Data Processing Addendum

Version 1.0 | Last Updated: August 17, 2026

---

---

1. Parties and Incorporation

This Data Processing Addendum ("DPA") forms part of and is incorporated into the agreement between AtmosAI, Inc., a Wyoming corporation ("we," "us," or "our"), and the customer entity identified in that agreement ("Customer"), governing Customer's access to the Services (the "Agreement").

The "Agreement" means the applicable Terms of Use, Order Form, subscription agreement, or other written or electronic agreement under which Customer accesses Marketing Titan, Lead Titan AI, IT Titan, or any other service we provide.

This DPA applies where we process Customer Personal Data subject to Data Protection Laws. It takes effect on the effective date of the Agreement and supersedes any prior data processing terms between the parties.

Order of precedence. In the event of conflict: (a) the Standard Contractual Clauses; (b) this DPA; (c) the Agreement.

---

2. Scope and Roles

2.1 Our Role as Processor

With respect to Customer Personal Data, Customer is the Controller — or, where Customer is itself a processor, the processor — and we are the Processor. Customer Personal Data means personal data contained in Customer Data as defined in the Agreement, including:

• CRM records Customer creates, uploads, imports, or syncs
• Campaign audience lists and recipient data Customer uploads or selects
• Email, SMS, voice, and social message content Customer creates or sends
• Creative assets, brand materials, and knowledge bases Customer uploads
• Prompts Customer submits to AI features and the resulting Generated Output
• Calendar, meeting, and scheduling data accessed through Customer's authorized integrations
• Campaign engagement and analytics data generated in Customer's workspace
• Contact records after Customer has exported or imported them into Customer's workspace

We process Customer Personal Data only on Customer's documented instructions, as set out in Section 4.

2.2 Our Role as Controller

We are an independent Controller with respect to:

• Account registration, authentication, and billing data
• Service usage, telemetry, security, and audit logs
• Our own marketing and customer communications
• Aggregated and de-identified data derived from Service operation

Our processing in this capacity is governed by our Privacy Policy, not this DPA.

2.3 The Contact Database — Excluded from This DPA

We are an independent Controller with respect to the Contact Database. The Contact Database — the compiled business contact records we source, verify, enrich, and make available through the Services, including derived attributes and scores — is not Customer Personal Data and is not processed by us on Customer's behalf or on Customer's instructions.

Accordingly, this DPA does not apply to the Contact Database while it is held by us. Our processing of that data is governed by our Privacy Policy and GDPR & UK GDPR Compliance page.

On export, Customer becomes a Controller. When Customer exports, imports, or otherwise takes a copy of a Contact Database record into Customer's workspace or systems, Customer becomes an independent Controller of that copy. From that point:

• Customer determines the purposes and means of processing that copy
• Customer is responsible for establishing a lawful basis for any communication to that individual
• Customer is responsible for providing notice under GDPR Art. 14 or equivalent law where required
• Customer must respond to data subject requests it receives regarding that copy
• Customer must honor deletion notices we issue under Section 2.4

The parties are independent Controllers, not joint Controllers, with respect to a record before and after export. Each is responsible for its own compliance.

2.4 Deletion Notices

Where an individual exercises a deletion, erasure, or opt-out right against us in respect of a Contact Database record, we will notify Customers known to have exported that record. Customer must delete the record from all its systems within 10 business days of notice, must not re-import it, and will confirm deletion on request.

This obligation is essential to our ability to give effect to data subject rights and to comply with data broker deletion statutes including the California Delete Act. It survives termination of the Agreement.

2.5 Regulated Data

Customer must not submit special category data under GDPR Art. 9, sensitive personal information under US state law, Protected Health Information, payment card data, financial account data, biometric data, or government identification numbers to the Services absent a separate written agreement with us. The Services are not designed for such data, and our technical and organizational measures are not calibrated to it.

