Data Processing Agreement

Last Updated: November 1, 2026

USING THIS DPA

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at https://commonpaper.com/standards/data-processing-agreement/1.1/ ("DPA Standard Terms"), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be "none" or "not applicable" and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

KEY TERMS

The key legal terms of the DPA are as follows:

Agreement
This DPA supplements the Website Builder Studio Terms of Service between 1000x Digital LLC and Customer, as accepted by Customer and in effect from time to time (the "Agreement").

Approved Subprocessors
The list of Subprocessors available at https://app.websitebuilder.studio/subprocessors. On the Last Updated date of this DPA, that list is set out below.

Provider has data processing terms in place with each Subprocessor below, with the one exception stated at the end of this paragraph: Cloudflare (Customer DPA v6.4, incorporated into Cloudflare's Self-Serve Subscription Agreement), Stripe (Stripe DPA, incorporated into the Stripe Services Agreement), Anthropic (Data Processing Addendum, incorporated into Anthropic's Commercial Terms of Service), OpenAI (Data Processing Addendum, signed October 15, 2026), Resend (Data Processing Agreement, signed September 21, 2026) and Google (Google's data processing terms for the Google services Provider uses, except as stated next). Email sent to Provider's support address is held in a standard Google mailbox that is not yet covered by those terms; Provider is moving it to a business account.

1. Cloudflare, Inc.
Country of location: United States, and the other countries in which Cloudflare operates data centers.
Anticipated Processing task: hosting and running the Service; storing the Service's data (database, file storage and sign-in sessions); custom domains and DNS; content delivery; bot protection on Customer's forms (which receives the submitting visitor's IP address); speech-to-text for voice input (the audio is not stored); request logs; routing of email sent to Provider's addresses.

2. Anthropic, PBC
Country of location: United States.
Anticipated Processing task: the AI models that write and edit Customer's site content and power the AI assistant. Anthropic receives what Customer types to the assistant, files Customer uploads to the assistant, Customer's business information and site content, the rows of a connected Google Sheet and a summary of a connected HubSpot account's deals when the assistant reads them and, when Customer asks the assistant about its inquiries, the details of those inquiries.

3. OpenAI OpCo, LLC
Country of location: United States.
Anticipated Processing task: generating images for Customer's sites from text descriptions.

4. Plus Five Five, Inc. (Resend)
Country of location: United States.
Anticipated Processing task: sending email for the Service, including the notice to Customer of each new inquiry (which carries the inquirer's details), the automatic reply to the inquirer, and the follow-up emails to inquirers that Customer turns on.

5. Stripe, Inc.
Country of location: United States.
Anticipated Processing task: subscriptions and payments. Card details are entered on Stripe's own page and never reach Provider's systems.

6. Google LLC
Country of location: United States.
Anticipated Processing task: sign-in with Google, if Customer chooses it (Google receives the sign-in email address); the mailbox that receives support email sent to support@websitebuilder.studio (forwarded by Cloudflare Email Routing) and the copies of feature requests sent from within the Service, which carry the text of the request; and Google Cloud, when Customer connects a Google Sheet by sharing it with the platform's own service account (Google Sheets API, read-only: the platform reads the rows of the sheet Customer shared).

Services that Customer connects to the Service itself (such as a CRM, spreadsheet, email marketing tool, messaging tool, SMS through Customer's own account, or a webhook), and services that a site visitor's browser contacts directly (such as an embedded map or video, or an analytics tool Customer adds), are not Provider's Subprocessors. See clause H.

Provider Security Contact
hello@micrositegenerator.com (subject "Security report"), or by mail to 1000x Digital LLC, P.O. Box 700012, Plymouth, MI 48170-9998.

Security Policy
Provider will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering.

Service Provider Relationship
To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq ("CCPA") applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.
In addition, the Schedule (US State Privacy Laws) at the end of this Cover Page applies, and Part B of that Schedule applies automatically whenever the CCPA applies.

Restricted Transfers
Governing Member State
EEA Transfers: Ireland.
UK Transfers: the laws of England and Wales.

