Effective date: November 6, 2025

This DPCA forms part of, and is governed by, the Master Services Agreement (“MSA”) between Spinwheel and Client. Capitalized terms used but not defined herein have the meaning given in the MSA.

1. Background & Principles

Spinwheel operates a consumer‑permissioned data platform. that acts only at the direction of the end user.

All Consumer Data is retrieved, transmitted, stored, and processed solely pursuant to the end user’s affirmative, informed, and revocable authorization and for that user’s designated purpose(s). Spinwheel does not sell, furnish, or otherwise transfer data from any third-party source to Client except as expressly initiated by the end user through the Platform Services.

2. Definitions

“Consumer Data” means any information relating to an identified or identifiable consumer obtained through the Platform Services.  “End User Input”, and “End User Output” have the meanings set forth in the MSA. “Consumer Permission” means the express, informed, and revocable authorization granted by an end user for Spinwheel and Client to obtain and process Consumer Data.

3. Consumer Permission & Control

The Parties expressly acknowledge and agree to the following data access and permission framework: (i) Spinwheel’s access to and processing of any Consumer Data is authorized directly by the End User pursuant to the Spinwheel End User Agreement and Privacy Policy. (ii) Spinwheel obtains and processes data for the End User, making it available through the Platform Services. (iii) Client’s access to any Consumer Data via the Platform Services is separately and independently authorized by the End User pursuant to the Client’s own terms of service and privacy policy with that End User. The Client is solely responsible for securing this authorization.

4. Privacy and Authorizations

Client will not (i) make representations or other statements with respect to End User Input that are contrary to or otherwise inconsistent with the Spinwheel End User Agreement or (ii) interfere with any legally permissible independent efforts by Spinwheel to provide End User notice or obtain End User consent for the collection and use of such End User Input. The parties agree that the Spinwheel End User Agreement and Privacy Policy will be presented to each End User for their consent in a commercially reasonably and legally compliant manner and format to which Spinwheel has agreed (and such agreement shall not be unreasonably withheld) at or prior to the time of such End User’s initial use of the Platform Services in the Client Application.

5. Data Ownership & Permitted Uses

Spinwheel does not claim ownership over Consumer Data. Each Party shall use Consumer Data solely for the purposes expressly permitted under the MSA, shall not sell Consumer Data, and shall honor all consumer instructions regarding data deletion or retention.

6. Regulatory Compliance

6.1 GLBA Data. Some of the information contained in the Platform Services is “nonpublic personal information,” as defined in the Gramm-Leach-Bliley Act (15 U.SC § 6801, et seq.) and related state laws, (collectively the “GLBA”), and is regulated by the GLBA (“GLBA Data”). Client shall not obtain and/or use GLBA Data through Platform Services, in any manner that would violate the GLBA, or any similar state or local laws, regulations and rules. Client acknowledges and agrees that it may be required to certify its permissible use of GLBA Data falling within an exception set forth in the GLBA at the time it requests information in connection with certain Platform Services and will recertify upon request by Spinwheel. Client certifies with respect to GLBA Data received through the Platform Services that it complies with the Interagency Standards for Safeguarding Client Information issued pursuant to the GLBA.          

6.2 Fair Credit Reporting Act. Client certifies that when using the Platform Services, it will comply with all applicable provisions of the FCRA and all other applicable federal, state and local legislation, rules, and regulations. Without limiting the generality of the foregoing, Client certifies that (a) Client will comply with all applicable provisions of the California Credit Reporting Agencies Act and any related regulations; and (b) Client will comply with all Vermont statutes and regulations on fair credit reporting, including but not limited to, obtaining the consent of Vermont residents prior to obtaining any information on Vermont residents through these Platform Services.