---

3. Definitions

"Data Protection Laws" means all applicable laws relating to privacy, data protection, and the processing of personal data, including: the GDPR; the UK GDPR and Data Protection Act 2018; the Swiss FADP; PIPEDA and Quebec Law 25; the CCPA as amended by the CPRA; and the comprehensive privacy statutes of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, in each case as amended.

"Controller," "Processor," "Data Subject," "Personal Data," "Personal Data Breach," "Processing," and "Supervisory Authority" have the meanings given in the GDPR, and equivalent terms under other Data Protection Laws — including "Business," "Service Provider," and "Consumer" under the CCPA — are construed accordingly.

"SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

"UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner under s.119A(1) of the Data Protection Act 2018.

"Sub-processor" means any third party we engage to process Customer Personal Data.

---

4. Processing Instructions

4.1 Documented Instructions

We process Customer Personal Data only on Customer's documented instructions, which comprise this DPA and the Agreement, Customer's configuration and use of the Services, and any further written instructions the parties agree.

We may also process where required by applicable law, in which case we will inform Customer of the requirement before processing unless the law prohibits notice on important grounds of public interest.

4.2 Unlawful Instructions

We will inform Customer if, in our opinion, an instruction infringes Data Protection Laws, and may suspend performance of that instruction pending resolution. We are not obliged to conduct a legal review of Customer's instructions.

4.3 Customer Obligations

Customer warrants that:

• It has a lawful basis for the processing it instructs, and has given all required notices to Data Subjects
• Its instructions comply with Data Protection Laws
• It has the right to transfer Customer Personal Data to us for processing
• Where Customer sends marketing communications through the Services, it holds any consent required under CAN-SPAM, TCPA, CASL, PECR, or equivalent law
• Where Customer records calls, it has obtained consents required by applicable wiretapping and recording law
• It will not instruct us to process in a manner that would cause us to breach Data Protection Laws

Customer is solely responsible for the accuracy, quality, and legality of Customer Personal Data.

4.4 AI Model Training

We do not train, fine-tune, or improve artificial intelligence or machine learning models using Customer Personal Data, and we do not add Customer Personal Data to the Contact Database. We do not develop our own models; AI functionality is provided through third-party Sub-processors, which we configure to disable training on customer data where that option is available.

Customer instructs us to process Customer Personal Data to provide the Services and to compile aggregated and de-identified statistics for the purpose of operating, securing, and improving the Services and our AI agents. De-identified data will not be re-identified or used to build profiles of any individual.

---

5. Confidentiality

We ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty, are trained on data protection, and access Customer Personal Data only as necessary to perform their duties.

---

6. Security

We implement and maintain appropriate technical and organizational measures under GDPR Art. 32, as described in Annex II. We may update those measures provided the level of protection is not materially reduced.

---

7. Sub-processors

7.1 General Authorization

Customer grants us general authorization to engage Sub-processors. A current list — including each entity's name, processing function, and processing location — is maintained at marketingtitan.ai/subprocessors and forms Annex III.

7.2 Changes and Objection

We will give at least 30 days' notice before adding or replacing a Sub-processor, through the notification mechanism at the URL above. Customer may subscribe to notifications.

Customer may object on reasonable data protection grounds within 15 days of notice. The parties will discuss in good faith. If we cannot provide a reasonable alternative, Customer may terminate the affected Services and receive a pro-rata refund of prepaid unused fees. Absent objection within the period, the Sub-processor is deemed approved.

Emergency changes. We may engage a new Sub-processor with shorter notice where necessary to address a security or availability emergency, notifying Customer as soon as practicable.

7.3 Sub-processor Obligations

We enter written agreements with each Sub-processor imposing data protection obligations no less protective than this DPA, and remain fully liable to Customer for each Sub-processor's performance.

---

8. Data Subject Rights

Taking into account the nature of the processing, we will assist Customer through appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to Data Subject requests under Chapter III of the GDPR and equivalent provisions.

The Services provide functionality enabling Customer to access, correct, export, restrict, and delete Customer Personal Data. Customer will use that functionality where it is sufficient.

