Data Processing Agreement

This DPA forms part of the agreement between Solid Digital, LLC (“Solid Digital”) and the Customer identified in the Order. It applies to personal data Solid Digital processes on Customer's behalf through sites.soliddigital.com (“Customer Personal Data”). It becomes binding through acceptance of the agreement incorporating it or signature below. Applicable Data Protection Law means privacy, data-security, and data-protection law applicable to the particular processing, including applicable U.S. state laws and, only when applicable, the GDPR and UK GDPR.

01

Roles and Scope

Customer is the controller/business, or a processor/service provider acting for an identified End Client controller. Solid Digital is respectively Customer's processor/service provider or subprocessor. Customer must have authority to appoint Solid Digital and provide the controller's lawful instructions. Actual activities determine legal roles. Account billing, contracting contacts, and processing independently required by law may involve Solid Digital acting in its own role, as explained in an accurate Privacy Notice. Such processing must remain narrowly separated from Customer's recipient data and does not authorize independent advertising, sale, sharing, or repurposing of that data.

02

Documented Instructions

Solid Digital will process Customer Personal Data only to deliver, secure, support, and wind down the contracted Service, as described in this DPA, the Order, and authenticated instructions consistent with them. It will not sell or share the data, use it for cross-context behavioral advertising, build independent marketing audiences, or train general-purpose AI models on it. Solid Digital will promptly inform Customer if it believes an instruction violates applicable law and may pause that instruction while the parties resolve it. If law requires processing outside instructions, Solid Digital will notify Customer before processing unless legally prohibited.

03

Customer Obligations

Customer determines lawful purposes, supplies accurate and minimized data, gives required notices, obtains required permissions, handles its legal obligations, and provides valid instructions. It must restrict recipients to the U.S. eligibility standard in the Email AUP, preserve permission and country evidence, and not submit prohibited data. Geographic restrictions do not override laws that otherwise apply. Customer will identify its controller contact and relevant jurisdictional obligations before processing. Solid Digital remains responsible for obligations directly applicable to it.

04

Confidentiality and Security

Solid Digital will restrict access to authorized personnel subject to confidentiality obligations and implement appropriate technical and organizational safeguards proportionate to the processing risks. Schedule B specifies the agreed measures. Solid Digital will regularly assess those measures and will not materially reduce the overall protection during the term. Schedule B is a description of measures, not a certification of any compliance standard.

05

Subprocessors

Customer grants general written authorization for subprocessors identified in completed Schedule C. Solid Digital will provide at least 30 days' advance written notice of additions or replacements involving Customer Personal Data. Customer may object within 15 days on reasonable data-protection grounds. The parties will seek a reasonable alternative; if none is available, Customer may terminate the affected service before the change takes effect and receive unused prepaid fees. Solid Digital will not expose the objecting Customer's data to the proposed provider while the objection remains unresolved. An emergency replacement needed to protect the Service requires as much prior notice as practicable and prompt explanation, while preserving a reasonable objection and exit opportunity.

Solid Digital will bind each subprocessor to written data-protection obligations appropriate to its activities and no less protective in substance than applicable obligations here. Solid Digital remains responsible for its subprocessors' performance of those obligations. Customer's approval does not excuse an unlawful transfer or inadequate safeguards.

06

Rights Requests and Assistance

Taking account of the nature of processing and available information, Solid Digital will reasonably assist Customer with access, correction, deletion, portability, opt-out, and other applicable rights requests; security obligations; breach notifications; impact assessments; and prior regulatory consultation. Solid Digital will forward requests concerning Customer's data without undue delay and will not respond substantively except on Customer's instructions or as law requires. Customer remains the decision maker for controller requests. Standard assistance is included; extraordinary assistance may be charged only at rates agreed in advance and not to remedy Solid Digital's own breach.

07

Personal Data Incidents

A Personal Data Incident is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Solid Digital will notify Customer without undue delay after becoming aware of an incident and, as an agreed contractual target, within 48 hours of awareness. A shorter legal deadline prevails. Notice will not wait for completion of the investigation. Solid Digital will provide available information about affected data and persons, likely consequences, containment and corrective measures, and a response contact, and supplement it as information becomes available. It will preserve relevant evidence, mitigate harm, and reasonably assist Customer's notifications. Notification does not itself admit liability. Solid Digital will not notify affected individuals on Customer's behalf without instruction unless legally required, in which case it will inform Customer where permitted.

08

Audits and Demonstrating Compliance

Solid Digital will make information reasonably necessary to demonstrate compliance available to Customer. Reviews should begin with relevant policies, questionnaires, and available independent reports. Where insufficient or required by law, Customer or a qualified independent auditor may conduct a proportionate audit or inspection on reasonable notice, subject to confidentiality and safeguards for other customers' data. Normally this occurs once annually during business hours; incidents, material concerns, and regulator requirements permit additional or expedited review. Solid Digital will not use confidentiality or a report-only process to defeat statutory audit rights. Each party bears its ordinary costs; Solid Digital bears reasonable corrective-review costs arising from its material breach.