Annex I(A) List of Parties
Data Exporter
Name: Customer
Address: the address in Customer's account, or, if none, the address Customer provides on request.
Contact Person: the owner of Customer's account, at the email address on the account.
Activities relevant to transfer: See Annex I(B)
Role: Controller; or Processor, where Customer uses the Service on behalf of its own clients.
Data Importer
Name: 1000x Digital LLC (Website Builder Studio is a product of 1000x Digital LLC)
Address: P.O. Box 700012, Plymouth, MI 48170-9998, United States
Contact Person:
Name: Privacy Contact, 1000x Digital LLC
Position: Privacy Contact
Address: P.O. Box 700012, Plymouth, MI 48170-9998, United States; hello@micrositegenerator.com
Activities relevant to transfer: See Annex I(B)
Role: Processor

Annex I(B) Description of Transfer and Processing Activities
Service
Website Builder Studio: a platform for building, checking, publishing and hosting websites and microsites for a business, with an AI assistant, including receiving and storing the inquiries submitted through forms on Customer's sites.
Categories of Data Subjects
- Customer's end users or customers: members of the public who submit a form on a site Customer publishes with the Service.
- Customer's employees: the people Customer invites to use its account.
- Any other individual whose information Customer enters into the Service (in site content, uploaded files, notes, or messages to the AI assistant).
Categories of Personal Data
- Name
- Contact information such as email, phone number, or address
- User activity and analysis such as device information or IP address: the IP address of a person submitting a form is used for spam and rate-limit checks and kept for no more than 24 hours; it is not stored with the inquiry. Page views are counted in totals, without IP addresses or per-visitor data.
- Other: the content of the form fields Customer chooses (by default name, email, phone, the service asked about, details, a message, and a newsletter choice); Customer's notes about an inquiry and its status; text Customer writes to the AI assistant and the replies; files Customer uploads; voice input, which is transcribed and not stored.
Special Category Data
Is special category data Processed? No. Customer will not use the Service to collect it (see clause E).
Frequency of Transfer
Continuous.
Nature and Purpose of Processing
Provider will Process Customer Personal Data as instructed in Section 2.2 of the DPA Standard Terms. The nature of processing includes:
- Receiving data, including collection, accessing, retrieval, recording, and data entry
- Holding data, including storage, organization, and structuring
- Using data, including analysis and consultation (for example, showing Customer its inquiries, scoring them for Customer, and drafting replies for Customer to review and send). Provider makes no automated decisions with legal or similarly significant effects on individuals.
- Updating data, including correcting, adaptation, and alteration
- Protecting data, including restricting and encrypting
- Sharing data, including disclosure to Approved Subprocessors, and delivery to services Customer connects, at Customer's instruction
- Returning data to the data exporter (export of inquiries and, where available, of sites)
- Erasing data, including destruction and deletion (subject to clause D)
The business purposes are: providing, maintaining, securing and supporting the Service for Customer as described in the Agreement, including building, checking, publishing and hosting Customer's sites; receiving, storing, notifying Customer of and delivering inquiries; operating the AI assistant for Customer; sending the automatic reply to people who submit a form and the other emails Customer turns on; and detecting and preventing spam, abuse and security incidents.
Duration of Processing
Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws. See also clause D.

