Data Processing Agreement

Scout by High Performance LSM

This Data Processing Agreement ("DPA") forms part of the Terms of Use between the customer that accepts the Terms of Use ("Customer") and Swanson International, Inc. DBA High Performance LSM, 400 Gilead Rd #86, Huntersville, NC 28078 ("Scout"). It applies whenever Scout processes Personal Data on Customer's behalf through the Services.

Effective Date: November 7, 2026.

1. DEFINITIONS

Capitalized terms not defined here have the meaning given in the Terms of Use.

"Controller", "Processor", "Sub-processor", "Personal Data", "Processing" and "Data Subject" have the meanings given in Data Protection Laws. Where a law uses different words (for example "business", "service provider" and "personal information" under the CCPA), those words are read as the matching terms here.

"Data Protection Laws" means all laws that apply to the Processing of Personal Data under this DPA, including the California Consumer Privacy Act as amended by the CPRA (CCPA) and other U.S. state privacy laws, Canada's PIPEDA and Quebec's Law 25, and, where it applies, the EU General Data Protection Regulation (GDPR).

"Customer Data" means Personal Data that Scout Processes on Customer's behalf through the Services: the Personal Data in Your Data (as defined in the Terms of Use), including data received from any Connected Service Customer connects. Customer Data does not include Account Data or Scout Research.

"Account Data" means the Personal Data of Customer's own representatives and users that Scout collects to open and run Customer's account, secure sign-in and bill for the Services (for example names, email addresses, sign-in records and billing details). Scout is an independent controller of Account Data under its Privacy Policy, and this DPA does not apply to it.

"Scout Research" has the meaning given in the Terms of Use. Scout is an independent controller of the Personal Data in Scout Research (the published business contact details of people at schools and organizations), and this DPA does not apply to it. When Customer copies a Scout Research contact into its own records or sends that contact an email through the Services, the copy and the email are Customer Data.

"Services" means the Scout platform, dashboard, emails and messages, and Connected Service connections described in the Terms of Use.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data.

2. SCOPE AND ROLES

For Customer Data, Customer is the Controller and Scout is the Processor. Where Customer itself acts as a processor for another party (for example a franchisor or a management company), Customer warrants that it has the authority to appoint Scout as a sub-processor on these terms, and Scout acts as Customer's sub-processor.

Scout Processes Customer Data only to provide the Services and only as described in this DPA. Scout does not decide the purposes or means of Processing Customer Data.

If this DPA conflicts with the Terms of Use on a data-protection matter, this DPA controls. Where Standard Contractual Clauses apply under Section 9, they control over this DPA to the extent of any conflict.

3. PROCESSING DETAILS (ANNEX I)

Subject matter: provision of the Services to Customer. Duration: the term of Customer's account plus the deletion period in Section 13. Frequency: continuous while the account is open.

Nature and purpose of the Processing:

• Account, store and team management for Customer's stores and users, including roles and store-level permissions.
• Preparing each store's weekly local marketing plan and sending it, and other notices, to the Team Members and addresses Customer chooses.
• Managing Customer's business ("trade") accounts, partnerships, fundraisers and their results, flyers and artwork, delivery-area maps and contacts Customer adds.
• Sending the emails Customer chooses to its team and, from Customer's own email address, to outside contacts; keeping delivery, bounce and unsubscribe records; and receiving replies and other emails sent to Scout's addresses for Customer and passing them to Customer.
• Receiving work schedule pictures for Customer's stores and delivering them to each store's team.
• Store team group chats (GroupMe), when Customer connects them: posting Customer's approved messages through Scout's bot, receiving new group messages, recording schedule confirmations and preparing team summaries.
• Providing Customer a download of Your Data on request.
• Security, support, service improvement and the creation of aggregated or de-identified statistics that do not identify Customer, its stores or the people in its data.

Categories of Data Subjects:

• Customer's owners, leaders, managers, employees and team members, who may include minors of legal working age (named in work schedules and team lists).
• Customer's business contacts: contacts at trade accounts, partners, schools, fundraising organizations and other organizations Customer works with or adds, and people who reply to or receive emails sent through the Services.
• Members of Customer's store group chats, to the extent their names and messages pass through the Services.

Categories of Personal Data:

• Team members: name, email address, phone number, role, store assignment, GroupMe name and identifier, work schedule (name and shifts as shown in the schedule picture), schedule confirmations and participation totals.
• Business contacts: name, title, organization, work email address, work phone number, mailing address, notes Customer adds, account and ordering status, partnership and fundraising records and results, and the emails exchanged through the Services and their delivery results.
• Group chat members: GroupMe name and identifier, and message text (kept no more than three days).

Special categories of Personal Data: none are intended or required. Customer agrees not to submit special-category data, payment card data, government identifiers or health information through the Services.

