Data Processing Agreement

Controller-to-processor terms for Aholler.ai Services Effective and last updated: October 7, 2026

AI WORLD LLC

doing business as Aholler.ai 1770 S Young Circle, Suite 1216, Hollywood, FL 33020, USA Published for use on aholler.ai

AGREEMENT

This Data Processing Agreement ("DPA") forms part of the Terms of Service, order form, master services agreement or other agreement governing use of the Aholler.ai Services (the "Agreement") between the Customer identified there and AI WORLD LLC d/b/a Aholler.ai. It applies where Aholler processes Customer Personal Data on Customer's behalf. If this DPA conflicts with the Agreement on that processing, this DPA controls.

1. PURPOSE AND SCOPE

This DPA allocates responsibilities under applicable privacy, data-protection and data-security law, including PIPEDA and applicable Canadian provincial laws, U.S. state privacy laws, the Florida Digital Bill of Rights where applicable, and applicable U.S. breach laws. A listed law applies only when its scope requirements are met.

2. DEFINITIONS

Applicable Data Protection Law

A privacy, data-protection or data-security law applicable to processing under the Agreement. Customer Personal Data Personal Data processed by Aholler on behalf of Customer through the Services. Controller and Processor Include analogous roles such as organization, business, service provider and contractor under Applicable Data Protection Law. Personal Data Information relating to an identified or identifiable natural person, including equivalent statutory terms. Processing Any operation on Personal Data, including collection, use, access, storage, recording, transcription, analysis, disclosure, transfer, deletion or destruction. Security Incident Unauthorized access to, acquisition, use, disclosure, alteration, loss or destruction of Customer Personal Data that compromises its confidentiality, integrity or security. It excludes unsuccessful attempts that do not compromise data. Subprocessor A third party engaged by Aholler to process Customer Personal Data on Customer's behalf.

3. ROLES

Customer acts as Controller or on behalf of a Controller and determines purposes, individuals contacted, data supplied, agent configuration, recording, use and retention instructions. Aholler acts as Processor or Service Provider for Customer Personal Data and processes it under the Agreement, this DPA, Customer's documented lawful instructions and law. Aholler may act as an independent Controller for its own billing, account administration, security, fraud prevention, legal compliance, agreement enforcement and direct Customer relationship, as described in the Privacy Policy.

4. DOCUMENTED INSTRUCTIONS

Customer instructs Aholler to provide the Services, including AI conversations, call routing, recording where enabled, transcription, summaries, scheduling, messaging, analytics, integrations, support, security and other enabled functionality. The Agreement, configuration and lawful use constitute documented instructions. Aholler will notify Customer before legally required processing where permitted.

5. CUSTOMER OBLIGATIONS

Customer represents and agrees that it: ● has lawful authority, a lawful basis, required notices and required consents; ● will provide lawful instructions and is responsible for recording, monitoring, AI and outbound-communications compliance; ● will respond to individuals concerning Customer's purposes and maintain its own privacy notices; and ● will not submit data requiring specialized safeguards unless Aholler expressly agrees to support it.

6. AHOLLER OBLIGATIONS

Aholler will: ● process Customer Personal Data only on documented instructions or as required by law; ● limit processing to providing and supporting the Services; ● ensure authorized personnel are bound by confidentiality; ● maintain appropriate safeguards and restrict access by role; ● assist reasonably with rights requests, incidents and legally required assessments; ● impose appropriate written obligations on Subprocessors; and ● delete or return data following termination as described below.

7. SECURITY

Aholler will maintain administrative, technical and organizational measures reasonably appropriate to data sensitivity, processing risk, available technology and implementation cost. Measures may include authentication, access controls, encryption in transit, encryption at rest where appropriate, logging, monitoring, backups, vulnerability management, least privilege, development controls, incident response and provider review. No system is completely secure.

8. SECURITY INCIDENTS

Aholler will notify Customer without undue delay after becoming aware of a confirmed Security Incident involving Customer Personal Data. As reasonably available, notice will describe the incident, affected categories and approximate scope, known or anticipated consequences, mitigation and information useful for Customer's obligations. Information may be provided in phases. Notice is not an admission of fault or liability.

9. CANADIAN BREACH SUPPORT

Where PIPEDA or applicable provincial law applies, Aholler will reasonably assist with assessment, records, regulator reporting, notice to individuals and mitigation. Customer remains responsible for determining its notification obligations unless law directly imposes that determination on Aholler.

10. INDIVIDUAL RIGHTS

Taking account of the processing and information available, Aholler will reasonably assist Customer with valid requests for access, correction, deletion, portability, confirmation, withdrawal of consent, opt-out or other applicable rights. Aholler may direct a requester to Customer or forward the request and will not respond on Customer's behalf unless instructed or legally required.

