Delivered Data Processing Addendum
Effective Aug 1, 2026

This Data Processing Addendum (the "DPA") is incorporated by reference into, and forms part of, the Standard Terms as Additional Terms under Section 4.4 of the Standard Terms, and applies to the extent Delivered Processes Personal Data on your behalf in connection with the Services. Capitalized terms not otherwise defined in this DPA have the meanings given to them in the Standard Terms or the Security Addendum.

1. DEFINITIONS

"CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its implementing regulations.

"Controller," "Processor," "Data Subject," and "Processing" (and "Process") have the meanings given to them under the GDPR, and "Business," "Service Provider," "Consumer," "Sell," and "Share" have the meanings given to them under the CCPA, in each case as applicable to the Personal Data at issue.

"Data Protection Laws" means all data protection and privacy laws applicable to the Processing of Personal Data under this DPA, including, as applicable, the GDPR, the UK GDPR, the CCPA, and other U.S. state privacy laws.

"GDPR" means Regulation (EU) 2016/679, and “UK GDPR” means the GDPR as incorporated into UK law by the UK European Union (Withdrawal) Act 2018.

"Personal Data" means personal data (as defined under applicable Data Protection Laws) that Delivered Processes on your behalf in connection with the provision of the Services, as further described in Exhibit 1.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Decision 2021/914, as amended, supplemented, or replaced from time to time.

2. SCOPE AND ROLES

2.1 Relationship of the Parties.

As between the parties, you are the Controller (or Business, as applicable) and Delivered is the Processor (or Service Provider, as applicable) with respect to Personal Data processed in connection with the Services. Exhibit 1 describes the categories of Data Subjects, categories of Personal Data, and purposes of Processing.

2.2 Scope Limitation.

The parties acknowledge that the Personal Data processed in connection with the Services is expected to be limited to basic contact and delivery information relating to your shipment recipients, such as name, phone number, email address, and delivery address, and does not include sensitive or special category personal data. You will not submit, and will not permit any Authorized User to submit, sensitive or special category personal data (including health, financial account, government identification, or biometric data) to the Services, unless the parties agree in writing to additional terms governing such data.

2.3 Compliance.

Each party will comply with its respective obligations under applicable Data Protection Laws with respect to its Processing of Personal Data under this DPA.

3. DELIVERED'S OBLIGATIONS AS PROCESSOR

3.1 Instructions.

Delivered will Process Personal Data only (a) to provide the Services in accordance with the Standard Terms and the applicable Order, (b) in accordance with your documented instructions, which include this DPA and the Standard Terms, and (c) as otherwise required by applicable law, in which case Delivered will, where legally permitted, notify you of that legal requirement before Processing.

3.2 Personnel.

Delivered will ensure that personnel authorized to Process Personal Data are subject to confidentiality obligations consistent with Section 7 of the Standard Terms.

3.3 Security.

Delivered will implement and maintain the technical and organizational security measures described in the Security Addendum.

3.4 Subprocessors.

Delivered may engage Subprocessors to Process Personal Data in accordance with Section 3.9 of the Security Addendum. Delivered will impose data protection obligations on each Subprocessor that are materially consistent with this DPA, and will remain liable for each Subprocessor's acts and omissions to the same extent Delivered would be liable if performing the Subprocessor's services directly.

3.5 Assistance with Data Subject Requests.

Taking into account the nature of the Processing, Delivered will provide reasonable assistance to you, at your expense for any material effort, to enable you to respond to requests from Data Subjects to exercise their rights under applicable Data Protection Laws. If Delivered receives such a request directly from a Data Subject, Delivered will promptly inform you and will not respond to the request except to acknowledge its receipt and direct the Data Subject to you, unless legally required to do otherwise.

3.6 Security Incident Notification.

Delivered will notify you of a confirmed Security Incident involving Personal Data in accordance with Section 3.6 of the Security Addendum.

3.7 Data Protection Impact Assessments.

Delivered will provide reasonable assistance to you, at your expense for any material effort, with any data protection impact assessment or prior consultation with a supervisory authority that you reasonably determine is required under applicable Data Protection Laws with respect to Delivered's Processing of Personal Data.

3.8 Deletion or Return.

Upon termination or expiration of the Standard Terms, Delivered will make Personal Data available for export and will delete or return Personal Data in accordance with Section 6.4 of the Standard Terms, except to the extent applicable law requires Delivered to retain some or all of such Personal Data.

