Confidentiality and Data Processing Addendum

The parties

Version 1.3, October 13, 2026

This Addendum (the "DPA") is part of the Marson Labs Client Service Agreement (the "Agreement") between MarSon Ventures LLC ("Marson Ventures"), which provides the Marson Labs service, and the Firm. Words with capital letters have the meanings in the Agreement. If this DPA and the Agreement conflict about Personal Data or the confidentiality of Firm Data, this DPA controls.

1. Definitions

• "Personal Data": any information in Firm Data that is linked or reasonably linkable to an identified or identifiable person, such as a Lead, a caller, a person who fills in a web form, a finished client who gets a review request, or a Firm staff user.
• "Process" or "Processing": any operation on Personal Data, such as collecting, recording, storing, using, sending or deleting it.
• "Security Incident": unauthorized access to, or acquisition, disclosure, loss or destruction of, Firm Data held by Marson Ventures or a Subprocessor.
• "NJDPA": the New Jersey Data Privacy Act, P.L.2023, c.266 (N.J.S.A. 56:8-166.4 et seq.).
• "NJ Breach Law": N.J.S.A. 56:8-161 to 56:8-163.
• "Subprocessor": a vendor on the Subprocessor List, or added under Section 6, that Processes Personal Data for Marson Ventures.
• "Subprocessor List": Exhibit A to this DPA. It is confidential. The Firm can get it at any time on request to team@marsonlabs.com.

2. Roles and instructions

2.1 The Firm decides why and how Personal Data is Processed. Marson Ventures Processes Personal Data only on the Firm's behalf and on its documented instructions. The Agreement, the Order Form and the Firm's settings in the Portal are the Firm's instructions.

2.2 To the extent the NJDPA applies to the Firm, the Firm is the "controller" and Marson Ventures is the Firm's "processor", and Marson Ventures will meet the processor duties in the NJDPA, including those in this DPA. These terms apply whether or not the NJDPA reaches the Firm.

2.3 Marson Ventures will tell the Firm if it believes an instruction breaks the law.

2.4 Annex 1 describes the Processing.

3. Confidentiality

3.1 Marson Ventures treats all Firm Data and all information about Leads as confidential information of the Firm, including information relating to the representation or prospective representation of the Firm's clients that the Firm must protect under RPC 1.6 and RPC 1.18.

3.2 Marson Ventures gives access to Firm Data only to its own staff and Subprocessors who need it to provide the Service, and only if they are bound by a duty of confidentiality at least as strict as this DPA.

3.3 Marson Ventures does not sell Personal Data or disclose it to anyone other than Subprocessors under this DPA (or as the law requires), does not use it for targeted advertising, and does not use it to contact Leads for its own purposes. Mobile opt-in data will never be shared or sold to third parties or lead generators.

3.4 Marson Ventures does not combine one firm's Firm Data with another firm's, except to create Usage Statistics that identify no firm and no person.

3.5 Section 10 of the Agreement (including Marson Ventures' role as the Firm's agent for intake and its duties when it receives a legal demand) applies to all Firm Data.

4. Security

4.1 Marson Ventures keeps reasonable administrative, technical and physical safeguards for Firm Data that fit the sensitivity of the data, including the measures in Annex 2.

4.2 The Firm is responsible for the security of its own logins, devices, website and forms.

5. Assistance to the Firm

5.1 Marson Ventures will help the Firm respond to requests from people about their Personal Data (for example, requests to see, correct or delete it, or to opt out), through Portal tools or on request. If Marson Ventures receives such a request directly, it will send it to the Firm promptly and will not answer it without the Firm's instructions, unless the law requires.

5.2 Where the NJDPA applies, Marson Ventures will give the Firm the information it reasonably needs for its data protection assessments and to show compliance with the NJDPA.

6. Subprocessors

6.1 The Firm authorizes Marson Ventures to use the Subprocessors on the Subprocessor List.

6.2 Marson Ventures will give the Firm at least 30 days' notice by email before it adds or replaces a Subprocessor that Processes Personal Data. The Firm may object in writing within that time on reasonable data-protection grounds. If the parties cannot resolve the objection, the Firm may cancel the Agreement before the change takes effect and get back any fees paid for time after the cancel date.

6.3 Each Subprocessor is bound by a written contract that requires it to meet data protection duties at least as protective as those in this DPA for the Processing it does. Marson Ventures is responsible for its Subprocessors' work on the Service.

