Data Processing Agreement

Version 1.0 — July 2026

This Data Processing Agreement (“DPA”) forms part of the ApexPoster Terms of Service (the “Agreement”) between Apex Technology Group, Inc. (“Apex,” “Processor”) and the customer that accepted them (“Customer,” “Controller”). It governs Apex's processing of Personal Data on Customer's behalf in connection with the ApexPoster services (the “Services”).

This DPA applies automatically where Customer is subject to the GDPR, the UK GDPR, the Swiss FADP, the CCPA as amended, or a comparable data protection law. Customer may also request a countersigned copy by emailing support@apexposter.net. Where this DPA conflicts with the Agreement, this DPA controls as to the processing of Personal Data.

1. Definitions

• Personal Data: any information relating to an identified or identifiable natural person that Apex processes on Customer's behalf under the Agreement.
• Customer Personal Data: Personal Data contained within Customer Content or within Customer's account configuration — for example a photograph of an identifiable employee in a playlist, a name on a welcome board, or the email address of an Authorized User.
• Processing, Controller, Processor, Data Subject, Supervisory Authority: as defined in the GDPR, and given equivalent meaning under other applicable law.
• Subprocessor: a third party engaged by Apex to process Customer Personal Data.
• Data Protection Laws: all laws applicable to the processing of Personal Data under this DPA, including the GDPR, the UK GDPR, the Swiss FADP, and US state privacy laws including the CCPA as amended by the CPRA.
• Standard Contractual Clauses (“SCCs”): the clauses annexed to European Commission Implementing Decision (EU) 2021/914, as amended or replaced.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• Terms not defined here have the meaning given in the Agreement.

2. Roles of the Parties

Customer is the Controller and Apex is the Processor with respect to Customer Personal Data. Customer determines the purposes and means of processing; Apex processes only as described in this DPA and on Customer's documented instructions.

Apex acts as an independent Controller for a limited set of data that it determines the purposes of itself — account registration and identity, billing and tax records, security and abuse-prevention logs, support correspondence, and aggregate service metrics. That processing is governed by the ApexPoster Privacy Policy, not by this DPA.

Under the CCPA, Apex is a “service provider.” Apex does not sell or share Personal Data, does not retain, use, or disclose it for any purpose other than performing the Services specified in the Agreement, and does not combine it with Personal Data received from other sources except as permitted for a service provider. Apex certifies that it understands and will comply with these restrictions.

3. Customer's Responsibilities

Customer is responsible for, and warrants that:

• It has a lawful basis for the Personal Data it uploads to, configures in, or displays through the Services, and has given any notices and obtained any consents that basis requires;
• Its instructions to Apex, and its use of the Services, comply with Data Protection Laws;
• The Personal Data it provides is accurate and that it has the right to disclose it to Apex;
• It has assessed whether displaying particular Personal Data on a publicly visible screen is appropriate and lawful in its context; and
• It manages access within its own account — assigning, reviewing, and revoking Authorized Users, and protecting credentials and pairing codes.

Prohibited categories. Customer must not upload to the Services any payment card data, government identification numbers, financial account numbers, health or medical records, biometric identifiers, or precise geolocation of individuals. The Services are not designed or assessed for these categories, and Apex has no obligation or liability with respect to them.

4. Apex's Processing Obligations

Apex will:

• Process Customer Personal Data only on Customer's documented instructions, including as to international transfers, unless required to do otherwise by law — in which case Apex will inform Customer before processing, unless that law prohibits it on important grounds of public interest. The Agreement, this DPA, and Customer's use of the Services constitute Customer's complete documented instructions;
• Immediately inform Customer if, in Apex's opinion, an instruction infringes Data Protection Laws;
• Ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate training;
• Limit internal access to Customer Personal Data to personnel who need it to provide, secure, or support the Services;
• Not sell Customer Personal Data, use it for advertising, or use it to train machine learning models; and
• Implement and maintain the security measures described in Annex II.

5. Subprocessors

Customer provides general authorization for Apex to engage Subprocessors. The Subprocessors engaged as of the version date of this DPA are listed in Annex III.

Apex will impose on each Subprocessor, by written contract, data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for its Subprocessors' performance.

Apex will give Customer at least thirty (30) days' notice before engaging a new Subprocessor that processes Customer Personal Data, by email to the account's notification address. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the terminated portion of the subscription term, as its sole and exclusive remedy.

6. Security

Apex will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. The measures in place as of the version date of this DPA are described in Annex II.

Apex may update those measures over time, provided it does not materially decrease the overall level of security.

