TollBit Data Processing Addendum

Last Updated October 29, 2025

This Data Processing Addendum (“DPA”) amends and forms part of the written agreement between Customer and TollBit (“TollBit”) (collectively, “the parties”) for the provision of services to Customer (the “Agreement”). This DPA prevails over any conflicting term of the Agreement but does not otherwise modify the Agreement.

  1. Definitions

    1. In this DPA:

      1. “Controller”, “Data Subject”, “Processing” (related terms such as “Process” and “Processed” shall have corresponding meanings), “Processor”, “Service Provider”, “Supervisory Authority”, and “Third Party” have the meaning given to them in Data Protection Law (as defined below);
      2. “Data Protection Law” means the General Data Protection Regulation (EU) 2016/679 ("GDPR") and all other Data Protection Laws of the European Union, the European Economic Area (“EEA”), and their respective Member States, Switzerland and the United Kingdom (“UK”); (ii) certain U.S. federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (California Civil Code § 1798.100) (“CCPA”); and (iii) all laws implementing or supplementing the foregoing;
      3. “Data Subject Rights” means all rights granted to Data Subjects by Data Protection Law, such as the right to information, access, rectification, erasure, restriction, portability, objection, and not to be subject to automated individual decision-making;
      4. “Restricted Data Transfer” means any international transfer of Personal Data that would be prohibited under Data Protection Law in the EEA or UK without implementation of additional safeguards such as Standard Contractual Clauses.
      5. “Personnel” means any natural person acting under the authority of TollBit;
      6. “Personal Data” means any information that constitutes “personal data” or “personal information” within the meaning of applicable Data Protection Law that TollBit Processes on behalf of Customer in performing the Services under the Agreement.
      7. “Personal Data Breach” means the unauthorized destruction, loss, control, alteration, disclosure of, or access to, Personal Data for which TollBit is responsible, to the extent that the incident constitutes a reportable “data breach”, “personal data breach”, “breach of the security of the system”, or other similar term as defined under Data Protection Law. Personal Data Breaches do not include unsuccessful access attempts or attacks that do not compromise the confidentiality, integrity, or availability of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
      8. “Sell” means to sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Personal Data to a Third Party for monetary or other valuable consideration.
      9. “Sensitive Data” means any type of Personal Data that is designated as a sensitive or special category of Personal Data, or otherwise subject to additional restrictions under Data Protection Law or other laws to which the Controller is subject;
      10. “Services” means the services and/or products to be provided by TollBit to Customer under the Agreement. The Services shall also include any required, usual, appropriate or acceptable methods to perform activities necessary to provide the Services, including (a) carrying out the Services or the business of which the Services are a part, (b) carrying out any benefits, rights and obligations related to the Services, (c) maintaining records relating to the Services, and (d) complying with any legal or self-regulatory obligations related to the Services;
      11. “Share” means to share, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Personal Data to Third Parties for targeted advertising to an individual based on Personal Data obtained from the individual’s activity across non-affiliated or distinctly-branded websites, applications, or services;
      12. “Subprocessor” means a Processor engaged by a Processor to carry out Processing on behalf of a Controller;
      13. “Standard Contractual Clauses” means (i) the Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”), and (ii) where the UK GDPR applies, the EU SCCs as supplemented by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Commissioner under S119A(1) Data Protection Act 2018 (the “UK SCCs”).

    2. Capitalized terms used but not defined herein have the meaning given to them in the Agreement.

  2. Scope and Roles
    1. This DPA applies only to the extent that TollBit Processes Personal Data that is subject to applicable Data Protection Law in the course of providing the Services pursuant to the Agreement.
    2. If Data Protection Law applies to the Processing of Personal Data, the parties agree that TollBit shall Process Personal Data only as a Processor acting on behalf of Customer and, with respect to CCPA and other applicable U.S. state privacy laws, as a Service Provider, in each case, regardless of whether Customer acts as a Controller or as a Processor on behalf of a third-party Controller with respect to Personal Data.
    3. The subject matter, nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects are set out in Annex I, which is an integral part of this DPA.
  3. Instructions
    1. TollBit will only Process Personal Data to provide the Services to Customer.
    2. It is the parties’ intent that TollBit is a Service Provider, and TollBit certifies that it will not (a) Sell or Share Personal Data; (b) Process Personal Data outside the direct business relationship between the parties or for any purpose other than to provide the Services in accordance with the Agreement, unless required or authorized by Data Protection Law; or (c) combine the Personal Data that TollBit receives from or on behalf of Customer with personal data that TollBit collects or receives from another person.
    3. Customer’s instructions are documented in Annex I, the Agreement, and any applicable statement of work.
    4. Customer may issue additional instructions to TollBit as it deems necessary to comply with Data Protection Law. Such instructions must be provided to TollBit in writing and acknowledged in writing by TollBit as constituting instructions for purposes of this DPA, and TollBit may charge a reasonable fee to comply with any such additional instructions.
    5. The parties acknowledge and agree that the disclosure of Personal Data by the Customer to TollBit does not form part of any monetary or other valuable consideration exchanged between the parties.
  4. Customer Responsibilities