Requests we receive. Where we receive a request relating to Customer Personal Data, we will not respond substantively except to confirm receipt and direct the Data Subject to Customer, and we will notify Customer without undue delay.

Requests relating to Contact Database records are handled by us directly as Controller under Section 2.3 and are not subject to this Section.

---

9. Assistance to Customer

Taking into account the nature of processing and the information available to us, we will assist Customer in complying with:

• Security obligations (GDPR Art. 32)
• Personal Data Breach notification (Arts. 33–34) — see Section 10
• Data Protection Impact Assessments (Art. 35) — by providing reasonably available information about the Services
• Prior consultation with Supervisory Authorities (Art. 36)

We may charge a reasonable fee for assistance that is disproportionate or that exceeds what the Services provide by default, on prior notice.

---

10. Personal Data Breach

We will notify Customer without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data.

Notification will describe, to the extent known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, likely consequences, measures taken or proposed, and contact details for further information. Where full information is unavailable initially, we will provide it in phases without undue delay.

We will take reasonable steps to contain and remediate, and will cooperate with Customer's investigation and notification obligations.

Our notification is not an acknowledgment of fault or liability.

---

11. International Transfers

11.1 Transfer Mechanisms

Where Customer Personal Data subject to GDPR, UK GDPR, or the Swiss FADP is transferred to us in the United States or onward to a jurisdiction without an adequacy decision, the following apply.

EEA transfers. The SCCs are incorporated by reference and apply as follows:

• Module Two (Controller to Processor) where Customer is a Controller
• Module Three (Processor to Processor) where Customer is itself a Processor
• Clause 7 (docking clause): applies
• Clause 9(a): Option 2 (general written authorization), with a notice period of 30 days as set out in Section 7.2
• Clause 11(a) (independent dispute resolution): the optional language does not apply
• Clause 17: governed by the law of Ireland
• Clause 18(b): courts of Ireland
• Annexes I, II, and III to the SCCs are populated by Annexes I, II, and III to this DPA

UK transfers. The UK Addendum is incorporated. Tables 1 to 3 are populated by the Annexes to this DPA; Table 4 — the party that may end the Addendum under Section 19 — is neither party.

Swiss transfers. The SCCs apply with these amendments: references to the GDPR are to the FADP; the competent authority is the Federal Data Protection and Information Commissioner; and "Member State" does not prevent Data Subjects in Switzerland from bringing proceedings in their place of habitual residence.

11.2 Transfer Impact Assessments

We will provide information reasonably necessary for Customer to conduct a transfer impact assessment, and will notify Customer if we become unable to comply with the SCCs.

11.3 Government Access Requests

Unless legally prohibited, we will notify Customer of any legally binding request from a public authority for Customer Personal Data, challenge requests that are unlawful, overbroad, or inconsistent with Data Protection Laws, and provide the minimum data legally required. We maintain a policy on handling such requests, available on request.

---

12. Audits

12.1 Information and Reports

We will make available information reasonably necessary to demonstrate compliance with Art. 28, including any current third-party audit reports and certifications we hold, on request and under confidentiality obligations, no more than once per twelve months absent a Personal Data Breach or Supervisory Authority requirement.

12.2 On-Site Audits

Where the above is insufficient to demonstrate compliance, Customer may conduct an audit on 30 days' prior written notice, no more than once per twelve months — or more frequently following a Personal Data Breach affecting Customer, or where required by a Supervisory Authority — during business hours, without unreasonably disrupting our operations, and subject to confidentiality.

Audits must not extend to other customers' data, our proprietary systems beyond what is necessary, or Sub-processor premises, for which we will supply available reports instead.

Customer bears its own costs and our reasonable costs for audits beyond the annual allowance. Auditors must not be our competitors and must sign confidentiality undertakings.

---

13. Deletion and Return

On termination or expiry of the Agreement, we will, at Customer's election, delete or return Customer Personal Data.