Annex I(C)
Competent Supervisory Authority
The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II Technical and Organizational Security Measures
Pseudonymization and encryption of personal data: data is encrypted in transit (HTTPS). Credentials for services Customer connects are additionally encrypted by the Service. Passwords are stored only as salted hashes (PBKDF2).
Protecting Customer Personal Data during storage (at rest): data is stored in Cloudflare's database and file storage, which encrypt data at rest.
Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services: every customer record carries its account identifier and every query is limited to the signed-in account; a permanent log, which cannot be edited or deleted, records account events.
Ability to restore the availability of and access to Customer Personal Data in a timely manner following a physical or technical incident: database point-in-time recovery for 30 days; a nightly copy of the database, restore-tested; a second copy of every uploaded file in a separate storage location. The nightly copy is stored on a company computer whose disk is encrypted with BitLocker and which is used only by Provider's authorized personnel. An encrypted copy of the database is also kept in a separate cloud storage location.
User identification and authorization process and protection: sign-in by password (stored only as a hash), by a one-time link emailed to the account's address, or with Google; sessions are held server-side; deleting an account requires the password or a code emailed to the account owner.
Personnel: access to Customer Personal Data is limited to the people who need it to provide, support and secure the Service, each of whom is bound by a duty of confidentiality (see clause L).
Physical security where Customer Personal Data is processed: the Service runs in Cloudflare's data centers, under Cloudflare's physical security controls.
Events logging: platform request logs and the permanent account event log.
Certification or assurance of processes and products: Provider holds no third-party certification. Its infrastructure provider, Cloudflare, maintains its own certifications.
Ensuring data minimization: forms collect only the fields Customer chooses; payment card details never reach Provider's systems.
Ensuring limited data retention: Customer can delete an inquiry, a site, its conversations with the AI assistant, or its whole account at any time (see clause D).
Allowing data portability and ensuring erasure: Customer can export its inquiries at any time; erasure as in clause D.
Ensuring accountability: Provider maintains a written incident response plan, the records described in Section 5.1 of the DPA Standard Terms, and a record of its Processing activities (see clause L).

ADDITIONAL TERMS (these modify and add to the DPA Standard Terms; under the paragraph "Using this DPA," they control)

A. US STATE PRIVACY LAWS. The Schedule (US State Privacy Laws) below applies.

B. SECURITY REPORTS (replaces Section 5.2 of the DPA Standard Terms). Provider does not currently hold an independent third-party audit report or certification. On written request, Provider will give Customer, on a confidential basis, a description of its security measures and, where the relevant Subprocessor permits, the then-current audit reports or certifications its infrastructure Subprocessors make available. References in the DPA Standard Terms to a "Report" mean these materials. Section 5.1 of the DPA Standard Terms is modified so that Customer may also exercise the assessment rights in Part A(6) of the Schedule, in the manner set out in clause M.

C. SECURITY INCIDENTS (adds to Section 4 of the DPA Standard Terms). For this DPA, "Security Incident" also includes any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, whether or not the GDPR applies. Provider's notice will go to the email address of Customer's account owner. To the extent known at the time, and updated as Provider learns more, the notice will describe: the nature of the Security Incident; the categories of Customer Personal Data and the categories and approximate number of individuals and records affected; its likely consequences; and the steps Provider has taken or proposes to take to contain it and reduce its effects. Where the affected individuals are people who submitted forms on Customer's sites, Customer, as controller, is responsible for any notice to those individuals, and Provider will give Customer the information it reasonably needs to give it. Provider will not name Customer in any public statement about a Security Incident without Customer's consent, unless the law requires it. An incident that is caused by Customer or its users (for example, through a compromised password), or that occurs in a service Customer connects under clause H, is not a Security Incident of Provider's; if Provider becomes aware of one, it will tell Customer promptly.

D. DELETION AND BACKUPS (adds to Section 7 of the DPA Standard Terms). Customer may delete an inquiry, a site, its conversations with the AI assistant, or its entire account at any time. When Customer deletes its account, Provider deletes the account, its sites, its inquiries, its conversations and its uploaded files from the Service at once (if a file cannot be erased at that moment, Provider finishes erasing it automatically within hours) and confirms by email. Provider keeps a permanent log of account events (such as sign-ups, payments and publishing), which contains no site content and no inquiry data. Provider also keeps the records described in Section 10 of its Privacy Policy. Provider keeps backup copies of the Service's data; they are kept secure and are used only to restore the Service after a failure. Data deleted from the Service may remain in backups made before the deletion, is not put back into use except to restore the Service after a failure, and remains subject to this DPA for as long as it is kept. Copies that Subprocessors hold in the ordinary course of providing their services (such as email delivery records and request logs) are deleted on those Subprocessors' own retention schedules. Nothing is deleted automatically when a subscription ends: Customer's inquiries, and its sites where the Agreement allows, remain available to Customer for download until Customer deletes the account.

E. NO SENSITIVE DATA. Customer will not use the Service to collect special category data or sensitive personal data (such as health information, financial account numbers, government identifiers, biometric data or precise geolocation), or personal data of children under 13. The Service is not designed to protect such data. Provider is not a "business associate" under the Health Insurance Portability and Accountability Act and does not enter into business associate agreements; Customer will not use the Service to collect or store protected health information.

