Data Processing Addendum

This Data Processing Addendum (“DPA”) amends and is part of the HELIOS Terms of Service or other customer agreement (“Agreement”) between Helios Sports, Inc. (“HELIOS”, “we”, “us”, “our”) and the customer party to the Agreement (“Customer”, “you”, “your”) if you live and use the Service (as defined in the Agreement) in a country governed by GDPR (defined below). This DPA has been pre-signed on behalf of HELIOS If this DPA applies to you, your act of accepting the Agreement constitutes your signature.

1.0 Definitions

1.1 “Customer Personal Data” means any Personal Data Processed by HELIOS or a Subprocessor relating to or on behalf of Customer in connection with the Service, excluding Prohibited Data.

1.2 “GDPR” means the European Union (“EU”) General Data Protection Regulation and all laws and regulations (including implementing laws and regulations of the EU, the European Economic Area, and their member states (“EU GDPR”), as well as Switzerland under the Swiss Federal Act on Data Protection (“Swiss FDPA”) and the United Kingdom (“UK”) under the UK Data Protection Act and GDPR as incorporated into UK law (“UK GDPR”), in each case as they may be amended from time to time and to the extent they apply to the Processing of Customer Personal Data under the Agreement and this DPA.

1.3 “EU-US Data Privacy Framework” or “DPF” means the EU-US and/or Swiss-US Data Privacy Frameworks and/or the UK Extension to the EU-US Data Privacy Framework, as applicable, and their respective successor frameworks, if any, as and when approved by the European Commission, the Swiss Federal Data Protection and Information Commissioner and/or the UK Information Commissioner, as applicable, on the one hand, and the US Department of Commerce or other authorized US agency on the other hand.

1.4 “Mandatory Clauses” means the Mandatory Clauses of the template Addendum B.1.0 issued by the UK Information Commissioner and submitted to the UK Parliament in accordance with s119A of the UK Data Protection Act on February 2, 2022, as such Addendum may be revised under Section 18 of those Mandatory Clauses.

1.5 “Prohibited Data” means any data or information transmitted to HELIOS in violation of the Agreement.

1.6 “Restricted Transfer” means a cross-border transfer of Customer Personal Data (such as from Customer to HELIOS, or from HELIOS to a Subprocessor) that would be prohibited by GDPR without a legal transfer mechanism to be established under this DPA.

1.7 “Standard Contractual Clauses” or “SCCs” means (as applicable, and as supplemented by the information in Attachments 1 and 2):

(a) Where the EU GDPR applies, the standard contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU SCCs”);

(b) Where the UK GDPR applies, the EU SCCs as modified by the Mandatory Clauses, or where the EU SCCs cannot legally be adopted as set forth in Section 6, the applicable standard data protection clauses adopted pursuant to Article 46(2)(c) or (d) of UK GDPR (in either case, “UK SCCs”); or

(c) Where the Swiss FDPA applies and the EU SCCs cannot legally be adopted as set forth in Section 6, the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner (the “Swiss SCCs”).

1.8 “Subprocessor” means any third party engaged by HELIOS to assist HELIOS in providing the Service, where such third party Processes Customer Personal Data. Subprocessors may include HELIOS’s affiliates.

1.9 The terms, “Controller”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor” and “Supervisory Authority” shall have the same meaning as in GDPR.

2.0 Applicability; Processing of Customer Personal Data

2.1 This DPA applies only to the extent that GDPR applies to Customer Personal Data and the Processing of such Customer Personal Data by HELIOS or a Subprocessor under the Agreement.

2.2 The applicability of this DPA also depends on the roles of HELIOS and Customer in relation to Customer Personal Data, as follows:

(a) Where you are a Controller or a Processor of Customer Personal Data of which HELIOS is not also a Controller, HELIOS shall be a Processor of Customer Personal Data, and HELIOS will Process such Customer Personal Data on your behalf in accordance with this DPA.

(b) Where HELIOS is a Controller of Customer Personal Data, HELIOS will Process such Customer Personal Data in compliance with GDPR and Subsection 2.4 and Section 6 of this DPA, to the extent applicable.

