B2B Data Protection Addendum

This Data Protection Addendum (“DPA”) forms part of the agreement governing use of the ChannelBridge.ai services (the “Agreement”) between Content Engine Marketing, a Florida corporation, operating ChannelBridge.ai (“ChannelBridge”) and the business customer identified in the Agreement (“Customer”).

This DPA describes the processing, protection, use, and handling of Personal Data in connection with the ChannelBridge services.

1. Purpose and Scope

ChannelBridge provides a business-to-business content distribution and reporting platform that discovers, curates, distributes, and measures publicly available content published by Customer.

Customer’s authorized reseller partners (“Partners”) may create ChannelBridge accounts and use ChannelBridge technology to display Customer’s content on their respective business websites.

In providing the Service, ChannelBridge processes a limited amount of account, technical, security, and website-interaction information necessary to:

administer Partner accounts;
deliver Customer content to Partner websites;
determine the Partner websites and URLs upon which Customer content is displayed;
measure content displays, views, and clicks;
prepare program-performance reporting for Customer;
maintain the security, integrity, and availability of the Service; and
detect, investigate, and prevent unauthorized activity, abuse, and security threats.

ChannelBridge does not use website visitor information for advertising, remarketing, audience targeting, data brokerage, individual lead identification, or unrelated commercial purposes.

2. Definitions

For purposes of this DPA:

“Applicable Data Protection Law” means any privacy or data-protection law applicable to the processing covered by this DPA, including, where applicable, U.S. state privacy laws and the General Data Protection Regulation of the European Union or substantially equivalent applicable laws.

“Customer Personal Data” means Personal Data processed by ChannelBridge on behalf of Customer in connection with the Service.

“Personal Data” means information that constitutes personal data, personal information, personally identifiable information, or a substantially equivalent term under Applicable Data Protection Law.

Personal Data may include technical identifiers such as an IP address, online or session identifier, or other information that Applicable Data Protection Law considers capable of relating to or identifying an individual or device.

“Security Incident” means unauthorized access to, acquisition of, alteration of, disclosure of, or destruction of Customer Personal Data that compromises the confidentiality, integrity, or security of such data.

“Subprocessor” means a third party engaged by ChannelBridge to process Customer Personal Data on behalf of ChannelBridge in connection with providing the Service.

3. Roles of the Parties

To the extent ChannelBridge processes Customer Personal Data on behalf of Customer, Customer shall be considered the controller, business, or equivalent party determining the purposes of processing, and ChannelBridge shall act as the processor, service provider, contractor, or equivalent party under Applicable Data Protection Law.

ChannelBridge may independently determine the purposes and means of processing limited administrative and security information necessary to:

establish and maintain ChannelBridge accounts;
authenticate authorized users;
maintain system and network security;
detect and prevent abuse;
maintain system logs;
comply with legal obligations; and
establish, exercise, or defend legal claims.

Such processing shall remain limited to legitimate operation and protection of the ChannelBridge Service and shall not include advertising, data brokerage, behavioral profiling, or unrelated exploitation of Personal Data.

4. Categories of Data Processed

4.1 Partner Account Information

ChannelBridge may maintain the following information concerning participating Partners:

Partner identifier;
Partner business email address;
salted, one-way cryptographic password hash;
account creation date;
account active/inactive status; and
Partner business website address.

ChannelBridge does not store Partner passwords in plaintext or in a form designed to permit recovery of the original password.

4.2 Website Technical and Interaction Information

When a visitor accesses a Partner website containing a ChannelBridge content feed, ChannelBridge may process:

IP address;
requested URL;
user agent;
ChannelBridge session identifier;
Partner page or URL displaying the ChannelBridge content feed;
Vendor article or content displayed;
Vendor article or content viewed;
Vendor article or content clicked; and
date and time associated with those events.

4.3 Web Server Security Logs

ChannelBridge maintains standard web-server logs, including Apache web-server logs, which may contain IP addresses, requested resources, timestamps, user-agent information, and related connection information.

Such logs are maintained for legitimate operational and security purposes, including investigation of suspicious activity, abuse prevention, system diagnostics, network security, and blocking malicious IP addresses.

4.4 Vendor Content

ChannelBridge discovers, curates, and distributes content that Customer has publicly published or otherwise made publicly available.

Customer remains responsible for ensuring that it possesses the rights necessary for ChannelBridge to access and redistribute such content through the Service.

To the extent publicly available Vendor content itself contains Personal Data, such data may necessarily be processed as part of the content distributed through the Service.

5. Website Visitor Privacy

ChannelBridge does not intentionally request or collect through its content feed direct visitor identifiers such as:

visitor names;
visitor email addresses;
telephone numbers;
postal addresses;
financial account information;
payment card information;
biometric information;
health information; or
precise geolocation information.

