DATA PROCESSING AGREEMENT

Preamble

This Data Processing Agreement ("DPA") forms part of the written agreement governing X3M LLC's provision of the Loomit services and/or X3M mediation services to the customer identified in that agreement (the "Principal Agreement"). X3M LLC ("Processor" or "X3M") and that customer ("Controller") are each a "Party" and together the "Parties". This DPA applies only where X3M processes Controller Personal Data on behalf of Controller in connection with the Services. The Principal Agreement and this DPA, including completed schedules, constitute Controller's documented instructions as further described below. Defined terms in the Principal Agreement retain their meanings unless this DPA specifies otherwise.

1. Definitions and interpretation

"Controller Personal Data" means Personal Data processed by X3M on Controller's behalf in providing the Services, whether transmitted by Controller, collected through an implementation authorized by Controller, or otherwise made available to X3M for that purpose.

"Data Protection Laws" means privacy and data-protection laws applicable to the relevant Processing, including the GDPR, UK GDPR and the CCPA/CPRA where applicable. No law applies to a particular Processing activity solely because it is named here.

"Personal Data", "Controller", "Processor", "Processing", "Data Subject" and "Personal Data Breach" have the meanings given in the GDPR where applicable, and their corresponding meanings under other applicable Data Protection Laws. "Subprocessor" means a third-party processor engaged by X3M to process Controller Personal Data on Controller's behalf. An advertising network or mediation provider engaged independently by Controller does not become X3M's Subprocessor solely by interfacing with the Services.

"Services" means the Loomit mediation-optimization, analytics and related services, and any X3M mediation services, provided under the Principal Agreement. "Restricted Transfer" means a transfer for which an international-transfer safeguard is required by applicable Data Protection Laws.

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with Processor, where "control" means ownership of more than 50% of the voting interests or the power to direct management.

2. Scope of Processing

Processor shall process Controller Personal Data only on documented instructions from Controller and to provide the Services, including the instructions documented in the Principal Agreement, this DPA, approved integrations and settings selected by Controller, unless Processing is required by applicable law. In that case, Processor shall inform Controller before Processing unless law prohibits doing so.

Processor shall promptly inform Controller if, in its opinion, an instruction infringes applicable Data Protection Laws. Controller remains responsible for determining the lawful basis for its Processing, notices and consents, the legality of instructions and any decisions concerning the purposes and means of Controller's Processing. Processor may suspend an unlawful instruction while the Parties seek a lawful alternative.

3. Nature and Purpose of the Processing

Processor may process Controller Personal Data only to supply, support, secure, troubleshoot, analyze and optimize the Services in accordance with Controller's documented instructions and Schedule 1; to comply with applicable legal requirements; for the anonymized benchmarking described in Section 3.A; and for the Model Development described in Section 3.B. Processing may include SDK events, ad-request handling, mediation optimization, audience or cohort analytics on Controller's behalf, testing and reporting. Such activities shall not be interpreted as authorizing unrelated advertising campaigns, retargeting, survey hosting or the linking of an individual Data Subject's records across different customers' applications.

3.A Anonymized and Aggregated Benchmarks. Controller instructs Processor, where lawful, to create genuinely anonymized aggregate statistics from Controller Personal Data solely after applying techniques designed to prevent reasonably likely identification or re-identification of Data Subjects. Processor may combine and use those anonymized statistics for aggregate performance benchmarking and disclose benchmark outputs, including publicly, only where no Data Subject, Controller, application or commercially sensitive client-level metric is reasonably identifiable, directly or by inference. Processor shall not attempt to re-identify anonymized outputs or enable third parties to do so. Until anonymization is effective, the input data remains Controller Personal Data and is subject to this DPA and applicable Data Protection Laws. Nothing in this Section waives a notice, lawful-basis, consent or confidentiality obligation imposed by applicable law or the Principal Agreement.

3.B Model Development and Service Improvement. As part of the Services and of Controller's documented instructions, Controller authorizes and instructs Processor to use Controller Personal Data in pseudonymised form, together with similar pseudonymised data processed for Processor's other customers, to develop, train, test, validate and improve the predictive models, algorithms, user segments and optimization strategies used to provide and improve the Services ("Model Development"). For this purpose, "Pseudonymised Data" means Controller Personal Data that excludes names, email addresses, telephone numbers and other direct identifiers, and that cannot be attributed to a specific Data Subject without additional information kept separately and subject to technical and organizational measures.