11. PIPEDA ACCOUNTABILITY

Where PIPEDA applies, Customer remains accountable for Personal Information under its control transferred for processing. Aholler will use contractual and organizational measures intended to provide a reasonably comparable level of protection and limit use to the Agreement, this DPA and Customer's instructions.

12. CROSS-BORDER PROCESSING

Customer acknowledges that Aholler is headquartered in the United States and data may be processed there or in other jurisdictions where authorized Subprocessors operate. Customer is responsible for required transparency. Aholler will maintain reasonable contractual safeguards. Information may be subject to lawful governmental access in the processing jurisdiction.

13. U.S. STATE PRIVACY TERMS

To the extent Aholler is a Processor, Service Provider or Contractor, it will process for the limited purposes in the Agreement and this DPA; provide the required level of protection; maintain confidentiality; assist with rights; notify Customer if it can no longer comply; permit reasonable steps to verify consistency; impose applicable obligations on Subprocessors; and not sell Customer Personal Data or use it for prohibited purposes.

14. FLORIDA PROCESSOR TERMS

Where Florida Statutes section 501.712 applies, this DPA provides clear instructions, nature and purpose, data types, duration and party rights and obligations. Aholler will ensure confidentiality, assist with applicable Controller duties, delete or return data on completion subject to lawful retention, make reasonably necessary compliance information available, support permitted assessments, and bind Subprocessors by written contract.

15. SUBPROCESSORS

Customer generally authorizes Aholler to use Subprocessors. Aholler will maintain a public list at aholler.ai/legal/subprocessors, impose written data-protection obligations appropriate to the services, and remain responsible for its obligations under this DPA to the extent required by law and the Agreement. Aholler may add or replace Subprocessors. Where required, Aholler will provide reasonable advance notice of a material new Subprocessor. Customer may object on reasonable, documented data-protection grounds within the stated notice period. The parties will seek a commercially reasonable solution; if none is available, either party may terminate the affected Service without penalty for the unused affected term.

16. GOVERNMENT REQUESTS

Unless prohibited, Aholler will notify Customer of a legally binding demand for Customer Personal Data. Aholler will review demands for facial validity, disclose only what is legally required and, where appropriate, direct the authority to Customer.

17. DELETION AND RETURN

On termination or Customer's lawful request, Aholler will delete or return Customer Personal Data within a reasonable period, at Customer's choice where practicable, unless law requires retention. Data in backups may remain until overwritten under normal cycles, protected and not actively processed except for restoration, security or legal compliance.

18. COMPLIANCE INFORMATION AND AUDITS

On reasonable written request, Aholler will provide information reasonably necessary to demonstrate compliance. Customer should first use available reports, questionnaires or summaries. Any further audit must be legally required, scoped to relevant systems, scheduled on reasonable notice, conducted no more than annually absent a Security Incident or regulator demand, protect confidentiality, avoid disruption and be at Customer's expense.

19. LIABILITY AND ORDER OF PRECEDENCE

The Agreement's liability limitations and exclusions apply to this DPA to the maximum extent permitted by law. This DPA controls over inconsistent processing terms; the Agreement otherwise remains in effect.

20. TERM AND CHANGES

This DPA begins when Customer uses processing Services and continues while Aholler processes Customer Personal Data. Aholler may update it for changes in law or Services, with notice of material changes as required. Updates will not materially reduce protection during an active order without a valid basis.

21. GOVERNING LAW

The governing-law and dispute provisions of the Agreement apply. If none exist, Florida law and applicable U.S. federal law govern, and courts in Broward County, Florida have exclusive jurisdiction, subject to non-waivable rights.

SCHEDULE A - DETAILS OF PROCESSING

Item

Description

Subject matter

Provision of AI voice, telecommunications, messaging, scheduling, transcription, analytics, integrations and support services. Duration For the Agreement term and thereafter only as needed for deletion, return, backup cycles or lawful retention. Nature and purpose Collection, hosting, access, transmission, routing, recording where enabled, transcription, analysis, summarization, scheduling, support, security, deletion and other processing needed for Customer-configured Services. Data subjects Customer personnel and authorized users; callers, message recipients, leads, clients, patients or customers of Customer; appointment participants; and other individuals whose data Customer submits. Data categories Identifiers and contact data; account and authentication data; call and message metadata; audio, recordings, transcripts and summaries; appointment and calendar data; Customer scripts and prompts; technical, usage and diagnostic data; and integration data. Sensitive data Not intended unless expressly supported and agreed. Customer must not submit regulated sensitive data requiring specialized safeguards without written approval. Frequency Continuous or on-demand according to Customer use and configuration. Return/deletion As stated in Section 17 and available product retention controls. DPA and privacy contact Contact AI WORLD LLC d/b/a Aholler.ai through the contact method published on aholler.ai, by email at privacy@aholler.ai for privacy matters, or by mail at 1770 S Young Circle, Suite 1216, Hollywood, FL 33020, USA.