Data Processing Addendum

Effective Date: August 1, 2026

This Data Processing Addendum (“DPA”) forms part of each written agreement, proposal, statement of work, order, or other contract (collectively, the “Agreement”) under which Green Moon Holdings, Inc. (“Green Moon”) Processes Client Personal Data on behalf of a client (“Client”). This DPA applies only to the extent Green Moon acts as a Processor, Service Provider, Contractor, or similar regulated recipient of Client Personal Data.

1. Definitions

“Applicable Data Protection Law” means each privacy, data-protection, or data-security law that applies to the Processing of Client Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 (“EU GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and other applicable U.S. state comprehensive privacy laws.

“Client Personal Data” means Personal Data Processed by Green Moon on behalf of Client in connection with the Services. It excludes Personal Data for which Green Moon independently determines the purposes and means of Processing, including Green Moon’s own business-contact, account-management, security, and legal-compliance data.

“Controller,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Process,” “Processor,” “Sale,” “Service Provider,” “Share,” and “Subprocessor” have the meanings given by Applicable Data Protection Law. “Services” means the services Green Moon provides under the Agreement. “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

2. Scope and Order of Precedence

This DPA applies to Green Moon’s Processing of Client Personal Data to provide the Services. If there is a conflict concerning privacy or data protection, the order of precedence is: the SCCs or mandatory transfer terms; this DPA; the Agreement; and other documents incorporated into the Agreement.

3. Roles and Instructions

Client is the Controller or Business and Green Moon is the Processor, Service Provider, or Contractor for Client Personal Data, except where the parties expressly agree otherwise or Applicable Data Protection Law assigns a different role.

Client instructs Green Moon to Process Client Personal Data as necessary to provide, secure, support, and improve the contracted Services; comply with the Agreement and Client’s documented instructions; prevent misuse and security threats; and comply with law. The Agreement, this DPA, applicable statements of work, project tickets, emails, and other written directions from authorized Client personnel constitute documented instructions.

Green Moon will Process Client Personal Data only on Client’s documented instructions unless law requires otherwise. If legally permitted, Green Moon will inform Client before Processing required by law. Green Moon will notify Client if it believes an instruction violates Applicable Data Protection Law and may suspend the affected Processing until the issue is resolved.

Client Responsibilities

Client is responsible for determining whether the Services and its instructions comply with Applicable Data Protection Law; providing required notices; obtaining required consents; establishing a lawful basis; responding to Data Subjects except to the extent Green Moon must assist; and ensuring that Client Personal Data is accurate, relevant, limited, and collected lawfully.

Client will not provide sensitive, special-category, highly regulated, or children’s data unless the Agreement expressly permits it and the parties document appropriate safeguards. Without express written agreement, the Services are not intended to Process protected health information subject to HIPAA, stored payment-card data, Social Security numbers, government identification numbers, biometric identifiers, or data subject to heightened localization or secrecy restrictions.

4. Confidentiality and Personnel

Green Moon will ensure that personnel authorized to Process Client Personal Data are subject to confidentiality obligations and receive appropriate privacy and security guidance. Access will be limited to personnel and contractors who need it to perform the Services, support operations, maintain security, or comply with law.

5. Security Measures

Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of Processing, as well as risks to individuals, Green Moon will maintain appropriate technical and organizational measures designed to protect Client Personal Data. The measures are described in Annex B and may evolve provided that the overall level of protection is not materially diminished.

6. Personal Data Breach

Green Moon will notify Client without undue delay after becoming aware of a confirmed Personal Data Breach affecting Client Personal Data. The notice will include, to the extent reasonably available, the nature of the breach, categories of affected data and Data Subjects, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be provided in phases as it becomes available.

Green Moon will take reasonable steps to contain, investigate, mitigate, and remediate the breach and will reasonably cooperate with Client’s legally required notifications. Client is responsible for determining whether to notify regulators, Data Subjects, or others unless law places that obligation directly on Green Moon.

7. Subprocessors

Client grants Green Moon general written authorization to engage Subprocessors. Green Moon will impose data-protection obligations on each Subprocessor that are no less protective in material respects than the obligations applicable to Green Moon for the relevant Processing. Green Moon remains responsible for a Subprocessor’s performance to the extent required by law.