7. Security Incidents

7.1 Marson Ventures will notify the Firm of a Security Incident immediately after discovering it, as New Jersey law requires, and in any case within 72 hours.

7.2 The notice will include what Marson Ventures then knows: what happened, when, what Firm Data and how many people may be affected, what Marson Ventures has done to contain it, and a contact person. Marson Ventures will update the Firm as it learns more.

7.3 Marson Ventures will cooperate with the Firm's investigation. The Firm decides whether and how to notify affected people, the New Jersey Division of State Police, or others under the NJ Breach Law and other law. Marson Ventures will not notify affected people or regulators about Firm Data without the Firm's OK, unless the law requires it.

7.4 If a Security Incident is caused by Marson Ventures' breach of this DPA, Marson Ventures pays the reasonable cost of the notices the law requires, within the cap for a breach of this DPA in Section 14.3 of the Agreement.

8. Retention, return and deletion

8.1 Call recordings are deleted 90 days after each call, at Marson Ventures and at its Subprocessors. Until then, the Firm can play them in the Portal (recording links expire shortly after they are opened) or ask for a copy.

8.2 Transcripts and call summaries are copied into the Firm's lead records. They stay there until the Firm asks Marson Ventures in writing to delete them, or until 30 days after the Service ends, whichever comes first.

8.3 Return. When the Service ends, Marson Ventures sends the Firm a copy of its Firm Data (leads; the timeline of calls, texts, emails, forms and transcripts; consent receipts; and opt-outs) as spreadsheet files, by email to the person who accepted the Agreement and to the Firm's lead-alert email, or by another secure method if the files are too large for email or the Firm asks. Call audio still kept is sent on request.

8.4 Deletion. Within 30 days after the Service ends, Marson Ventures deletes Firm Data from its active systems and instructs its Subprocessors to do the same. Copies in backups are deleted as the backups expire on their normal cycle, and stay protected under this DPA until then. On request, Marson Ventures confirms the deletion in writing.

8.5 Exceptions. Marson Ventures may keep (a) Usage Statistics, (b) billing and payment records the law requires it to keep, and (c) consent receipts and opt-out records for up to 4 years, only to defend claims about calls and texts. Anything kept stays protected under this DPA.

8.6 "The Service ends" means the day the Service stops for the Firm for any reason: the end of the last Paid Month after the Firm cancels; at once for a canceled proof run or a cancel before the Go-Live Date; or the end date of a termination under Section 7.4 of the Agreement.

9. Compliance information and assessments

9.1 Once a year, or after a Security Incident, Marson Ventures will answer the Firm's reasonable written security questionnaire and give the Firm the information it reasonably needs to show compliance with this DPA.

9.2 Where the NJDPA applies, Marson Ventures will allow and cooperate with reasonable assessments by the Firm or its chosen assessor, with reasonable notice and at the Firm's cost, or may instead arrange an independent assessment of its own measures and give the Firm the report on request.

10. Other terms

10.1 Data location. Marson Ventures stores Firm Data in the United States.

10.2 Health information. If the Firm chooses Full Intake, Firm Data may include callers' health information, which is "sensitive data" under the NJDPA. Any consent the NJDPA requires from the caller is the Firm's duty as controller. The parties do not intend Marson Ventures to receive protected health information as a HIPAA business associate.

10.3 No AI training. Marson Ventures does not use Firm Data to train AI models.

10.4 Term. This DPA applies for as long as Marson Ventures or a Subprocessor holds Firm Data.

Annex 1: Details of the Processing

Annex 2: Security measures

1. Each firm's data is kept separate in the database with row-level security, and a nightly test checks that one firm cannot read another's data.
2. Each firm has its own phone account and its own AI agent.
3. Admin logins require two-step verification.
4. Recording links expire 15 minutes after a logged-in person opens them.
5. Passwords and keys are kept in protected environment settings, never in code. The firm's calendar key is stored encrypted.
6. A bot check on web forms.
7. Error logs are set not to capture personal data.
8. Uptime monitoring with alerts to Marson Ventures.
9. Test and live systems are separate. Tests use test data only.
10. Data is encrypted in transit and at rest.
11. Every outgoing text, call and email passes the compliance check in Schedule 2 of the Agreement.