Sub-Processor Schdule

XATHARI SUB-PROCESSOR PERFORMANCE & COMPLIANCE SCHEDULE

‍

Effective Date: September 4, 2026

Last Revised: September 4, 2026

‍

THIS SUB-PROCESSOR PERFORMANCE & COMPLIANCE SCHEDULE (“SCHEDULE” OR “SUB-PROCESSOR AGREEMENT”) GOVERNS THE ENGAGEMENT OF THIRD-PARTY VENDORS, CLOUD INFRASTRUCTURE PROVIDERS, CMS DISTRIBUTION ENGINE PARTNERS, AD SERVING PARTNERS, AND TELEMETRY ANALYTICS SUBCONTRACTORS (COLLECTIVELY, “SUB-PROCESSORS”) ACTING ON BEHALF OF XATHARI, LLC (“XATHARI”) IN THE PROCESSING OF CUSTOMER PERSONAL DATA, SYSTEM LOGS, AND VENUE TELEMETRY.

‍

THIS SCHEDULE IS INCORPORATED BY REFERENCE INTO XATHARI’S MASTER DATA PROCESSING ADDENDUM (DPA) AND APPLIES TO ALL SUB-PROCESSORS AUTHORIZED BY XATHARI TO ACCESS, HOST, TRANSMIT, OR PROCESS PERSONAL DATA ORIGINATING FROM XATHARI SUBSCRIBERS, ADVERTISERS, AND VENUE VISITORS.

‍

1. PURPOSE & INTENT

• 1.1 Chain of Processing Compliance: Under global data protection regulations—including the General Data Protection Regulation (GDPR Article 28(4)), the California Consumer Privacy Act (CCPA/CPRA), and the UK GDPR—Xathari operates as a Data Processor or Service Provider. When Xathari engages Sub-processors to perform specific processing activities, Xathari must impose data protection obligations that are no less protective than those set forth in Xathari’s customer-facing Data Processing Addendum (DPA).
• 1.2 Binding Flow-Down: This Schedule sets forth the mandatory operational, technical, organizational, and audit requirements that every authorized Sub-processor must satisfy when processing data for Xathari.

‍

2. MANDATORY OBLIGATIONS OF SUB-PROCESSORS

Every Sub-processor engaged by Xathari agrees and covenants to strictly comply with the following mandatory requirements:

• 2.1 Purpose Limitation: Sub-processor shall process Customer Personal Data solely for the limited and specified business purposes outlined in the underlying Master Services Agreement or Vendor Agreement executed with Xathari, and strictly according to Xathari’s documented instructions.
• 2.2 No Sale or Sharing of Personal Data: Sub-processor is expressly prohibited from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating Customer Personal Data to any third party for monetary or other valuable consideration, or for cross-context behavioral advertising. Sub-processor is further prohibited from combining Customer Personal Data with personal information Sub-processor receives from or on behalf of another person, or collects from its own independent interaction with the relevant individual, except as permitted by the CCPA/CPRA.
• 2.3 Confidentiality Commitments: Sub-processor shall ensure that all personnel authorized to process Customer Personal Data (including employees, contractors, and engineers) have committed themselves to strict statutory or contractual obligations of confidentiality.

‍

3. TECHNICAL & ORGANIZATIONAL SECURITY MEASURES (TOMs)

Sub-processor must implement and maintain technical and organizational safeguards appropriate to the risk of processing, including, at a minimum:

• 3.1 Encryption Standards:
  
  • Encryption of Customer Personal Data at rest using industry-standard protocols (AES-256 or equivalent strong encryption algorithms).
  • Encryption of Customer Personal Data in transit across public networks using TLS 1.3 (or, at minimum, TLS 1.2).
• 3.2 Access Controls & Identity Management: Implementation of Strict Least Privilege Access Controls, Multi-Factor Authentication (MFA) for all administrative interfaces, and automatic account locking after consecutive failed login attempts.
• 3.3 Vulnerability Management & Patching: Regular vulnerability scanning. For vulnerabilities posing a significant risk, Sub-processor shall begin testing and planning for remediation no later than three (3) business days after becoming aware of the vulnerability and shall complete deployment in the most expedient time possible, employing reasonable compensating controls in the interim and maintaining auditable records of all remediation efforts.
• 3.4 Data Separation: Logical or physical segregation of Xathari’s data from the data of Sub-processor’s other commercial tenants or clients.