2.3 As a Processor, HELIOS will not Process Customer Personal Data other than on your documented instructions, which shall be deemed to include the following: You instruct HELIOS (and authorize HELIOS to instruct each Subprocessor) to Process Customer Personal Data and transfer Customer Personal Data to the United States (or to or from any other country or territory where you use the Service) for the following purposes:

(a) Processing in accordance with the Agreement and this DPA;

(b) Processing initiated by you (such as by your actions and choices when using the Service);

(c) Processing to comply with other reasonable instructions you provide;

(d) Processing to deliver, improve, administer and maintain the Service;

(e) Processing to improve security, prevent fraud, and mitigate risk; and

(f) Processing to comply with applicable laws (including law enforcement requests),

in each case consistent with the terms of the Agreement and GDPR.

2.4 Where HELIOS is a Controller, you acknowledge and agree that as part of providing the Service, we have the right to use data relating to or obtained in connection with the operation, support or use of the Service for our legitimate internal business purposes, including the purposes listed in Subsections 2.3(a)-(f) above. We will Process Customer Personal Data in compliance with GDPR and only for purposes that are compatible with those described above, and we will not use or disclose Customer Personal Data for any other purpose unless we have first aggregated and anonymized such data so that it does not identify you or any other person.

2.5 Certain details regarding HELIOS’s Processing of Customer Personal Data are described in Attachment 1. We may update those descriptions from time to time to reflect new products, features or functionality in the Service.

2.6 You represent and warrant to HELIOS that any Processing instruction you provide to us will comply with GDPR and that you are authorised to give such instruction.

2.7 In your use of the Service, you agree that any Processing by you of Customer Personal Data will be in accordance with GDPR. You have sole responsibility for the accuracy, content, and legality of Customer Personal Data and the means by which you acquired such Customer Personal Data if other than from yourself.

2.8 To the extent you do not have the ability to correct, amend, transfer or delete Customer Personal Data yourself using the functionality available to you in the Service, HELIOS will comply with your reasonable request take such actions as may be required by GDPR, to the extent we are legally permitted to do so and have access to such Customer Personal Data.

2.9 We will treat Customer Personal Data as confidential information in accordance with the Agreement (which includes our Privacy Policy) and will ensure that our personnel engaged in the Processing of Customer Personal Data are reliable and informed of the confidential nature of the Customer Personal Data, have received appropriate training on their responsibilities, are limited in their access to Customer Personal Data to what is necessary for the performance of the Agreement, and have executed written confidentiality agreements.

2.10 Except as you and we otherwise expressly agreed in writing, and except as may be required by GDPR or other law, regulation or legal obligation applicable to us or our Subprocessor, we will, within a reasonable time following termination of the Agreement or your earlier request, anonymize, delete or return to you Customer Personal Data in our possession or control, and we will require each Subprocessor to do the same. This requirement will not apply to Customer Personal Data archived in our back-up systems, which will not otherwise be further Processed, and which will be deleted in the ordinary course of our business, except as may be required by applicable law.

3.0 Subprocessing

3.1 You authorise us to appoint Subprocessors in accordance with this DPA and any restrictions in the Agreement.

3.2 A current list of Subprocessors is available upon request, and a copy of such list as of the date of this DPA is included in Attachment 1. Wemay continue to use those Subprocessors in connection with the Service.

3.3 We may update our list of Subprocessors from time to time. If we notify you that we have established an automatic notification mechanism with respect to changes to our list of Subprocessors, you agree to subscribe or opt-in to that mechanism in the manner indicated in the notice. If you notify us in writing of your objection (on reasonable grounds) to our appointment of a new Subprocessor within ten (10) days of our notice to you of a that appointment, then we will take reasonable steps to address your objections, which may include making a change in the Service or recommending a reasonable change in your configuration or use of the Service. If we are unable to make any applicable change within a reasonable period of time, not to exceed sixty (60) days, then, notwithstanding anything in the Agreement, you may terminate the Agreement and your subscription to the Service.

3.4 With respect to each Subprocessor, we will: (a) ensure that the arrangement with the Subprocessor is governed by a written contract including terms which offer substantially similar levels of protection in connection with Restricted Transfers as those set out in this DPA; and (b) remain responsible to you for the performance of the Subprocessor’s data protection obligations under that contract.