09

Return, Deletion, and Suppression

At termination, Customer may elect return or deletion of Customer Personal Data. During the Terms' 30-day export period, Solid Digital will provide available data in a commonly usable format. It will delete remaining active copies within 30 days after that period and expire backup copies within 90 further days, unless law requires retention. Backups pending expiry will be isolated from ordinary use; restoration will reapply deletion and suppression instructions. During the term, the Service applies these retention rules: addresses that never confirm their subscription are deleted 30 days after the confirmation message; a subscriber erased at the Customer's request is deleted with their consent record; suppression (unsubscribe, bounce, complaint) is kept as a one-way hash of the email address, not as a readable list, so a suppressed address is never mailed again. Unsubscribed subscribers' records and delivery events are kept for the term of the account, so a person who unsubscribed is never added back, and are then returned or deleted under this Section.

Minimum suppression data may be retained only on documented instructions, including an expressly agreed post-termination suppression service with a defined retention period, or to satisfy a specific legal obligation. Solid Digital must not retain full lists indefinitely by labeling them suppression records. The basis, fields, period, and access restrictions for any exception must be documented and communicated to Customer. Legally retained data will be restricted to the required purpose and deleted when that basis ends. Upon request Solid Digital will confirm completion, identifying lawful exceptions. Customer should export suppression records before moving to a replacement sender.

10

U.S. State Privacy Terms

Where Solid Digital acts as a service provider or contractor under the CCPA, it will comply with applicable CCPA obligations and provide the same level of privacy protection required by that law. The specific business purposes are the email and related service operations in Schedule A. Solid Digital will not sell or share Customer Personal Data; retain, use, or disclose it outside those specific purposes or the direct business relationship; or combine it with data from other customers or its own interactions, except as specifically permitted by the CCPA and its regulations. It certifies that it understands and will comply with these restrictions.

Customer may take reasonable and appropriate steps to verify compliant use and to stop and remediate unauthorized use. Solid Digital will notify Customer if it determines it can no longer meet applicable obligations. It will provide required request assistance and impose applicable restrictions on downstream providers. Comparable purpose limits, confidentiality, assistance, deletion, and oversight requirements apply under other applicable state processor laws. The parties will supplement this DPA where a mandatory state requirement is not otherwise met.

11

International Processing and Transfers

The contracted email audience is U.S.-only. This restriction is not a finding that the GDPR, UK GDPR, or another non-U.S. law is inapplicable; Customer's establishment, data sources, and actual activities may independently trigger obligations. Customer must disclose such circumstances before processing. Where applicable, Solid Digital will meet mandatory processor duties, including processing on instructions, confidentiality, safeguards, assistance, subprocessor controls, audit cooperation, and return or deletion.

No restricted international transfer may begin until a valid mechanism is documented. Depending on the facts, this may require executed EU standard contractual clauses with the correct controller-to-processor or processor-to-processor module, completed annexes, transfer assessment, supplementary measures, and a UK addendum or other applicable instrument. This paragraph does not itself execute those instruments or establish adequacy. Schedule C must accurately identify processing and remote-access locations; a U.S. AWS region does not establish exclusive U.S. processing, support access, or recipient-server location. If no lawful mechanism is available, the affected processing must stop.

12

General

The agreement's fees, confidentiality, liability, and dispute provisions apply subject to mandatory law. Nothing here limits individual rights, regulator powers, or obligations under executed mandatory transfer clauses. This DPA controls personal-data conflicts, subject to mandatory transfer clauses. Its protections continue while Solid Digital or its subprocessors retain Customer Personal Data. Material changes require agreement and must not weaken mandatory protections.

Schedule A — Processing Details

Subject: Hosting and operating authorized website-connected and managed email workflows through sites.soliddigital.com.

Duration: Contract term, export period, and limited deletion/retention periods in Section 9.

Nature: Collection, import, validation, organization, storage, transmission, delivery-event recording, authorized reporting, suppression, support, export, and deletion.

Purpose: Send approved transactional and permission-based marketing email for Customer or identified End Clients; operate preferences and abuse prevention; provide related contracted support.

Data subjects: Client employees and authorized users; prospects, subscribers, customers, and website users eligible under the U.S. recipient policy.

Data fields: Names, email addresses, optional phone numbers and SMS consent records (stored for future use; no SMS is sent), tags and custom fields, business/contact details, country and its basis (self-declared, customer address or import mapping) with the importer's evidence statement, consent source/time/disclosure text/page/IP address, confirmation and unsubscribe timestamps, message content and approved personalization, delivery/bounce/complaint events, subscription status, hashed suppression entries, necessary IP/device/security logs, and per-recipient click events only if the Client turned click tracking on. Open tracking is not used.

Excluded by default: Payment-card numbers, government identifiers, passwords in message bodies, health records, biometric identifiers, precise location, special-category data, and data knowingly relating to children under 13. Separate signed terms and security review are required before any exception; this DPA is not a HIPAA business associate agreement.