(A) Client certifies, that unless otherwise set forth in an Order, it will not use any of the information it receives through the Platform Services to determine, in whole or in part, an individual’s eligibility for any of the following products, services or transactions: (i) credit or insurance to be used primarily for personal, family or household purposes: (ii) employment purposes; (iii) a license or other benefit granted by a government agency; or (iv) any other product, service or transaction in connection with which a consumer report may be used under the FCRA or any similar state statute, including without limitation apartment rental, check-cashing, or the opening of a deposit or transaction account;

(B) by way of clarification, without limiting the foregoing, Client may use, except as otherwise prohibited or limited by this Agreement, information received through the Platform Services for the following purposes: (i) to verify or authenticate an individual’s identity; (ii) to prevent or detect fraud or other unlawful activity; (iii) to locate an individual; (iv) to review the status of a legal proceeding; (v) to collect a debt, provided that such debt collection does not constitute in whole or in part, a determination of an individual consumer’s eligibility for credit to insurance to be used primarily for personal, family or household purposes; or (vi) to determine whether to buy or sell consumer debt or a portfolio of consumer debt in a commercial secondary market transaction, provided that such determination does not constitute in whole or in part, a determination of an individual’s consumer’s eligibility for credit or insurance to be used primarily for personal, family or household purposes;

(C) specifically, Client shall not use the Platform Services: (i) to revoke consumer credit; (ii) to accelerate, set or change repayment terms other than as a component of a loan consolidation; or (iii) for the purpose of determining a consumer eligibility or any repayment plan; provided, however, that Client may, consistent with the certification and limitation set for this in this section, use the Platform Services for identifying, locating, or contacting a consumer in connection with the collection of a consumer’s debt or for prioritizing collection activities; and

(D) In addition, Client acknowledges and agrees that Spinwheel is neither a “consumer reporting agency” nor a “furnisher” of information to consumer reporting agencies under the Fair Credit Reporting Act (“FCRA”) and any materials generated and share by an End User (“End User Output”) is not a “consumer report” under the FCRA and cannot be used as or in such. Client represents and warrants that it will not, and will not permit or enable any third-party to, use the Platform Services (including End User Output) as a or as part of a “consumer report” as that term is defined in the FCRA or otherwise use the Platform Services (including End User Output) such that the Platform Services (including End User Output) would be deemed “consumer reports” under the FCRA.

6.3 HIPAA. Client represents and warrants that Client will not provide Spinwheel with any Protected Health Information (as that term is defined in 45 CFR § 160.103) or with Electronic Health Records or Patient Health Records (as those terms are defined in 42 USC § 17921(5), and 42 USC § 17921(11), respectively) or with information from such records without the execution of a specific agreement between the parties, a Spinwheel Business Associate Agreement. 

6.4 Regulatory Requirements. Client agrees to be held responsible for compliance with all applicable federal (including, but not limited to the FCRA & GLBA) and state legislation. 

7. Data Security 

Client acknowledges that the information available through Platform Services may include personally identifiable information and/or sensitive personal information that is required be protected from unauthorized acquisition or disclosure under federal and/or state law and that it is Client’s obligation to keep all such accessed information confidential and secure. Accordingly, Client shall: (a) restrict access to Platform Services to those employees who have a need to know as part of their official duties; (b) ensure that none of its employees shall (i) obtain and/or use any information from the Platform Services of personal reasons, or (ii) transfer any information received from the Platform Services to any party except as permitted hereunder; (c) keep all customer-identifying materials, accounts, numbers, and their related passwords or other security measures confidential and prohibit disclosures in accord with all relevant laws and confidentiality provisions in customer agreements; (d) immediately deactivate the User ID for any employee who no longer has a need to know, or for terminated employees on or prior to the date of termination; (e) take all commercially reasonable measures to prevent unauthorized access to, or use of, the Platform Services or data received therefrom, whether the same is in electronic form or hard copy, by any person or entity; (f) maintain and enforce data destruction procedures to protect the security and confidentiality of all information obtained through Platform Services as it is being disposed; (g) unless otherwise permitted by contract with a customer or required by law, purge all information received through the Platform Services and stored electronically or on hard copy by the customer within 90 days of initial receipt; (h) be capable of receiving the Platform Services by means of secured transmission as is deemed reasonable by Spinwheel; (i) not access and/or use the Platform Services via mechanical, programmatic, robotic, scripted or other automated search means, other than through batch or machine-to-machine applications approved by Spinwheel; and (j) take all steps to protect their networks and computer environments, or those used to access the Platform Services, from compromise. 

