Data Processing Addendum

Effective date: July 19, 2026

This Data Processing Addendum (“DPA”) forms part of the LIVEPLUSTV Terms of Service between LIVEPLUSTV INC. (“LIVEPLUSTV”, “we”, “us”) and the customer (“Customer”, “you”). It applies automatically, without separate signature, wherever we process personal data on your behalf in providing the Service and applicable data-protection law (including the EU/UK GDPR, PIPEDA, or Quebec’s Law 25) requires processor terms. If there is a conflict between this DPA and the Terms, this DPA controls for the processing it covers.

1. Roles and scope

For personal data relating to your viewers and end users that we process in delivering and measuring your streams, you are the controller (or an intermediate processor for another controller) and LIVEPLUSTV is your processor. For personal data we collect for our own purposes — your account, billing, security, and consent records — we are the controller, and our Privacy Policy applies instead of this DPA.

2. Details of processing

• Subject matter and duration: provision of the LIVEPLUSTV cloud playout, delivery, and audience-measurement service, for as long as the Terms apply to you.
• Nature and purpose: hosting, encoding, packaging, delivering, and measuring audience and playback quality for your channels, and inserting advertising where you enable it.
• Categories of data subjects: viewers and end users of your channels.
• Categories of personal data: pseudonymous playback session identifiers, coarse geolocation (country, city, approximate map position derived at the network edge), device and player type, network/ISP, IP-derived routing data processed transiently to deliver streams, and playback quality-of-experience events. We do not intentionally process special categories of personal data, and you must not configure the Service to send us any.

3. Our obligations as processor

We will:

1. process personal data only on your documented instructions — your use and configuration of the Service constitutes those instructions — unless processing is required by law, in which case we will inform you unless the law prohibits it;
2. ensure persons we authorize to process personal data are bound by confidentiality obligations;
3. implement and maintain appropriate technical and organizational measures, including encryption in transit, hardened credential storage, access controls and least-privilege administration, tenant isolation, and logging;
4. assist you, taking into account the nature of the processing, in responding to data-subject requests (access, correction, deletion, portability, objection) that relate to processing under this DPA;
5. assist you with your security, breach-notification, and data-protection impact-assessment obligations, taking into account the information available to us;
6. notify you without undue delay after becoming aware of a personal-data breach affecting personal data processed under this DPA, with information sufficient to support your own notification obligations (including the GDPR’s 72-hour timeline);
7. on termination of the Service, delete the personal data processed under this DPA within the content-deletion window described in the Terms, unless law requires longer retention; and
8. make available information reasonably necessary to demonstrate compliance with this DPA, and allow and contribute to audits — first through written responses and available security documentation, and, where required by law for cause, an audit conducted with reasonable notice, at your cost, no more than once per year, without access to other customers’ data.

4. Subprocessors

You authorize us to engage subprocessors to provide the Service, within the categories described in our Privacy Policy. A current named list of subprocessors, with processing locations, is available to you at any time on request at [email protected]. We will update the list before adding or replacing a subprocessor that processes personal data under this DPA; if you object on reasonable data-protection grounds and we cannot offer an alternative, you may cancel the affected Service. We remain responsible for our subprocessors’ performance under this DPA.

5. International transfers

We process personal data in Canada, the European Union, and the United States (locations by provider are included in the subprocessor list available on request). For personal data subject to the EU or UK GDPR transferred to countries without an adequacy decision, the European Commission’s Standard Contractual Clauses (processor module) — and, for UK data, the UK International Data Transfer Addendum — are incorporated into this DPA by reference, with LIVEPLUSTV as data importer and you as data exporter. Canada is the subject of an EU adequacy decision for data handled under PIPEDA.

6. Canadian privacy law

Where PIPEDA or Quebec’s Law 25 applies to personal data we process for you, we will process it only for the purposes described in this DPA, protect it with the safeguards described above, notify you of confidentiality incidents affecting it, and assist you with access and correction requests.

7. Liability and precedence

The liability of each party under this DPA is subject to the limitations and exclusions of liability in the Terms. This DPA is effective for as long as we process personal data on your behalf and terminates automatically when that processing ends.

8. Contact

Privacy Officer — LIVEPLUSTV INC. — 375 University Avenue, Suite 3279, Toronto, Ontario M5G 2J5, Canada — [email protected]