Sprout Social Influencer Marketing Brand Safety Feature Addendum

This Brand Safety Feature Addendum ("Addendum") governs Subscriber's use of the Brand Safety feature within the Influencer Marketing Subscription Services and is incorporated into the Sprout Social Influencer Marketing Product Terms ("Product Terms") and the agreement in place between the parties with respect to the use of Influencer Marketing Subscription Services ("Agreement"). Capitalized terms used but not defined in this Addendum have the meanings given in the Product Terms or the Agreement. In the event of any conflict between this Addendum and the Product Terms, this Addendum prevails with respect to the Brand Safety Feature.

1. 1. Brand Safety Feature. The "Brand Safety Feature" allows Subscriber to evaluate Creator content against safety categories using AI-powered analysis. Subscriber may select from Sprout Social's pre-defined safety categories ("Default Categories") or, where available, define custom safety categories ("Custom Categories," and together with Default Categories, "Safety Categories"). The Brand Safety Feature generates AI-powered outputs, including flags, scores, and summaries ("Brand Safety Outputs"), designed to assist Subscriber's independent evaluation of Creator content. Brand Safety Outputs are probabilistic, may contain inaccuracies, and do not constitute a determination by Sprout Social regarding any Creator's content or suitability.

2. 2. Subscriber Responsibilities. Subscriber is the data controller for all personal data processed through the Brand Safety Feature. Subscriber's selection and configuration of Safety Categories constitutes documented processing instructions to Sprout Social. Subscriber is solely responsible for: (a) determining the lawfulness of its processing instructions, including establishing and documenting a valid legal basis under applicable data protection law for each Safety Category it enables or defines; (b) providing any legally required notices to Creators or other data subjects whose data is processed through the Brand Safety Feature; and (c) conducting independent human review of Brand Safety Outputs before making any decisions regarding Creator engagement.

3. 3.Restrictions on Safety Categories.

   1. a. Applicability; Subscriber's Responsibility to Determine Scope. Subscriber is solely responsible for determining, for each use of the Brand Safety Feature, whether the EU GDPR, UK GDPR, EU AI Act, or any other law imposing equivalent requirements applies to its processing (taking into account, among other things, Subscriber's location and the location of the creators being analyzed). The restrictions in subsections (b) and (c) apply whenever such a law applies to the relevant processing. Where no such law applies, subsections (b) and (c) do not restrict Subscriber's creation or use of Safety Categories.

   2. b. Special Category and Criminal Offense Data. Where a law described in subsection (a) applies, Subscriber shall not create or enable Safety Categories designed to, or reasonably likely to, reveal or permit the inference of (i) special categories of personal data within the meaning of Article 9(1) of the EU GDPR (or equivalent categories under applicable law), including data revealing political opinions, religious or philosophical beliefs, racial or ethnic origin, trade union membership, health, sex life, or sexual orientation; or (ii) personal data relating to criminal convictions, offenses, or allegations of criminal activity within the meaning of Article 10 of the EU GDPR (or equivalent under applicable law), unless Subscriber has established and documented a valid legal basis for such processing under all applicable law (including, where applicable, a condition under Article 9(2) and any authorization required under Article 10 of the EU GDPR) prior to enabling the Safety Category. Subscriber acknowledges that legitimate interests is not a valid basis for processing special category data, and that Subscriber bears sole responsibility for determining the lawfulness of such processing.

   3. c. Emotions and Intentions. Where a law described in subsection (a) applies, Subscriber shall not create or enable Safety Categories designed to, or reasonably likely to, identify or infer the emotions or intentions of a natural person (including whether a creator appears angry, distressed, aggressive, unstable, or otherwise emotionally "risky").

   4. d. Illustrative Examples. By way of example and without limitation, Safety Categories subject to the restrictions above include those that target or reference specific political figures, parties, or movements; religious beliefs, practices, or figures; sexual orientation or gender identity; racial or ethnic groups, national origin, or immigration status; health conditions, disabilities, or medical treatments; criminal conduct, arrests, or convictions; or a creator's emotional state, mood, or disposition.

4. 4. Use of Brand Safety Outputs. Subscriber shall not: (a) share, disclose, or make available Brand Safety Outputs to any third party, including other Sprout Social subscribers, affiliated brands, or agencies acting on behalf of other brands, except to Subscriber's own personnel and authorized agents evaluating Creator partnerships on Subscriber's behalf; (b) use Brand Safety Outputs to create or contribute to any cross-brand or cross-account database, list, or scoring system that rates or categorizes Creators; or (c) represent Brand Safety Outputs to Creators or any third party as definitive or factual determinations about a Creator's content or character.

5. 5. Sprout Social's Processing Role. Sprout Social processes personal data through the Brand Safety Feature solely as a data processor acting on Subscriber's instructions, as supplemented by this Addendum and the DPA. Sprout Social will not use Brand Safety Outputs for its own purposes, including product improvement, model training, analytics, or benchmarking, and will not share or make available any Brand Safety Outputs associated with Subscriber's account to any other subscriber or third party (other than subprocessors engaged to provide the Brand Safety Feature). Notwithstanding the foregoing, Sprout Social may use de-identified and aggregated Safety Category configuration data (excluding Brand Safety Outputs and any data associated with or attributable to a specific Creator) for purposes of improving the Brand Safety Feature, including the development and refinement of Default Categories. Sprout Social's provision of Default Categories does not constitute a determination by Sprout Social regarding the lawfulness or appropriateness of any category for Subscriber's use.

6. 6. Sprout Social's Rights. Sprout Social reserves the right to review, modify, disable, or remove any Safety Category (including Custom Categories) at any time if Sprout Social reasonably determines that such category creates legal, regulatory, or reputational risk. Sprout Social may update, add, or remove Default Categories or restrict the scope of permitted Custom Categories at any time. Sprout Social does not undertake any obligation to monitor Subscriber's configuration of Safety Categories or use of Brand Safety Outputs for compliance with this Addendum or applicable law.