4.0 Assistance; Notification

4.1 Taking into account the nature of any Processing of Customer Personal Data by HELIOS and the information available to us, and solely with respect to such Processing, we will provide (a) reasonable assistance and cooperation with respect to your obligations, where applicable, to respond to requests by Data Subjects for the exercise of their rights under GDPR (including your own requests, where you may be considered both a Controller and a Data Subject) and (b) reasonably requested information regarding the Service to enable you to carry out any data protection impact assessments and/or prior consultations with Supervisory Authorities that you reasonably consider to be required under GDPR. To the extent legally permitted, you shall be responsible for any costs arising from our provision of such assistance.

4.2 Where HELIOS is a Processor and you are a Controller, we will, without undue delay, notify you of any Personal Data Breach and will include in such notice, as applicable and to the extent known by us, (a) a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects concerned and the categories and approximate number of Customer Personal Data records concerned, (b) the likely consequences of the Personal Data Breach, and (c) the measures taken or proposed to be taken by us to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Where HELIOS is a Controller and you are a Data Subject, we will, without undue delay, notify you of any Personal Data Breach likely to result in a high risk to your rights and freedoms in relation to your Customer Personal Data, subject to the exceptions set forth in GDPR Article 34(3) and will include in such notice the information described above, as applicable. In either case, we may provide such information in phases without undue further delay as such information becomes known to us.

5.0 Security; Certifications; Audits

5.1 We will maintain administrative, physical and technical safeguards for protection of the security, confidentiality and integrity of Customer Personal Data, as further described in Attachment 1. We may update that description from time to time to reflect changes in available technology or the Service.

5.2 Upon your written request, but no more frequently than once per calendar year, and on the condition that you have entered into an appropriate non-disclosure agreement with us, we will provide you with a summary copy of our most recent third-party audits or certifications, if any, or other information that we generally make available to our customers demonstrating our compliance with compliance with Subsection 5.1. Only to the extent you cannot reasonably confirm such compliance based on the information we provide, and where required by GDPR or the SCCs, you may, at your own cost, audit our technical and organizational measures no more frequently than once per calendar year.

5.3 Before the commencement of any such audit, you must enter into an appropriate non-disclosure agreement with us, and you and HELIOS must mutually agree on the scope, timing, and duration of the audit. You agree to reimburse us for any time expended for the audit, at our then-current professional services rates, and you must promptly notify us with information regarding any non-compliance discovered during the course of the audit. You must also comply (and ensure that your auditor complies) with our safety and security policies, and in any event you must avoid causing any damage, injury or disruption to our premises, equipment, personnel and business in the course of such audit. Any such audit shall not require us to disclose to you or your auditor, or allow you or your auditor to access:

(a) Any data or information about any other HELIOS customer;

(b) Any HELIOS internal accounting or financial information;

(c) Any HELIOS trade secret;

(d) Any information that, in our reasonable opinion could compromise the security of our systems or facilities, or cause us to breach our obligations under GDPR or other applicable law, or our security, confidentiality or privacy obligations to any other HELIOS customer or any third party; or

(e) Any information that you seek to access for any reason other than the good faith fulfilment of your obligations under GDPR and our compliance with this DPA.

6.0 Restricted Transfers

6.1 During any period in which (a) the EU-US Data Privacy Framework is in effect and may legally serve as a valid data transfer mechanism under GDPR and (b) HELIOS is certified in accordance with the requirements of the DPF, the DPF shall apply to any Restricted Transfer and the subsequent Processing of Personal Data in connection with the Service, and HELIOS will comply with the DPF in connection with such Restricted Transfers and Processing.

6.2 Solely to the extent Subsection 6.1 does not apply to any Restricted Transfer due to the unavailability of the DPF or lack of certification, you (as the “data exporter”) and HELIOS (as the “data importer”) enter into the Standard Contractual Clauses in respect of any such Restricted Transfer.

6.3 Subject to Subsection 6.2, the SCCs shall come into effect upon commencement of the relevant Restricted Transfer and shall be deemed incorporated into this DPA.

