Data Processing Addendum

Effective: October 1, 2026 · Version 3.0

This Addendum is part of the ENTRRO Merchant Agreement between Wyola LLC d/b/a ENTRRO ("ENTRRO") and each business that signs that Agreement ("you", "your business"). The Agreement incorporates this Addendum by reference to this page; it needs no separate signature. Signing the Agreement adopts the version of this Addendum published here on the date you sign. Where this Addendum conflicts with the Agreement on a data protection matter, this Addendum controls.

What this covers. Sections 1 to 5 and 7 to 9 set out the parties' obligations under the GDPR and UK GDPR where those apply. Section 6 sets out ENTRRO's obligations as a service provider under the California Consumer Privacy Act as amended by the CPRA. Annex 1 lists the security measures ENTRRO maintains.

1. Definitions and roles

1.1 Data protection law means every privacy or data protection law applicable to a party's processing under the Agreement, including the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) and, where applicable, the EU General Data Protection Regulation and UK GDPR (GDPR). Personal data means information covered by those laws. Process, controller, processor, business, service provider and sell carry the meanings given in the applicable law. Capitalized terms not defined here (Platform, Promotion, Pass, Validation, Promoter) have the meanings given in the Agreement.

1.2 Customer data obtained through the Platform. For personal data relating to customers that your business obtains through the Platform, your business is the controller and business, and ENTRRO acts as processor and service provider on your behalf.

1.3 Platform operation and Promoter accounts. For personal data ENTRRO processes to operate the Platform generally, and for Promoters' own account data, ENTRRO is the controller and business in its own right, under the ENTRRO Privacy Policy. Your business is not a controller of that data and receives none of it except as the Platform displays it.

1.4 Each party complies with data protection law in respect of its own processing. Neither party is responsible for the other's independent processing.

2. Subject matter, duration, nature and purpose

2.1 ENTRRO processes personal data in order to provide the Platform: issuing and validating Passes, attributing validated Passes to Promoters, billing, and support. Processing continues for the term of the Agreement, plus any retention required by law.

2.2 Categories of data subjects: your business's customers; your business's owners, managers and scanner staff; and, where relevant, Promoters.

2.3 Categories of personal data: identifiers and contact details; Pass and redemption records; Validation events; device and scanner metadata; and transaction metadata. ENTRRO does not receive or store raw card or bank numbers. Payment credentials are entered directly into Stripe and tokenized by Stripe, as stated in the Agreement's Standard Terms.

2.4 ENTRRO does not process special category data, government identifier data, or children's data on your behalf under this Addendum. Where identity or business verification requires such data, it is collected by Stripe directly under Stripe's own terms, and ENTRRO neither collects nor stores it.

3. ENTRRO's obligations as processor

ENTRRO shall: (a) process personal data only on your documented instructions, this Addendum and the provision of the Platform being such instructions, unless required otherwise by law, in which case ENTRRO will notify you unless the law forbids it; (b) ensure personnel authorized to process personal data are bound by confidentiality; (c) implement and maintain the technical and organizational security measures set out in Annex 1; (d) assist you, taking into account the nature of processing and the information available, with responses to data subject requests, with security obligations, and with data protection impact assessments and prior consultations; (e) notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, with the information reasonably available; (f) on termination, delete or return such personal data at your election, subject to retention required by law; and (g) make available the information reasonably necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate on reasonable prior notice, no more than once in any twelve month period absent a breach or a regulator's requirement.

4. Your obligations

4.1 You warrant that you have a lawful basis for the personal data you provide or instruct ENTRRO to process, that any notices and consents required have been given and obtained, and that your instructions will not put ENTRRO in breach of data protection law.

4.2 You shall handle customer and Promoter personal data you receive through the Platform only as permitted by law and the Agreement, and shall not use it to build or enrich a separate profile of a Promoter, or disclose it other than as the Agreement allows.

5. Sub-processors

5.1 You give general written authorization for ENTRRO to engage the sub-processors listed below and any successor to them. ENTRRO imposes data protection obligations on each sub-processor no less protective than those in this Addendum, and remains responsible for their performance.

5.2 ENTRRO gives you at least 30 days' notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, you may end the Agreement without penalty as your sole remedy.

5.3 This list covers sub-processors engaged for personal data ENTRRO processes on your behalf. It does not list ENTRRO's own suppliers for personal data ENTRRO controls in its own right, such as the electronic signature provider used to execute the Agreement, which are disclosed in the ENTRRO Privacy Policy.

The current list is also maintained on the Subprocessors page.

6. CCPA / CPRA service provider terms

6.1 Where ENTRRO processes personal information on your behalf, ENTRRO acts as a service provider and the personal information is disclosed only for the limited and specified business purpose of providing the Platform.

6.2 ENTRRO shall not: (a) sell or share that personal information as those terms are defined in the CCPA/CPRA; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, or as otherwise permitted by the CCPA/CPRA; (c) retain, use or disclose it outside the direct business relationship between ENTRRO and your business; or (d) combine it with personal information received from, or on behalf of, another person, or collected from its own interactions with a consumer, except as the CCPA/CPRA permits a service provider to do.

6.3 ENTRRO certifies that it understands the restrictions in section 6.2 and will comply with them, and shall notify you if it determines it can no longer meet its obligations under the CCPA/CPRA. You may, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

6.4 ENTRRO shall assist you in responding to consumer requests to know, delete, correct, and opt out, to the extent the personal information is processed on your behalf and you cannot reasonably respond yourself.

7. International transfers

7.1 The Platform is operated from the United States. Where personal data subject to the GDPR is transferred out of the EEA or the UK, the parties rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated by reference, and for UK transfers on the UK International Data Transfer Addendum (IDTA), together with any supplementary measures required by law. Your business is the data exporter and ENTRRO the data importer. Where the Clauses require a choice, the governing law and forum are those of Ireland unless the parties agree otherwise in writing.

8. Liability and precedence

8.1 Each party's liability under this Addendum is subject to the limitation of liability in the Agreement's Standard Terms.

8.2 If this Addendum conflicts with the Agreement on a data protection matter, this Addendum controls. If this Addendum conflicts with the Standard Contractual Clauses, the Clauses control.

9. Contact

Data protection inquiries, sub-processor objections, and breach notices: privacy@entrro.com. Current sub-processors are published on the Subprocessors page.

Annex 1. Technical and organizational security measures

ENTRRO maintains measures appropriate to the risk, including: encryption of personal data in transit (TLS) and at rest; role based access control with least privilege and individual named accounts; multi-factor authentication on administrative access; segregation of production from non-production environments; logging of administrative and validation events; regular backups with restoration testing; vulnerability patching of hosted infrastructure; personnel confidentiality undertakings; a documented incident response process; and vendor due diligence before a sub-processor is engaged. Payment credentials are never held by ENTRRO; they are tokenized by Stripe, which maintains PCI DSS Level 1 certification.

Previous versions

Agreements signed before October 1, 2026 incorporate the version of this Addendum in force on their signing date.

• Version 2.0, effective June 16, 2026, attached to Merchant Services Agreement v2.0 as Exhibit B: PDF

Changes in version 3.0: moved from the signed PDF to this page; "merchant", "venue" and "guest" replaced by "your business" and "customer" to match Merchant Agreement v3; cross references updated to the Agreement's Standard Terms. No change to roles, obligations, sub-processors or security measures.