F. SUBPROCESSOR CHANGES (modifies Section 2.6.1 of the DPA Standard Terms and, through Section 3.2, Clause 9 of the EEA SCCs). Provider will inform Customer at least 30 days in advance and in writing of any intended addition or replacement of a Subprocessor, by email to the account owner and by updating the list of Approved Subprocessors. In Clause 9 of the EEA SCCs, the minimum time period for prior notice of Subprocessor changes is 30 days. If Customer objects and the parties cannot resolve the objection in good faith, Customer may end the affected Service on notice, and Provider will refund any prepaid fees for the period after termination.

G. REQUESTS FROM INDIVIDUALS (adds to Section 6.1 of the DPA Standard Terms). Provider may tell an individual who contacts it that Provider Processes the data for Customer and has passed the request to Customer, and may direct the individual to Customer. Provider will pass the request to Customer without undue delay. Doing so is not a response to the request. Customer can view, export and delete the inquiries received through its sites, and delete its account, itself in the Service, and will use those tools first; Provider will help, as described in Section 6.1 of the DPA Standard Terms, where Customer cannot respond without Provider. Customer, as controller, is responsible for verifying the identity of the person making a request.

H. SERVICES CUSTOMER CONNECTS. When Customer connects another service (such as a CRM, spreadsheet, email marketing tool, messaging tool, SMS through Customer's own account, or a webhook), Customer Personal Data is sent there at Customer's instruction. Those services are not Provider's Subprocessors, and their processing is governed by Customer's own agreement with them. The sites Customer builds with the Service are public websites: anything Customer chooses to publish on them (for example, names or photos of staff or customers, or reviews) is available to anyone who visits, and Customer is responsible for having the right to publish it.

I. NO AI TRAINING. Provider does not use Customer Personal Data to train AI models, and its agreements with its AI Subprocessors do not permit them to do so. Provider does not include Customer Personal Data in any knowledge or other material that the Service makes available to other customers. Under their own terms, Provider's AI Subprocessors may keep the data they receive for a limited period to detect and prevent misuse of their services and to meet legal requirements, and then delete it.

J. WHERE DATA IS PROCESSED; TRANSFER FALLBACK. Provider is located in the United States and Processes Customer Personal Data in the United States, and its Subprocessors may Process it in the countries named in the list of Approved Subprocessors. Provider is not certified under the EU-US Data Privacy Framework. If a transfer of Customer Personal Data to Provider or by Provider to a Subprocessor relies on the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework, and that framework is invalidated, suspended or otherwise ceases to be a lawful basis for the transfer, then the EEA SCCs or the UK Addendum, as completed in Section 3 of the DPA Standard Terms and this Cover Page, apply to that transfer automatically from that moment, and Provider will ensure that its Subprocessors have an equivalent fallback in place. Provider will not make, and will not permit a Subprocessor to make, any onward transfer of Customer Personal Data received under the EEA SCCs or the UK Addendum unless the onward transfer complies with Applicable Data Protection Laws and those clauses.

K. PROVIDER'S OWN DATA.

(1) Account data. When Provider uses the contact, sign-in and billing details of Customer's account owner and users, and its records of its relationship with Customer, to manage and bill the account, to keep the Service secure and to meet its legal obligations, Provider acts as an independent controller under its Privacy Policy, not as Customer's processor. For any other Processing, those details remain Customer Personal Data under this DPA.
(2) Usage Data. Usage Data (as defined in the Agreement) is used as the Agreement permits. To the extent Usage Data contains Customer Personal Data, that data remains subject to this DPA. Provider discloses Usage Data to others only in aggregated form that does not identify Customer, its users or any individual. If Provider holds information derived from Customer Personal Data in de-identified form, Provider will take reasonable measures so that it cannot be linked to an individual, will not try to re-identify it, and will contractually require any recipient to do the same.
(3) Security across all sites. To protect the Service and every customer's sites from spam and abuse, Provider counts form submissions from each IP address across all sites on the Service for a short period (see Annex I(B)). Provider uses this only to detect and prevent spam, abuse and security incidents, which Applicable Data Protection Laws permit a processor or service provider to do, and for no other purpose.