6.4 Subject to Subsection 6.2, the terms and applicability of certain sections of the SCCs shall be as follows:

(a) Module One (Controller to Controller) shall apply to Restricted Transfers and Processing under Subsection 2.2(b) of this DPA, and Module Two (Controller to Processor) or Module Three (Processor to Processor), as applicable, shall apply to Restricted Transfers and Processing under Subsection 2.2(a) of this DPA;

(b) Clause 7 (optional docking clause for third parties) shall apply;

(c) Clause 9(a) (use of subprocessors – authorization) under Module Two or Module Three, shall be Option 2 of such Clause (general written authorization), and the time period for notice under such Option shall be as set forth in Subsection 3.3 of this DPA;

(d) if HELIOS has identified an independent dispute resolution body in the Agreement or its Privacy Policy, and such body is eligible under the optional paragraph of Clause 11(a) (redress – dispute resolution), then such optional paragraph shall be included;

(e) the version of Clause 13(a) (supervision – applicable Supervisory Authority) that applies to the role of Customer in connection with Restricted Transfers shall be included, and where, notwithstanding the provisions of such Clause 13(a), the parties may select the applicable Supervisory Authority, such Supervisory Authority shall be that of the Republic of Ireland;

(f) Where Module Two or Module Three apply, Option 1 of Clause 17 (governing law – selected by the parties) shall apply, and the governing law under such Option (and under Clause 17 of Module One, where it applies) shall be that of the Republic of Ireland;

(g) the applicable forum under Clause 18(b) (choice of forum and jurisdiction) shall be the Republic of Ireland; provided, however, that if Module Three applies and Customer is headquartered in the United States, then, subject to the rights of Data Subjects under Clause 18(c) (right of data subject to bring proceedings in the member state where the data subject resides), the forum shall be as set forth in the Agreement;

(h) the details required or permitted to be described in Annex I as to the parties and the description of the Restricted Transfer shall be as set forth in Attachment 1 to this DPA, and the competent Supervisory Authority shall be as set forth in Clause 13 (supervision – applicable Supervisory Authority) and Subsection 6.4 (e) above;

(i) the technical and organizational measures required or permitted to be described in Annex II shall be as set forth in the Agreement and in Attachment 1 to this DPA;

(j) the list of Subprocessors required or permitted to be set forth in Annex III under Module Two or Module Three shall be as provided for in Section 3 and Subsection 6.4(c) of this DPA;

(k) where the UK GDPR applies, then, notwithstanding the foregoing provisions of this Subsection 6.4 and to the extent legally permitted, the UK SCCs shall constitute part of this DPA and the relevant annexes or appendices of the UK SCCs shall be deemed completed with the information contained in Attachments 1 and 2 of this DPA; and

(l) where the Swiss FDPA applies, then, notwithstanding the foregoing provisions of this Subsection 6.4 and to the extent legally permitted, (i) any references in the EU SCCs to “Directive 95/46/EC” or “Regulation (EU) 2016/679” shall be interpreted as references to Swiss FDPA, (ii) references to “EU,” “Union,” and “Member State” are replaced with “Switzerland”, and references to “competent supervisory authority” and “competent courts” shall be interpreted as references to the Swiss Federal Data Protection and Information Commissioner and competent courts in Switzerland, (iii) Clause 17 is replaced to state that “The Clauses are governed by the laws of Switzerland” and Clause 18 is replaced to state “Any dispute arising from these Clauses shall be resolved by the courts of Switzerland. The parties agree to submit themselves to the jurisdiction of such courts.”, and (iv) where the EU SCCs cannot lawfully be used, as modified above, under Swiss FDPA, the Swiss SCCs shall constitute part of this DPA and the relevant annexes or appendices of the Swiss SCCs shall be deemed completed with the information contained in Attachments 1 and 2 of this DPA.

6.5 Neither Subsection 6.1 nor Subsection 6.2 shall apply to a Restricted Transfer unless the effect of such Subsection, together with other reasonably practicable compliance steps undertaken by HELIOS, is to allow the relevant Restricted Transfer to take place without breach of GDPR.

