Data Processing Addendum

1. Scope and Parties

1.1 This Data Processing Addendum ("DPA") forms part of the agreement between GLOBAL ENTERPRISE CLOUD SYSTEMS ("GECS"), trading as AdultSense, and the client (Advertiser or Publisher) under the Terms of Service, Advertiser Terms and/or Publisher Terms (the "Agreement"). It applies to the extent GECS processes Personal Data in connection with the Agreement that is subject to Data Protection Laws.

1.2 This DPA is accepted by the client on acceptance of the Agreement. No separate signature is needed. If there is a conflict between this DPA and the Agreement concerning Personal Data, this DPA prevails.

2. Definitions

2.1 "Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the ePrivacy Directive and its national implementations, UK PECR, the data protection law of the Republic of Panama and any other data protection law that applies to the processing.

2.2 "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the GDPR. "SCCs" means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914; "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner. "Sub-processor" means any processor engaged by GECS to process Personal Data on behalf of the client.

3. Roles of the Parties

3.1 Ad delivery data. In respect of End User data processed by the ad server for frequency capping, unique counting, rotation, fraud detection and reporting, GECS and the Publisher each act as independent controllers for their own processing. The Publisher is responsible for transparency to, and obtaining any required consent from, visitors to its website. Each controller is responsible for its own compliance.

3.2 Account data. GECS acts as an independent controller for business contact and account data of client personnel, as described in the Privacy Policy.

3.3 Processor services. Where GECS processes Personal Data on documented instructions of the client solely to provide a service to that client (for example, hosting client-supplied materials containing Personal Data, or producing client-specific reports), GECS acts as Processor and sections 4 to 9 apply.

3.4 Clients must not provide GECS with special category data, data relating to criminal convictions, or data of children, and must not pass directly identifying data (names, emails, phone numbers) through ad code, URLs or tracking parameters.

4. Processor Obligations

4.1 Where GECS acts as Processor, it will: (a) process Personal Data only on the client's documented instructions, including as set out in the Agreement, unless required by law (in which case it will inform the client unless legally prohibited); (b) ensure that persons authorised to process Personal Data are bound by confidentiality; (c) implement the security measures in section 6; (d) comply with section 5 when engaging Sub-processors; (e) assist the client, taking into account the nature of processing, in responding to Data Subject requests and in meeting obligations relating to security, breach notification, impact assessments and prior consultation; (f) at the client's choice, delete or return Personal Data at the end of the services, unless retention is required by law; and (g) make available information reasonably necessary to demonstrate compliance and allow for audits as described in section 8.

4.2 GECS will inform the client if, in its opinion, an instruction infringes Data Protection Laws.

4.3 Details of processing: subject matter and duration — provision of the services for the term of the Agreement; nature and purpose — hosting, storage, analysis and reporting for the client; categories of Data Subjects — End Users and client personnel; categories of data — technical identifiers, IP addresses, device and usage data, business contact data.

5. Sub-processors

5.1 The client grants general authorisation for GECS to engage Sub-processors, including for hosting, infrastructure, content delivery, email and messaging. GECS will maintain a list of Sub-processors available on request at Show email, and will notify the client of intended additions or replacements at least fourteen (14) days in advance by email or in the portal.

5.2 The client may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the client may terminate the affected services as its sole remedy, without entitlement to any refund. GECS will impose data protection obligations on each Sub-processor no less protective than this DPA and remains liable for its Sub-processors' performance.

6. Security

6.1 GECS implements appropriate technical and organisational measures, including: encryption of data in transit using current TLS; access controls on a least-privilege basis with authentication for administrative access; logical separation of client data; logging and monitoring of systems; regular backups; patch management; IP truncation or aggregation of raw ad server logs after 90 days (portal logs retained 12 months and financial records 7 years, as set out in the Privacy Policy); personnel confidentiality obligations; and incident response procedures.

7. Personal Data Breaches

7.1 GECS will notify the client without undue delay, and where feasible within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on the client's behalf, providing information reasonably available to help the client meet its own notification obligations. Notification is not an acknowledgement of fault.

8. Audits

8.1 GECS will respond to reasonable written requests for information about its processing no more than once in any twelve (12) month period (unless required by a supervisory authority or following a Personal Data Breach). Any on-site audit must be agreed in advance, conducted at the client's cost, during business hours, subject to confidentiality and without disruption to GECS's operations or access to other clients' data.

9. International Transfers

9.1 Where Personal Data subject to EU, UK or Swiss law is transferred to GECS in Panama or to a Sub-processor in a country without an adequacy decision, the parties agree that the SCCs are incorporated by reference: Module One (controller to controller) for independent controller transfers and Module Two (controller to processor) for processor services, with the client as data exporter and GECS as data importer; the optional docking clause applies; option 2 (general authorisation) applies to Clause 9; Clause 11 optional language does not apply; Clauses 17 and 18 — the law and courts of Ireland. For UK transfers the UK Addendum applies, and for Swiss transfers the SCCs apply with references adapted to Swiss law. Annex information is as set out in section 4.3 and section 6.

10. Other Data Protection Laws

10.1 Where any other data protection law applies to Personal Data that GECS processes on the client's behalf, GECS will process it only to provide the services described in the Agreement and on the client's documented instructions, will not sell it, and will not combine it with other data except as needed to provide those services or prevent fraud. The client is responsible for determining which laws apply to its own processing and for giving any notices and obtaining any consents those laws require.

11. Liability and Term

11.1 Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where such limitations are prohibited by Data Protection Laws. This DPA continues for as long as GECS processes Personal Data under the Agreement. Governing law and jurisdiction are as set out in the Agreement (Republic of Panama), save as required by section 9 for the SCCs.