Roles

• Client: Data Controller

• House of Webs: Data Processor

Client retains sole responsibility for determining lawful purposes and means of processing.

Processing Scope

We process data only as instructed by Client and solely to provide contracted services.

Client warrants it has all required consents and legal authority.

Sub-Processors

Client authorizes use of third-party sub-processors, including but not limited to:

• CRM platforms

• Hosting providers

• Messaging and telecom providers

We are not liable for sub-processors acts or omissions beyond applicable law.

Security

We implement commercially reasonable measures.

No specific security outcome is guaranteed.

Data Subject Requests

Client is solely responsible for responding to data subject requests.

We may assist at Client’s expense.

Liability Limitation

To the maximum extent permitted by law, our total liability under this DPA is limited to fees paid

in the prior 3 months.