Data Processing Addendum
Last Updated November 12, 2026
This Data Processing Addendum (“DPA”) is entered into between The Maverick Lab Inc. (“Maverick”) and the customer identified in the applicable Order or agreement governing use of Maverick’s Services (“Customer”).
This DPA forms part of that agreement (the “Agreement”) and applies for so long as Maverick Processes Personal Data on Customer’s behalf.
1. DEFINITIONS
“Applicable Data Protection Law” means applicable laws and regulations governing the Processing of Personal Data, including, where applicable, the California Consumer Privacy Act and California Privacy Rights Act (“CCPA/CPRA”), the EU General Data Protection Regulation (“GDPR”), and the UK GDPR.
“Customer Data” means all data, including Personal Data, that Customer submits to the Services or that Maverick obtains from Customer’s connected third-party accounts (such as email marketing or e-commerce platforms) in providing the Services, including Contributions and Generated Content as defined in the Agreement.
“Customer Personal Information” means Personal Data contained in Customer Data that constitutes “personal information” under the CCPA/CPRA.
“Personal Data” means information relating to an identified or identifiable individual that is contained in Customer Data and protected under Applicable Data Protection Law.
“Services” means the Service as defined in the Agreement.
“Subprocessor” means a third party engaged by Maverick to Process Personal Data on Customer’s behalf in connection with the Services.
Capitalized terms used but not defined in this DPA (including “Controller,” “Processor,” “Process,” “Data Subject,” and “Personal Data Breach”) have the meanings given in Applicable Data Protection Law or, if not defined there, in the Agreement.
2. ROLES AND RESPONSIBILITIES
Customer is the Controller (or equivalent role) of Personal Data contained in Customer Data, and Maverick is the Processor (or equivalent role), except with respect to information about Customer’s personnel who use the Services and information Processed for security, fraud prevention, and legal compliance purposes, for which Maverick is an independent Controller.
Customer is responsible for obtaining all rights, permissions, consents, and lawful bases necessary for Customer’s use of the Services and Maverick’s Processing of Personal Data, and for ensuring that its instructions to Maverick comply with Applicable Data Protection Law.
Customer will not submit protected health information subject to HIPAA or other specially regulated information unless separately agreed in writing.
Persons authorized by Maverick to Process Personal Data will be subject to appropriate confidentiality obligations.
3. PROCESSING OF PERSONAL DATA
Maverick may Process Personal Data as necessary to provide, operate, maintain, support, secure, analyze, optimize, personalize, test, develop, and improve the Services; to perform analytics and generate insights for Customer; to prevent fraud, abuse, and security threats; to comply with applicable law; and to perform other activities reasonably related to providing the Services to Customer, provided that Maverick will not use Customer’s Personal Data to provide services to another customer.
Maverick will Process Personal Data in accordance with Customer’s documented instructions, which include the Agreement, this DPA, and Customer’s configuration and use of the Services. Maverick will inform Customer if it reasonably believes a Customer instruction violates Applicable Data Protection Law.
The categories of Personal Data processed through the Services may include names, email addresses, phone numbers, location information, customer identifiers, purchase information, marketing and engagement information, campaign activity, IP addresses, Customer-provided content, and inferences derived from such data. The categories of Data Subjects may include Customer’s customers, subscribers, and other individuals whose information is included in Customer Data.
Maverick will Process Personal Data for the duration of the Agreement, subject to the retention and deletion provisions in Section 10.
4. DE-IDENTIFIED AND AGGREGATED DATA
Maverick may create, derive, and use data that has been de-identified, aggregated, or otherwise processed so that it cannot reasonably be used to identify Customer or an individual. Maverick will take reasonable measures to ensure such data cannot be re-associated with Customer or an individual, will not attempt to re-identify it, and will contractually require any recipient of such data to do the same.
Maverick may use such data for any legitimate business purpose, including analyzing, developing, testing, securing, improving, and providing its products, services, software, artificial intelligence systems, models, algorithms, and related technologies.
5. SECURITY
Maverick will maintain reasonable administrative, technical, and organizational safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, including appropriate access controls, authentication measures, and encryption of Personal Data at rest and in transit over public networks.
6. PERSONAL DATA BREACHES
Maverick will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed by Maverick on Customer’s behalf.
To the extent reasonably available, Maverick will provide information reasonably necessary for Customer to comply with its obligations under Applicable Data Protection Law.
