Flyers Up LLC — Data Processing Agreement

This Data Processing Agreement ("DPA") describes how Flyers Up LLC ("Flyers Up," "we," "our," or "us") processes personal data in connection with the Flyers Up platform. It is intended to provide transparency to users and, where applicable, to address requirements under data protection laws. This DPA is incorporated by reference into our Terms of Service and Privacy Policy.

Section 1 — Definitions

For purposes of this DPA, the following terms have the meanings set forth below:

• Personal Data means any information relating to an identified or identifiable natural person.
• Data Subject means the identified or identifiable natural person to whom Personal Data relates.
• Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, or deletion.
• Controller means the entity that determines the purposes and means of Processing. Flyers Up acts as a Controller with respect to Personal Data processed to operate the Platform.
• Processor means an entity that Processes Personal Data on behalf of a Controller. Where Flyers Up engages subprocessors, those subprocessors act as Processors.
• Platform means the Flyers Up marketplace platform, including websites, applications, and related services.

Section 2 — Scope of Processing

Flyers Up Processes Personal Data to operate the Flyers Up marketplace platform, which connects local service professionals ("Pros") with customers for services such as cleaning, handyman work, tutoring, moving, and other local services. This DPA applies to all Personal Data Processed by Flyers Up in connection with the Platform, whether collected directly from users or from third parties.

Section 3 — Categories of Data Collected

Flyers Up may collect and Process the following categories of Personal Data:

• Account information: Name, email address, phone number, password (hashed), and account preferences.
• Contact details: Mailing address, billing address, and other contact information provided by users.
• Identity verification data: Government-issued identification, date of birth, and related information used for identity verification or background screening.
• Payment data: Payment method information, billing details, and transaction history. Payment card data is processed by our payment processor; we do not store full card numbers.
• Booking details: Service requests, scheduling information, service addresses, and booking history.
• Communications between users: Messages exchanged through the Platform, support tickets, and feedback.
• Profile and business information: Photos, bios, service descriptions, licenses, certifications, and insurance information.
• Device and usage data: IP address, device type, browser, log data, and analytics data.

Section 4 — Purpose of Processing

Personal Data is Processed for the following purposes:

• Operating and maintaining the Platform, including facilitating bookings and communications between Pros and customers
• Processing payments, payouts, and related financial transactions
• Preventing fraud, abuse, and unauthorized access
• Ensuring trust and safety, including identity verification and background screening
• Providing customer support and resolving disputes
• Improving the Platform through analytics and product development
• Complying with legal obligations and enforcing our terms and policies
• Communicating with users about the Platform, bookings, and account matters

Section 5 — Data Security Measures

Flyers Up implements industry-standard administrative, technical, and physical safeguards to protect Personal Data. These measures include, but are not limited to:

• Encryption: Encryption in transit (TLS) and at rest where applicable
• Access controls: Role-based access, authentication requirements, and principle of least privilege
• Monitoring: Logging, monitoring, and incident response procedures
• Secure infrastructure: Hosting and infrastructure provided by reputable providers with security certifications
• Vendor assessment: Evaluation of subprocessors' security practices where appropriate

No system is completely secure. Flyers Up will notify affected users and relevant authorities of data breaches as required by applicable law. See our Data Security Policy for additional detail.

Section 6 — Subprocessors

Flyers Up may engage third-party subprocessors to Process Personal Data in connection with the Platform. Subprocessors are selected based on their ability to meet our security and compliance requirements. Categories of subprocessors include:

• Cloud hosting providers: Infrastructure and application hosting
• Payment processors: Payment processing, payouts, and related financial services
• Identity verification services: Identity verification and background screening
• Analytics tools: Performance monitoring, analytics, and product improvement
• Communication services: Email, notifications, and customer support tools
• Database and authentication services: Data storage and user authentication

Subprocessors are bound by contractual obligations to protect Personal Data and Process it only in accordance with our instructions. Flyers Up remains responsible for subprocessor compliance with this DPA. We may update our list of subprocessors from time to time; material changes will be reflected in our Privacy Policy or through other appropriate notice.

Section 7 — International Transfers

Flyers Up operates primarily in the United States. Personal Data may be Processed in jurisdictions outside the country in which you reside, including the United States. When we transfer Personal Data across borders, we implement appropriate safeguards as required by applicable law, which may include standard contractual clauses, adequacy decisions, or other mechanisms recognized by relevant data protection authorities. By using the Platform, users in jurisdictions outside the United States consent to the transfer of their Personal Data to the United States and other jurisdictions where our subprocessors operate.

Section 8 — Data Subject Rights

Data Subjects may exercise the following rights with respect to their Personal Data, subject to applicable law and any limitations necessary for legal or operational purposes:

• Access: Request a copy of Personal Data we hold about you
• Correction: Request correction of inaccurate or incomplete Personal Data
• Deletion: Request deletion of Personal Data, subject to retention requirements
• Restriction: Request restriction of Processing in certain circumstances
• Portability: Request transfer of Personal Data in a structured, machine-readable format where applicable
• Objection: Object to Processing based on legitimate interests or for direct marketing

To exercise these rights, contact support@flyersup.app. We will respond within the timeframes required by applicable law. We may require verification of identity before processing requests. You may also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

California residents may have additional rights under the CCPA/CPRA. See our Privacy Policy for details.

Section 9 — Data Retention

Flyers Up retains Personal Data only as long as necessary for the purposes described in this DPA, including:

• Operating the Platform and providing services
• Complying with legal obligations (e.g., tax, financial, and regulatory requirements)
• Resolving disputes and enforcing our terms
• Establishing, exercising, or defending legal claims

Retention periods vary by data type. Account data is retained while the account is active and for a reasonable period thereafter. Booking and payment records may be retained for seven years or as required by law. When Personal Data is no longer necessary, we delete or anonymize it in accordance with our data retention procedures.

Section 10 — Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, Flyers Up will notify affected Data Subjects and relevant supervisory authorities as required by applicable law. Notification will be made without undue delay and will include, to the extent practicable, the nature of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed to address the breach. Flyers Up will document all breaches and the response thereto.

Section 11 — Limitation of Liability

To the maximum extent permitted by applicable law, Flyers Up's liability arising from or related to the Processing of Personal Data under this DPA is subject to the limitations of liability set forth in our Terms of Service. Nothing in this DPA excludes or limits liability that cannot be excluded or limited under applicable law.

Section 12 — Governing Law

This DPA is governed by the laws of the State of Delaware, United States, without regard to conflict of law principles. Any disputes arising from or related to this DPA shall be resolved in accordance with the dispute resolution provisions of our Terms of Service, including the arbitration agreement set forth in our Arbitration Policy. Where applicable data protection law requires a different governing law or forum for data protection matters, such requirements shall apply to the extent necessary.

Section 13 — Updates

Flyers Up may update this DPA from time to time to reflect changes in our practices, the Platform, or applicable law. We will notify users of material changes by posting the updated DPA and updating the "Last Updated" date. Continued use of the Platform after changes indicates acceptance of the updated DPA.

Section 14 — Contact

Questions regarding this DPA or our data processing practices may be directed to: Flyers Up LLC — support@flyersup.app