Data Processing Addendum

Last Updated: October 5, 2026

This Data Processing Addendum (this "Addendum") forms part of the Terms of Engagement (the "Agreement") between MMJI CHILLZ, LLC, a Delaware limited liability company, operating as Booking with Ava, together with its successors and permitted assigns ("Booking with Ava," "we," "us," or "our"), and the Venue that has accepted the Agreement ("Venue," "you," or "your"). This Addendum applies automatically when you accept the Agreement, and it applies for as long as Booking with Ava processes Venue Personal Data. Capitalized terms used but not defined in this Addendum have the meanings given in the Agreement.

1. DEFINITIONS

For the purposes of this Addendum:

"Applicable Data Protection Law" means all laws and regulations of the United States and its states that apply to the processing of personal information under the Agreement, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and its regulations (the "CCPA"), and the comprehensive consumer privacy laws of other states, in each case as amended or replaced from time to time.
"Controller" means a person that, alone or jointly with others, determines the purposes and means of processing personal information, and includes a "business" under the CCPA.
"Processor" means a person that processes personal information on behalf of a Controller, and includes a "service provider" under the CCPA.
"Personal Information" means any information that is "personal information," "personal data," or an equivalent term under Applicable Data Protection Law.
"Security Incident" means a breach of security leading to the unauthorized acquisition of, or access to, Venue Personal Data in Booking with Ava's possession or control that compromises its security, confidentiality, or integrity, or any equivalent term defined by Applicable Data Protection Law. Unsuccessful attempts and activities that do not compromise the security of Venue Personal Data, such as pings, port scans, and blocked log-in attempts, are not Security Incidents.
"Booking with Ava Controller Data" means Personal Information for which Booking with Ava is a Controller, including Host Data, information about Team Members and other users of the Services, information collected through Booking with Ava's own booking, sign-in, account, payment, marketplace, and website flows, and information about the use of the Services.
"Subprocessor" means a person that Booking with Ava engages to process Venue Personal Data on Booking with Ava's behalf.
"Venue Personal Data" means Personal Information that you, or a Third-Party Service acting on your instructions, enter, upload, import, sync, or otherwise provide to the Services, or that Booking with Ava processes on your behalf at your direction, in each case as a Processor under the Agreement, as further described in Annex 1. Venue Personal Data does not include Booking with Ava Controller Data, even where a copy of it is also included in your customer records.

The terms "business purpose," "commercial purpose," "consumer," "de-identified," "sell," and "share" have the meanings given to them in the CCPA.

2. ROLES OF THE PARTIES

2.1 Booking with Ava as an Independent Controller

Booking with Ava is an independent Controller of Booking with Ava Controller Data and processes it for its own purposes as described in its Privacy Policy. Booking with Ava's processing of Booking with Ava Controller Data is not subject to Sections 3 through 10 of this Addendum.

2.2 Venue as an Independent Controller of Host Data It Receives

When Booking with Ava makes Host Data available to you in connection with a Listing or a Booking, Booking with Ava discloses it to you as an independent Controller, and you receive it as an independent Controller. Each party is separately responsible for its own compliance with Applicable Data Protection Law for its own processing of Host Data. You must: (a) process Host Data in compliance with Applicable Data Protection Law and your own privacy notice; (b) honor requests that consumers make to you regarding your copy of Host Data; (c) honor any opt-out signal, suppression instruction, or deletion notice that Booking with Ava passes to you, to the extent Applicable Data Protection Law requires; and (d) not sell or share Host Data, or use it for targeted advertising, except as Applicable Data Protection Law permits.

2.3 Booking with Ava as a Processor of Venue Personal Data

With respect to Venue Personal Data, you are the Controller, and Booking with Ava is your Processor and service provider. Venue Personal Data may include, to the extent the Services offer the relevant features, customer and contact records that you create or import, notes you add to them, the recipients and content of messages that you send through the Services, data synced from Third-Party Services that you connect, and reports or events that you direct Booking with Ava to send to your advertising, analytics, or other accounts.

2.4 Your Responsibilities as Controller

You are responsible for the lawfulness of the collection of Venue Personal Data and of your instructions to Booking with Ava. You represent and warrant that: (a) you have provided all notices and obtained all consents, and have all rights and lawful bases, required by Applicable Data Protection Law and other Applicable Law for Booking with Ava to process Venue Personal Data as contemplated by the Agreement, including any consent required for the messages you send; (b) your instructions comply with Applicable Data Protection Law; and (c) you will not provide to the Services sensitive Personal Information, Personal Information of children under thirteen (13) years of age, payment card numbers, government identification numbers, or health information, except where a feature of the Services is expressly designed to receive it and Applicable Law permits it. You are responsible for responding to consumer requests relating to Venue Personal Data.

