and its Annexes, and for Table 4 the importer may end the UK Addendum as set out in Section 19 of that Addendum.
• 4.3 Swiss Transfers: For transfers governed by the Swiss FADP, references to the EU GDPR in the SCCs shall be adapted to refer to the FADP, and the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner (FDPIC).

‍

5. SUB-PROCESSORS

• 5.1 Authorization of Sub-processors: Customer grants Xathari general written authorization to engage third-party Sub-processors to support the delivery of the Services. The complete list of currently authorized Sub-processors and their processing activities is maintained in Annex III of this DPA and in the Sub-Processor Performance & Compliance Schedule.
• 5.2 Flow-Down Obligations: Xathari shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those imposed on Xathari under this DPA, including prohibitions on selling or sharing Customer Personal Data and a requirement to reasonably assist Xathari in responding to Data Subject requests and, where applicable, in cooperating with cybersecurity audits or privacy risk assessments required under Applicable Data Protection Laws. Each such agreement shall also require the Sub-processor to notify Xathari if it can no longer meet its obligations and to permit Xathari to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data. Xathari remains fully liable to Customer for the performance of each Sub-processor's obligations.
• 5.3 Sub-processor Change Notification: Xathari shall notify Customer at least thirty (30) calendar days prior to appointing any new Sub-processor or replacing an existing Sub-processor by updating its public legal portal at https://www.xathari.com/legal/sub-processor-schedule#current-sub-processors and sending automated notifications to registered account administrators. Customer may object to a new Sub-processor on reasonable data protection grounds within fourteen (14) days of notice. If the parties cannot reach a reasonable resolution of the objection within thirty (30) days, Customer may terminate the affected portion of the Services without penalty, and Xathari will not process Customer Personal Data through the disputed Sub-processor while the objection is pending.

‍

6. DATA SUBJECT RIGHTS & ASSISTANCE

• 6.1 Data Subject Requests: Xathari shall, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures to fulfill Customer’s obligations to respond to Data Subjects exercising their rights under Applicable Data Protection Laws (e.g., rights of access, rectification, deletion, data portability, or opt-out).
• 6.2 Direct Requests: If a Data Subject submits a request directly to Xathari regarding Customer Personal Data, Xathari shall promptly advise the Data Subject to submit their request directly to Customer, and notify Customer within five (5) business days. This Section 6.2 applies where Xathari processes the relevant Personal Data in its capacity as Processor/Service Provider on Customer's behalf (e.g., venue or publisher visitor data collected via QR/NFC interaction). Where a Data Subject's request instead concerns Personal Data for which Xathari itself acts as Controller/Business (e.g., Xathari's own billing or account data), Xathari shall verify and fulfill the request directly in accordance with the Xathari Privacy Policy.
• 6.3 Non-Account-Holder Verification: For Data Subjects who do not hold a registered Xathari account, Xathari shall verify the identity of the requester using the specific interaction data reasonably available to it (e.g., the device or browser used, and the approximate timestamp and location of the relevant QR or NFC interaction), rather than requiring account credentials.

‍

7. PERSONAL DATA BREACH MANAGEMENT

• 7.1 Breach Notification: In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Xathari shall notify Customer without undue delay, and in any event within seventy-two (72) hours of confirming the incident.
• 7.2 Breach Communication: The notification shall describe the nature of the breach, affected data categories, estimated record counts, immediate containment measures taken, and contact details for Xathari’s security lead.
• 7.3 Mitigation: Xathari shall take prompt commercial steps to contain, mitigate, and remediate the effects of any Personal Data Breach at its own expense.

