Data processing addendum.

Last Updated: October 2, 2026

This Data Processing Addendum ("Addendum") forms part of the agreement between Zero Processing Fees LLC, doing business as Keep The Fees ("KTF") and each Shop that accepts this Addendum. It applies when KTF processes personal information on that Shop's behalf. Capitalised terms not defined here have the meanings in the Terms of Service ("Terms").

1. Scope, roles, and acceptance

Covered information. "Shop Personal Information" means Client Data, Artist Data, and any other information KTF processes on the Shop's behalf that is personal information, personal data, or consumer health data under applicable privacy law. Information remains covered while that law treats it as personal information, including where identifiers have been removed but individuals remain identifiable. "Applicable Privacy Law" means the privacy, data protection, consumer health data, and breach-notification laws that apply to the relevant processing.

Roles. The Shop determines the purposes and means of processing Shop Personal Information; KTF acts as its processor or service provider for that processing. Roles follow actual activities and Applicable Privacy Law. User Account Data KTF processes for its own account administration purposes is governed by the Privacy Policy. A separate copy held in the Shop's business records remains covered by this Addendum. Independent recipients and providers acting for their own regulatory purposes are addressed in Section 6.

Acceptance. KTF will provide this Addendum and the provider information described in Section 5 for review before acceptance. The Shop accepts this Addendum through its authorised representative with the Terms under Sections 3 and 47 of the Terms. KTF retains the version accepted with the acceptance record and makes retained copies available for saving or printing on request. Acceptance solely as an Individual User does not bind a Shop. Publication does not supply any separate consent required from an individual.

2. Processing details and instructions

Subject matter and duration. Processing supports the Shop's selected KTF features during its trial or subscription, followed by only the limited processing necessary for export, deletion, and permitted retention under Section 10. Processing may occur continuously or when the Shop uses a feature.

Individuals and information. Records may concern the Shop's clients, including minors where the Shop lawfully serves them; artists, employees, contractors, owners, and authorised users; and people identified in Shop communications. Categories include identity and contact details; appointments and service history; work, commission, and payout records; photographs, signatures, and identification documents; form responses and Health Information; message content and delivery records; and acceptance, consent, opt-out, and audit records. Payment and payout information is limited to what the Services handle as described in the Privacy Policy.

Nature and purposes. On the Shop's documented instructions and only for the features it uses, KTF may collect, receive, organise, store, retrieve, transmit, export, correct, and delete Shop Personal Information to:

• Maintain client and personnel records, schedule appointments, and administer the Shop's authorised access;
• Present and store intake, consent, waiver, and other forms, including extracting and structuring their contents through document-processing tools;
• Send appointment confirmations, reminders, receipts, and other transactional communications, and record delivery and opt-out events;
• Prepare audiences and deliver Shop-directed marketing campaigns using eligible contact and consent records, subject to Parts VI-A and VI-B of the Terms;
• Calculate Shop-directed commissions and payout records and transmit the authorised information needed for integrations the Shop selects;
• Provide support, resolve errors, maintain records, detect fraud, and protect the confidentiality, integrity, and availability of the Services; and
• Fulfil privacy requests and export and deletion instructions, and create Aggregated Data only within the limits in Section 3.

The accepted agreement, the Shop's authorised feature settings and actions, and lawful written instructions agreed with KTF constitute the Shop's documented instructions. The Shop must supply lawful instructions, appropriate notices, and required consents. An instruction cannot waive Applicable Privacy Law or the restrictions below. KTF will promptly inform the Shop if it believes an instruction violates Applicable Privacy Law and will suspend the affected processing while the issue is resolved. If law requires other processing, KTF will inform the Shop before that processing unless legally prohibited.

3. Restrictions on use

KTF will process Shop Personal Information only for the specific purposes in Section 2 and the Shop's lawful instructions, or as required by law. KTF will not sell it, share it for cross-context behavioural advertising, use it for KTF's own advertising, or retain, use, or disclose it outside the direct business relationship with the Shop except as expressly permitted by Applicable Privacy Law. KTF will not combine it with personal information from other customers, third parties, or KTF's own interactions with individuals except where Applicable Privacy Law expressly permits the combination for an authorised purpose.

KTF will not use Shop Personal Information to train general-purpose or independently commercialised artificial intelligence models, or permit a provider to use it for that purpose. AI-assisted extraction and structuring of the Shop's documents is permitted solely to deliver the Shop's selected service on its instructions and under the provider protections in Section 5.