Green Moon will maintain a current list of Subprocessors or make it available upon request. Green Moon will provide reasonable advance notice of a new Subprocessor that will materially Process Client Personal Data, which may be provided by email, an online list, or project documentation. Client may object within 15 days on reasonable data-protection grounds. The parties will work in good faith to resolve the objection. If no reasonable alternative is available, either party may terminate the affected portion of the Services, subject to the Agreement.

8. Data Subject Requests

If Green Moon receives a request from a Data Subject concerning Client Personal Data, Green Moon will, unless legally prohibited, refer the request to Client and not respond substantively except on Client’s instructions or as required by law. Taking into account the nature of the Processing, Green Moon will provide reasonable assistance so Client can respond to requests under Applicable Data Protection Law.

9. Compliance Assistance

Taking into account the nature of Processing and information available to Green Moon, Green Moon will reasonably assist Client with security obligations, breach assessments and notifications, data-protection impact assessments, prior consultations with authorities, and other compliance obligations directly related to Green Moon’s Processing. The parties may agree on reasonable fees for assistance beyond the ordinary scope of the Services.

10. Return and Deletion

Upon termination or expiration of the Services, and at Client’s written request, Green Moon will return or delete Client Personal Data within a commercially reasonable period, unless law requires retention or the data remains in backups that cannot reasonably be isolated. Backup data will remain protected and will be deleted or overwritten through normal cycles. Green Moon may retain records necessary to demonstrate compliance, resolve disputes, enforce the Agreement, or satisfy legal obligations, provided retained Client Personal Data is not used for another purpose.

11. Information and Audits

Green Moon will make available information reasonably necessary to demonstrate compliance with this DPA. No more than once annually, unless required by a regulator or following a material security incident, Client may request a reasonable audit of Green Moon’s relevant controls. Audits must occur during normal business hours, on reasonable advance notice, without unreasonable disruption, and with protections for other clients’ confidentiality and security. Green Moon may satisfy a request through documentation, questionnaires, certifications, or an independent report. On-site audits require mutual agreement and are at Client’s expense unless they identify a material breach by Green Moon.

12. Government and Legal Requests

Unless prohibited by law, Green Moon will notify Client of a legally binding demand for Client Personal Data and will direct the requesting authority to Client where appropriate. Green Moon will review demands for validity and scope, challenge unlawful or disproportionate demands where reasonable, and disclose only the minimum information legally required.

13. International Transfers

Green Moon may Process Client Personal Data in the United States and other countries where Green Moon or authorized Subprocessors operate. Green Moon will use a lawful transfer mechanism where required.

EEA Transfers

If Client Personal Data protected by the EU GDPR is transferred to Green Moon in a country not recognized as adequate, the SCCs are incorporated by reference. Module Two applies to Controller-to-Processor transfers and Module Three applies to Processor-to-Processor transfers, as appropriate.

UK Transfers

For restricted transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Commission SCCs is incorporated by reference and completed as described in Annex D.

Swiss Transfers

For transfers subject to Swiss law, the SCCs apply with modifications necessary to cover Swiss Personal Data and recognize the Swiss Federal Data Protection and Information Commissioner as the competent authority where applicable.

Transfer Assessments and Supplementary Measures

Each party will provide information reasonably necessary for the other to assess restricted transfers. Green Moon will implement supplementary measures where reasonably necessary and will notify Client if it can no longer comply with an applicable transfer mechanism.

14. U.S. State Privacy Terms

To the extent Green Moon acts as a Service Provider, Contractor, or Processor under a U.S. state privacy law, Green Moon will:

• Process Personal Information only for the limited and specified purposes described in the Agreement, this DPA, and Client’s documented instructions.
• Not Sell or Share the Personal Information, retain, use, or disclose it outside the direct business relationship, or combine it with Personal Information received from another person or collected from Green Moon’s own interaction with a consumer, except as permitted by applicable law.
• Provide the same level of privacy protection required of Client for the relevant Personal Information and notify Client if Green Moon determines it can no longer meet its obligations.
• Permit Client, subject to Section 11, to take reasonable and appropriate steps to verify compliant use and to stop and remediate unauthorized use.
• Require Subprocessors to comply with corresponding restrictions and assist Client with consumer requests as required by this DPA.

The parties acknowledge that Client discloses Personal Information to Green Moon for business purposes and not as consideration for money or other valuable consideration.

