Conditional Business Data Processing Agreement

01

Applicability and conditional status

This specimen is not automatically incorporated into account Terms and is not currently an executed processing agreement. Ordinary marketplace account, booking, safety, financial and legal-record purposes do not become customer-instructed processing merely because a customer is a business. A distinct covered service must first be identified and the factual controller and processor roles established.

If both parties complete its schedules and execute it through authorized representatives, this Agreement governs only the processing expressly identified in Schedule 1. Unfilled fields are execution blockers; this page does not claim the processing or safeguards already exist.

02

Parties and defined scope

Popriva is operated by Lost Hills LLC, doing business as Popriva, formed in Wyoming, United States. Public mailing address: 1480 Colorado Blvd, Ste 200A #209, Los Angeles, CA 90041, United States. Contact: [email protected].

Effective date: October 22, 2026; applies when this version is presented for new activity and accepted where agreement is required. Document version: 2026-10-22-legal-1. These terms do not replace your previously accepted booking agreement.

The customer-controller is [dpa customer entity — confirmation needed], of [dpa customer address — confirmation needed]. Popriva is processor only for the covered processing [dpa covered service — confirmation needed]. “Customer Data” means personal data processed on that customer’s documented instructions within that scope. “Applicable Data Protection Law” means [dpa applicable law — confirmation needed], to the extent applicable to the parties and processing. Other terms take their applicable statutory meanings.

This Agreement supplements [dpa main agreement — confirmation needed]. For Customer Data processing it prevails over inconsistent general commercial terms; mandatory law and any valid applicable transfer instrument prevail over it. It does not make customers controllers of every creator’s independent marketplace record or override data-subject rights.

03

Documented instructions and customer responsibilities

The customer determines the lawful purposes of covered processing, establishes a lawful basis, supplies required notices and instructions, and ensures it may lawfully disclose Customer Data. Instructions are the executed agreement and schedules, supported configured instructions within their scope, and subsequent lawful written instructions from an authorized customer contact.

Popriva shall process Customer Data only on those instructions, including for international transfers, unless legally required otherwise. Where required by law, Popriva shall inform the customer before compelled processing unless prohibited for important public-interest reasons. If Popriva considers an instruction infringes Applicable Data Protection Law, it shall promptly tell the customer and suspend the affected instruction while the parties address it.

Popriva shall not sell Customer Data, use it for unrelated advertising, or repurpose it for independent product training under this processor agreement. Any independent purpose requires a separate lawful basis, transparent disclosure and appropriate role assessment; a processor instruction cannot supply them by implication.

04

Confidentiality and security

Popriva shall ensure that persons authorized to process Customer Data are bound by confidentiality or an appropriate statutory duty, receive relevant instructions and access only what their duties require. Access shall be revoked when no longer needed.

Popriva shall implement and maintain the appropriate technical and organizational measures agreed in Schedule 2, considering the processing context and risks. Changes may improve or replace controls without materially reducing the agreed protection. This contractual undertaking is conditional on execution; it is not a claim that an unverified deployment meets an unstated certification.

05

Subprocessors

The customer grants [dpa subprocessor authorization model — confirmation needed] authorization only for the subprocessors and covered functions identified in Schedule 3. Before engaging a subprocessor, Popriva shall impose written obligations providing the protection required by Applicable Data Protection Law for the assigned processing. Popriva remains responsible to the customer for performance of those obligations to the extent required by that law.

For a general-authorization model, Popriva shall provide advance written notice of intended additions or replacements through [dpa subprocessor notice channel — confirmation needed] at least [dpa subprocessor notice period — confirmation needed] before access. The customer may object on reasonable data-protection grounds within [dpa subprocessor objection period — confirmation needed]. The parties shall seek a protective resolution; if none is available, the affected processing may not proceed without the required authorization and either party may end the affected service under [dpa objection termination terms — confirmation needed].

Under a specific-authorization model, written approval is required before the new subprocessor begins covered processing. An inventory of all platform vendors is not itself an authorized subprocessor list; independent payment or social-platform controllers must be classified separately.

06

Data-subject requests and regulatory assistance

Considering the nature of processing, Popriva shall assist the customer through appropriate technical and organizational measures to respond to requests to exercise data-subject rights. It shall promptly relay a request concerning Customer Data and not respond substantively on the customer’s behalf except on instructions or where legally required. Identity checks and responses shall avoid unnecessary disclosure.

Taking into account available information, Popriva shall assist with security obligations, impact assessments, prior regulatory consultation and legally required breach communications. Practical contacts, response procedures and any permitted reasonable assistance fees are [dpa assistance arrangements — confirmation needed]. Fees must not prevent mandatory cooperation.

07

Personal-data breaches

Popriva shall notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Data, using [dpa incident contact — confirmation needed] and the incident procedure [dpa incident procedure — confirmation needed]. Initial notice shall provide the available facts, affected data and people where known, likely consequences, response measures and a contact for follow-up; missing information may follow in stages without undue further delay.

Popriva shall take appropriate containment and remediation steps, preserve relevant evidence, cooperate with the customer’s investigation and keep it informed of material developments. Notification is not an admission of fault. This clause does not delay a mandatory notice while awaiting a complete investigation or promise an invented fixed-hour threshold.

08

Audit and compliance information

Popriva shall make available information necessary to demonstrate its compliance with the applicable processor obligations and allow and contribute to audits, including inspections, by the customer or its mandated auditor. The parties shall use proportionate confidentiality and security arrangements to protect other customers and systems without defeating mandatory access.