‍

4. INCIDENT NOTIFICATION & DATA BREACH PROTOCOLS

• 4.1 24-Hour Security Incident Notice: In the event of a confirmed or reasonably suspected Security Incident, unauthorized access, data breach, exfiltration, or loss affecting Xathari Customer Data or hardware infrastructure, Sub-processor shall notify Xathari via email at [email protected] within twenty-four (24) hours of detection.
• 4.2 Remediation & Reporting Requirements: The notification must contain, at a minimum:
  
  1. A description of the nature of the Security Incident, including affected data categories and estimated record counts;
  2. The identity of affected systems or cloud instances;
  3. Immediate containment and remediation actions taken or planned; and
  4. Contact information for Sub-processor’s designated Incident Response Lead.
• 4.3 Mitigation Duties: Sub-processor shall take immediate steps to mitigate the effects of the Security Incident and shall provide full cooperation to Xathari in investigating and responding to the event.

‍

5. INTERNATIONAL DATA TRANSFERS & ADEQUACY

• 5.1 Standard Contractual Clauses (SCCs): To the extent that the processing of Customer Personal Data involves an international transfer of data originating from the European Economic Area (EEA), United Kingdom (UK), or Switzerland to a country not recognized as providing an adequate level of data protection, Sub-processor agrees to execute and abide by the EU Standard Contractual Clauses (Module 3: Processor-to-Processor) and the UK International Data Transfer Addendum.
• 5.2 Transfer Impact Assessments (TIAs): Sub-processor agrees to conduct and maintain documented Transfer Impact Assessments and provide executive summaries to Xathari upon request.

‍

6. AUDIT RIGHTS, CERTIFICATIONS, & ASSISTANCE OBLIGATIONS

• 6.1 Security Audits & Certifications: Sub-processor shall maintain independent, third-party security certifications appropriate to its service scope, such as SOC 2 Type II, ISO/IEC 27001, or PCI-DSS. Sub-processor shall provide copies of its latest audit reports (e.g., SOC 2 Type II report) to Xathari annually upon request.
• 6.2 Conditional Audit & Inspection Rights: Notwithstanding Section 6.1, and in addition to the documentary review described therein, Xathari (or a qualified independent third-party auditor engaged by Xathari, subject to reasonable confidentiality obligations) shall have the right to conduct an on-site or remote inspection or audit of Sub-processor's data processing environment, security controls, and compliance with this Schedule upon the occurrence of any of the following:
  
  • (a) a confirmed Security Incident under Section 4 affecting Customer Personal Data;
  • (b) Sub-processor's failure to provide, or the lapse, expiration, or suspension of, any certification required under Section 6.1; or
  • (c) a requirement or request from a competent regulatory or supervisory authority.

Absent a triggering event under (a)–(c), this right shall not be exercised more than once in any twelve (12)-month period. Except where a shorter period is necessitated by an active Security Incident or a regulatory deadline, Xathari shall provide Sub-processor with no less than ten (10) business days' advance written notice, and any audit shall be conducted during normal business hours in a manner designed to minimize disruption to Sub-processor's operations. Sub-processor shall provide reasonable cooperation, including access to relevant personnel, systems, facilities, and documentation, necessary to complete the audit.  Xathari shall bear the costs of such audits, provided that if an audit is triggered by a Security Incident under Section 4 or reveals a material breach of this Schedule by Sub-processor, Sub-processor shall reimburse Xathari for all reasonable costs associated with the audit.