7.0 General Terms

7.1 Governing law and jurisdiction: Without prejudice to the SCCs: (a) you and HELIOS submit to the choice of jurisdiction stated in the Agreement with respect to any disputes or claims related to this DPA, including disputes regarding its existence, validity or termination or the consequences of its nullity; and (b) this DPA and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of the country or territory stated for this purpose in the Agreement.

7.2 Order of precedence: Nothing in this DPA reduces our or your obligations under the Agreement in relation to the protection of Customer Personal Data or permits any Processing of Customer Personal Data in a manner which is prohibited by the Agreement or GDPR. In the event of any conflict or inconsistency between this DPA and the EU-US Data Privacy Framework or SCCs, as applicable pursuant to Section 6, the EU-US Data Privacy Framework or SCCs, as applicable, shall prevail.

7.3 Severability: Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (a) amended as necessary to ensure its validity and enforceability, while preserving your and our mutual intentions as closely as possible or, if this is not possible, (b) construed in a manner as if the invalid or unenforceable part had never been contained in this DPA.

ATTACHMENT 1: CERTAIN DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATA

Countries in which Customer Personal Data may be Processed by HELIOS: The United States and the country in which Customer will be using the Service.

Subject matter and duration of the Processing of Customer Personal Data: The subject matter and duration of the Processing of the Customer Personal Data are set out in the Agreement and this DPA.

The nature and purpose of the Processing of Customer Personal Data: The nature and purpose of the Processing of the Customer Personal Data are set out in the Agreement and this DPA.

The types of Customer Personal Data to be transferred and Processed: Customer may submit Customer Personal Data to the Service, the extent of which is determined and controlled by Customer in its sole discretion (but subject to any limitations set forth in the Agreement) and which may include, but is not limited to, the following categories of Personal Data:

• Account registration and verification information
• Demographic information
• Service usage information
• Athletic performance information (including pertinent health information as it relates to athletic performance)
• Geospatial information

The categories of Data Subjects to whom the Customer Personal Data relates: Customer may submit Personal Data to the Service, the extent of which is determined and controlled by Customer in its sole discretion (but subject to any limitations set forth in the Agreement) and which may include, but is not limited to, the following categories of Data Subjects:

• Authorized users of the Service

The obligations and rights of Customer: The obligations and rights of Customer are set out in the Agreement and this DPA.

Description of the Technical and Organizational Measures for the Protection of Customer Personal Data:

Within HELIOS’s area of responsibility, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, HELIOS has in relation to the Customer Personal Data implemented and will maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These include administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Customer Personal Data including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss, alteration, disclosure or access of or to Customer Personal Data.

HELIOS will not materially decrease the overall security of the Service during its provision of such Service to Customer.

List of Subprocessors as of 8 October 2026:

ATTACHMENT 2: ANNEXES TO THE STANDARD CONTRACTUAL CLAUSES

ANNEX I

A. LIST OF PARTIES

Data exporter(s): The data exporter is the Customer party to the Agreement. Customer’s contact details (and that of its data protection officer, if any), role and/or representative in the European Union, if any, are set forth in the Agreement or DPA or are on file with HELIOS.

Data importer(s): The data importer is HELIOS, and its role is that of controller or processor, as applicable pursuant to Subsection 2.2 of the DPA. HELIOS’s contact details (and that of its data protection officer, if any) are set forth in the Agreement.

HELIOS’s representative in the European Union is:

Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: datarequest@datarep.com (subject line “HELIOS”); web: www.datarep.com/data-request. Contact addresses in each EU/EEA member state are listed in DataRep’s representative contact summary.

HELIOS’s representative in the UK is:

Data Protection Representative Limited (trading as DataRep), 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. Email: datarequest@datarep.com (subject line “HELIOS”).

B. DESCRIPTION OF TRANSFER

The description of the transfer is set forth in Attachment 1 to the DPA.

C. COMPETENT SUPERVISORY AUTHORITY

The applicable Supervisory Authority shall be determined pursuant to Subsection 6.4 of the DPA.

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

The applicable measures implemented by the data importer are set forth on Attachment 1 to the DPA.

ANNEX III - LIST OF SUB-PROCESSORS

Please see Section 3 and Subsection 6.4(c) of the DPA.