In carrying out Model Development, Processor shall: (a) use only Pseudonymised Data, limited to what is reasonably necessary for the relevant purpose; (b) not link or attempt to link an individual Data Subject's records across different customers' applications, and not attempt to re-identify any Data Subject; (c) not sell, rent or disclose Controller's Pseudonymised Data to third parties other than Subprocessors bound by this DPA; (d) not use Controller Personal Data to target advertising to Data Subjects other than in providing the Services to the relevant customer; and (e) apply the measures described in Schedule 2.

The models, weights, parameters, features, segment definitions and statistical learnings resulting from Model Development ("Model Outputs") do not identify Controller, its applications or any Data Subject, do not constitute Controller Personal Data, and are owned exclusively by Processor, who may use them to provide services to Controller and to Processor's other customers. Controller acknowledges that Model Development is an integral and non-severable part of the Services, that Model Outputs cannot be extracted or unlearned once trained, and that Processor's return and deletion obligations under Section 13 apply to Controller Personal Data but not to Model Outputs. Controller shall ensure that its privacy notices and, where required, consents cover the Processing of end-user data by its service providers to improve advertising monetization services.

4. Categories of Data Subjects

The categories of Data Subjects are Controller's end users of mobile games, applications or other digital properties using the Services, as further described in Schedule 1. Processor may reasonably decline or suspend a Processing activity to the extent necessary to avoid violation of applicable law or its contractual obligations, after notifying Controller when reasonably practicable. The Parties will cooperate in good faith on lawful alternatives. Extraordinary assistance requested beyond Processor's legal obligations may be subject to reasonable, pre-agreed fees.

5. Types of Data Processed

The categories of Controller Personal Data and Processing activities are set out in Schedule 1, which governs in case of an inconsistent description elsewhere in this DPA. The existence of pseudonymous identifiers, device-level advertising identifiers and event-level records must not be taken to mean such information is necessarily anonymous or outside Data Protection Laws. Collection, transient use, storage and retention of each data category shall reflect the actual deployment and documented configuration of the Services.

Controller shall not intentionally provide special-category or other sensitive Personal Data beyond what the Parties have specifically agreed in writing and can lawfully safeguard; the Parties shall implement appropriate additional restrictions if such Processing is required.

6. Processor Personnel

Processor shall limit access to Controller Personal Data to personnel who require it for the Services and who are bound by contractual or statutory confidentiality obligations. Processor shall maintain access controls appropriate to their roles and shall ensure that personnel process Controller Personal Data only under authorized instructions, except where law requires otherwise.

7. Controller’s Obligations

Controller is responsible for complying with applicable Data Protection Laws in connection with its end users, applications, notices, choices, consents, and configuration of advertising partners and mediation platforms. Controller shall provide lawful and documented instructions, apply appropriate security measures within systems it controls, and shall not instruct Processor to process Controller Personal Data unlawfully. Processor's compliance with this DPA does not relieve Controller of its own statutory obligations.

8. Security

Processor shall implement and maintain appropriate technical and organizational measures as described in Schedule 2, taking into account the nature and risks of the Processing. Processor may update its measures provided the overall security level is not materially reduced.

Processor shall notify Controller without undue delay after becoming aware of a confirmed Personal Data Breach affecting Controller Personal Data processed by Processor. The notice will describe available information reasonably necessary for Controller's notification obligations and may be supplemented as the investigation progresses. Processor shall reasonably cooperate in investigation, mitigation and legally required notifications, taking account of the nature of the Processing and information available to Processor. Processor is not responsible for restoring Controller-controlled systems or data not affected by Processor's breach, except to the extent required by applicable law or another express contractual obligation.

9. Subprocessing

Controller grants Processor general written authorization to engage the Subprocessors identified in the current Schedule 3, subject to the requirements of Article 28(2) and (4) GDPR where applicable. Processor shall impose on each Subprocessor materially equivalent data-protection obligations as required by applicable law and remains responsible for that Subprocessor's performance of those obligations to the extent required by law.

Processor shall notify Controller in writing (including email or an agreed notice portal) at least 15 days before adding or replacing a Subprocessor. Controller may object in writing within that notice period on reasonable, documented data-protection grounds. The Parties shall consult in good faith. If a reasonable objection cannot be resolved, Processor may offer an alternative and either Party may terminate only the affected Services on written notice, with payment for Services already performed and any prepayments for undelivered affected Services addressed in accordance with the Principal Agreement and applicable law. Neither Party has an automatic right to terminate unaffected services under the Principal Agreement solely because of the objection.

Advertising networks and mediation providers configured and contracted by Controller are not listed as Processor's Subprocessors merely because Controller chooses to connect them; their roles and contractual terms require a case-by-case assessment.