4. CUSTOMER'S INSTRUCTIONS AND RESPONSIBILITIES

Customer's documented instructions are: this DPA, the Terms of Use, the settings Customer selects in the Services (including who receives each kind of email, which groups Scout posts to, and each instruction to send an email or a message), and any further written instructions Customer gives that Scout accepts. Scout will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

Customer is responsible for: (a) the lawful basis for the Processing; (b) giving any notices to, and obtaining any consents from, its team members and business contacts that Data Protection Laws require, including for the processing of minors' work schedules; (c) having the authority to connect each Connected Service and to send email from each domain or mailbox it connects; (d) the content of the emails and messages it sends through the Services and their compliance with the law, including the CAN-SPAM Act; and (e) the accuracy of the Customer Data it provides.

5. SCOUT'S OBLIGATIONS AS PROCESSOR

Scout will:

• Process Customer Data only on Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law, in which case Scout will tell Customer before Processing unless the law prohibits it.
• Ensure that every person it authorizes to Process Customer Data is bound by a duty of confidentiality.
• Implement and maintain the technical and organizational measures in Section 7 (Annex II).
• Engage Sub-processors only under Section 8 (Annex III).
• Keep each customer's data separated from every other customer's data, so that one customer cannot view another's Customer Data.
• Not combine Customer Data with Personal Data obtained from other sources except as needed to provide the Services to Customer.
• Not use a Connected Service's sign-in for longer than the connection requires, and keep GroupMe message text no longer than three days and schedule pictures no longer than 30 days.
• Assist Customer, taking into account the nature of the Processing, in responding to Data Subject requests (Section 10) and in meeting Customer's obligations on security, Security Incident notification, data protection impact assessments and prior consultation with supervisory authorities.
• Delete or return Customer Data at the end of the Services under Section 13.
• Keep records of its Processing activities and make available the information reasonably needed to demonstrate compliance with this DPA, and allow audits under Section 12.
• Tell Customer promptly if it can no longer meet its obligations under this DPA.

6. CCPA AND U.S. STATE PRIVACY LAW TERMS

To the extent the CCPA or another U.S. state privacy law applies, Scout is Customer's "service provider" or "processor", and Customer discloses Customer Data to Scout only for the limited and specified business purpose of providing the Services. Scout will not: (a) sell or share Customer Data; (b) retain, use or disclose Customer Data for any purpose other than the business purposes specified in this DPA, or outside the direct business relationship between Customer and Scout; or (c) combine Customer Data with Personal Data it receives from other sources, except as permitted by law. Scout will comply with the applicable law and provide the same level of privacy protection the law requires of Customer, will notify Customer if it determines it can no longer meet these obligations, and grants Customer the right to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Data. Scout certifies that it understands these restrictions and will comply with them. Sending an email or message to a recipient Customer chooses is a disclosure for a business purpose specified in this DPA and is not a sale or sharing.

7. SECURITY MEASURES (ANNEX II)

Scout maintains the following measures, which reflect what is in place in production as of the date of this DPA, and reviews them at least once a year. Scout may update these measures as the Services evolve, provided the overall level of protection is not reduced.

• Encryption in transit: TLS on all connections between users and the Services, with HTTP Strict Transport Security.
• No direct internet access to the server: the server accepts no inbound connections; all web traffic reaches it only through Cloudflare's encrypted tunnel, and administrative access is through AWS Systems Manager, with no SSH keys.
• Encryption at rest: the server's data volume, files stored in Amazon S3 and backups are encrypted at rest. Service keys and secrets are kept in AWS Systems Manager Parameter Store as encrypted values, read only by the parts of the Services that need them, never written into code, logs or notes.
• Sign-in: one-time codes or links sent by email instead of passwords; sign-in attempts limited; secure, host-only session cookies; every session ends after at most 90 days, and an owner can sign a person out of every device.
• Access control: roles and store-level permissions within each account, checked on the server for every request; each customer's data separated from every other customer's and tested so that one customer cannot read or change another's data.
• Connected Services: a GroupMe sign-in is used only during the connection and never stored; posts are made through Scout's bot. Gmail and Microsoft mailbox sign-ins, where Customer connects one, are stored encrypted and deleted when disconnected.
• Least privilege: Scout's server and build roles in AWS can reach only the resources and keys they need; instance metadata protected (IMDSv2).
• Patching: automatic daily security updates for the server's operating system.
• Backups: daily backups of the data volume and of the data, retained for no more than 35 days, with restores tested.
• Monitoring: alarms for the dashboard or worker stopping, errors in the logs, disk space, failed backups and failed weekly builds, sent to Scout's team.
• Change control: each change is tested on copies of real data before release, and each release receives a separate security review.
• Data minimization: GroupMe message text kept no more than three days; schedule pictures deleted after 30 days; emails to outside contacts carry an unsubscribe link and suppression of bounced and unsubscribed addresses.

Scout does not claim a penetration test or a SOC 2 or ISO certification.

8. SUB-PROCESSORS (ANNEX III)

Customer gives general authorization for Scout to use the Sub-processors below. Scout will give Customer at least 30 days' notice (by email or by updating this page and notifying Customer in the Services) before adding or replacing a Sub-processor that Processes Customer Data. Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, Customer may terminate the affected Services. Scout imposes data-protection obligations on each Sub-processor that are no less protective than this DPA and remains responsible for their performance.

