Data Processing Addendum

Effective October 31, 2026. Part of the Terms of Service between the subscribing business (“Customer”) and Markivia Digital LLC (“Markivia”).

1. Roles

For personal information about the Customer’s own customers, prospects and contacts that reaches Markivia (“Customer Data”), the Customer is the business that decides the purposes of processing, and Markivia is its service provider or processor. For account information about the Customer’s team members, Markivia acts as described in the Privacy Policy.

2. What Markivia processes and why

Names, contact details, messages and notes from inquiries received through the Customer’s website, connected platforms and advertising, together with follow-up records. Markivia processes Customer Data only to provide the service described in the Terms and as the Customer instructs through Markivia, and for no other purpose. Markivia does not sell Customer Data, does not share it for cross-context behavioural advertising, and does not combine it with data from other customers.

3. Customer responsibilities

The Customer is responsible for having a lawful basis to collect Customer Data, for the privacy notice shown on its website and forms, for responding to its customers’ requests, and for the instructions it gives Markivia.

4. Confidentiality and security

Markivia limits access to Customer Data to staff who need it, binds them to confidentiality, and applies the measures in the Privacy Policy: encryption in transit and of credentials at rest, hashed passwords, two-factor sign-in for administrators, tenant isolation enforced on the server, audit logs, and tested backups.

5. Sub-processors

Markivia uses the following sub-processors and will notify the Customer at least 14 days before adding one, giving the Customer the right to object:

• Vercel Inc. (hosting), Neon Inc. (database), and the object storage provider named in the Customer’s workspace settings, for storing and serving the service, United States.
• Stripe, Inc. (payments), United States.
• Resend (transactional email), United States.
• OpenAI, L.L.C. (AI drafting from approved brand information only; Customer Data is not sent), United States.
• Meta Platforms, Inc. and Google LLC, only for data the Customer chooses to publish to or receive from those platforms.

6. Assistance

Markivia will help the Customer respond to requests from individuals to access, correct or delete their data, and will forward any such request it receives directly. Markivia will notify the Customer without undue delay after becoming aware of a breach affecting Customer Data.

7. Deletion and return

The Customer can export Customer Data from Markivia at any time. On termination Markivia keeps Customer Data for 30 days for export and then deletes it, except where retention is required by law. See Data Deletion.

8. Audit

On written request, no more than once a year, Markivia will provide information reasonably needed to show compliance with this addendum.

9. California and other state laws

Where the California Consumer Privacy Act or a similar state law applies, Markivia is a service provider, will comply with the obligations that law places on service providers, will notify the Customer if it can no longer meet them, and grants the Customer the right to take reasonable steps to stop and remediate unauthorized use of Customer Data.