3. PROCESSING ON YOUR INSTRUCTIONS

3.1 Instructions

Except as permitted by Section 5 or required by Applicable Law, Booking with Ava will process Venue Personal Data on your documented instructions. The Agreement, this Addendum, your configuration and use of the features of the Services, and any instructions you give through the Venue Tools are your complete documented instructions. Any additional instruction requires Booking with Ava's written agreement and may be subject to additional fees. The nature and purpose of the processing, the types of Personal Information, the categories of individuals, and the duration of the processing are described in Annex 1. Your acceptance of the Agreement is also your instruction to Booking with Ava to process Venue Personal Data for the purposes described in Section 5.

3.2 Unlawful Instructions

Booking with Ava may notify you if it determines that an instruction infringes Applicable Data Protection Law, and may decline to follow that instruction. Booking with Ava has no obligation to monitor or assess the lawfulness of your instructions.

4. CCPA SERVICE PROVIDER TERMS

4.1 Business Purposes

You disclose Venue Personal Data to Booking with Ava for the following limited and specified business purposes: providing, maintaining, supporting, securing, and operating the Services for you as described in the Agreement and Annex 1, including storing and organizing your customer records, enabling you to send messages and manage Bookings, honoring opt-out and do-not-contact requests across the Services, and the other purposes permitted under Section 5 (together, the "Business Purposes").

4.2 Restrictions

To the extent the CCPA applies, and except as otherwise permitted by the CCPA and its regulations, Booking with Ava:

will not sell or share Venue Personal Data;
will not retain, use, or disclose Venue Personal Data for any purpose, including any commercial purpose, other than the Business Purposes, or outside the direct business relationship between you and Booking with Ava;
will not combine Venue Personal Data with Personal Information that Booking with Ava receives from or on behalf of another person, or collects from its own interactions with a consumer, except as permitted by the CCPA and its regulations;
will comply with the obligations that apply to it as a service provider under the CCPA and provide the level of privacy protection that the CCPA requires; and
will notify you if it determines that it can no longer meet its obligations under the CCPA.

4.3 Your Rights

You may take reasonable and appropriate steps, as described in Section 9, to help ensure that Booking with Ava uses Venue Personal Data in a manner consistent with your obligations under the CCPA. On notice, you may take reasonable and appropriate steps to stop and remediate any unauthorized use of Venue Personal Data by Booking with Ava.

4.4 Certification

Booking with Ava certifies that it understands the restrictions in this Section 4 and will comply with them.

5. PERMITTED USES RESERVED TO BOOKING WITH AVA

You agree that Booking with Ava may also retain, use, and disclose Venue Personal Data, to the extent permitted by Applicable Data Protection Law, for the following purposes, each of which is a Business Purpose:

to engage Subprocessors as described in Section 6;
to build, develop, and improve the quality of the Services, including through analytics, testing, and the training and improvement of models and features, provided that Booking with Ava does not use Venue Personal Data to perform services on behalf of another person or to build or modify a profile of a consumer for use in providing services to another person;
to detect, prevent, investigate, and respond to security incidents, fraud, abuse, spam, and malicious, deceptive, or illegal activity, and to enforce the Agreement and the Acceptable Use Policy;
to comply with Applicable Law, legal process, court orders, and requests from government authorities, and to establish, exercise, or defend legal claims;
to maintain platform-wide records of opt-out and do-not-contact requests, consisting of the contact identifier, its opt-out status, and related details of the request, and to use those records across the Services to comply with Applicable Law and carrier requirements and to help prevent messages that may be unlawful, including where a consumer has opted out of messages sent through the Services;
to create de-identified or aggregated information, as Applicable Data Protection Law defines those terms, and to use and disclose that information for any lawful purpose; and
for the other purposes specified in California Code of Regulations, title 11, section 7050(a), and in the corresponding provisions of other Applicable Data Protection Law that permit a Processor to retain, use, or disclose Personal Information.

6. SUBPROCESSORS

6.1 General Authorization

You give Booking with Ava a general authorization to engage Subprocessors, including Booking with Ava's affiliates and the categories of service providers described in Annex 1. Booking with Ava will make information about its Subprocessors available to you on request or through the Services.

6.2 Subprocessor Contracts

Booking with Ava will engage each Subprocessor under a written contract that requires the Subprocessor to meet obligations regarding Venue Personal Data that are consistent with those that Applicable Data Protection Law requires of Booking with Ava as a Processor. Booking with Ava remains responsible to you for the performance of its Subprocessors' obligations, subject to the limitations in the Agreement.