• Amazon Web Services, Inc. (United States): cloud hosting, storage, backups and the building of each store's weekly plan, for all Customer Data.
• Cloudflare, Inc. (United States): domain name service, TLS, security filtering and the encrypted tunnel through which all web traffic reaches the Services. Customer Data passes through Cloudflare in transit; Cloudflare does not store it in the Services' databases.
• Twilio Inc., operating SendGrid (United States): sending all emails from the Services (sign-in codes, weekly plans, notices and the emails Customer sends) and receiving emails sent to Scout's addresses for Customer, such as replies and schedule pictures. SendGrid receives each message's recipients and content, and delivery results; messages are processed under Twilio's data processing addendum. It has no access to the Services' databases.
• Zoho Corporation (United States): Scout's company mailboxes, which receive support emails and emails forwarded to Scout for Customer, such as schedule pictures sent to scout@highperformancelsm.com.
• Anthropic, PBC (United States): AI assistance used by Scout's team for software development and support, which may see Customer Data when Scout troubleshoots Customer's account; and reading replies to Scout's emails to propose updates to Customer's records. Anthropic does not use the data to train its models.

Stripe, Inc. and ActiveCampaign, LLC process Account Data only, never Customer Data, and are listed in the Privacy Policy. Google LLC (Google Maps Platform) receives store addresses and place searches, not Customer Data.

GroupMe (Microsoft) and the email providers and Google accounts Customer connects are independent controllers chosen by Customer. They are not Sub-processors of Scout. The recipients of emails and messages Customer sends are recipients chosen by Customer and are not Sub-processors of Scout.

9. INTERNATIONAL TRANSFERS

Customer Data is hosted in the United States. Where Customer Data protected by the GDPR or Swiss law is transferred to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor, as applicable), which are incorporated into this DPA by reference. Customer is the data exporter and Scout the data importer; Annexes I to III of this DPA serve as the annexes to those clauses.

For Customer Data about individuals in Canada, Scout provides a comparable level of protection through this DPA and will assist Customer with any notice, assessment or consent that PIPEDA or Quebec's Law 25 requires for the transfer.

Scout will tell Customer if it becomes subject to a legal requirement that prevents it from honoring these transfer safeguards.

10. DATA SUBJECT RIGHTS

Scout will forward to Customer, within five business days, any request it receives from a Data Subject concerning Customer Data, and will not respond to the Data Subject except to refer the request to Customer, unless Customer instructs otherwise or law requires. Taking into account the nature of the Processing, Scout will provide reasonable assistance, through the Services where possible, so that Customer can respond to requests for access, correction, deletion, restriction, objection and portability within the time Data Protection Laws allow. A recipient's unsubscribe request is honored automatically for Customer's future emails through the Services.

11. SECURITY INCIDENTS

Scout will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Data. The notice will describe the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point, with information supplied in phases as it becomes available. Scout will cooperate with Customer's investigation and with any notification Customer must make to a supervisory authority or to Data Subjects, and will not identify Customer in any public statement about the incident without Customer's consent unless law requires it.

12. AUDITS

On written request, no more than once in any 12-month period unless a Security Incident has occurred or a supervisory authority requires it, Scout will make available the information reasonably necessary to demonstrate compliance with this DPA: its security documentation, summaries of any third-party assessments or certifications it holds, and written answers to a reasonable security questionnaire. If that information is not sufficient, Customer or an independent auditor bound by confidentiality may conduct an audit, on at least 30 days' notice, during business hours, in a manner that does not disrupt Scout's operations or expose other customers' data, at Customer's cost. The parties will agree to the scope in advance.

13. RETENTION, RETURN AND DELETION

Scout keeps Customer Data only for as long as needed to provide the Services. Schedule pictures are deleted 30 days after they are received, and GroupMe message text within three days. Customer may download its Customer Data at any time from the Services. When Customer's account ends, Customer may download its Customer Data for 30 days, and Scout will delete it within the following 30 days, unless law requires longer retention or the data is needed to resolve a dispute already in progress. Copies in routine backups are retained for no more than 35 days and then overwritten, and are not restored except for disaster recovery. On request, Scout will confirm deletion in writing.

Emails already delivered remain in their recipients' mailboxes, and Scout's email Sub-processor keeps its own delivery records under its data processing addendum.

14. LIABILITY

Each party is responsible for its own compliance with Data Protection Laws. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Use, except that nothing limits a party's liability to the extent that applicable law prohibits such limitation, including liability that cannot be limited under the Standard Contractual Clauses.

15. TERM, CHANGES AND GOVERNING LAW

This DPA takes effect when Customer accepts the Terms of Use and continues for as long as Scout Processes Customer Data. Scout may update this DPA to reflect changes in law or in the Services by posting the revised version at highperformancelsm.com/dpa and notifying Customer; changes that reduce Customer's protections take effect no earlier than 30 days after notice. This DPA is governed by the laws of the State of North Carolina, subject to mandatory Data Protection Laws that apply to the Processing.

16. CONTACT

Swanson International, Inc. DBA High Performance LSM

400 Gilead Rd #86, Huntersville, NC 28078

Data protection contact: help@highperformancelsm.com

(980) 281-2471