7. DATA SUBJECT REQUESTS
Maverick will provide reasonable assistance to Customer, taking into account the nature of the Processing, in responding to legally required Data Subject requests.
Where technically feasible, Maverick may provide functionality allowing Customer to access, correct, export, or delete Customer Data.
Maverick will provide reasonable assistance to Customer as required by Applicable Data Protection Law in connection with Customer’s obligations relating to security, Personal Data Breaches, data protection impact assessments, and regulatory consultations.
Customer will reimburse Maverick for reasonable costs incurred in providing assistance outside the ordinary functionality of the Services.
8. SUBPROCESSORS
Customer authorizes Maverick to engage third-party Subprocessors to Process Personal Data in connection with the Services. Maverick’s current Subprocessors will be provided upon request.
Maverick remains responsible for its Subprocessors’ performance of their applicable data protection obligations to the extent required by Applicable Data Protection Law. Maverick will enter into written agreements with its Subprocessors that include data protection obligations to the extent required by Applicable Data Protection Law.
If Customer requests in writing to receive notice of new Subprocessors, Maverick will notify Customer by email before the new Subprocessor begins Processing Personal Data, and Customer may object on reasonable and documented data protection grounds within fourteen (14) days of such notice. The Parties will work in good faith to address any reasonable objection.
9. INTERNATIONAL TRANSFERS
Customer acknowledges that Personal Data may be transferred to, stored in, or accessed from the United States and other countries in which Maverick or its Subprocessors operate.
10. RETURN AND DELETION
At Customer’s request following termination of the Services, Maverick will, at Customer’s choice, return or delete Customer Data within ninety (90) days, except to the extent retention is required by applicable law. Customer Data retained in backup systems will be deleted in accordance with Maverick’s normal backup retention cycle and will not be restored or otherwise processed except as required by law or for disaster recovery purposes.
11. AUDITS
Upon reasonable written request, Maverick will make available information reasonably necessary to demonstrate its compliance with this DPA.
Customer may conduct no more than one audit or security assessment per twelve-month period, except where required by a regulatory authority or following a reasonably suspected material Personal Data Breach. Maverick may satisfy an audit request by providing available security documentation. Customer will bear the costs of any audit, including Maverick’s reasonable costs of assisting.
12. CALIFORNIA PRIVACY LAW
To the extent Maverick acts as a “Service Provider” under the CCPA/CPRA, Maverick will:
(a) Process Customer Personal Information only for the business purposes specified in the Agreement and this DPA, and not for any other purpose, including any other commercial purpose, except as permitted by the CCPA/CPRA;
(b) not sell or share Customer Personal Information;
(c) not retain, use, or disclose Customer Personal Information outside the direct business relationship between Maverick and Customer;
(d) not combine Customer Personal Information with personal information Maverick receives from or on behalf of other persons, or collects from its own interactions with consumers, except as permitted by the CCPA/CPRA;
(e) comply with applicable obligations under the CCPA/CPRA and provide the same level of privacy protection as is required of businesses under the CCPA/CPRA;
(f) notify Customer if Maverick determines it can no longer meet its obligations under the CCPA/CPRA; and
(g) provide Customer with reasonable assistance necessary for Customer to comply with applicable CCPA/CPRA obligations, including responding to consumer requests.
Customer may take reasonable and appropriate steps, consistent with Section 11, to ensure Maverick uses Customer Personal Information consistently with Customer’s obligations under the CCPA/CPRA, and, upon notice, to stop and remediate any unauthorized use of Customer Personal Information.
13. LIABILITY
This DPA is subject to the Agreement’s limitations of liability, disclaimers, exclusions, indemnification provisions, governing law, and other applicable terms.
To the maximum extent permitted by law, Maverick’s aggregate liability arising out of or relating to this DPA or the Processing of Personal Data shall not exceed the limitation of liability applicable under the Agreement.
Nothing in this DPA creates a separate, uncapped, or enhanced liability obligation relating to privacy, data protection, security, regulatory fines, or Personal Data unless expressly agreed in a written amendment signed by Maverick.
14. ORDER OF PRECEDENCE
This DPA supplements the Agreement.
If there is a conflict between this DPA and the Agreement, this DPA will control solely with respect to the subject matter of data protection and only to the extent necessary to comply with Applicable Data Protection Law.
Nothing in this DPA increases Maverick’s liability beyond the limitations of liability expressly stated in the Agreement, except to the extent prohibited by Applicable Data Protection Law.