ChannelBridge does not attempt to determine the real-world identity of website visitors from technical or interaction information collected through the Service.

ChannelBridge does not create consumer marketing profiles or combine ChannelBridge website activity with external consumer datasets for the purpose of identifying, advertising to, or remarketing to individual visitors.

6. ChannelBridge Session Cookie

ChannelBridge may assign a session cookie or comparable session identifier when a visitor interacts with a ChannelBridge content feed.

The identifier is used solely to support operation of the ChannelBridge Service and to measure content interaction, including article views and clicks, for program-performance reporting.

ChannelBridge shall not use the ChannelBridge session identifier for:

targeted advertising;
behavioral advertising;
remarketing;
sale of audience information;
unrelated cross-service profiling; or
identification of an individual visitor.

The Partner operating the website on which the ChannelBridge feed appears remains responsible for providing any website notices or obtaining any consent required under Applicable Data Protection Law for cookies or similar technologies used on its website.

ChannelBridge will provide Partners with reasonable information concerning ChannelBridge technologies necessary to support such disclosures.

7. Purpose Limitation

ChannelBridge shall process Customer Personal Data only:

to provide the Service;
to perform the processing described in this DPA and the Agreement;
pursuant to documented instructions from Customer;
to protect the security and integrity of ChannelBridge systems;
as otherwise permitted for a service provider or processor under Applicable Data Protection Law; or
where required by applicable law.

ChannelBridge shall not:

sell Customer Personal Data;
share Customer Personal Data for cross-context behavioral advertising;
use Customer Personal Data for targeted advertising;
rent or commercially distribute raw visitor information;
use Customer Personal Data to build individual consumer profiles;
use Customer Personal Data to identify anonymous website visitors;
use Customer Personal Data for unrelated marketing purposes; or
disclose Customer Personal Data to Customer’s Vendors, Partners, or other third parties except as necessary to provide the Service or as required by law.

8. Vendor Reporting

ChannelBridge uses technical and interaction information to evaluate and report on the effectiveness of Customer’s ChannelBridge program.

Reporting may include:

participating Partner reach;
number of Partner websites displaying Customer content;
URLs upon which Customer content is displayed;
content distribution;
backlinks;
article displays or impressions;
article views;
article clicks;
content popularity; and
aggregate visitor activity.

Customer reporting may be broken down by participating Partner website so that Customer may evaluate content distribution and performance within its reseller network.

Customer does not receive raw website visitor IP addresses, session identifiers, or information intended to identify individual website visitors.

ChannelBridge reporting is intended to measure Partner and content performance rather than individual consumer behavior.

9. Sale, Sharing, and Commercial Exploitation

ChannelBridge does not sell Customer Personal Data or website visitor Personal Data.

ChannelBridge does not share such information for cross-context behavioral advertising and does not provide raw visitor information to data brokers, advertisers, audience-enrichment providers, or other parties for independent commercial use.

ChannelBridge shall not retain, use, or disclose Customer Personal Data outside the direct business relationship between ChannelBridge and Customer except as permitted or required by Applicable Data Protection Law.

ChannelBridge shall not combine Customer Personal Data with Personal Data received from unrelated customers or third parties for advertising, profiling, consumer enrichment, or other unrelated commercial purposes.

Nothing in this Section prohibits ChannelBridge from using information reasonably necessary to maintain network or information security, detect malicious activity, prevent fraud or abuse, comply with law, or produce data that has been aggregated or deidentified so that it is no longer Personal Data under Applicable Data Protection Law.

10. Confidentiality

ChannelBridge shall limit access to Customer Personal Data to personnel who require access to perform or secure the Service.

Persons authorized to access Customer Personal Data shall be subject to appropriate confidentiality obligations.

ChannelBridge currently maintains highly restricted administrative access to production systems.

11. Security Measures

ChannelBridge shall maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature and limited scope of the Personal Data processed.

Current safeguards include:

HTTPS/TLS encryption for network communications;
firewall-protected servers;
automated monitoring of system and authentication logs;
automated blocking of suspicious or abusive IP addresses and related security controls;
restricted administrative access;
IP-based administrative access restrictions;
SSH key authentication for server administration;
additional authentication credentials for administrative access;
a highly limited number of authorized administrators;
salted, one-way password hashing algorithm;
regular vulnerability and security updates; and
automatic application of security updates where operationally appropriate.

ChannelBridge may modify its security controls from time to time provided that such modifications do not materially reduce the overall security of the Service.

No security system can guarantee absolute protection from every possible threat, and the obligations in this DPA require reasonable safeguards appropriate to the nature of the Service rather than an absolute guarantee against a Security Incident.

12. Subprocessors

As of the effective date of this DPA, ChannelBridge does not engage Subprocessors to process Customer Personal Data in connection with providing the ChannelBridge Service.

ChannelBridge’s principal application systems and data-processing infrastructure are privately operated and controlled by ChannelBridge.