    5.1 Customer shall (i) provide all notices and obtain all consents, permissions and rights necessary under applicable Data Protection Law for TollBit to lawfully Process Personal Data for the purposes contemplated by the Agreement; (ii) make appropriate use of the Services to ensure a level of security appropriate to the particular content of the Personal Data; (iii) comply with all Data Protection Law applicable to the collection of Personal Data and the transfer of such Personal Data to TollBit and its Subprocessors; and (iv) ensure its Processing instructions comply with applicable laws (including applicable Data Protection Law).

  5. Personnel and Subprocessing
    1. TollBit will require all Personnel authorized to Process Personal Data agree to maintain the confidentiality of the data.
    2. Customer authorizes TollBit to engage and disclose Personal Data to the Subprocessors identified in Annex III (“Subprocessor List”); and Subprocessors engaged in accordance with Section 5.3.
    3. If TollBit engages any additional Subprocessor not already identified on the Subprocessor List, TollBit will notify Customer of the proposed engagement of the Subprocessor giving Customer the opportunity to object. If Customer does not make a reasonable objection to the proposed engagement within 30 days of TollBit providing notice to Customer under this Section 5.3, Customer is deemed to have authorized the engagement of such Subprocessor. If Customer objects prior to the appointment of such Subprocessor, TollBit will work with Customer in good faith to resolve the issue. If an alternative solution cannot be found, Customer and TollBit may agree to terminate the impacted Services, and the Customer shall pay TollBit any fees due for the Services performed prior to termination.
    4. TollBit will enter into a written agreement with all Subprocessors which imposes substantially similar obligations on the Subprocessors as this DPA imposes on TollBit. TollBit will remain fully liable to the Customer for the performance of each Subprocessor’s data protection obligations relating to this DPA in the event the Subprocessor fails to fulfil those obligations.
    5. To the extent required by law, TollBit will provide a copy of TollBit’s agreements with Subprocessors to Customer upon request. TollBit may redact commercially sensitive information before providing such agreements to Customer.
  6. Restricted Data Transfers
    1. In the event that the Personal Data Processed under the DPA is subject to Data Protection Law and the transfer of Personal Data to TollBit would be restricted in the absence of the Standard Contractual Clauses, the parties agree that the Standard Contractual Clauses shall be incorporated into this DPA with Customer as the “data exporter” and TollBit as the “data importer.”
    2. The EU SCCs are completed as follows: the optional docking clause in Clause 7 is implemented; Clause 9(a) option 2 is implemented and the time period therein is specified as thirty (30) days; the optional redress clause in Clause 11(a) is struck; the governing law in Clause 17 is the law of Ireland; the court in Clause 18(b) are the courts of Ireland; and Annex 1, 2 and 3 to the EU SCCs are the appendices of this DPA. To the extent required by Data Protection Law in the UK, Part 1, tables 1, 2 and 3 of the UK SCCs will be deemed to be completed like its equivalent provisions in the EU SCCs. For the purpose of Part 1, Table 4, either party may end the UK SCCs in accordance with Section 19 of the UK SCCs.
  7. Security and Personal Data Breaches
    1. TollBit will implement and maintain technical and organizational measures in relation to the Processing of Personal Data designed to provide a level of security appropriate to the risks which may occur as a result of Processing Personal Data, and in particular the risks of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, including the measures listed in Annex II (as appropriate).
    2. TollBit will inform Customer without undue delay and no later than 48 hours after becoming aware of a Personal Data Breach, and will provide Customer with details of the Personal Data Breach and reasonable assistance in remediating and mitigating the effects of the Personal Data Breach.
    3. TollBit’s notification of or response to a Personal Data Breach under Section 7.2 will not be construed as an acknowledgement by TollBit of any fault or liability with respect to the Personal Data Breach.
    4. In the event of a Personal Data Breach, Customer is solely responsible for determining whether Data Protection Law requires the notification of affected individuals, regulators and other parties of the Personal Data Breach.