Customer may export Customer Personal Data through Service functionality for 30 days after termination. After that period we will delete Customer Personal Data within 90 days, except:

• Where retention is required by applicable law, in which case we will isolate the data and cease active processing
• Backup copies, which are deleted on the rolling backup cycle described in Annex II, not exceeding 90 days
• Aggregated and de-identified data
• Records necessary to evidence compliance, including consent and opt-out logs

---

14. US State Privacy Law Terms

14.1 CCPA and CPRA

With respect to Personal Information subject to the CCPA, Customer is a Business and we are a Service Provider. We:

• Will not sell or share Personal Information
• Will not retain, use, or disclose Personal Information except to perform the Services specified in the Agreement, or as otherwise permitted by the CCPA
• Will not retain, use, or disclose Personal Information outside the direct business relationship between us and Customer
• Will not combine Personal Information received from Customer with Personal Information received from another source, except as permitted by CCPA § 1798.140(ag)(1)
• Certify that we understand and will comply with these restrictions
• Will notify Customer if we determine we can no longer meet our obligations
• Will grant Customer the right to take reasonable steps to stop and remediate unauthorized use

We will assist Customer in responding to Consumer requests to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information.

14.2 Other State Laws

Where other US state privacy statutes apply, we act as a processor or service provider and will comply with the equivalent obligations those statutes impose, including processing only on Customer's instructions, assisting with consumer rights requests, and maintaining appropriate security.

14.3 Data Broker Status

Customer acknowledges that, separately from our role as Service Provider under this DPA, we operate as a Controller of the Contact Database and are a data broker as defined under California Civ. Code § 1798.99.80 and comparable statutes in Texas, Oregon, and Vermont.

That activity is outside the scope of this DPA. The Service Provider certifications in Section 14.1 apply only to Customer Personal Data and do not extend to the Contact Database.

---

15. Canada

Where PIPEDA, Quebec Law 25, or provincial privacy legislation applies:

PIPEDA. We process Customer Personal Data as a service provider on Customer's behalf and remain accountable for it. We use contractual means to ensure comparable protection where data is transferred for processing, and we assist Customer with access and correction requests. Where a breach of security safeguards creates a real risk of significant harm, we will notify Customer without undue delay so that Customer can meet its reporting obligations to the Privacy Commissioner of Canada, and we maintain records of such breaches for 24 months.

Quebec Law 25. We assist Customer with privacy impact assessments required before personal information is communicated outside Quebec, provide the information Customer needs to respond to requests for portability, de-indexing, and information about automated decision-making, and notify Customer of any confidentiality incident without delay so Customer can notify the Commission d'accès à l'information and affected individuals. We maintain a confidentiality incident register.

Alberta and British Columbia. We assist Customer with access and correction requests and with notification to the applicable provincial commissioner where a real risk of significant harm exists.

---

16. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Laws prohibit such limitation.

Liability arising under the SCCs is subject to the same limitations to the maximum extent permitted, provided nothing limits either party's liability to Data Subjects under GDPR Art. 82 or restricts a Data Subject's rights under the SCCs.

---

17. Customer Indemnity

Customer will indemnify and hold us harmless against any claim, fine, penalty, or liability, including reasonable legal costs, arising from:

• Customer's instructions, where following them caused us to breach Data Protection Laws
• Customer's failure to establish a lawful basis, provide required notices, or obtain required consents
• Customer's submission of data prohibited under Section 2.5
• Customer's failure to honour a deletion notice under Section 2.4
• Any claim by a Data Subject relating to processing Customer instructed

Under GDPR Art. 82(2) a processor is liable only where it has not complied with obligations specifically directed to processors or has acted outside or contrary to lawful instructions of the controller. Nothing in this DPA extends our liability beyond that standard.

18. General

Term. This DPA remains in effect for as long as we process Customer Personal Data.