7. Personal Data Breach

Apex will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will describe, to the extent known: the nature of the breach and the categories and approximate number of Data Subjects and records affected; the likely consequences; and the measures taken or proposed to address it and mitigate its effects. Where the information is not all available at once, Apex will provide it in phases as it is obtained.

Apex will provide reasonable assistance to Customer in meeting Customer's own notification obligations to Supervisory Authorities and Data Subjects. Apex's notification is not an acknowledgment of fault or liability.

8. Assistance to Customer

Taking into account the nature of the processing, Apex will:

• Provide the functionality within the Services that allows Customer to access, correct, export, and delete Customer Personal Data itself, which is the primary means by which Customer will satisfy Data Subject requests;
• Provide reasonable additional assistance, at Customer's expense where the effort is substantial, in responding to Data Subject requests that Customer cannot fulfil through that functionality;
• Promptly forward to Customer any request Apex receives directly from a Data Subject relating to Customer Personal Data, without responding to it substantively other than to direct the Data Subject to Customer; and
• Provide reasonable assistance with data protection impact assessments and prior consultations with Supervisory Authorities, taking into account the information available to Apex.

9. Audit

Apex will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, and will respond to reasonable written security questionnaires no more than once in any twelve-month period.

Where Data Protection Laws require an on-site audit and the information provided is not sufficient, Customer may audit Apex's compliance, subject to: reasonable prior written notice of at least thirty (30) days; no more than once in any twelve-month period, except where required by a Supervisory Authority or following a Personal Data Breach; conduct during business hours without unreasonable disruption; the auditor being bound by confidentiality and not being a competitor of Apex; scope limited to systems and records relevant to Customer Personal Data and excluding other customers' data; and Customer bearing its own and Apex's reasonable costs.

10. International Transfers

Apex processes Customer Personal Data in the United States. Customer authorizes this transfer.

Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (Controller to Processor) applies, with Customer as data exporter and Apex as data importer.
• Clause 7 (docking clause) applies.
• In Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 5 of this DPA.
• In Clause 11, the optional independent dispute resolution language does not apply.
• In Clause 17, the SCCs are governed by the law of Ireland.
• In Clause 18(b), disputes will be resolved before the courts of Ireland.
• Annexes I, II, and III to this DPA populate Annexes I, II, and III to the SCCs.

For UK transfers, the UK Addendum applies to the SCCs, with Tables 1 to 3 populated by the Annexes to this DPA, and Table 4 specifying that neither party may terminate under Section 19 of the Addendum. For Swiss transfers, references to the GDPR are read as references to the FADP, the competent authority is the Swiss Federal Data Protection and Information Commissioner, and “member state” is read to include Switzerland.

11. Deletion and Return

Customer may access, export, and delete Customer Personal Data throughout the term of the Agreement using the functionality of the Services.

On termination or expiry of the Agreement, Apex will delete Customer Personal Data within thirty (30) days, except to the extent it is required to retain it by law. Where Apex retains data under that exception, this DPA continues to apply to it. Backups are overwritten on a rolling basis in the ordinary course. Content already cached on Customer's own devices is outside Apex's control and is Customer's responsibility to remove.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits a Data Subject's rights under Data Protection Laws or either party's liability to a Supervisory Authority.

13. Term and General

This DPA takes effect when Customer accepts the Agreement and continues until Apex has ceased all processing of Customer Personal Data. Provisions that by their nature should survive will survive.

Apex may update this DPA where required by a change in Data Protection Laws, in a Supervisory Authority decision, or in the SCCs themselves, and will give Customer reasonable notice of any material change. Except as stated in Section 2, and other than as to the processing of Personal Data, the Agreement remains unchanged and in full force.

Annex I — Details of Processing

A. List of Parties

Data exporter (Controller): the Customer identified in the ApexPoster account, at the contact details held on that account. Its activities relevant to the transfer are its use of a digital signage service to display content on screens it operates.

Data importer (Processor): Apex Technology Group, Inc., a Delaware corporation. Contact: support@apexposter.net. Its activities relevant to the transfer are the provision of the ApexPoster hosted digital signage service.

B. Description of Transfer

C. Competent Supervisory Authority

The supervisory authority of the EEA member state in which the data exporter is established, or where the exporter is not established in the EEA, the authority of the member state in which its EU representative is established or in which the relevant Data Subjects are located.

Annex II — Technical and Organizational Measures

Annex III — Subprocessors

This list is current as of the version date above. Changes are notified in accordance with Section 5.