L. PROVIDER'S ADDITIONAL COMMITMENTS.

(1) Provider will promptly tell Customer if, in Provider's opinion, an instruction from Customer infringes Applicable Data Protection Laws.
(2) Provider gives access to Customer Personal Data only to those of its personnel who need it to provide, support or secure the Service or to comply with the law, and ensures that each of them has committed to confidentiality or is under an appropriate statutory duty of confidentiality.
(3) Provider may update the security measures in Annex II as technology and the Service develop, but will not do so in a way that reduces the overall security of Customer Personal Data.
(4) Provider keeps a record of the Processing it carries out for its customers, as Applicable Data Protection Laws require of a processor.

M. HOW AUDITS AND ASSESSMENTS WORK (applies to Section 5 of the DPA Standard Terms, clause B and Parts A(6) and B(4) of the Schedule, except where Applicable Data Protection Laws or the EEA SCCs require otherwise). Customer will first ask, in writing to the Provider Security Contact, for the information and materials described in clause B and Section 5.3 of the DPA Standard Terms. If those are not enough to meet a legal requirement, Customer may carry out an assessment itself or through an independent assessor that is bound by confidentiality and is not a competitor of Provider, on at least 30 days' written notice, at a time and with a scope the parties agree in good faith, during business hours, remotely where possible, and not more than once in any 12 months, unless a Security Incident or a supervisory authority or other regulator requires another. Each party bears its own costs, and Customer pays its assessor. Everything Customer learns in an assessment is Provider's confidential information and may be used only to check compliance with this DPA and to meet Customer's legal obligations.

N. REQUESTS FROM GOVERNMENT AUTHORITIES (adds to Section 6.1 of the DPA Standard Terms). If a court, government, law-enforcement or regulatory authority asks Provider for Customer Personal Data, Provider will, unless the law forbids it: tell Customer promptly; tell the authority that Provider Processes the data for Customer; give the authority Customer's basic contact details and ask it to direct its request to Customer; and give Customer reasonable help, at Customer's expense, to seek a protective order or other remedy. Provider will not disclose Customer Personal Data to an authority voluntarily, without a valid and binding legal requirement; and, if it is required to disclose, it will disclose only the minimum the requirement demands.

O. CUSTOMER'S RESPONSIBILITIES FOR ITS SITES (adds to Section 2.5 of the DPA Standard Terms). Customer is the controller of the personal data collected through its sites and is responsible for:
(1) publishing its own privacy policy on each site and giving site visitors every notice the law requires (the Service publishes the privacy policy Customer provides; Provider does not write it);
(2) obtaining any consent the law requires, including for cookies, analytics and marketing tools Customer adds, and for the follow-up emails or other messages Customer turns on;
(3) the accuracy and lawfulness of the personal data it collects and of its instructions, and the settings it chooses in the Service (such as which form fields to collect, which services to connect and when to delete data); and
(4) not taking any action that would make its disclosure of Customer Personal Data to Provider a "sale" or "sharing" under a State Privacy Law, or that would prevent Provider from acting as its service provider or processor.

P. CHANGES TO THIS DPA. Provider may update this DPA in the same way, and with the same notice, as the Agreement allows Provider to update the Agreement: if a change materially affects Customer, Provider will email Customer's account owner at least 30 days before it takes effect. A change that Applicable Data Protection Laws or a supervisory authority require may take effect sooner, when the law requires. No change will reduce the protection this DPA gives to Customer Personal Data already Processed, unless the law requires it.

Q. NOTICES. Provider's notices under this DPA (including Security Incident and Subprocessor notices) go to the email address of Customer's account owner. Customer will keep that address current and able to receive Provider's email; a notice sent to it is given. Customer's notices to Provider go to hello@micrositegenerator.com or by mail to Privacy Contact, 1000x Digital LLC, P.O. Box 700012, Plymouth, MI 48170-9998.

