Data Processing Addendum

Effective Date: 9/2/2026

Version: V.2

This Data Processing Addendum (“DPA”) sets forth the data processing terms under which AMR Ventures, LLC d/b/a SN3 Group (formerly Strategy Ninjas) (“Company,” “SN3 Group,” “we,” “us,” or “our”) Processes Personal Data on behalf of clients in connection with applicable Services.

This DPA applies to any client, customer, individual, company, or entity (“Client,” “you,” or “your”) that enters into, accepts, approves, signs, pays for, or otherwise authorizes a Statement of Work (“SOW”), proposal, order form, service agreement, change order, checkout, invoice, or other written or electronic authorization that references this DPA, the Master Services Agreement (“MSA”), or Services involving the Processing of Personal Data.

By signing, accepting, approving, checking an acknowledgement box, paying an invoice, or otherwise authorizing an applicable SOW or order that references this DPA or the MSA, Client agrees to be bound by this DPA without requiring a separate signature on this DPA.

This DPA forms part of and is incorporated into the MSA and any applicable SOW between Company and Client. Together, the MSA, applicable SOW, this DPA, and any incorporated exhibits or addenda are referred to as the “Agreement.”

1. Purpose and Scope

This DPA applies only to the extent Company Processes Personal Data on behalf of Client in connection with the Services and where applicable privacy laws require contractual terms governing such Processing.

This DPA does not apply to data that is not Personal Data, data that Company Processes as an independent Controller for its own business purposes, or data Processed by Third-Party Services outside Company’s control except as expressly stated in this DPA.

2. Definitions

For purposes of this DPA:

“Controller” means the entity that determines the purposes and means of Processing Personal Data.

“Processor” means the entity that Processes Personal Data on behalf of a Controller.

“Personal Data” means information relating to an identified or identifiable person that Company Processes on behalf of Client under the Agreement and that is subject to applicable privacy law.

“Process” or “Processing” means any operation performed on Personal Data, whether by automated means or not, including access, collection, use, storage, organization, adaptation, disclosure, transfer, deletion, or destruction.

“Subprocessor” means a third party engaged by Company to Process Personal Data on behalf of Client.

Except as otherwise defined in this DPA, capitalized terms have the meanings given in the MSA or applicable SOW.

3. Roles of the Parties

The Parties acknowledge and agree that, with respect to Personal Data Processed under this DPA, Client is the Controller or Business, as applicable, and Company is the Processor or Service Provider/Contractor, as applicable.

Company may act as an independent Controller for its own business operations, including billing, security, legal compliance, fraud prevention, service improvement using aggregated or de-identified data, and internal recordkeeping.

4. Processing Details

The subject matter, duration, nature, and purpose of the Processing, as well as the types of Personal Data and categories of data subjects, are described in the applicable SOW and this DPA.

4.1 Subject Matter

Company provides AI consulting, AI agent development, automations, integrations, implementation support, training, documentation, advisory services, and related Services.

4.2 Duration

Company will Process Personal Data for the duration of the Agreement and for such additional period as necessary to comply with legal obligations, enforce rights, maintain reasonable backups, or complete secure deletion in accordance with Company’s retention practices.

4.3 Nature and Purpose

Processing may include receiving, organizing, structuring, storing, accessing, transmitting, transforming, retrieving, using, and deleting Personal Data solely as necessary to perform the Services described in the applicable SOW and documented instructions from Client.

4.4 Categories of Data Subjects

Depending on the Services, data subjects may include Client personnel, contractors, customers, prospects, website visitors, leads, vendors, tenants, borrowers, applicants, or other individuals whose data Client provides or makes accessible.

4.5 Categories of Personal Data

Depending on the Services, Personal Data may include names, contact details, business identifiers, account information, CRM data, communication history, transactional data, support records, usage data, and similar categories described in the applicable SOW.

Unless expressly approved in writing or in an accepted SOW, Personal Data does not include Restricted Data prohibited under the Agreement.

5. Client Instructions

Company will Process Personal Data only on Client’s documented instructions, including as set forth in the Agreement, applicable SOW, Client’s use of the Services, and Client’s written or electronic instructions.

Client instructs Company to Process Personal Data as reasonably necessary to provide the Services, secure the Services, prevent fraud and abuse, troubleshoot issues, comply with law, and carry out other permitted activities expressly described in the Agreement.

Client is solely responsible for ensuring that its instructions comply with applicable law.

Company is not required to follow an instruction that Company reasonably believes is unlawful, infeasible, inconsistent with the Agreement, or creates a material security, legal, operational, regulatory, or technical risk.

6. Confidentiality

Company will ensure that persons authorized to Process Personal Data are subject to confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

7. Security Measures

Taking into account the nature of the Processing, the state of the art, implementation costs, and the nature, scope, context, and purposes of Processing, Company will implement commercially reasonable administrative, technical, and organizational measures designed to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, alteration, or disclosure.

Such measures may include, as appropriate:

• access controls and role-based permissions;
• password protection and multifactor authentication where reasonably available;
• encryption in transit where supported;
• secure credential handling practices;
• logging or monitoring appropriate to the Services;
• reasonable personnel security and training practices; and
• incident response procedures.

Client acknowledges that no security measure is perfect and that Company does not warrant absolute security.

Client further acknowledges that security is a shared responsibility and that Client remains responsible for Client-side identity management, access controls, credential rotation, device security, endpoint security, permission management, platform configuration, vendor selection, and monitoring of Client environments.

8. Subprocessors

Client authorizes Company to use Subprocessors in connection with the Services, including cloud providers, hosting providers, AI platform providers, infrastructure vendors, email providers, repositories, automation platforms, communication vendors, and support vendors.