Audit coordination, routine notice, evidence delivery, frequency and costs are [dpa audit arrangements — confirmation needed]. Where reliable independent evidence answers the relevant question, it may be used first. Urgent incidents, credible noncompliance or regulator requirements must not be blocked by a routine notice or frequency limit.

09

Return, deletion and legal retention

At the customer’s choice, after the covered service ends Popriva shall return or delete Customer Data and delete existing copies unless applicable law requires retention. The selection, usable return format, completion periods and backup isolation and expiry are specified in the executed Schedule 1. The platform’s retention rules for independent-controller records do not override the customer’s lawful return or deletion instructions for covered Customer Data.

Where law requires retention, Popriva shall identify the relevant requirement where permitted, restrict the retained data to that purpose, continue applicable protections and delete it when the requirement ends. Backup procedures must prevent ordinary reuse of deleted data and account for restoration. Any independent-controller records retained for Popriva’s own legal purposes must be separately identified and justified rather than silently treated as processor copies.

10

International transfers

No transfer authorization is inferred from signing this specimen. Schedule 4 must identify exporter, importer, roles, countries, onward transfers and the applicable lawful mechanism before covered restricted transfers occur. Popriva shall follow documented lawful transfer instructions and provide information reasonably required for the applicable assessment and supplementary measures.

If a transfer mechanism ceases to support the processing, the parties shall promptly establish a valid replacement or suspend the affected transfer. Standard contractual clauses, UK instruments or adequacy provisions apply only where validly selected and completed for the relevant facts; no module or region is automatically adopted here.

11

Responsibility, term and execution

This Agreement lasts for the covered service and for any protected retention obligations. Liability allocation between the parties follows [dpa liability terms — confirmation needed] and the main agreement only to the extent lawful; it does not reduce rights or liabilities owed to data subjects or authorities under mandatory law. Governing law and forum are the laws of the State of California, United States, excluding its conflict-of-laws rules and preserving any mandatory protections of the laws that apply to you and the state or federal courts serving Los Angeles County, California, subject to any mandatory right to bring or defend a claim in your home jurisdiction or another legally required forum, subject to mandatory requirements and any superior applicable transfer clauses.

Authorized execution must identify both parties, signatory names, authority, acceptance date, complete schedules and the agreed version: [dpa execution record — confirmation needed]. A website visit, end-user signup or privacy acknowledgement does not execute this conditional agreement.

12

Schedule 1 — Processing description and instructions

• Main agreement and covered service: [dpa main agreement — confirmation needed]; [dpa covered service — confirmation needed]. Subject matter, nature and purpose: [dpa processing purpose — confirmation needed].
• Customer instructions and authorized instruction contacts: [dpa documented instructions — confirmation needed]; [dpa authorized contacts — confirmation needed].
• Data-subject categories: [dpa data subjects — confirmation needed]. Personal-data categories: [dpa data categories — confirmation needed]. Special-category or criminal-offence data and safeguards, if specifically authorized: [dpa sensitive data scope — confirmation needed]. No such data is authorized by leaving this field blank.
• Processing operations, frequency, volume and access parties: [dpa operations — confirmation needed]. Covered processing duration and service end trigger: [dpa duration — confirmation needed].
• Return or deletion choice, export format and operational deadlines: [dpa return deletion choice — confirmation needed]. Retention and backup treatment for the covered Customer Data: [dpa retention schedule — confirmation needed].
• Independent-controller exclusions and their notices: [dpa controller exclusions — confirmation needed]. Customer rights and responsibilities are those in the instruction and assistance clauses, supplemented by [dpa customer obligations — confirmation needed].

13

Schedule 2 — Agreed technical and organizational measures

Complete this annex from verified deployment and operational evidence before execution. A source-code feature is not proof of a production control. The agreed measures must be proportionate to the covered data and service.

• Hosting and processing locations, access paths and contractual security responsibilities: Popriva’s application is hosted in the United States. Authorized infrastructure providers process the information necessary to host and operate the service. Other integrations may involve processing outside the United States under the relevant notices and applicable safeguards. Object storage, backups, lifecycle and recovery locations: Authorized storage and backup services process saved records and files for controlled storage, recovery and delivery. Our application’s US hosting location does not mean that every external integration or recipient processes information only in the United States.
• Access control, role assignment, authentication, privileged access and access reviews: [dpa access controls — confirmation needed].
• Encryption in transit and at rest, key custody and secrets handling: [dpa encryption controls — confirmation needed].
• Logging, monitoring, vulnerability management, change review and security testing: [dpa monitoring and testing — confirmation needed].
• Resilience, backup restoration, continuity testing and incident response: [dpa resilience and incident controls — confirmation needed].
• Personnel confidentiality, training, physical safeguards and vendor oversight: [dpa organizational measures — confirmation needed].
• Data minimization, tenant separation, deletion, export and rights-request controls: [dpa data lifecycle controls — confirmation needed]. Evidence owner and last verification date: [dpa security evidence record — confirmation needed].

14

Schedule 3 — Authorized subprocessors

Complete one entry per actual processor receiving covered Customer Data, naming its legal entity, service, data, processing locations, onward transfers and authorization basis: [dpa authorized subprocessors — confirmation needed]. Do not automatically list every analytics, payment or social integration as a subprocessor. The executed annex must include the agreed notice and objection contacts and the authorization model selected above.

15

Schedule 4 — Transfer record

For each restricted transfer complete exporter/importer identities, actual data and roles, origin and destination, transfer mechanism, any selected module and annexes, assessment and supplementary measures, onward-transfer restrictions and review owner: [dpa transfer schedule — confirmation needed]. If no restricted transfer occurs, record the facts supporting that conclusion. Unresolved locations or unselected instruments prevent execution for affected transfers.