‍ ‍

EXHIBIT C TO NURTURESYNC TERMS OF SERVICE

‍ ‍

NURTURESYNC

‍ ‍

DATA PROCESSING AGREEMENT

‍ ‍

https://www.nurturesync.io/data-processing-agreement

This Agreement is entered into between MPCT Solutions, LLC (“Processor”) and the Client identified below (“Controller”).

This DPA supplements and is incorporated into the NurtureSync Terms of Service.

‍ ‍

Controller (Client): ____________________________   Effective Date: ____________________________

‍ ‍‍ ‍

1.  DEFINITIONS‍ ‍

Controller: The Client organization that determines the purposes and means of processing personal data through the NurtureSync Service.

‍Processor: MPCT Solutions, LLC, which processes personal data on behalf of the Controller in connection with providing the NurtureSync Service.

‍Personal Data: Any information relating to an identified or identifiable individual that Controller uploads, stores, or processes through the Service.

‍Processing: Any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.

‍‍

2.  SCOPE AND PURPOSE OF PROCESSING ‍

Processor processes Personal Data solely to provide the NurtureSync Service as described in the Terms of Service, including hosting, storage, backup, and data export. Processor will not process Personal Data for any purpose other than as instructed by Controller or as required by applicable law.

‍Categories of data: Account information (names, email addresses, phone numbers), organizational data (roles, permissions), usage activity data, and uploaded content as provided by Controller.

‍Duration: Processing continues for the duration of Controller’s active subscription and ends upon termination, after which data is deleted per the NurtureSync Cancellation and Refund Policy.

‍ ‍

3.  PROCESSOR OBLIGATIONS

Processor agrees to:

‍•        Process Personal Data only on Controller’s documented instructions and as permitted under the Terms of Service

•        Implement and maintain appropriate technical and organizational security measures to protect Personal Data

•        Notify Controller without undue delay, and where practicable within 72 hours, upon becoming aware of a Personal Data breach

•        Assist Controller in responding to data subject rights requests to the extent reasonably practicable given the nature of the processing

•        Delete or return Personal Data upon termination of the subscription in accordance with the Cancellation and Refund Policy

•        Ensure that persons authorized to process Personal Data are subject to confidentiality obligations

4.  SUB-PROCESSOR‍ ‍

Controller authorizes Processor to engage the following sub-processors in connection with the Service: ‍

‍ ‍

Processor will notify Controller of any intended changes to sub-processors with reasonable advance notice. Controller may object to a new sub-processor within 15 days of notice; if Processor cannot reasonably accommodate the objection, either party may terminate this DPA.

5.  CONTROLLER OBLIGATIONS

Controller represents and warrants that: (a) it has a lawful basis for processing and providing Personal Data to Processor; (b) it has provided appropriate notices to and obtained any required consents from data subjects; and (c) its instructions to Processor comply with applicable law.

6.  GOVERNING LAW AND RELATIONSHIP TO TOS

This DPA is governed by the laws of the State of Colorado, USA. This DPA supplements the NurtureSync Terms of Service. In the event of a conflict between this DPA and the Terms of Service with respect to the processing of Personal Data, this DPA controls. All other terms of the Terms of Service remain in full force and effect.

‍ ‍

SIGNATURES

‍ ‍ ‍

‍ ‍

Document Control

Version: 1.1 — Designated as Exhibit C to NurtureSync Terms of Service · May be updated independently of TOS · June 10, 2026

‍ ‍