15. Liability

Each party’s liability arising out of this DPA is subject to the exclusions and limitations in the Agreement, except to the extent prohibited by Applicable Data Protection Law or the SCCs.

16. Term and Termination

This DPA remains effective while Green Moon Processes Client Personal Data. Provisions that by their nature should survive, including confidentiality, deletion, audits, transfer terms, liability, and Data Subject rights under the SCCs, will survive termination.

17. Miscellaneous

Except as modified by this DPA, the Agreement remains in effect. Electronic signatures and counterparts are valid. If a provision is unenforceable, it will be interpreted to best achieve its lawful purpose and the remainder will continue in effect.

Annex A — Processing Details

Subject Matter and Duration

Green Moon Processes Client Personal Data to provide the Services for the term of the Agreement and any lawful retention period afterward.

Nature and Purpose of Processing

Depending on the Services, Processing may include collecting, accessing, receiving, recording, organizing, storing, hosting, adapting, retrieving, consulting, analyzing, combining, segmenting, transmitting, displaying, securing, troubleshooting, backing up, deleting, and otherwise using Client Personal Data to perform marketing strategy, website design or development, hosting or maintenance, analytics, search optimization, email or campaign services, creative production, event support, customer-relationship management, reporting, and related consulting or support.

Categories of Data Subjects

Data Subjects may include Client personnel and contractors; Client’s current and prospective customers, members, students, applicants, donors, subscribers, website visitors, event participants, and business contacts; Client’s vendors and partners; and other individuals whose Personal Data Client provides or makes accessible.

Categories of Personal Data

Personal Data may include names and contact details; professional, educational, and organizational information; communications and form submissions; marketing preferences and campaign interactions; device, cookie, website-usage, analytics, referral, and attribution data; customer-relationship and transaction information; project content; and other data described in the Agreement or Client’s instructions.

Special Categories and Sensitive Data

No special-category or sensitive data is intended unless expressly identified and authorized in writing with appropriate safeguards.

Annex B — Technical and Organizational Measures

Green Moon maintains measures appropriate to the risks and nature of the Services, which may include documented security and privacy practices; confidentiality obligations; role-based or need-to-know access; unique accounts; password controls; multifactor authentication where available and appropriate; encryption in transit and at rest where supported; reasonable patching, malware protection, and secure configuration; backups and recovery procedures; logging and incident-response practices; risk-based vendor review; data minimization and retention practices; physical safeguards; and security and privacy guidance for personnel.

Annex C — Subprocessor Information

Client authorizes Green Moon to use providers in categories including cloud hosting and infrastructure; website and content-management platforms; forms and data-capture tools; email, file storage, and collaboration; analytics and tag management; marketing automation and customer-relationship management; advertising and social platforms; scheduling and video; security and spam prevention; project management and support; and accounting or payment administration.

Specific providers may vary by project and may include Client-selected systems. Green Moon will identify material Subprocessors in the applicable statement of work, project documentation, an online list, or a list available on request from pr*****@*******on.space.

Annex D — International Transfer Terms

EU Standard Contractual Clauses

The SCCs are incorporated by reference. Module Two applies where Client is a Controller and Green Moon is a Processor; Module Three applies where Client is a Processor and Green Moon is a Subprocessor. The optional docking clause applies. General written authorization for Subprocessors applies, with the notice period in Section 7. The optional independent dispute-resolution language does not apply. Unless the parties select another eligible EU Member State, the SCCs are governed by Irish law and the courts of Ireland have jurisdiction. Annex A supplies the transfer description; Annex B supplies security measures; and Annex C supplies Subprocessor information.

UK Addendum

For UK restricted transfers, the mandatory clauses of the UK International Data Transfer Addendum are incorporated. The parties’ details are those in the Agreement; the SCC modules and selections are stated above; and Annexes A, B, and C complete the relevant tables.

Swiss Modifications

For Swiss transfers, references to the GDPR include the Swiss Federal Act on Data Protection where applicable; references to EU Member State law and authorities are adapted to Switzerland; and Swiss Data Subjects may enforce the SCCs as modified.

