GrabMore Data Processing Addendum

Last Updated: July 15, 2026

This Data Processing Addendum ("DPA") forms part of the Merchant Services Agreement between GrabMore USA LLC, doing business as GrabMore ("GrabMore"), and Merchant.

It applies only when GrabMore processes Personal Data on Merchant's behalf as a processor or service provider. It does not apply to information GrabMore processes for its own account administration, fraud prevention, platform analytics, support, security, legal compliance, payment administration, tax, or contract enforcement, for which GrabMore acts as an independent business or controller.

1. Definitions

"Applicable Data Protection Law" means a privacy or data-protection law applicable to the processing covered by this DPA.

"Merchant Personal Data" means Personal Data processed by GrabMore on Merchant's behalf through the Services.

"Personal Data" means information relating or reasonably linkable to an identified or identifiable individual and includes equivalent terms under Applicable Data Protection Law.

"Security Incident" means unauthorized access to, acquisition, alteration, disclosure, loss, or destruction of Merchant Personal Data for which GrabMore is responsible, excluding unsuccessful attempts that do not compromise security.

"Subprocessor" means a third party engaged by GrabMore to process Merchant Personal Data on GrabMore's behalf.

2. Roles and instructions

Merchant is the business, controller, or responsible party for Merchant Personal Data it directs GrabMore to process. GrabMore is the processor or service provider for that limited processing.

GrabMore will process Merchant Personal Data only:

• to provide the Services;
• under Merchant's documented instructions in the Agreement, campaign settings, support requests, and authorized feature use;
• to protect the Services and prevent fraud; or
• as required by law.

If GrabMore believes an instruction violates Applicable Data Protection Law, GrabMore may notify Merchant and suspend the affected processing.

3. Processing details

The processing is described in Schedule 1 and continues for the Agreement term and any lawful retention period.

Merchant will not instruct GrabMore to collect or process information that is unnecessary, unlawful, or prohibited by the Agreement.

4. Confidentiality and personnel

GrabMore will ensure that personnel authorized to process Merchant Personal Data are subject to confidentiality obligations and receive access only as reasonably needed.

5. Security

GrabMore will maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of Merchant Personal Data, processing risks, and GrabMore's size and resources.

Measures may include:

• access controls and role-based permissions;
• authentication and credential protection;
• encrypted transmission;
• secure token and secret storage;
• logging and monitoring;
• backups and recovery procedures;
• vulnerability and patch management;
• incident-response procedures; and
• service-provider risk controls.

This DPA does not promise that every listed measure applies identically to every system or that security is absolute.

6. Subprocessors

Merchant authorizes GrabMore to use Subprocessors for hosting, databases, storage, caching, monitoring, communications, analytics, security, support, payment, and related Services.

GrabMore will require a Subprocessor to protect Merchant Personal Data under obligations appropriate to the service.

GrabMore will make a current Subprocessor list available on request or through a designated webpage. Where required, GrabMore will provide notice of a material new Subprocessor and a reasonable opportunity to object on legitimate data-protection grounds.

Payment processors acting under their own terms may be independent businesses or controllers and are not Subprocessors for that independent processing.

7. Individual requests

Taking into account the nature of processing, GrabMore will provide commercially reasonable assistance for verified requests involving access, correction, deletion, portability, or other rights relating to Merchant Personal Data.

Merchant is responsible for determining whether and how to respond. GrabMore may charge reasonable costs for unusually burdensome assistance not caused by GrabMore's breach.

8. Security incidents

GrabMore will notify Merchant without undue delay after confirming a Security Incident affecting Merchant Personal Data.

The notice will include available information concerning the nature of the incident, affected data, likely consequences, and mitigation steps. GrabMore may provide information in phases as it becomes available.

Merchant is responsible for notifications relating to Merchant's independent systems or legal duties, except to the extent Applicable Data Protection Law assigns a duty to GrabMore.

Notification is not an admission of fault or liability.

9. Return and deletion

Upon termination or Merchant's verified request, GrabMore will delete or return Merchant Personal Data within a commercially reasonable period, except where retention is necessary for outstanding Digital Gift Cards, transactions, fraud prevention, security, taxes, accounting, legal obligations, processor requirements, backups, or legal claims.

Information retained under an exception remains protected by this DPA and the Privacy Policy.

10. Audits and information

GrabMore will provide information reasonably necessary to demonstrate compliance with this DPA, such as relevant policies, summaries, questionnaires, or third-party reports when available.

On-site audits require reasonable advance notice, must not compromise other customers or security, and are limited to once annually unless required by law or following a material Security Incident. Merchant bears audit costs unless the audit identifies a material breach by GrabMore.

11. Restricted processing

GrabMore will not, in its processor or service-provider role:

• sell Merchant Personal Data;
• retain, use, or disclose it outside the business purposes in the Agreement except as permitted by law;
• combine it with information received from another person except as permitted for the Services, security, fraud prevention, or as allowed by law; or
• use it for cross-context behavioral advertising.

GrabMore will notify Merchant if it can no longer meet an applicable service-provider or processor obligation.

12. International transfers

If Merchant Personal Data is transferred from a jurisdiction requiring a transfer mechanism, the parties will use a legally recognized mechanism reasonably appropriate to the transfer.

Merchant will not enable international campaigns without GrabMore's written approval.

13. Liability and priority

The Merchant Agreement's liability, indemnification, dispute, and termination provisions apply to this DPA.

If this DPA conflicts with the Merchant Agreement concerning processor obligations for Merchant Personal Data, this DPA controls for that issue.

Schedule 1 - Processing description

Subject matter and purpose

Providing Merchant-specific Digital Gift Card listing, checkout, delivery, activation, balance, redemption, refund, reporting, support, integration, fraud prevention, and administration services.

Duration

The Agreement term plus lawful retention periods.

Individuals

• purchasers;
• gift recipients and holders;
• Merchant owners, staff, and users;
• support contacts; and
• other individuals whose information Merchant submits through the Services.

Data categories

• names, email addresses, and mobile numbers;
• account and authentication identifiers;
• purchase, delivery, balance, activation, and redemption information;
• customer-service and refund information;
• device, log, security, and fraud information;
• Merchant staff roles and permissions;
• processor transaction identifiers and payment metadata; and
• other information Merchant lawfully submits for the Services.

Full card numbers and CVV codes are intended to be handled by payment processors, not stored by GrabMore.

Processing activities

Collection, recording, organization, storage, retrieval, consultation, use, transmission, disclosure to authorized recipients, restriction, deletion, and deidentification as necessary for the Services.