10. Data Subject Rights

Processor shall, taking into account the nature of the Processing and information reasonably available to it, assist Controller in responding to Data Subject requests relating to Controller Personal Data. Processor shall promptly notify Controller if it receives such a request directly and shall not respond substantively except under Controller's documented instructions or as required by law. Processor shall provide reasonable assistance with data protection impact assessments, prior consultations and data-security compliance where legally required and relevant to Processor's Services. The Parties may agree reasonable charges for assistance that materially exceeds mandatory requirements.

11. Data Transfer

Controller acknowledges that authorized Processing and access may involve transfers outside the country or region of origin. Each Party shall comply with applicable restrictions on international transfers of Controller Personal Data. For any Restricted Transfer from the EEA to Processor, the Parties hereby incorporate by reference the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 (the "EU SCCs"), Module Two (controller to processor), or Module Three (processor to processor) where Controller acts as a processor, completed as follows: (i) Clause 7 (docking clause) applies; (ii) Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 9 of this DPA; (iii) the optional language in Clause 11 does not apply; (iv) for Clauses 17 and 18, the governing law and courts are those of Ireland; and (v) Annexes I.A and I.B are completed by Schedule 1, Annex I.C by the competent supervisory authority of Controller's EU establishment or representative, Annex II by Schedule 2 and Annex III by Schedule 3. For Restricted Transfers from Switzerland, the EU SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as the competent authority. For Restricted Transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner is incorporated by reference, with its Tables 1 to 3 completed by this DPA and its Schedules and "neither Party" selected in Table 4.

The controller-processor clauses under Commission Implementing Decision (EU) 2021/915 are not incorporated. In the event of a conflict between the incorporated EU SCCs or UK Addendum and this DPA, the EU SCCs or UK Addendum prevail for the relevant Restricted Transfer only.

12. Audit

Processor shall make available information reasonably necessary to demonstrate compliance with the Processor obligations applicable under this DPA and Article 28 GDPR, including available independent assurance or audit materials. Where additional verification is reasonably necessary, Processor shall permit and contribute to audits by Controller or an independent auditor mandated by Controller as required by applicable law.

Except where a competent authority, a material confirmed breach or applicable law reasonably requires otherwise, audits shall be limited to once in any 12-month period, on at least 30 days' prior written notice, during normal business hours and under reasonable confidentiality and security safeguards. Audits shall avoid unnecessary disruption and shall not disclose other customers' information, unrelated trade secrets or security-sensitive details where equivalent evidence can be provided. Controller shall bear reasonable audit costs unless the audit establishes a material breach by Processor, in which case the Parties' remedies are subject to the Principal Agreement and applicable law. These procedural safeguards do not eliminate a mandatory statutory audit right.

13. Term

This DPA applies for the duration of Processing of Controller Personal Data under the Principal Agreement. Upon expiration or termination of the relevant Services, and at Controller's choice, Processor shall return or delete Controller Personal Data and delete remaining copies, unless applicable law requires retention. The parties may agree on commercially reasonable export and deletion methods and timeframes; any backup-retention period must be stated accurately in Schedule 1. Until deletion, Controller Personal Data remains protected under this DPA. On reasonable written request, Processor shall confirm completion of deletion, subject to permitted exceptions.

14. General Terms

Confidentiality. Confidentiality obligations shall be governed by the confidentiality provisions of the Principal Agreement. No separate NDA is incorporated by this DPA unless expressly identified and executed by both Parties.

Assignment. Processor may assign this DPA, together with the Principal Agreement, without Controller's consent to an Affiliate or to a successor in connection with a merger, acquisition, corporate reorganization or sale of all or substantially all of the assets or business to which this DPA relates. Otherwise, this DPA follows an assignment of the Principal Agreement permitted under that agreement. Any permitted assignee must assume the relevant data-protection obligations. This provision does not authorize a Restricted Transfer without the safeguards required by applicable law.

Amendments. Amendments must be agreed in writing by both Parties, except for routine updates to the Subprocessor list and technical schedules made in accordance with the change procedures expressly permitted here. Legally required amendments shall be negotiated promptly and in good faith.

Order of Precedence; Liability. This DPA governs to the extent of a direct conflict solely about the Processing of Controller Personal Data. The limitations of liability, exclusions of damages, indemnification provisions and allocation of risk in the Principal Agreement continue to apply to claims under this DPA to the maximum extent allowed by law. Nothing here limits non-waivable statutory liability or enforceable third-party rights under applicable transfer SCCs. This DPA does not create any separate uncapped indemnity, direct or indirect loss-of-profits exposure, or liability for Controller's own breach.