3.9 Audit.

No more than once per twelve (12) month period, and subject to reasonable advance written notice and the confidentiality protections in Section 7 of the Standard Terms, Delivered will make available to you information reasonably necessary to demonstrate Delivered's compliance with this DPA. Delivered may satisfy this obligation by providing a summary of its then-current security certifications or audit reports described in the Security Addendum in lieu of an on-site audit, unless you reasonably demonstrate that such information is insufficient to address a specific, documented compliance concern.

4. CCPA AND OTHER U.S. STATE PRIVACY LAW TERMS

4.1 Service Provider Role.

To the extent the CCPA applies to Personal Data processed under this DPA, Delivered is a Service Provider receiving Personal Data from you for the business purpose of providing the Services. Delivered will not: (a) Sell or Share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the business purpose specified in the Standard Terms and this DPA, or as otherwise permitted by the CCPA; (c) retain, use, or disclose Personal Data outside the direct business relationship between Delivered and you; or (d) combine Personal Data with personal data Delivered receives from or on behalf of another person, except as permitted by the CCPA. Delivered certifies that it understands the restrictions in this Section 4.1 and will comply with them.

4.2 Other U.S. State Privacy Laws.

To the extent other U.S. state privacy laws apply to Personal Data processed under this DPA, Delivered will Process Personal Data as a “processor” (or equivalent term) under such laws, and this DPA is intended to satisfy the applicable processor contract requirements under such laws.

5. INTERNATIONAL DATA TRANSFERS

5.1 Applicability.

This Section 5 applies only to the extent your use of the Services involves a transfer of Personal Data protected under the GDPR, the UK GDPR, or Swiss data protection law to Delivered in a country that has not been recognized as providing an adequate level of data protection by the relevant authority (a "Restricted Transfer").

5.2 Transfer Mechanism.

To the extent of a Restricted Transfer, the Standard Contractual Clauses (Module 2: Controller to Processor) are hereby incorporated by reference, with you as “data exporter” and Delivered as “data importer,” completed as described in Exhibit 2. For transfers subject to the UK GDPR, the parties will comply with the UK Information Commissioner's Office International Data Transfer Addendum to the SCCs. For transfers subject to Swiss data protection law, the SCCs will apply with such modifications as are required under Swiss law.

5.3 Cooperation.

Each party will reasonably cooperate with the other to give effect to this Section 5, including by promptly notifying the other party if it becomes aware that a transfer mechanism described above ceases to provide an adequate level of protection for a Restricted Transfer.

6. LIABILITY

The liability of each party under this DPA is subject to the limitations of liability set forth in Section 10 of the Standard Terms. Nothing in this DPA expands either party's liability beyond what is set forth in the Standard Terms, except to the extent applicable Data Protection Laws prohibit such a limitation.

7. RELATIONSHIP TO STANDARD TERMS

This DPA constitutes Additional Terms incorporated into the Standard Terms pursuant to Section 4.4 of the Standard Terms. In the event of a conflict between this DPA and the Standard Terms with respect to the Processing of Personal Data, this DPA shall control. This DPA terminates automatically upon termination or expiration of the Standard Terms, except that Section 3.8 (Deletion or Return) will survive.

EXHIBIT 1 — DETAILS OF PROCESSING

Subject Matter: Delivered's provision of the Services, including Shipment tracking, visibility, and delivery notification functionality.

Duration: The Term of the Standard Terms, plus any period during which Delivered retains Personal Data in accordance with Section 3.8 of this DPA.

Categories of Data Subjects: Your shipment recipients and other individuals identified in Shipment records submitted by you, such as individuals receiving or otherwise associated with a Shipment.

Categories of Personal Data: Name; phone number; email address; delivery address; and other Shipment-related contact information submitted by you through the Services. Personal Data does not include sensitive or special category personal data, as described in Section 2.2 of this DPA.

Frequency of Processing: Continuous, for the duration of the Term.

Nature of Processing: Collection, storage, organization, retrieval, use, transmission, and deletion of Personal Data as necessary to provide the Services.

Purpose of Processing: Providing, maintaining, and supporting the Services, including Shipment tracking and delivery notifications, in accordance with the Standard Terms and the applicable Order.