  8. Assistance

    1. TollBit will reasonably assist Customer, including by implementing appropriate technical and organizational measures, with the fulfilment of Customer’s own obligations under Data Protection Law, including:

      1. complying with Data Subjects’ requests to exercise Data Subject Rights;
      2. replying to inquiries or complaints from Data Subjects;
      3. replying to investigations and inquiries from Supervisory Authorities;
      4. conducting data protection impact assessments, and prior consultations with Supervisory Authorities; and
      5. providing notifications to affected individuals, regulators and other parties in connection with Personal Data Breaches.

    2. Unless prohibited by Data Protection Law, TollBit will inform Customer as soon as reasonably practicable if TollBit:

      1. receives a request, complaint or other inquiry regarding the Processing of Personal Data from a Data Subject or Supervisory Authority;
      2. receives a binding or non-binding request to disclose Personal Data from law enforcement, courts or any government body;
      3. is subject to a legal obligation that requires TollBit to Process Personal Data in contravention of Customer’s instructions; or
      4. is otherwise unable to comply with Data Protection Law or this DPA.

    3. Unless prohibited by Data Protection Law, TollBit will obtain Customer’s written authorization before responding to, or complying with any requests, orders, or legal obligations referred to in Section 8.2.

  9. Accountability

    1. Customer has the right, upon notice, to take reasonable and appropriate steps to stop and remediate TollBit’s unauthorized use of Personal Data.
    2. TollBit will inform Customer without undue delay if TollBit believes that a written instruction by Customer pursuant to this DPA, violates Data Protection Law, in which case TollBit may suspend the Processing until Customer has modified or confirmed the lawfulness of the instructions in writing.

  10. Audit

    1. Upon Customer’s prior written request, and no more than once annually, TollBit will make available to Customer the required information reasonably necessary to demonstrate compliance with the obligations of Data Protection Law and this DPA. TollBit shall provide additional information as reasonably necessary to allow for and contribute to audits, including inspections, conducted by a Supervisory Authority, Customer or another auditor mandated by law.
    2. If a third party is to conduct a Customer-requested audit, TollBit may object to the auditor if the auditor is, in TollBit’s reasonable opinion, not suitably qualified or independent, a competitor of TollBit or otherwise manifestly unsuitable. Such objection by TollBit will require Customer to appoint another auditor or conduct the audit itself.
    3. The audit must be conducted during regular business hours at the applicable facility, subject to an audit plan agreed to between the parties at least two weeks in advance and may not unreasonably interfere with TollBit’s business activities.
    4. If Customer’s requested audit scope is addressed in an SSAE 16/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer’s audit request and TollBit confirms there are no known material changes in the controls audited, Customer agrees to accept those findings in lieu of requesting an audit of the controls covered by the report.
    5. Any Customer-requested audits are at Customer’s expense. Customer shall reimburse TollBit for any time expended by TollBit or its Subprocessors in connection with any Customer-requested audits or inspections at TollBit’s then-current professional services rates, which shall be made available to Customer upon request.
    6. Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this DPA. The audit reports are confidential information of the parties under the terms of the Agreement.
  11. Liability
    1. The total combined liability of either party and its affiliates towards the other party and its affiliates, whether in contract, tort or any other theory of liability, under or in connection with Agreement and this DPA combined, will be limited to limitations on liability or other liability caps agreed to by the parties in the Agreement.
  12. Analytics

    12.1 Customer acknowledges and agrees that TollBit may create and derive from Processing related to the Services anonymized and/or aggregated data that does not identify Customer or any natural person, and use, publicize or share with third parties such data to improve TollBit’s products and services and for its other legitimate business purposes.

  13. Notifications
    1. TollBit will make all notifications required under this DPA as agreed to in the Agreement.
  14. Term and Duration of Processing
    1. On expiration or termination of the Agreement, or upon written request from Customer at any time, TollBit will, as soon as reasonably practicable, return or securely delete and destroy all Personal Data in TollBit’s possession or control, except as otherwise required by law or set out in the Agreement. Upon request from Customer, TollBit will certify such secure deletion in writing within thirty (30) days of Customer’s request.
  15. Modification of this DPA
    1. This DPA may only be modified by a written amendment signed by both Customer and TollBit.
  16. Invalidity and Severability
    1. If any provision of this DPA is found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, then the invalidity or unenforceability of such provision does not affect any other provision of this DPA and all provisions not affected by such invalidity or unenforceability will remain in full force and effect.