Health Information. Health Information, and any additional information treated as consumer health data by Applicable Privacy Law, may be processed only to provide the Shop's requested Services on its instructions or as required by law. KTF will not sell or license it, use or disclose it for advertising, or derive Aggregated Data from it. Health Information, form responses, identification documents, and segments derived from them may not be used to target marketing. The Shop's general acceptance does not replace a legally required health-data consent or authorisation.

Aggregation. Section 16 of the Terms permits creation of Aggregated Data only where the underlying processing is lawful and consistent with this Addendum. KTF must satisfy the applicable deidentification standard and the Terms' safeguards before treating an output as non-personal information. Combining identifiable records across Shops is not authorised merely because the intended output is aggregated. KTF will not attempt re-identification and will require recipients to maintain deidentification and refrain from re-identification. Any output that remains personal information under Applicable Privacy Law remains subject to this Addendum.

Where the California Consumer Privacy Act and its regulations apply, KTF will comply with their applicable service-provider requirements and provide the same level of privacy protection they require of the Shop. KTF certifies that it understands and will comply with the restrictions in this Addendum. KTF will promptly notify the Shop if it determines it can no longer meet its obligations under Applicable Privacy Law or this Addendum.

4. Confidentiality and safeguards

KTF will ensure that people authorised to process Shop Personal Information are bound by confidentiality obligations and have access only as needed for their assigned responsibilities. KTF will maintain the administrative, technical, and physical safeguards in Section 18 of the Terms and the Data Policy, including encryption in transit and at rest, role-based access, administrative access logging, and ongoing security review. Safeguards must be appropriate to the nature and volume of the information and the risks of processing.

5. Providers processing on KTF's behalf

5.1 Authorisation and information. The Shop generally authorises KTF to engage providers to perform the permitted processing on KTF's behalf, subject to this Section. Before acceptance and on request thereafter, KTF will make available the current providers' identities, processing functions, and processing locations. The categories appear in Section 6 of the Privacy Policy; the current details may be requested at [email protected]. General authorisation does not permit a provider to use the information for its own unrelated purposes.

5.2 Changes. KTF will update the provider information described in Section 5.1 when it adds or replaces a provider that processes Shop Personal Information, and will make the updated information available on request. The Shop's continued use of the affected Services after an update constitutes its authorisation of the change.

5.3 Contracts and oversight. Before disclosure, KTF will bind each provider by a written contract imposing confidentiality, purpose restrictions, safeguards, assistance, and return or deletion obligations no less protective than those applicable to its processing under this Addendum, including any required statutory contract terms. KTF will take reasonable steps to assess and monitor compliance and to stop and remediate unauthorised processing. Equivalent obligations must flow down to further providers used for that processing.

5.4 Allocation of responsibility. KTF will perform its own provider-contracting, assessment, oversight, and remediation obligations in this Addendum. It does not guarantee that a provider will perform or comply with its obligations, assume the provider's contractual liabilities, or voluntarily undertake liability for the provider's acts or omissions as if they were KTF's own. This allocation includes the Marketing Provider and applies whether KTF or the Shop selects the provider, and whether the feature is embedded, separately enabled, or billed by KTF. Actual processing and Applicable Privacy Law determine the parties' roles and any nondelegable responsibility. Any responsibility for a provider that Applicable Privacy Law requires KTF to retain remains with KTF. Section 12 expressly applies the provider exclusion in Section 39.8 of the Terms and the fallback liability limits.

6. Independent recipients and transfers

Where the Shop independently engages a recipient to process on the Shop's instructions under a separate agreement, KTF will transmit only the information authorised for that integration and perform its own express processing and delivery duties. The recipient's subsequent independent processing is governed by its agreement with the Shop and Applicable Privacy Law. A provider may separately act for its own legal or regulatory purposes under Section 17.6 of the Terms. Its independent role does not exempt processing it performs on KTF's behalf from Section 5. KTF does not guarantee the recipient's performance; monetary liability between the parties follows Section 12.

KTF will not make a transfer requiring a legal transfer mechanism unless the mechanism and safeguards required by Applicable Privacy Law are in place. This Addendum does not itself constitute standard contractual clauses or authorise a transfer that would otherwise be unlawful.

7. Individuals' requests and compliance assistance

KTF will promptly forward to the Shop requests concerning Shop Personal Information and, taking account of the processing and information available to it, provide the assistance reasonably necessary for the Shop to meet its obligations and deadlines. This includes access, correction, deletion, portability, restrictions, consent withdrawal, and opt-outs where applicable. KTF will act on the Shop's lawful instructions and give relevant instructions to its providers. It may respond directly where legally required or authorised by the Shop, and handles its own User Account Data requests under the Privacy Policy.