Term of Use

Effective Date: August 1, 2026

These Terms of Use (“Terms”) govern your access to and use of GreenMoon.space and any other website operated by Green Moon Holdings, Inc. that links to these Terms (collectively, the “Site”). By accessing or using the Site, you agree to these Terms. If you do not agree, do not use the Site.

1. About Green Moon and These Terms

Green Moon Holdings, Inc. (“Green Moon,” “we,” “us,” or “our”) provides marketing strategy, website, design, technology, analytics, communications, and related consulting services.

These Terms govern the Site and generally available content and resources. They do not replace a proposal, statement of work, master services agreement, hosting or maintenance agreement, nondisclosure agreement, or other written contract for paid services. If a separate agreement conflicts with these Terms, the separate agreement controls for the subject matter it covers.

2. Eligibility and Authority

You must be at least 18 years old and legally capable of entering a contract to use the Site. If you use the Site on behalf of an organization, you represent that you are authorized to bind that organization to these Terms, and “you” includes that organization.

3. Privacy

Our Privacy Policy explains how we collect, use, disclose, and protect Personal Information. By using the Site, you acknowledge the practices described in the Privacy Policy. If Green Moon processes personal data on behalf of a client in providing contracted services, the applicable agreement and Data Processing Addendum govern that processing.

4. Limited License to Use the Site

Subject to these Terms, Green Moon grants you a limited, revocable, nonexclusive, nontransferable license to access and use the Site and its content for your personal use or legitimate internal business purposes. This license does not transfer ownership of any content or intellectual property.

5. Intellectual Property

The Site and its content, including text, graphics, designs, logos, trademarks, service marks, photographs, videos, audio, downloads, templates, frameworks, methods, software, and the selection and arrangement of those materials, are owned by or licensed to Green Moon and are protected by intellectual-property laws.

Except as expressly permitted, you may not copy, reproduce, republish, upload, post, transmit, distribute, sell, license, modify, create derivative works from, publicly display, publicly perform, frame, mirror, or exploit Site content without Green Moon’s prior written permission.

6. Downloadable Resources

Green Moon may offer guides, checklists, reports, templates, webinars, or other resources. Unless a resource states different license terms, you may download and use it for your personal use or internal business purposes. You may not resell, sublicense, publish, distribute, remove attribution from, or use a resource to create a competing commercial product or service.

7. Prohibited Conduct

You agree not to:

• Use the Site for an unlawful, fraudulent, deceptive, abusive, or harmful purpose.
• Interfere with Site operation, security, availability, or another user’s access.
• Attempt to gain unauthorized access to accounts, systems, networks, source code, or data.
• Introduce malware, malicious code, excessive traffic, denial-of-service activity, or other harmful material.
• Circumvent access controls, security measures, rate limits, robots instructions, or content protections.
• Scrape, crawl, harvest, index, extract, or systematically collect Site content or data through automated means, except for standard search-engine indexing that follows our published instructions.
• Use Site content or data to train, fine-tune, evaluate, or operate an artificial-intelligence or machine-learning model without Green Moon’s prior written permission.
• Impersonate another person, misrepresent affiliation, or submit false or misleading information.
• Infringe intellectual-property, privacy, publicity, confidentiality, or other rights.
• Use the Site to transmit unsolicited commercial messages or collect contact information for unauthorized marketing.

8. Submissions and Communications

If you submit an inquiry, brief, file, feedback, testimonial, idea, or other material, you represent that you have the right to provide it and that our receipt and permitted use will not violate law or another person’s rights. Do not submit confidential, proprietary, sensitive, or regulated information through a general Site form unless Green Moon has authorized the method and agreed to protect the information.

You retain ownership of your submissions. You grant Green Moon a nonexclusive, worldwide, royalty-free license to host, copy, transmit, and use submissions as reasonably necessary to respond to you, evaluate a potential engagement, provide requested services, operate the Site, and comply with law. If you voluntarily provide suggestions or feedback, Green Moon may use them without restriction or compensation, provided we do not publicly identify you without permission.

Submitting a form, sending an email, or scheduling a consultation does not create a client, fiduciary, agency, partnership, joint-venture, or other professional relationship. A service relationship begins only when the parties enter an applicable written agreement.

9. Informational Content; No Professional Advice

Site content is provided for general informational and educational purposes. It is not legal, financial, accounting, tax, employment, cybersecurity, or other regulated professional advice. Marketing and technology outcomes depend on many factors, and examples, case studies, testimonials, estimates, forecasts, or past results do not guarantee future performance.