Notices. Notices shall be sent in accordance with the Principal Agreement, including to X3M at legal@x3mads.com and to Controller at its contractual legal-notice address, unless a Party gives written notice of updated contact details.

Governing Law; Attorneys' Fees. As between the Parties, this DPA is governed by the laws of the State of Delaware, without regard to conflict-of-law principles, consistent with the Principal Agreement. The Principal Agreement's provision granting the prevailing party in a litigated dispute reasonable attorneys' fees, costs and expenses as part of the judgment applies to disputes arising under this DPA. This DPA does not create a separate exclusive forum or displace mandatory data-protection law or mandatory transfer SCC rights.

Electronic Signatures. This DPA may be executed by counterparts and electronic signatures as permitted under the Principal Agreement and applicable law.

Execution. Unless signed separately, this DPA is effective on the effective date of the Principal Agreement or the date otherwise agreed by the Parties in writing. Processor: X3M LLC. Controller: the customer identified in the Principal Agreement.

SCHEDULE 1 — DETAILS OF PROCESSING

Controller: Customer identified in the Principal Agreement. Processor: X3M LLC. Subject matter: processing of data generated in connection with Controller's implementation and use of Loomit. Nature and purpose: collection, receipt, transmission, temporary handling, use, aggregation and permitted storage of SDK/ad events to provide mediation optimization, ad availability, cohort analytics, reporting, testing, debugging, support, fraud/security diagnostics and related Services at Controller's instruction, including Model Development under Section 3.B.

Categories of Data Subjects: end users of Controller's mobile games, applications and other digital properties integrating the Services.

Categories of Controller Personal Data: timestamps, event types (such as impression, request, error and SDK initialization), country, platform, advertising and device identifiers where permitted and available, X3M app-scoped pseudonymous identifiers, ad format, placement and related event properties, and location signals or other authorized optional integration fields to the extent actually collected. The collection, temporary use, storage and retention of location signals and advertising identifiers, where applicable, shall depend on the relevant implementation and configuration of the Services and remain subject to Sections 5 and 13 of this DPA.

Sensitive data: not intended to be submitted to Processor unless the Parties agree otherwise in writing and implement legally required controls.

Duration: for the relevant term of Services and any additional retention permitted or required under applicable law, with deletion/return under Section 13.

SCHEDULE 2 — TECHNICAL AND ORGANIZATIONAL MEASURES

Processor shall maintain risk-appropriate security measures.

Such measures may include, as appropriate to the nature of the Services and the relevant processing environment: encryption of data in transit and at rest where stored; role-based access controls, SSO and MFA for privileged access where applicable; access logging and review; security monitoring and vulnerability management; backup and disaster-recovery controls; incident response procedures; and personnel confidentiality obligations.

Processor may update these measures from time to time, provided that the overall level of security is not materially reduced.

SCHEDULE 3 — AUTHORIZED SUBPROCESSORS

The following providers are authorized to act as Subprocessors to the extent they process Controller Personal Data on Processor's behalf in connection with the Services:

Amazon Web Services (AWS) — cloud hosting, infrastructure, storage and related technical operations.

Databricks — analytics and data processing.

Imply — real-time analytics and database capabilities.

Papertrail — operational logging and monitoring.

The scope and location of Processing depend on the Services and infrastructure configuration applicable to Controller. Additional information may be provided upon Controller's reasonable written request.

Advertising networks and mediation providers independently engaged or chosen by Controller are excluded unless a particular provider is actually appointed by X3M as a Subprocessor for Controller Personal Data.

Changes to the list of authorized Subprocessors shall be governed by Section 9 of this DPA.

SCHEDULE 4 — CONDITIONAL CALIFORNIA TERMS

To the extent the CCPA/CPRA applies to specified Controller Personal Data and Processor qualifies as a "service provider" or "contractor" for the relevant Processing, Processor shall: (a) process that personal information solely for the specific business purposes of providing the mediation optimization, ad analytics, reporting, diagnostics and support Services described in Schedule 1, or otherwise as expressly permitted by California law; (b) not sell or share the personal information or retain, use or disclose it outside the permitted contractual purposes, including for purposes outside the direct business relationship except as legally permitted; (c) not combine it with personal information received from or on behalf of other persons, or collected from Processor's own interactions with consumers, except as permitted for service providers under the CCPA regulations, including to build or improve the quality of the Services provided that Processor does not use it to build or modify profiles of individual consumers for use in providing services to another business; (d) notify Controller if it determines it can no longer meet its applicable obligations; and (e) cooperate reasonably with legally required compliance checks and remediation, requests and privacy protections under applicable regulations. Controller retains the reasonable rights necessary to ensure permitted and compliant use.