KTF will also provide information and reasonable assistance required for the Shop's applicable security duties, breach notifications, privacy risk assessments, cybersecurity audits, and regulatory inquiries, including relevant information in KTF's possession or control. Neither a Shop's record ownership nor an individual's loss of platform access removes statutory rights.

8. Security incidents

KTF will notify the Shop without undue delay after becoming aware of unauthorised access to, acquisition, disclosure, alteration, loss, or destruction of Shop Personal Information, and within the deadline in Section 18.2 of the Terms or any shorter deadline required by Applicable Privacy Law. KTF will provide the reasonably available facts, affected categories of information and individuals, likely consequences where known, response measures, and a contact for follow-up, and supplement the notice as information becomes available. An incomplete investigation does not excuse a required initial notice.

KTF will take reasonable steps to contain, investigate, and remediate the incident and cooperate with the Shop's legally required response. The Shop handles notices it is required to give, and KTF handles notices it is separately required to give. Notification is not an admission of fault.

9. Verification and remediation

KTF will make available information reasonably necessary to demonstrate compliance. The Shop may take reasonable and appropriate steps to verify that KTF's processing complies with this Addendum and Applicable Privacy Law, including assessments and audits by the Shop or a qualified independent assessor. Any assessment is at the Shop's expense, limited to once in any twelve-month period except following a security incident affecting the Shop's data or where required by law, on at least thirty (30) days' notice, and conducted so as to protect other customers' information and confidential systems and avoid disruption. KTF may satisfy a request by providing existing reports or written responses where they reasonably demonstrate compliance. Section 21 of the Terms does not prevent an assessment authorised under this Section; testing must remain within the agreed scope.

On notice, the Shop may require reasonable steps to stop and remediate unauthorised processing, including suspension of the affected processing and verification of deletion. KTF will cooperate and address identified noncompliance. If KTF cannot meet its obligations under Applicable Privacy Law, the Shop may stop using the affected Services and cancel under Section 13.3 of the Terms.

10. Return, deletion, and retention

KTF will follow the Shop's lawful instructions to return or delete Shop Personal Information, including instructions needed to fulfil individuals' rights. After termination, the export and deletion schedule in Section 43 of the Terms applies unless Applicable Privacy Law requires earlier action. KTF will require its providers to follow the corresponding return or deletion instructions and will confirm completion to the Shop on request.

Any retention exception must be permitted by Applicable Privacy Law. Information retained for legal, tax, regulatory, claims, or opt-out purposes must be limited to what that purpose requires, protected under this Addendum, and deleted when the justification ends. Routine backups remain protected and isolated from ordinary use, expire through the backup rotation within any applicable legal deadline, and must have outstanding deletion instructions reapplied if restored. A retention or backup exception does not permit new marketing, model training, or other unrelated use. Deidentified information may be retained as Aggregated Data only if it meets Section 3 and the Terms; Health Information is excluded.

11. Precedence, changes, and survival

Subject to Applicable Privacy Law, this Addendum controls conflicts concerning processing of Shop Personal Information under Section 4 of the Terms. It expressly preserves the liability allocation in Section 12 below. Changes follow Section 47 of the Terms. No amendment authorises a use requiring an individual's separate consent without that consent.

These processing, protection, assistance, return, and deletion obligations survive while KTF or its providers retain Shop Personal Information. Continued protection does not create a right to retain or use it beyond the permitted period or purposes.

12. Liability and rights

Section 39.8 of the Terms expressly applies to this Addendum and excludes KTF's monetary liability for provider-related losses to the maximum extent permitted by law, including the ordinary-negligence and contractual claims identified there. This Addendum's priority on processing matters does not override that exclusion or create a guarantee of a provider's performance. Where a complete exclusion is unenforceable or does not apply, the damages exclusions and aggregate cap in Section 39 apply to the extent permitted by law, subject to its express exceptions for fraud, gross negligence, willful misconduct, and nonwaivable liability. A confidentiality, privacy, or security breach alone does not remove those limits. The cap is shared across the Terms and incorporated policies and is not multiplied by the number of documents, providers, or legal theories.

This allocation does not reduce any substantive obligation, prevent non-monetary relief otherwise available by law, restrict a regulator's powers, or limit nonwaivable rights or claims of individuals who are not bound by the allocation. This Addendum creates no contractual third-party beneficiary rights and no additional indemnity. It does not excuse either party from its own statutory responsibilities.

13. Contact and copies

For instructions, provider information, retained versions, privacy requests, or compliance questions, contact Zero Processing Fees LLC (d/b/a Keep The Fees) at [email protected] or 3748 Coventry Lane, Boca Raton, FL 33496.