Client agrees that on at least a quarterly basis it will review searches performed by its User IDs to ensure that such searches were performed for a legitimate business purpose and in compliance with all terms and conditions herein. Client will implement policies and procedures to prevent unauthorized use of the Platform Services and will immediately notify Spinwheel, in writing to the Spinwheel if Client suspects, has reason to believe or confirms that a User ID or the Platform Services (or data derived directly or indirectly therefrom) is or has been stolen, compromised, misused or used, accessed or acquired in an unauthorized manner or by any unauthorized person, or for any purpose other than legitimate business reasons. Client shall remain solely liable for all costs associated therewith and shall further reimburse Spinwheel for any expenses it incurs due to Client’s failure to prevent such impermissible use or access of User IDS and/or the Platform Services, or any actions required as a result thereof. Furthermore, in the event that the Platform Services provided to the Client include personally identifiable information or sensitive personal information (including, but not limited to, social security numbers, driver’s license numbers or dates of birth), the following shall apply: Client acknowledges that, upon unauthorized acquisition to or access of such information, including but not limited to that which due to use by an unauthorized person or due to unauthorized use (a “Security Event”), Client shall, in compliance with law, notify the individuals whose information was potentially accessed or acquired that a Security Event has occurred, and shall also notify any other parties (including but not limited to regulatory entities and credit reporting agencies) as may be required in Spinwheel’s reasonable discretion. Client agrees that such notification shall not reference Spinwheel or the product through which the data was provided, nor shall Spinwheel be otherwise identified or referenced in connection with the Security Event, without Spinwheel’s express written consent. Client shall be solely responsible for any other legal or regulatory obligation which may arise under applicable law in connection with such a Security Event and shall bear all costs associated with complying with legal and regulatory obligations in connection therewith. Client shall remain solely liable for claims that may arise from a Security Event, including, but not limited to, costs for litigation (including attorneys’ fees), and reimbursement sought by individuals, including but not limited to, costs for credit monitoring or allegations of loss in connection with the Security Event, and to the extent that any claims are brought against Spinwheel, shall indemnify Spinwheel from such claims. Client shall provide samples of all proposed materials to notify consumers and any third-parties, including regulatory entities, to Spinwheel for review and approval prior to distribution. In the event of a Security Event, Spinwheel may, in its sole discretion, take immediate action, including suspension or termination of Client’s account, without further obligation or liability of any kind. 

Client shall implement and maintain a comprehensive information security program written in one or more readily accessible parts and that contains administrative, technical, and physical safeguards that are appropriate to the client’s size and complexity, the nature and scope of its activities, and the sensitivity of the information provided to the client by Spinwheel; and that such safeguards shall include the elements set forth in 16 C.F.R. § 314.4 and shall be reasonably designed to (i) insure the security and confidentiality of the information provided by Spinwheel, (ii) protect against any anticipated threats or hazards to the security or integrity of such information, and (iii) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any consumer.

8. Audit 

Client understands and agrees that, in order to ensure compliance with the FCRA, GLBA, DPPA, other similar state or federal laws, regulations or rules, regulatory agency requirements, this Agreement, and Spinwheel’s obligations under its contracts with its data providers and Spinwheel’s internal policies, Spinwheel may conduct periodic reviews of Client’s use of the Spinwheel Services and may, upon reasonable notice, audit Client’s records, processes and procedures related to Client’s use, storage and disposal of Platform Services and information received therefrom. Client agrees to cooperate fully with any and all audits and to respond to any such audit inquiry within ten (10) business days, unless an expedited response is required. Violations discovered in any review and/or audit by Spinwheel will be subject to immediate action including, but not limited to, suspension or termination of the license to use the Platform Services, reactivation fees, legal action, and/or referral to federal or state regulatory agencies.

