Panther & Cub Data Processing Addendum

Effective date: August 23, 2026
Version: 1.0

This Data Processing Addendum (“DPA”) is incorporated into the agreement between Panther & Cub LLC (“Provider”) and Customer when Provider processes Customer Personal Data on Customer’s behalf in providing the Services.

1. Definitions and roles

“Customer Personal Data” means personal information or personal data contained in Customer Data that Provider processes on Customer’s behalf under the agreement.

“Data Protection Law” means privacy and data-protection law applicable to a party’s processing under the agreement. Terms such as controller, processor, business, service provider, sell, share, and personal data have the meanings given by applicable Data Protection Law.

Customer is the controller or business and Provider is the processor or service provider for Customer Personal Data, except where the parties act in another role required by law. Each party is independently responsible for compliance obligations applicable to its role.

2. Processing instructions

Provider will process Customer Personal Data only:

• To provide, secure, support, and administer the Services.
• On Customer’s documented instructions in the agreement and authorized communications.
• As required by law, in which case Provider will notify Customer before processing unless law prohibits notice.

Provider will not sell Customer Personal Data, share it for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship for an independent commercial purpose, or combine it with personal information received from another source except as permitted by applicable law to provide the Services.

Customer instructs Provider to process Customer Personal Data as described in Schedule 1 and to use subprocessors as permitted below.

3. Customer obligations

Customer represents that it has a lawful basis and has supplied all notices and obtained all consents required for the processing. Customer’s instructions will comply with Data Protection Law, and Customer will not instruct Provider to process prohibited data or in an unlawful manner.

Customer will disclose special security, localization, deletion, retention, data-subject, or regulatory requirements before processing begins. Unless expressly approved in an Order, Customer must not provide payment-card data, protected health information, biometric data, government identifiers, children’s data, export-controlled data, or similarly sensitive or regulated data.

4. Confidentiality

Provider will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as reasonably necessary for their responsibilities.

5. Security

Provider will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Services, the information available to Provider, and the risks of the processing. The baseline measures in Schedule 2 apply to Provider-controlled systems used to process Customer Personal Data.

Customer is responsible for securely configuring Customer-controlled systems, managing its users and credentials, and determining whether the Services and measures are appropriate for Customer’s processing.

6. Security incidents

Provider will notify Customer without undue delay after confirming a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Provider’s possession or control (“Security Incident”).

Provider will provide information reasonably available to it that Customer reasonably needs to meet applicable notification obligations and will take reasonable steps to contain and remediate the Security Incident. Notice is not an admission of fault or liability.

Unsuccessful attempts, scans, pings, denial-of-service attempts, and similar events that do not result in unauthorized access to Customer Personal Data are not Security Incidents under this DPA.

7. Subprocessors

Customer generally authorizes Provider to use affiliates and third parties to process Customer Personal Data when reasonably necessary to provide the Services (“Subprocessors”). Provider will impose data-protection obligations on each Subprocessor that are materially consistent with this DPA for the processing it performs.

The applicable Order, service documentation, or provider account identifies material service-specific Subprocessors where appropriate. Customer may request current information at [email protected].

Provider remains responsible for its obligations under this DPA, subject to the agreement’s limitations. If Customer reasonably objects to a new Subprocessor on substantiated data-protection grounds, the parties will work in good faith on a commercially reasonable alternative. If no alternative is reasonably available, either party may terminate only the affected Service, and Customer will pay fees and non-cancellable commitments incurred through termination.

8. Individual requests

Taking into account the nature of the processing, Provider will provide reasonable assistance for Customer to respond to verified requests by individuals. If Provider receives a request relating to Customer Personal Data, Provider will direct the requester to Customer where reasonably identifiable and will not independently respond except on Customer’s instruction or as required by law.

Assistance outside standard functionality or involving material work may be billed at agreed rates unless required because of Provider’s breach.

9. Compliance assistance

Taking into account the nature of the processing and information available to Provider, Provider will provide reasonable assistance with Customer’s legally required impact assessments, regulator consultations, and breach obligations. Customer remains responsible for determining whether and how those duties apply.

Provider will make available information reasonably necessary to demonstrate its compliance with this DPA. No more than once annually, unless required after a Security Incident or by a regulator, Customer may request a reasonable remote audit. Audits must protect other customers, security, confidentiality, and Provider’s operations. Customer bears its audit costs and Provider’s reasonable costs for material assistance unless an audit establishes Provider’s material breach.

10. Return and deletion

During the Service, Customer may retrieve Customer Personal Data using available functionality or an agreed export. Following termination, Provider will delete or return Customer Personal Data as stated in the applicable Service Terms or Order, unless law requires retention.

Deletion from backups occurs through routine cycles where immediate deletion is not reasonably practicable. Until deletion, retained data remains protected by this DPA and will not be actively processed except for security, continuity, or legal purposes.

11. International transfers

Customer authorizes processing in the United States and other locations where Provider and authorized Subprocessors operate. Each party will use a legally recognized transfer mechanism when required by Data Protection Law.

If the European Commission’s Standard Contractual Clauses or another statutory transfer addendum is required for a specific transfer, the parties will complete and incorporate the applicable modules and selections before that transfer. This DPA alone does not represent that a required transfer instrument has been executed.

12. Liability and precedence

The liability limitations and exclusions in the agreement apply in aggregate to the agreement and this DPA and are not increased by this DPA. Nothing limits an individual’s rights or a regulator’s authority where they cannot lawfully be limited.

If this DPA conflicts with the agreement on the processing of Customer Personal Data, this DPA controls. The Order controls the business scope and expressly agreed special requirements.

Schedule 1 — Processing details

Item	Description
Subject matter	Processing necessary to provide the Services in the applicable Order.
Duration	The term of the affected Service plus the deletion, backup, and legal-retention periods described in the agreement.
Nature and purpose	Hosting, access, storage, transmission, configuration, support, troubleshooting, development, migration, analytics, marketing operations, automation, or other processing stated in the Order.
Data subjects	Customer personnel, users, customers, prospects, suppliers, contractors, website visitors, and other individuals whose data Customer lawfully supplies.
Data categories	Contact, account, transaction, communication, content, device, usage, identifier, and other data stated in the Order.
Sensitive data	Not permitted unless expressly identified and approved in the Order with required safeguards.
Customer instructions	The agreement, the Order, service configuration, and documented instructions from authorized Customer contacts.

Schedule 2 — Baseline security measures

Provider’s measures for Provider-controlled systems include, as appropriate to the Service:

• Role-based access limited to personnel with a business need.
• Confidentiality obligations for personnel and contractors.
• Multi-factor authentication where reasonably available for privileged access.
• Encryption in transit using commonly accepted protocols where supported.
• Reasonable credential, endpoint, and access-management practices.
• Security updates and configuration management for Provider-controlled systems within scope.
• Logging, monitoring, backup, and recovery measures only to the extent included in the affected Service.
• Procedures for responding to suspected security incidents.
• Vendor review proportionate to the vendor’s role and information involved.
• Secure deletion or access removal consistent with the agreement and system capabilities.

These measures do not convert a Service into managed security, backup, monitoring, disaster recovery, or regulated-data service unless the Order expressly includes that service.