Company will impose contractual obligations on Subprocessors that are materially protective of Personal Data in a manner appropriate to the nature of the services provided.

A current list of material Subprocessor categories may be provided upon written request.

If Client reasonably objects to a new Subprocessor based on documented privacy or security concerns, the Parties will work in good faith to determine a commercially reasonable solution.

If no commercially reasonable solution is available, either Party may terminate the affected Services on written notice.

9. Assistance With Data Subject Requests

Taking into account the nature of the Processing, Company will provide reasonable assistance to Client, at Client’s expense, in responding to requests from individuals seeking to exercise privacy rights, to the extent Client cannot reasonably fulfill such requests without Company’s assistance.

If Company receives such a request directly, Company may, unless prohibited by law, direct the requester to Client and may notify Client of the request.

10. Assistance With Compliance

Taking into account the nature of Processing and the information available to Company, Company will provide reasonable assistance to Client, at Client’s expense, with Client’s obligations relating to security assessments, breach notifications, impact assessments, and consultations with regulators where required by applicable law, in each case only to the extent such obligations are directly triggered by Company’s Processing of Personal Data under the Agreement.

Company is not responsible for Client’s independent legal, regulatory, privacy, employment, marketing, advertising, consumer protection, fair housing, lending, healthcare, financial, or sector-specific compliance obligations unless expressly agreed in an accepted SOW.

11. Security Incident Notification

If Company confirms a Security Incident affecting Personal Data in Company’s possession or control, Company will notify Client without unreasonable delay and provide information reasonably available to Company about the nature of the Security Incident and remediation steps taken or planned.

Company’s notification of or response to a Security Incident is not an admission of fault or liability.

For clarity, a Security Incident does not include events caused by or arising from Client systems, Client personnel, compromised Client credentials, Client-directed configurations, Third-Party Services, open internet transmission, or data not in Company’s possession or control.

12. Return or Deletion

Upon termination or expiration of the applicable Services, Company will, upon written request and subject to the Agreement, delete or return Personal Data in Company’s possession or control, unless retention is required by law, necessary to establish or defend legal claims, retained in routine backups, or technically impracticable to delete immediately.

Any retained Personal Data will remain protected under this DPA.

13. Audit and Information Rights

To the extent required by applicable law, Company will make available to Client reasonable information necessary to demonstrate Company’s compliance with this DPA.

Any audit rights must be exercised:

• no more than once annually;
• during normal business hours;
• with reasonable advance written notice;
• in a manner that minimizes disruption;
• in a manner that protects the confidentiality of other customers; and
• subject to appropriate confidentiality obligations.

If Company provides third-party audit reports, certifications, summaries, questionnaires, or similar information reasonably sufficient to demonstrate compliance, Client will use those materials in satisfaction of any audit request unless additional review is legally required.

Client will bear the costs of any audit it requests, unless the audit establishes a material breach of this DPA by Company.

14. Cross-Border Transfers

To the extent Personal Data subject to cross-border transfer restrictions is transferred by Company across national borders, the Parties will cooperate in good faith to implement a lawful transfer mechanism reasonably appropriate to the circumstances, which may include standard contractual clauses or another recognized mechanism where applicable.

15. CCPA / U.S. State Privacy Terms

To the extent Company Processes Personal Data subject to the California Consumer Privacy Act, as amended, or similar U.S. state privacy laws, Company will not:

• sell or share Personal Data provided by Client;
• retain, use, or disclose Personal Data for any purpose other than the limited and specified purposes set forth in the Agreement and this DPA, except as otherwise permitted by applicable law;
• retain, use, or disclose Personal Data outside the direct business relationship between the Parties, except as permitted by law; or
• combine Personal Data received from Client with Personal Data received from another source except as permitted by applicable law.

Company may use Personal Data for internal purposes permitted by law, including security, integrity, debugging, fraud prevention, quality assurance, and de-identification.

16. Third-Party Services and Shared Responsibility

Client acknowledges that the Services may involve Third-Party Services selected, approved, authorized, configured, or used by Client, and that such Third-Party Services may independently Process Personal Data under their own terms, privacy notices, data processing terms, and security practices.

Company is not responsible for the privacy, security, compliance, data retention, logging, model training, monitoring, or breach practices of Third-Party Services except to the extent Company independently fails to meet obligations expressly imposed on Company under this DPA.

Client is responsible for reviewing and accepting the terms, privacy policies, data processing terms, and security commitments of Third-Party Services used in connection with the Services.

17. Order of Precedence

If there is a conflict between this DPA and the MSA or applicable SOW, this DPA will control solely with respect to the Processing of Personal Data.

For all other matters, the applicable order of precedence in the MSA or SOW will apply.

18. Updates to this DPA

Company may update this DPA from time to time.

The version of this DPA referenced in the applicable SOW, proposal, order form, checkout, invoice, or other authorization will govern that engagement unless the Parties agree otherwise in writing.

19. Survival

This DPA survives for so long as Company retains Personal Data subject to this DPA.

20. Acceptance Through SOW or Electronic Authorization

This DPA does not require a separate signature to be enforceable where Client has accepted an SOW, proposal, order form, checkout, invoice, or other written or electronic authorization that references or incorporates this DPA, the MSA, or Services involving the Processing of Personal Data.

Client’s acceptance may occur by electronic signature, checkbox acknowledgement, written approval, payment, or other conduct indicating authorization to proceed.

The individual accepting an applicable SOW or order on behalf of Client represents and warrants that they have authority to bind Client to this DPA, the MSA, and the applicable SOW.

Company may require a separately signed version of this DPA for enterprise, regulated, high-risk, cross-border, or custom engagements at Company’s discretion.

End of Data Processing Addendum