‍

8. AUDITS, ASSESSMENTS, & CERTIFICATIONS

• 8.1 Audit Rights: Xathari shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. Upon at least thirty (30) calendar days’ advance written notice, Xathari shall permit Customer (or its designated independent auditor) to conduct an audit or inspection of Xathari’s data processing activities, provided that such audit is conducted during normal business hours, without disrupting business operations, and subject to reasonable non-disclosure obligations.
• 8.2 Audit Reports: Customer agrees that its audit rights under Section 8.1 shall be satisfied in the first instance by Xathari providing copies of third-party audit reports, security certifications, or SOC 2 summaries from its underlying infrastructure partners. Where (a) a confirmed Personal Data Breach has occurred, (b) a required certification has lapsed or was not provided, or (c) a Supervisory Authority or Applicable Data Protection Law requires it, Customer may escalate beyond documentary review and exercise the full on-site audit or inspection right described in Section 8.1, subject to the same thirty (30) calendar days' notice, business-hours, and confidentiality conditions set out therein.

‍

9. DATA RETURN & DESTRUCTION

Upon termination or expiration of the Agreement, Xathari shall, at Customer’s election, securely delete or return all Customer Personal Data in its possession or control within thirty (30) calendar days, using NIST SP 800-88 Rev. 1 compliant sanitization protocols, unless Applicable Data Protection Laws require retention of such data. If Customer does not communicate an election within thirty (30) calendar days after termination or expiration, Xathari may proceed with secure deletion.

‍

-------------------------

ANNEX I — DETAILS OF DATA PROCESSING

‍

A. List of Parties

• Data Exporter: Customer (subscribing to or using Xathari services).
• Data Importer: Xathari, LLC (providing cloud digital signage, ad network, and CEP analytics services).

‍

B. Description of Transfer & Processing

• Categories of Data Subjects: Customer employees/admins, venue visitors, web end-users interacting with DOOH screens, dynamic QR codes, NFC tags, or partner website properties.
• Categories of Personal Data: Account registration details (name, business email, business name), device IP addresses, browser user-agent headers, coarse geographic location metrics (city/region-level, resolved via ipgeolocation.io; not precise geolocation), QR code scan logs, NFC interaction timestamps, and consent states. Where Customer authorizes programmatic advertising campaigns, processing may also include device advertising identifiers, precise geolocation transmitted in bid requests, cookie-matched identifiers, audience segment identifiers, and privacy preference signals.
• Sensitive Data: None, except precise geolocation where Customer authorizes location-based programmatic advertising campaigns.
• Frequency of Transfer: Continuous for the duration of the Agreement.
• Nature & Purpose of Processing: Performance of cloud digital signage distribution, ad impression serving, fraud/IVT detection, telemetry verification, and billing operations.
• Duration of Processing: For the term of the Agreement plus applicable post-termination sanitization windows.

‍

-------------------------

ANNEX II — TECHNICAL & ORGANIZATIONAL MEASURES (TOMs)

‍

• Access Control: Multi-factor authentication (MFA) via Microsoft Entra ID, role-based access control (RBAC), automatic session timeouts.
• Data Security: AES-256 encryption at rest, TLS 1.2/1.3 encryption in transit across all endpoints, programmatic API key isolation.
• System Integrity: Edge DDoS mitigation via Cloudflare, automated vulnerability scanning, daily cloud backup verification.
• Organizational Security: Security awareness training for personnel, strict background verification, formal incident response plan.

‍

-------------------------

ANNEX III — AUTHORIZED SUB-PROCESSOR INVENTORY

‍

The following table constitutes the complete, authorized list of Sub-processors engaged by Xathari as of the Effective Date:

‍

‍

Note on Client-Side Software & Public APIs

Client-side rendering software libraries (Chart.js, Tabulator, and Leaflet.js) run strictly within the end-user's local web browser without transferring personal data to remote servers. Public data resolution services (zipopotam.us) process non-personal postal codes without logging individual identifiers, and are categorized as client-side software dependencies rather than Data Sub-processors under GDPR/CCPA only to the extent they do not receive or process any personal information, persistent identifiers, or metadata linkable to a consumer or device. If zipopotam.us processes any such information, it shall instead be treated as a Sub-processor subject to Section 5.2.

Note on Exchange & Demand Partners

Programmatic exchange or demand partners are not Sub-processors. They receive bid-stream data as independent third parties for advertising delivery, are disclosed in the Xathari Privacy Policy, and fall outside the flow-down obligations of Section 5.2, except that Xathari transmits applicable opt-out preference signals to them with each bid request.

‍

‍