ANNEX I

A. LIST OF PARTIES

Customer is the Controller and the data exporter and TollBit is the Processor and the data importer.

B. DESCRIPTION OF TRANSFER

Subject MatterTollBit’s provision of services to Customer.Duration of the ProcessingFor the term of the Agreement and as required under applicable law.Nature and Purpose of the ProcessingTollBit will Process Personal Data for the purposes of providing the Services to Customer in accordance with the DPA.Frequency of the ProcessingContinuous.Categories of DataAny Personal Data available on Customer’s website that is featured in Customer’s editorial content (such as name or email address); IP addresses of Customer’s website visitors, which TollBit Processes to detect hidden bot scraping; and any Personal Data provided by Customer about Customer’s employees and authorized users.Sensitive Data ProcessedThe Services are not intended to Process Sensitive Data unless otherwise agreed to between the parties.Data SubjectsIndividuals featured in Customer’s editorial content, Customer’s website visitors, and Customer’s employees and authorized users.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority is the Irish Data Protection Commission.

ANNEX II

TollBit shall implement and maintain the controls listed in this Annex II in accordance with industry standards generally accepted by information security professionals as necessary to reasonably protect Personal Data during storage, processing and transmission.

Physical access control

Technical and organizational measures to prevent unauthorized persons from gaining access to the data processing systems available in premises and facilities (including databases, application servers and related hardware), where Personal Data is Processed, include: (a) establishing security areas, restriction of access paths; (b) establishing access authorizations for employees and third parties; (c) access control system (ID reader, magnetic card, chip card); (d) key management, card-keys procedures; (e) door locking (electric door openers etc.); (f) security staff, janitors; (g) surveillance facilities, video/CCTV monitor, alarm system; and (h) securing decentralized data processing equipment and personal computers.

Virtual access control

Technical and organizational measures to prevent data processing systems from being used by unauthorized persons include: (a) user identification and authentication procedures; (b) ID/password security procedures (special characters, minimum length, change of password); (c) automatic blocking (e.g. password or timeout); (d) monitoring of break-in-attempts and automatic turn-off of the user ID upon several erroneous passwords attempts; (e) creation of one master record per user, user-master data procedures per data Processing environment; and (f) encryption of archived data media.

Data access control

Technical and organizational measures to ensure that persons entitled to use a data processing system gain access only to such Personal Data in accordance with their access rights, and that Personal Data cannot be read, copied, modified or deleted without authorization, include: (a) internal policies and procedures; (b) control authorization schemes; (c) differentiated access rights (profiles, roles, transactions and objects); (d) monitoring and logging of accesses; (e) disciplinary action against employees who access Personal Data without authorization; (f) reports of access; (g) access procedure; (h) change procedure; (i) deletion procedure; and (j) encryption.

Disclosure control

Technical and organizational measures to ensure that Personal Data cannot be read, copied, modified or deleted without authorization during electronic transmission, transport or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities Personal Data are disclosed, include: (a) encryption/tunneling; (b) dynamic data masking; (c) logging; and (d) transport security.

Entry control

Technical and organizational measures to monitor whether Personal Data has been entered, changed or removed (deleted), and by whom, from data processing systems, include: (a) logging and reporting systems; and (b) audit trails and documentation.

Availability control

Technical and organizational measures to ensure that Personal Data are protected against accidental destruction or loss (physical/logical) include: (a) backup procedures; (b) mirroring of hard disks (e.g. RAID technology); (c) uninterruptible power supply (UPS); (d) remote storage; (e) antivirus/firewall systems; and (f) disaster recovery plan.

Separation control

Technical and organizational measures to ensure that Personal Data collected for different purposes can be processed separately include: (a) separation of databases; (b) “internal client” concept / limitation of use; (c) segregation of functions (production/testing); and (d) procedures for storage, amendment, deletion, transmission of data for different purposes.

ANNEX III

List of Subprocessors

Customer authorizes TollBit to engage the following Subprocessors:

Subprocessor Company NameSubprocessor Location(Description of Processing activities carried out by Subprocessor)AWSUnited StatesCloud providerGoogle CloudUnited StatesAnalyticsClerkUnited StatesUser Authentication