• 6.3 Regulatory Assistance: Sub-processor shall assist Xathari in fulfilling Xathari’s obligations to respond to Data Subject Rights Requests (e.g., access, deletion, correction requests under GDPR/CCPA) within five (5) business days of receiving a written request from Xathari.
• 6.4 Compliance Remediation & Notification: Xathari shall have the right to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data by Sub-processor. Sub-processor shall notify Xathari promptly, and in any event within five (5) business days, if it determines it can no longer meet its obligations under this Schedule or applicable data protection law, and shall reasonably cooperate with Xathari's own cybersecurity audit and privacy risk assessment obligations under applicable law.
• 6.5 Downstream Sub-processors: Sub-processor shall not engage another sub-processor to process Customer Personal Data without providing Xathari with prior written notice and an opportunity to object. If Sub-processor engages a downstream sub-processor, it shall do so by way of a written contract which imposes on such downstream sub-processor data protection obligations no less protective than those set forth in this Schedule, including prohibitions on the retention, use, or disclosure of Customer Personal Data for any purpose other than the business purposes specified in this Schedule.

‍

7. AUTHORIZED SUB-PROCESSOR LIST

Xathari maintains an active, updated inventory of authorized third-party Sub-processors. The current authorized Sub-processors and their processing scopes are set forth below:

‍

‍

• 7.1 Client-Side Dependencies & Anonymous Public Data Exclusions: Client-side rendering libraries (including Chart.js, Tabulator, and Leaflet.js) execute strictly within the end-user’s local web browser without transferring personal data to external servers. Public data resolution APIs (such as zipopotam.us) process non-personal postal codes without logging individual identifiers, and are classified as software dependencies rather than Data Sub-processors only to the extent they do not receive or process any personal information, persistent identifiers, or metadata linkable to a consumer or device. If such an API processes any such information, it shall instead be treated as a Sub-processor subject to Section 2 of this Schedule.
• 7.2 Advertising Exchange & Demand Partner Exclusion: Programmatic advertising exchange or demand partners disclosed in the Xathari Privacy Policy are not Sub-processors under this Schedule. They receive bid-stream data as independent third parties for their own advertising purposes, not on Xathari's behalf, and are therefore not subject to the flow-down obligations of Section 2 of this Schedule. Xathari transmits applicable opt-out preference signals, including Global Privacy Platform (GPP) strings, to these partners with each bid request, consistent with Section 4.5 of the Xathari Privacy Policy and Section 2.5 of the Xathari Data Processing Addendum.

‍

8. SUB-PROCESSOR CHANGE NOTIFICATION PROTOCOL

• 8.1 Advance Notice of Changes: Xathari will maintain an updated list of Sub-processors on its public legal portal (https://www.xathari.com/legal/sub-processor-schedule#current-sub-processors). Xathari shall notify Enterprise Subscribers and Customers at least thirty (30) calendar days prior to authorizing any new Sub-processor or replacing an existing Sub-processor by updating the legal portal and sending an automated notification to registered account administrators.
• 8.2 Right to Object: Enterprise Customers may object to the appointment of a new Sub-processor on reasonable data protection grounds by submitting a written notice of objection to [email protected] within fourteen (14) calendar days of receiving notice.
• 8.3 Resolution Mechanism: Upon receipt of an objection, Xathari will work in good faith with Customer to find a reasonable commercial solution (e.g., configuring services to avoid using the disputed Sub-processor). During this resolution period, Xathari shall not process the objecting Customer's data through the disputed Sub-processor unless and until the objection is resolved or a workaround is implemented. If no solution can be reached within thirty (30) days, Customer may terminate the affected portion of the service without penalty.

‍

9. DATA RETURN & DESTRUCTION

Upon termination or expiration of Sub-processor’s vendor contract with Xathari, or upon Xathari’s written request, Sub-processor shall securely delete, destroy, or return all copies of Customer Personal Data in its possession or control within thirty (30) calendar days, utilizing NIST SP 800-88 Rev. 1 compliant sanitization standards, and provide written certification of destruction to Xathari.

‍