6.3 New Subprocessors and Objections

Booking with Ava will give you notice of a new or replacement Subprocessor where Applicable Data Protection Law requires it, by updating its Subprocessor information, by email, through the Venue Tools, or by other reasonable means. You may object to the change on reasonable grounds relating to data protection by notifying Booking with Ava in writing within the period stated in the notice, or, if none is stated, promptly. If you object, Booking with Ava may, in its discretion, propose a reasonable alternative. If Booking with Ava does not do so, your sole and exclusive remedy is to stop using the features of the Services that involve the Subprocessor or to terminate the Agreement.

7. CONFIDENTIALITY AND SECURITY

7.1 Personnel

Booking with Ava will require the persons it authorizes to process Venue Personal Data to be subject to a duty of confidentiality with respect to it.

7.2 Security Measures

Booking with Ava will use administrative, technical, and organizational measures designed to protect Venue Personal Data, appropriate to the nature of the Venue Personal Data and the risks of the processing. Booking with Ava may update these measures from time to time. You are responsible for your own security, including the security of your accounts, credentials, and devices, your configuration of the Services, and your Team Members' access.

7.3 Security Incidents

Booking with Ava will notify you of a Security Incident within the time and to the extent required by Applicable Data Protection Law. Booking with Ava will provide information about the Security Incident that is reasonably available to it and that you reasonably need to meet your own notification obligations, and may provide that information in stages as it becomes available. Booking with Ava's notification of, or response to, a Security Incident is not an acknowledgment of fault or liability. Unless Applicable Law requires otherwise, you are responsible for notifying affected individuals, regulators, and other persons about a Security Incident involving Venue Personal Data, and Booking with Ava may notify them where it determines that Applicable Law requires it to do so.

8. ASSISTANCE

8.1 Consumer Requests

Taking into account the nature of the processing, Booking with Ava will provide reasonable assistance, through appropriate technical and organizational measures and insofar as possible, to help you respond to requests from consumers to exercise their rights under Applicable Data Protection Law regarding Venue Personal Data. Booking with Ava may provide this assistance by making self-service features available in the Venue Tools. If Booking with Ava receives a request from a consumer that identifies you, Booking with Ava may refer the consumer to you, and may respond to the request itself to the extent it relates to Booking with Ava Controller Data. You will inform Booking with Ava of any consumer request made under Applicable Data Protection Law regarding Venue Personal Data that Booking with Ava must comply with, and provide the information necessary for Booking with Ava to comply with it, and Booking with Ava will comply with the request to the extent Applicable Data Protection Law requires of a service provider or Processor.

8.2 Assessments and Other Assistance

Booking with Ava will provide information reasonably available to it that you reasonably need to conduct data protection assessments that Applicable Data Protection Law requires of you regarding Booking with Ava's processing of Venue Personal Data, and will provide other assistance that Applicable Data Protection Law requires a Processor to provide.

8.3 Costs

Booking with Ava may charge you reasonable fees for assistance that goes beyond the self-service features of the Services, to the extent Applicable Data Protection Law permits.

9. AUDITS AND COMPLIANCE INFORMATION

9.1 Compliance Information

On your reasonable written request, Booking with Ava will make available to you information in its possession or control that is reasonably necessary to demonstrate its compliance with its obligations under Applicable Data Protection Law and this Addendum, including written responses to reasonable security and privacy questionnaires.

9.2 Assessments

Where Applicable Data Protection Law requires Booking with Ava to allow and cooperate with assessments, Booking with Ava will do so by providing the information described in Section 9.1 or, at Booking with Ava's option, a report of an assessment conducted by a qualified and independent assessor of Booking with Ava's choosing using an appropriate and accepted control standard or framework. Any other assessment that Applicable Data Protection Law requires must be conducted on reasonable advance written notice, during normal business hours, no more than once in any twelve-month period unless required following a Security Incident or by a regulator, in a manner that does not unreasonably interfere with Booking with Ava's operations or compromise the security or confidentiality of other customers' data, by an assessor bound by confidentiality obligations acceptable to Booking with Ava, and at your expense.

9.3 Unauthorized Use

If you reasonably believe that Booking with Ava is using Venue Personal Data in a manner not permitted by this Addendum, you may notify Booking with Ava in writing with reasonable detail, and you may take reasonable and appropriate steps to stop and remediate the unauthorized use, including by instructing Booking with Ava to stop the specified use while Booking with Ava reviews the notice, or by deleting or ceasing to provide the affected Venue Personal Data. If Booking with Ava determines that the use is not permitted, it will take reasonable steps to stop and remediate it.

