Data Processing Addendum

For personal information that Lotly processes on behalf of a California-resident consumer or under a Subscriber's account that processes information about California residents, Lotly acts as a service provider as defined in Cal. Civ. Code § 1798.140(ag) and certifies that: (i) Lotly will not sell or share Personal Information; (ii) Lotly will not retain, use, or disclose Personal Information outside the direct business relationship with Subscriber or for any commercial purpose other than the specific purposes set forth in the MSA; (iii) Lotly will not retain, use, or disclose Personal Information outside of the contracted business purposes; (iv) Lotly will not combine Personal Information received from Subscriber with personal information Lotly receives from any other source, except as expressly permitted by Cal. Civ. Code § 1798.140(ag)(1)(D); and (v) Lotly will notify Subscriber if it makes a determination that it can no longer meet its obligations under CCPA/CPRA. Lotly will, on Subscriber's instruction and to the extent technically feasible, delete Personal Information identified by Subscriber pursuant to a verifiable consumer request under Cal. Civ. Code § 1798.105 within 45 days, subject to FCRA retention exceptions.

For personal information of Colorado residents, Lotly is a processor under C.R.S. § 6-1-1303(19) and Subscriber is the controller. Lotly will: (i) process personal information only in accordance with Subscriber's documented instructions; (ii) ensure persons authorized to process personal information are subject to confidentiality obligations; (iii) implement appropriate technical and organizational measures; (iv) engage subprocessors only with prior general written authorization (Subscriber may object to additions); (v) assist Subscriber in fulfilling Colorado consumer-rights requests (access, correction, deletion, opt-out of sale/targeted-advertising/profiling); (vi) make available all information reasonably necessary to demonstrate compliance and allow reasonable audits; and (vii) at Subscriber's option, delete or return all personal information after the end of services, subject to legal-hold obligations.

For personal information of Virginia residents, Lotly is a processor under Va. Code § 59.1-575 and Subscriber is the controller. Lotly will process personal data only on Subscriber's documented instructions, maintain a duty of confidentiality, assist with consumer-rights requests, make information available to demonstrate compliance, allow reasonable assessments, and engage subprocessors only with prior written authorization. Lotly will not sell personal data; Lotly will not process personal data for advertising or profiling purposes outside the contracted scope; and at termination Lotly will, at Subscriber's election, return or delete the personal data subject to legal-hold exceptions.

For personal information of Connecticut residents, Lotly is a processor under Conn. Gen. Stat. § 42-515. Lotly will process personal data only on Subscriber's documented instructions, maintain confidentiality of persons processing the data, ensure equivalent flow-down obligations with subprocessors (requiring prior written authorization), provide assistance with consumer-rights responses and data-security assessments, and at termination return or delete personal data at Subscriber's option subject to legal-hold exceptions.

The Washington My Health My Data Act (Wash. Rev. Code Ch. 19.373) regulates the collection of "consumer health data." Lotly does not knowingly collect consumer health data through the Services, and Subscriber will not upload, transmit, or instruct Lotly to process consumer health data without a separately-executed written agreement that establishes the bases required by RCW 19.373.030 (consent, written authorization, or contract necessity). Any inadvertent receipt of consumer health data will be promptly returned or deleted, and Lotly will assist Subscriber in honoring deletion and access requests directed to Subscriber.

The Illinois Biometric Information Privacy Act (740 ILCS 14/) regulates the collection of biometric identifiers and biometric information. Lotly does not collect, capture, store, or otherwise obtain biometric identifiers or biometric information from any individual through the Services, except to the extent the Subscriber separately enables a feature that does so on lawful BIPA-compliant terms with the individual's affirmative consent and a published retention schedule. Subscriber is responsible for compliance with BIPA on any such feature it enables; Lotly will assist by maintaining the technical controls that gate access to and disposal of any such data.