Frequency: As specified by approved campaigns and workflows.

Controller / Customer privacy contact: as stated in the Order or, absent one, the account owner.

Solid Digital privacy / incident contact: privacy@soliddigital.com.

End Client controllers, if Customer is an agency: each End Client's site and its authorized approvers as recorded in the Service.

Schedule B — Minimum Security Commitments

Solid Digital maintains at least the following measures.

Implemented in the Service:

Solid Digital provides its current control details on reasonable request under Section 8.

• Least-privilege access, individual administrator accounts, MFA for privileged and cloud access, access logging, periodic review, and prompt revocation.
• Client isolation in application authorization and storage access; scoped credentials; secrets held outside source code; controlled production access and changes.
• Encryption for web/API transport and stored databases/backups using appropriate managed controls. For email transport, document opportunistic versus required TLS and failure behavior; do not promise end-to-end encryption or guaranteed encrypted delivery.
• Domain-ownership verification, SPF/DKIM/DMARC configuration, guarded sending routes, quotas, and monitored delivery feedback.
• Tested unsubscribe and suppression enforcement on every sending path, including imports, queued jobs, retries, and automations.
• Input validation, rate limits, bot/abuse controls for public forms, dependency and vulnerability management, and risk-based patching.
• Security and sending-event logs with restricted access and documented retention; avoid unnecessary full message bodies and secrets in logs.
• Documented incident response, backups and restoration tests, deletion processes, personnel confidentiality, and periodic security training.
• U.S.-recipient eligibility validation at import, signup, and send time using recorded evidence, with unknown/non-U.S. records blocked.
• Each Client sends only from a domain it verified (DKIM and custom MAIL FROM via Amazon SES); a monitoring-only DMARC record is requested when the domain has none (Gmail and Yahoo require DMARC for bulk senders).
• Each Client is a separate Amazon SES tenant, so reputation, automatic pauses and suppression are tracked per Client; a dedicated IAM credential limited to SES in us-east-1 is used; secrets are held in AWS Secrets Manager, not in source code.
• Confirmed opt-in, U.S. eligibility and suppression are enforced at signup, import and immediately before each send, including queued sends.
• Unsubscribe, confirmation and click links are signed (HMAC) and cannot be forged; the pages require a deliberate button press so link scanners cannot act on them.
• Delivery, bounce and complaint events arrive through Amazon SNS with verified signatures; bounces and complaints are suppressed automatically.
• Public signup forms are protected by spam scoring, rate limits and edge form tokens; confirmation messages are rate-limited per address and per Client.
• Message bodies are not logged; events keep only the event type and minimal metadata.
• Per-campaign approval of the exact version by the Client's approver, first-campaign review by Solid Digital, plan allowances, daily ramp-up for new domains, automatic pauses and a platform-wide stop switch.

Schedule C — Subprocessor Register

1. Amazon Web Services, Inc.

Services: Amazon SES (email transmission, per-Client tenants, delivery processing); Amazon SNS (delivery, bounce and complaint notifications); Amazon Lightsail (application servers and the PostgreSQL database holding subscriber, consent and campaign records); AWS Secrets Manager (credentials; no Customer Personal Data).

Data: Recipient addresses, names, consent and country records, sender identities, message content, delivery and complaint information, and related metadata.

AWS region: us-east-1 (N. Virginia, United States). AWS may access data from other locations to provide support, under the AWS Data Processing Addendum.

2. Cloudflare, Inc.

Service: Hosting and edge delivery of Customer websites (Workers, R2, KV), including the signup forms through which subscribers and their consent are submitted.

Data: Form submissions in transit (email, name, country, consent text, IP address) and website request logs. Locations: Cloudflare's global edge network, under Cloudflare's Data Processing Addendum.

3. MailerSend (MailerLite group)

Service: Solid Digital's own service notifications to Customer users (campaign approval requests, alerts). Not used to send to Customer's recipients.

Data: Customer users' names and email addresses; notification content, which can include a subscriber's or commenter's name and message.

4. AI model providers through Solid Digital's AI gateway (llm.soliddigital.com): Anthropic, PBC; OpenAI; Google LLC

Service: AI drafting of campaign content and other AI features at the Customer's request.

Data: Website content and business facts. Recipient lists and subscriber records are not sent to AI providers for email features. These providers are used under their paid API terms, which do not permit training their models on the data sent.

No other provider has access to Customer Personal Data processed for email. Stripe processes Customer's own billing details in Solid Digital's own role.

For each: legal entity, service purpose, data involved, processing/access locations, and applicable safeguards.

Customer-directed integrations and independent recipient mailbox providers must be separately mapped; do not describe every external recipient system as Solid Digital's subprocessor.

Subprocessor notice mechanism and register URL: this Schedule, published at sites.live/data-processing-agreement; changes are notified by email to account owners under Section 5.

This DPA is accepted electronically together with the Terms of Service. A countersigned copy is available on request from privacy@soliddigital.com.