SCHEDULE — US STATE PRIVACY LAWS

PART A. ALL STATES. This Part applies to the extent a US state consumer privacy law applies to the Processing of Customer Personal Data under this DPA, including the laws of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and, from the dates they take effect, the laws of Alabama, Louisiana, Oklahoma and Vermont, and any similar state law that takes effect later (each a "State Privacy Law"). Under each State Privacy Law, Provider is Customer's "processor" or "service provider" (or the equivalent term in that law), and Provider will:
(1) Process Customer Personal Data only on Customer's documented instructions (Section 2.2 of the DPA Standard Terms) and for the nature, purposes, types of data and duration described in Annex I(B);
(2) ensure that each person who Processes Customer Personal Data for Provider is subject to a duty of confidentiality with respect to that data;
(3) not sell or share Customer Personal Data, not use it for targeted advertising or cross-context behavioral advertising, and not combine it with personal data Provider receives from or on behalf of another person or collects from its own interactions with individuals, except as the applicable State Privacy Law permits a processor or service provider to do;
(4) provide the same level of privacy protection that the applicable State Privacy Law requires of Customer, and notify Customer if Provider determines that it can no longer meet its obligations under that law;
(5) make available to Customer, on reasonable request, all information in Provider's possession necessary to demonstrate Provider's compliance with this Schedule and the applicable State Privacy Law;
(6) allow, and cooperate with, reasonable assessments by Customer or Customer's designated assessor; or, at Provider's option and where the law allows, arrange for a qualified and independent assessor to assess Provider's policies and technical and organizational measures using an appropriate and accepted control standard or framework and assessment procedure, at least once a year where the applicable law requires it, and give Customer a report of that assessment on request;
(7) engage a Subprocessor only under a written contract that requires the Subprocessor to meet Provider's obligations under this DPA with respect to the Customer Personal Data, and only after notice and an opportunity to object under clause F; and keep a current list of its Subprocessors at the address in Approved Subprocessors;
(8) taking into account the nature of the Processing and the information available to Provider, assist Customer by appropriate technical and organizational measures, as far as reasonably practicable, in responding to consumer rights requests; in meeting Customer's obligations for the security of Processing and for notice of a breach of security; and in conducting and documenting data protection assessments; and
(9) at Customer's direction, delete or return all Customer Personal Data at the end of the provision of the Service, unless retention is required by law, and subject to clause D.
Customer may, on written notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data by Provider.

PART B. CALIFORNIA. Whenever the CCPA applies to the Processing of Customer Personal Data, this Part applies automatically, in addition to Part A and the Service Provider Relationship paragraph:
(1) Customer discloses Customer Personal Data to Provider only for the limited and specified business purposes stated in Annex I(B) under "Nature and Purpose of Processing";
(2) Provider will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose (including any commercial purpose) other than those business purposes, or as otherwise permitted by the CCPA and its regulations; will not retain, use or disclose it outside the direct business relationship between Provider and Customer; and will not combine it with personal information Provider receives from or on behalf of another person or collects from its own interaction with a consumer, except as the CCPA regulations permit;
(3) Provider will comply with the obligations that apply to it under the CCPA and will provide the same level of privacy protection as the CCPA requires of businesses;
(4) Customer may take reasonable and appropriate steps to ensure that Provider uses Customer Personal Data consistently with Customer's obligations under the CCPA, including by the assessments in Part A(6), which Customer may exercise at least once every 12 months;
(5) Provider will notify Customer if it determines that it can no longer meet its obligations under the CCPA, and Customer may then, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data;
(6) Provider will cooperate with Customer in responding to verifiable consumer requests and will act on Customer's instructions for those requests;
(7) Provider will notify Customer when it engages a Subprocessor to Process Customer Personal Data (clause F), and will bind each Subprocessor by a written contract containing the same obligations as this Part; and
(8) Provider certifies that it understands the restrictions in this Part and will comply with them.

Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above. Customer enters into this DPA by accepting the Agreement, and this DPA takes effect on the Agreement's Effective Date. On request to hello@micrositegenerator.com, Provider will provide a copy of this DPA for signature.

PROVIDER: 1000x Digital LLC
CUSTOMER: the Customer named in the Agreement

1000x Digital LLC, P.O. Box 700012, Plymouth, MI 48170-9998

Version 1.0