10. RETURN AND DELETION

10.1 During the Agreement

During the term of the Agreement, you may export or delete Venue Personal Data using the features of the Venue Tools, to the extent those features are available, or by contacting Booking with Ava.

10.2 After the Agreement Ends

After the Agreement ends, at your written direction, Booking with Ava will delete or return Venue Personal Data, unless retention is required by Applicable Law. Booking with Ava may retain Venue Personal Data in backups and archives until it is deleted or overwritten in the ordinary course, and may retain Venue Personal Data to the extent it is needed for a purpose described in Section 5, in each case subject to this Addendum for as long as it is retained. If you do not give a direction, Booking with Ava may delete Venue Personal Data after the Agreement ends in accordance with its retention practices.

10.3 Booking with Ava Controller Data

This Section 10 does not apply to Booking with Ava Controller Data, which Booking with Ava retains as described in its Privacy Policy, even where a copy of it is also included in your customer records.

11. INTERNATIONAL PROCESSING

Venue Personal Data may be processed in the United States and in other countries where Booking with Ava, its affiliates, and its Subprocessors operate. You authorize these transfers, and you are responsible for any notice or consent that Applicable Law requires for them.

12. GENERAL

12.1 Liability

Booking with Ava's liability arising out of or relating to this Addendum is subject to the exclusions and limitations of liability in the Agreement, to the extent permitted by Applicable Data Protection Law, and counts toward, and is not in addition to, the aggregate limit on Booking with Ava's liability under the Agreement. Nothing in this Addendum limits your liability. Your indemnification obligations in the Agreement apply to claims arising out of your breach of this Addendum, your instructions, and your processing of Host Data and Venue Personal Data.

12.2 Order of Precedence

If this Addendum conflicts with the Agreement regarding the processing of Venue Personal Data, this Addendum controls to the extent of the conflict. In all other respects, the Agreement controls.

12.3 Changes in Law

Booking with Ava may modify this Addendum as described in the Agreement, including to address changes in Applicable Data Protection Law, guidance, or the Services. If Applicable Data Protection Law requires additional contract terms for the processing of Venue Personal Data, the parties agree that those terms are incorporated into this Addendum to the minimum extent required.

12.4 Assignment and Successors

This Addendum follows the Agreement. If Booking with Ava assigns or transfers the Agreement as described in the Agreement, including to an affiliate or a successor to the business that operates the Services, Booking with Ava may assign or transfer this Addendum, and transfer Venue Personal Data and Booking with Ava Controller Data, to the assignee or successor without your consent, and you will be bound to the assignee or successor on the terms of this Addendum.

12.5 Term

This Addendum remains in effect for as long as Booking with Ava processes Venue Personal Data, and the provisions that by their nature should survive will survive its end.

ANNEX 1: DETAILS OF PROCESSING

Subject Matter and Duration

The subject matter of the processing is Booking with Ava's provision of the Services to you under the Agreement. The processing continues for the term of the Agreement and any later period described in Section 10.

Nature and Purpose of Processing

Booking with Ava may collect, record, organize, structure, store, adapt, retrieve, consult, use, combine as permitted in Section 4, analyze, transmit, disclose at your direction, restrict, erase, and otherwise process Venue Personal Data to:

host, store, organize, display, and allow you to search, segment, edit, export, and delete your customer and contact records;
enable you to create, schedule, send, and track emails, text messages, and other communications, and to process replies, delivery information, and opt-out requests;
enable you to create and manage Bookings and Quotes, and to record notes and related information;
exchange data with Third-Party Services that you connect, and send reports, events, or other data to accounts or destinations that you designate;
provide support, maintain, secure, and operate the Services; and
carry out the purposes described in Section 5.

Categories of Individuals

Individuals whose Personal Information you provide to the Services or that Booking with Ava processes on your behalf, which may include your customers and prospective customers, Hosts and guests whose details you enter, recipients of your messages, contacts in lists you import or sync, and your business contacts.

Types of Personal Information

The Personal Information you choose to provide or direct Booking with Ava to process, which may include names, email addresses, phone numbers, postal addresses, company and job information, event and booking details, purchase and visit history, communication preferences and consent records, message content and delivery and engagement information, notes, custom fields, identifiers from connected Third-Party Services, and online identifiers.

Sensitive Personal Information

Not intended to be processed. See Section 2.4.

Categories of Subprocessors

Booking with Ava may engage Subprocessors in the following categories: hosting, database, and storage providers; email and text-message delivery providers and wireless carriers; payment processors; analytics, monitoring, and error-reporting providers; customer support and relationship management providers; security, fraud-prevention, and bot-detection providers; content-safety and artificial intelligence providers; mapping and location providers; and Booking with Ava's affiliates that provide personnel, systems, or services to support the Services.