9. Record Retention & Sub‑processing

For uses of GLB Data and DPPA Data Client shall maintain for a period of five (5) years a complete and accurate record (including consumer identity, purpose, and, if applicable, consumer authorization) pertaining to every access to such data.

10. Cross‑Border Transfers

If Spinwheel or Client transfers Consumer Data across national borders, it shall ensure an adequate level of data protection and comply with all applicable transfer mechanisms (e.g., SCCs, UK Addendum, CBPR).

11. Termination & Suspension

Termination Rights for Data Misuse, Legal Violations, and Operational Concerns. Notwithstanding any other provision of this Agreement, Spinwheel reserves the right to terminate this Agreement immediately upon written notice to Client under any of the following circumstances. Unauthorized Data Usage: If Client uses data beyond the approved parameters set out in this Agreement, including but not limited to unauthorized access, sharing, or processing of data.  For the avoidance of doubt, Client is not permitted to use any data obtained from Spinwheel in any format for services (including Credit Repair services), products, derivative datasets, secondary uses, or any other use other than those expressly set out in this Agreement Legal and Regulatory Violations: If Client violates any regulation, law, order, consent decree, judicial ruling, or other legal instrument. This includes non-compliance with industry standards and legal obligations pertinent to the services provided under this Agreement. Operational Concerns: If Spinwheel has commercially reasonable concerns regarding the security, soundness, or safety of Client’s operations, including but not limited to issues pertaining to compliance, data security, and operational resilience.

12. Survival & Order of Precedence

Sections 3 through 10 shall survive termination or expiration of the MSA. In the event of conflict between this DPCA and the MSA, the DPCA shall control for all data‑protection matters.

CLIENT AFFILIATE CERTIFICATION

This Client Affiliate Certification (the “Certification”) is made as of [DATE] by [AFFILIATE NAME], a [STATE/COUNTRY] [ENTITY TYPE] (“Affiliate”), in favor of Spinwheel Solutions, Inc. (“Spinwheel”).

WHEREAS:

1. [CLIENT NAME] (“Client”) and Spinwheel have entered into a Master Services Agreement dated [DATE] (the “Agreement”); and

2. Affiliate wishes to receive access to the API Package and Platform Services (as defined in the Agreement) in accordance with Section 1.4 of the Agreement.

NOW, THEREFORE, Affiliate hereby certifies and agrees as follows:

1. Affiliate acknowledges that it has received and reviewed a copy of the Agreement.

2. Affiliate agrees to be bound by and comply with all obligations, duties, and warranties applicable to Client under the Agreement as if Affiliate were a party to the Agreement, including but not limited to: a) The restrictions on use of the Platform Services set forth in Section 1.2 of the Agreement; b) The compliance requirements set forth in Section 1.3 of the Agreement; c) The representations and warranties set forth in Section 7 of the Agreement; d) The confidentiality obligations set forth in Section 6 of the Agreement; e) The data security requirements set forth in Exhibit B of the Agreement; and f) Any other applicable terms and conditions of the Agreement.

3. Affiliate acknowledges that its use of the Platform Services is subject to Spinwheel’s approval and may be terminated by Spinwheel at any time.

4. Affiliate agrees that Client shall remain jointly and severally liable to Spinwheel for any failure of Affiliate to meet its obligations under federal, state, or local laws and/or for breach of any obligation under this Certification or the Agreement.

5. This Certification shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of law provisions.

IN WITNESS WHEREOF, the undersigned has executed this Certification as of the date first written above.

[AFFILIATE NAME]

By: ___________________________

Name: _________________________

Title: __________________________