Green Moon may discuss emerging technologies, data, analytics, search platforms, advertising systems, and artificial intelligence. These subjects change quickly. You are responsible for evaluating whether any information or recommendation is appropriate for your circumstances and for obtaining specialized advice where needed.

10. Third-Party Services and Links

The Site may contain links to, integrations with, or embedded content from third parties. Green Moon does not control and is not responsible for third-party content, availability, security, products, services, or practices. A link or reference does not imply endorsement. Your use of third-party services is governed by their terms and privacy notices.

11. Availability and Changes

We may modify, suspend, restrict, or discontinue any part of the Site or its content at any time. We do not guarantee that the Site will always be available, error-free, secure, or current. We may correct errors or update content without notice.

12. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SITE AND ALL CONTENT AND RESOURCES ARE PROVIDED “AS IS” AND “AS AVAILABLE.” GREEN MOON DISCLAIMS ALL EXPRESS, IMPLIED, AND STATUTORY WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, QUIET ENJOYMENT, AND SECURITY. GREEN MOON DOES NOT WARRANT THAT THE SITE WILL MEET YOUR REQUIREMENTS OR BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS.

Some jurisdictions do not allow certain warranty exclusions, so some exclusions may not apply to you.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, GREEN MOON AND ITS OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, AGENTS, LICENSORS, AND AFFILIATES WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, BUSINESS OPPORTUNITY, GOODWILL, DATA, OR USE, ARISING FROM OR RELATING TO THE SITE OR THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE TOTAL AGGREGATE LIABILITY OF GREEN MOON AND THE OTHER RELEASED PARTIES FOR ALL CLAIMS ARISING FROM OR RELATING TO THE SITE OR THESE TERMS WILL NOT EXCEED THE GREATER OF ONE HUNDRED U.S. DOLLARS OR THE AMOUNT YOU PAID GREEN MOON, IF ANY, SPECIFICALLY FOR ACCESS TO THE SITE DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM.

These limitations do not apply to liability that cannot lawfully be limited. Separate service agreements may contain different limitations for paid services.

14. Indemnification

To the extent permitted by law, you will defend, indemnify, and hold harmless Green Moon and its officers, directors, employees, contractors, agents, licensors, and affiliates from claims, damages, liabilities, judgments, costs, and expenses, including reasonable attorneys’ fees, arising from your unlawful or unauthorized use of the Site, your submissions, your violation of these Terms, or your infringement of another person’s rights. Green Moon may control the defense of a matter subject to indemnification, and you will reasonably cooperate.

15. Copyright and Rights Complaints

If you believe Site content infringes your copyright or other rights, send a written notice to pr*****@*******on.space identifying the protected work or right, the challenged material and its location, your contact information, a statement of good-faith belief, a statement under penalty of perjury that the information is accurate and you are authorized to act, and your physical or electronic signature. Green Moon may remove or restrict access to material while reviewing a complaint.

16. Changes to These Terms

We may update these Terms by posting a revised version and changing the Effective Date. Changes apply prospectively when posted unless a later date is stated. Your continued use of the Site after the effective date of revised Terms constitutes acceptance of the revised Terms.

17. Governing Law and Venue

These Terms are governed by the laws of the State of Ohio, without regard to conflict-of-law principles. Any dispute arising from or relating to the Site or these Terms must be brought exclusively in the state or federal courts located in Franklin County, Ohio, and you consent to personal jurisdiction and venue there. This section does not prevent either party from seeking injunctive or equitable relief in another court with jurisdiction to protect intellectual property, confidential information, or system security.

18. General Terms

These Terms and the documents they expressly incorporate are the entire agreement concerning use of the Site. If a provision is unenforceable, it will be modified to the minimum extent necessary and the remaining provisions will remain in effect. Green Moon’s failure to enforce a provision is not a waiver. You may not assign these Terms without Green Moon’s written consent; Green Moon may assign them in connection with a corporate transaction or transfer of the Site. Headings are for convenience only. Provisions that by their nature should survive will survive termination.

19. Contact

Green Moon Holdings, Inc.
Dublin, Ohio, United States
Email: pr*****@*******on.space
Website: https://greenmoon.space