If ChannelBridge later engages a Subprocessor to process Customer Personal Data, ChannelBridge shall ensure that the Subprocessor is subject to written data-protection obligations appropriate to the processing and at least substantially equivalent to the relevant protections required of ChannelBridge under this DPA.

Where Applicable Data Protection Law requires prior notice, authorization, or an opportunity to object to a new Subprocessor, ChannelBridge shall comply with those requirements.

13. Data Minimization

ChannelBridge shall limit collection and processing of Personal Data to information reasonably necessary and proportionate to:

provide the Service;
generate program-performance analytics;
maintain Partner accounts;
maintain system security;
diagnose technical issues; and
comply with applicable legal obligations.

ChannelBridge shall not intentionally collect sensitive categories of Personal Data through the ChannelBridge content feed.

The Service is designed for business-to-business use and is not directed toward children.

14. Retention and Deletion

ChannelBridge shall retain Personal Data only for as long as reasonably necessary to provide the Service, maintain legitimate security and operational records, generate Customer reporting, satisfy applicable legal obligations, resolve disputes, or enforce contractual rights.

Upon termination of Customer’s Service, ChannelBridge shall, upon request and subject to applicable legal, security, archival, and technical requirements, delete or return Customer Personal Data that is no longer reasonably required.

ChannelBridge may retain:

aggregated reporting information;
statistical information;
properly deidentified information; and
security or system records that ChannelBridge is legally or operationally required to retain,

provided that retained information is not subsequently used for a purpose prohibited by this DPA.

15. Data Subject and Consumer Requests

To the extent required by Applicable Data Protection Law, ChannelBridge shall provide commercially reasonable assistance to Customer in responding to an authenticated request from an individual concerning Customer Personal Data processed by ChannelBridge on Customer’s behalf.

If ChannelBridge receives such a request directly and reasonably determines that Customer is responsible for responding to the request, ChannelBridge may direct the requester to Customer or notify Customer of the request.

ChannelBridge shall not independently respond on Customer’s behalf unless legally required to do so or authorized by Customer.

16. Security Incidents

ChannelBridge shall notify Customer without undue delay after becoming aware of a confirmed Security Incident affecting Customer Personal Data where notification is required under Applicable Data Protection Law.

The notification shall, to the extent reasonably available, describe:

the nature of the Security Incident;
the categories of information affected;
known or reasonably anticipated consequences;
corrective or containment actions taken by ChannelBridge; and
information reasonably necessary for Customer to evaluate its legal notification obligations.

ChannelBridge shall take reasonable steps to contain, investigate, mitigate, and remediate a Security Incident.

Notification of a Security Incident shall not constitute an admission of fault, liability, or violation of law.

17. Compliance Information

Upon reasonable written request, ChannelBridge shall provide Customer with information reasonably necessary to demonstrate ChannelBridge’s compliance with its obligations under this DPA.

Where required by Applicable Data Protection Law, Customer may take reasonable and proportionate steps to verify that ChannelBridge processes Customer Personal Data consistently with this DPA.

Any review or verification shall:

protect ChannelBridge confidential and security-sensitive information;
avoid unreasonable interference with ChannelBridge operations;
be limited to information relevant to the processing covered by this DPA; and
not require disclosure of information that would materially compromise the security of ChannelBridge systems or other customers.

18. U.S. State Privacy Law Requirements

Where ChannelBridge processes Personal Data as a service provider, processor, or contractor under an applicable U.S. state privacy law, ChannelBridge shall process such information only for the limited and specified business purposes described in the Agreement and this DPA.

To the extent required by applicable law, ChannelBridge shall:

comply with applicable obligations imposed upon processors, service providers, or contractors;
provide the same level of privacy protection required of such parties by applicable law;
notify Customer if ChannelBridge determines that it can no longer meet a material applicable privacy-law obligation;
permit Customer to take reasonable and appropriate steps as legally required to help ensure that Personal Data is used consistently with Customer’s obligations; and
cooperate with reasonable corrective actions where necessary to prevent or remediate unauthorized use of Customer Personal Data.

Nothing in this DPA requires ChannelBridge to assume an obligation imposed solely upon Customer in its capacity as a business or controller.

19. European and International Data Protection

The parties acknowledge that ChannelBridge primarily provides services to businesses located in the United States.

The mere availability of a Customer or Partner website to persons outside the United States shall not, by itself, be construed by the parties as an agreement that any particular foreign data-protection law applies.

If processing under the Agreement is subject to the European Union General Data Protection Regulation, UK GDPR, or another data-protection regime imposing processor obligations, the parties shall interpret this DPA consistently with the applicable requirements.

Where ChannelBridge acts as a processor subject to such law, ChannelBridge shall, to the extent legally required:

process Personal Data only upon documented instructions from the applicable controller;
ensure persons authorized to process Personal Data are subject to confidentiality obligations;
maintain security measures appropriate to the risk;
reasonably assist the controller with applicable data-subject rights;
reasonably assist with applicable security, breach-notification, and data-protection-assessment obligations;
delete or return Personal Data following completion of the applicable services, subject to legally permitted retention;
make available information reasonably necessary to demonstrate compliance; and
comply with applicable requirements concerning engagement of subprocessors.

If a legally required international data-transfer mechanism is necessary for a particular Customer relationship, the parties shall cooperate in implementing an appropriate lawful transfer mechanism, including applicable standard contractual clauses where required.

20. Customer Responsibilities

Customer is responsible for:

the lawfulness of its instructions to ChannelBridge;
its own compliance with Applicable Data Protection Law;
ensuring that Vendor content made available for distribution may lawfully be distributed through ChannelBridge;
providing any privacy notices for which Customer is legally responsible; and
obtaining any consent or authorization that Applicable Data Protection Law specifically requires Customer to obtain.

Nothing in this DPA transfers to ChannelBridge legal obligations that Applicable Data Protection Law assigns exclusively to Customer.

21. Partner Responsibilities

Partners independently operate and control their respective business websites.

The Partner operating a website incorporating a ChannelBridge content feed is responsible for its own website privacy notice, cookie disclosures, consent mechanism, and other obligations applicable to operation of that Partner website.

ChannelBridge shall make reasonable information concerning the ChannelBridge feed, session technology, and categories of information processed available to participating Partners so that they can accurately describe ChannelBridge technology in their website privacy disclosures.

22. No Sensitive Personal Data Intended

The parties acknowledge that the ChannelBridge Service is not designed to collect or process sensitive Personal Data.

Customer shall not intentionally submit or instruct ChannelBridge to process sensitive categories of Personal Data, including:

financial account credentials;
payment-card information;
medical or health information;
biometric identifiers;
government identification numbers;
precise geolocation information; or
other legally designated sensitive Personal Data,

unless ChannelBridge expressly agrees in writing to such processing.

23. Changes in Law

If a change in Applicable Data Protection Law requires modification of this DPA, the parties shall cooperate in good faith to implement amendments reasonably necessary to maintain compliance while preserving the intended commercial purposes of the Agreement.

24. Conflict and Order of Precedence

If there is a conflict between this DPA and the Agreement concerning the processing or protection of Personal Data, this DPA shall control solely with respect to that conflict.

Except as modified by this DPA, the Agreement remains in full force and effect.

25. Term

This DPA becomes effective on the effective date of the Agreement or the date on which ChannelBridge begins processing Customer Personal Data, whichever occurs first.

This DPA remains effective for as long as ChannelBridge processes Customer Personal Data subject to the Agreement.

Provisions concerning confidentiality, security incidents, use limitations, deletion, and legally permitted retention shall survive termination to the extent applicable to Personal Data retained after termination.

SCHEDULE A — PROCESSING DETAILS

Subject Matter:
Distribution and measurement of publicly available Vendor content through participating reseller Partner websites.

Nature of Processing:
Collection, transmission, organization, storage, analysis, aggregation, reporting, security monitoring, and deletion of limited technical and content-interaction information.

Purpose of Processing:
Providing ChannelBridge services; administering Partner accounts; delivering Vendor content; attributing content distribution to participating Partner websites; measuring content displays, views, and clicks; generating Vendor program-performance reporting; maintaining system security; and preventing abuse.

Duration:
For the duration of the ChannelBridge services and thereafter only to the extent reasonably required for security, legal, contractual, archival, or legitimate operational purposes.

Categories of Data Subjects:

Partner business representatives and account users; and
visitors to participating Partner websites who encounter or interact with ChannelBridge content.

Categories of Personal Data:

Partner account information:

business email address;
Partner identifier;
account status and creation date;
business website address; and
password hash.

Website technical and interaction information:

IP address;
user agent;
session identifier;
requested URL;
Partner page URL;
content displayed;
content viewed;
content clicked; and
date/time information.

Sensitive Personal Data:
None intentionally collected.

Processing Frequency:
Continuous as necessary to operate the ChannelBridge Service.

Subprocessors:
None currently used for Customer Personal Data processing.

SCHEDULE B — SECURITY MEASURES

ChannelBridge currently maintains measures including:

HTTPS/TLS-protected network communications;
firewall-protected private systems;
automated server and authentication-log monitoring;
automated IP blocking, abuse prevention and related mechanisms;
IP-restricted administrative access;
SSH key authentication for server administration;
additional administrative authentication credentials;
highly restricted administrative privileges;
salted one-way password hashing;
automated vulnerability and security updates where operationally appropriate;
security logging for investigation of unauthorized or malicious activity; and
limitation of processing to the minimum information reasonably required to provide and secure the Service.