Changes. We may update this DPA where required by Data Protection Laws or to reflect Service changes, on 30 days' notice, provided no update materially reduces protections. Prior versions are archived at marketingtitan.ai/dpa/archive.

Severability. If a provision is invalid, the remainder stands.

Governing law. As stated in the Agreement, except where the SCCs or Data Protection Laws require otherwise.

---

Annex I — Description of Processing

A. Parties

Data Exporter: Customer, as identified in the Agreement. Role: Controller, or Processor where Module Three applies. Contact: as recorded in Customer's account.

Data Importer: AtmosAI, Inc., 30 N Gould St, Ste. R, Sheridan, WY 82801. Role: Processor. Contact: dpo@marketingtitan.ai.

B. Description

Categories of Data Subjects. Customer's employees, contractors, and authorized Users; Customer's own customers, clients, and prospects; recipients of Customer's marketing and sales communications; contacts within Customer's CRM; and individuals appearing in creative assets, knowledge bases, or screen recordings Customer uploads.

Categories of Personal Data

Special category data: none. Customer is prohibited from submitting it under Section 2.5.

Frequency: continuous, for the duration of the Agreement.

Nature and purpose: hosting, storage, transmission, and processing to provide CRM, campaign delivery, contact management, AI content generation, voice and SMS communication, scheduling, analytics, and related functionality, together with security, support, and service maintenance.

Retention: as set out in Section 13 and our Privacy Policy.

Sub-processor processing: as described in Annex III, for the duration of the Agreement.

C. Competent Supervisory Authority

Where Customer is established in the EEA, its lead supervisory authority. Where Customer is not established in the EEA but is subject to GDPR under Art. 3(2), the authority of the Member State in which Customer's Art. 27 representative is established.

D. Product Scope

This DPA covers processing through Marketing Titan, Lead Titan AI, and IT Titan. Where a product processes narrower categories than those listed above, only the applicable categories apply.

---

Annex II — Technical and Organizational Measures

Pseudonymization and encryption [ENCRYPTION IN TRANSIT AND AT REST; KEY MANAGEMENT; WHERE PSEUDONYMIZATION IS APPLIED]

Confidentiality, integrity, availability, and resilience [ACCESS CONTROLS; NETWORK SEGMENTATION; HARDENING; REDUNDANCY; FAILOVER]

Restoration of availability [BACKUP FREQUENCY; RETENTION WINDOW; TESTED RESTORATION; RTO/RPO]

Testing and evaluation [PENETRATION TESTING CADENCE; VULNERABILITY SCANNING; CODE REVIEW; THIRD-PARTY AUDITS]

Access control [RBAC; LEAST PRIVILEGE; MFA FOR ADMINISTRATIVE ACCESS; ACCESS REVIEW CADENCE; JOINER/MOVER/LEAVER PROCESS]

Data minimization [RETENTION ENFORCEMENT; DELETION TOOLING; MINIMIZATION IN AI PIPELINES]

Logging and monitoring [AUDIT LOGGING; LOG RETENTION; ALERTING; SIEM]

Incident response [DETECTION; ESCALATION; RESPONSE PROCEDURES; NOTIFICATION WORKFLOW; POST-INCIDENT REVIEW]

Personnel [BACKGROUND CHECKS; CONFIDENTIALITY AGREEMENTS; SECURITY AND PRIVACY TRAINING CADENCE]

Sub-processor governance [VENDOR SECURITY ASSESSMENT; CONTRACTUAL FLOW-DOWN; PERIODIC REVIEW]

Certifications SOC 2 Type I. Our SOC 2 Type I report attests to the design of our controls at a point in time. We do not hold SOC 2 Type II or ISO 27001. A Type II observation window has not been completed. Current status is published at marketingtitan.ai/security.

---

Annex III — Sub-processors

The current list is maintained at marketingtitan.ai/subprocessors and incorporated by reference.

The list states, for each Sub-processor: legal entity name, processing function, categories of Personal Data processed, and processing locations.

Categories represented: