Organizations Feature Data Processing Addendum

Updated: July 29, 2026

This Organizations Feature Addendum (this “Addendum”) is entered into by and between Customer and Klaviyo, Inc. (“Klaviyo”).

PARTIES AND BACKGROUND

(A) Customer has entered into a Data Processing Agreement with Klaviyo governing Klaviyo’s processing of Customer Personal Data in connection with the Services (the “DPA”).

(B) Customer wishes to enable the Organizations Feature (as defined below) as part of the Services, which involves processing of Customer Personal Data across linked accounts not otherwise addressed in the DPA.

(C) This Addendum sets out the supplemental terms governing that processing and is incorporated into and forms part of the DPA as of the Addendum Effective Date (as defined in Section 7).

1. INCORPORATION AND ORDER OF PRECEDENCE

1.1 This Addendum supplements the DPA and constitutes Customer’s supplemental written instructions under clause 4.2 of the DPA with respect to Cross-Account Processing.

1.2 Capitalized terms used but not defined in this Addendum have the meanings given to them in the DPA.

1.3 In the event of any conflict between this Addendum and the DPA solely with respect to Cross-Account Processing, this Addendum shall control. In all other respects, the DPA remains in full force and effect and is unaffected by this Addendum.

2. DEFINITIONS

In this Addendum, the following terms have the following meanings:

“Cross-Account Processing” means the processing of Customer Personal Data across two or more linked accounts within an Organization in connection with the Organizations Feature.

“Identity Resolution” means the matching of profiles across linked accounts within an Organization to identify where the same individual exists in more than one account and to create a cross-account identity mapping.

“Organization” means a grouping of two or more Customer accounts linked under a common organizational structure within the Services, enabling Cross-Account Processing subject to this Addendum.

“Organizations Feature” means the features of the Services that enable Cross-Account Processing within an Organization.

3. SCOPE AND AUTHORIZATION

3.1 Customer understands and acknowledges Klaviyo acts as processor (or sub-processor, as applicable) in respect of all processing of Customer Personal Data on behalf of Organizations as part of the Organizations Feature, as further described in this Addendum.

3.2 Customer authorizes Klaviyo to perform Cross-Account Processing across Customer’s linked accounts within an Organization, which may include: (a) Identity Resolution; (b) cross-account analytics (including customer overlap analysis, aggregate customer lifetime value, and purchase gap analysis); and (c) where separately enabled by Customer and subject to the consent requirements in Section 4, (i) cross-account marketing, including personalized content, product recommendations, and automated messaging across linked accounts; and (ii) cross-account segmentation and activation.

3.3 Cross-Account Processing will be performed only for accounts that have completed the required in-product data sharing authorization flow.

4. CUSTOMER REPRESENTATIONS AND WARRANTIES

Customer represents and warrants that:

4.1 it has updated its privacy policies or terms of service as may be required by Applicable Data Protection Laws for Cross-Account Processing;

4.2 it has established a lawful basis under Applicable Data Protection Laws for all Cross-Account Processing;

4.3 where linked accounts are controlled by an entity other than Customer, Customer is authorized to issue instructions to Klaviyo on behalf of, and bind, each such linked account’s controller with respect to Cross-Account Processing under this Addendum;

4.4 where linked accounts are controlled by separate legal entities, an appropriate controller or joint controller agreement under Article 26 of the GDPR exists between all linked entities;

4.5 where the Organizations Feature includes cross-account marketing, segmentation, or activation, Customer has provided notice and acquired valid multi-brand consent, each as required by Applicable Data Protection Laws, from data subjects prior to enabling such features; and

4.6 Customer is solely responsible for (i) determining whether its use of Cross-Account Processing may give rise to regulatory obligations under Applicable Data Protection Laws, including registration, disclosure, and consumer-request obligations, and (ii) for satisfying them.

5. AUDIT RIGHTS

A linked account’s audit rights under clause 7 of the DPA extend to Cross-Account Processing involving that account’s data. Audit rights do not extend to data belonging to other accounts in the Organization that the auditing entity does not control. Klaviyo may satisfy overlapping audit requests from multiple linked accounts with a single audit exercise.

6. SECURITY INCIDENT NOTIFICATION

Where a Security Incident affects data processed pursuant to the Organizations Feature, Klaviyo will notify the Organization-level administrator designated by Customer. The notification will identify which linked accounts’ Personal Data was affected. Customer is responsible for downstream notification to individual linked account controllers and to data subjects. Customer’s authorization under Section 4.3 extends to receipt of Security Incident notifications on behalf of linked account controllers. This Section supplements and does not limit Klaviyo’s obligations under clause 8 of the DPA.

7. ACCEPTANCE AND EFFECTIVE DATE

7.1 By enabling the Organizations Feature through the in-product authorization flow, Customer agrees to be bound by the terms of this Addendum, effective as of the date such action is completed (the “Addendum Effective Date”).

7.2 This Addendum may be accepted electronically, and such electronic acceptance shall have the same force and effect as a handwritten signature.

7.3 This Addendum remains in effect for as long as the Organizations Feature is enabled for Customer’s account(s), and automatically terminates upon Customer disabling the Organizations Feature for all linked accounts, without prejudice to any rights or obligations accrued prior to termination.

# Organizations Feature Data Processing Addendum This Organizations Feature Addendum (this “**Addendum**”) is entered into by and between Customer and Klaviyo, Inc. (“**Klaviyo**”). **PARTIES AND BACKGROUND** (A) Customer has entered into a Data Processing Agreement with Klaviyo governing Klaviyo’s processing of Customer Personal Data in connection with the Services (the “**DPA**”). (B) Customer wishes to enable the Organizations Feature (as defined below) as part of the Services, which involves processing of Customer Personal Data across linked accounts not otherwise addressed in the DPA. (C) This Addendum sets out the supplemental terms governing that processing and is incorporated into and forms part of the DPA as of the Addendum Effective Date (as defined in Section 7). **1. INCORPORATION AND ORDER OF PRECEDENCE** 1.1 This Addendum supplements the DPA and constitutes Customer’s supplemental written instructions under clause 4.2 of the DPA with respect to Cross-Account Processing. 1.2 Capitalized terms used but not defined in this Addendum have the meanings given to them in the DPA. 1.3 In the event of any conflict between this Addendum and the DPA solely with respect to Cross-Account Processing, this Addendum shall control. In all other respects, the DPA remains in full force and effect and is unaffected by this Addendum. **2. DEFINITIONS** In this Addendum, the following terms have the following meanings: “**Cross-Account Processing**” means the processing of Customer Personal Data across two or more linked accounts within an Organization in connection with the Organizations Feature. “**Identity Resolution**” means the matching of profiles across linked accounts within an Organization to identify where the same individual exists in more than one account and to create a cross-account identity mapping. “**Organization**” means a grouping of two or more Customer accounts linked under a common organizational structure within the Services, enabling Cross-Account Processing subject to this Addendum. “**Organizations Feature**” means the features of the Services that enable Cross-Account Processing within an Organization. **3. SCOPE AND AUTHORIZATION** 3.1 Customer understands and acknowledges Klaviyo acts as processor (or sub-processor, as applicable) in respect of all processing of Customer Personal Data on behalf of Organizations as part of the Organizations Feature, as further described in this Addendum. 3.2 Customer authorizes Klaviyo to perform Cross-Account Processing across Customer’s linked accounts within an Organization, which may include: (a) Identity Resolution; (b) cross-account analytics (including customer overlap analysis, aggregate customer lifetime value, and purchase gap analysis); and (c) where separately enabled by Customer and subject to the consent requirements in Section 4, (i) cross-account marketing, including personalized content, product recommendations, and automated messaging across linked accounts; and (ii) cross-account segmentation and activation. 3.3 Cross-Account Processing will be performed only for accounts that have completed the required in-product data sharing authorization flow. **4. CUSTOMER REPRESENTATIONS AND WARRANTIES** Customer represents and warrants that: 4.1 it has updated its privacy policies or terms of service as may be required by Applicable Data Protection Laws for Cross-Account Processing; 4.2 it has established a lawful basis under Applicable Data Protection Laws for all Cross-Account Processing; 4.3 where linked accounts are controlled by an entity other than Customer, Customer is authorized to issue instructions to Klaviyo on behalf of, and bind, each such linked account’s controller with respect to Cross-Account Processing under this Addendum; 4.4 where linked accounts are controlled by separate legal entities, an appropriate controller or joint controller agreement under Article 26 of the GDPR exists between all linked entities; 4.5 where the Organizations Feature includes cross-account marketing, segmentation, or activation, Customer has provided notice and acquired valid multi-brand consent, each as required by Applicable Data Protection Laws, from data subjects prior to enabling such features; and 4.6 Customer is solely responsible for (i) determining whether its use of Cross-Account Processing may give rise to regulatory obligations under Applicable Data Protection Laws, including registration, disclosure, and consumer-request obligations, and (ii) for satisfying them. **5. AUDIT RIGHTS** A linked account’s audit rights under clause 7 of the DPA extend to Cross-Account Processing involving that account’s data. Audit rights do not extend to data belonging to other accounts in the Organization that the auditing entity does not control. Klaviyo may satisfy overlapping audit requests from multiple linked accounts with a single audit exercise. **6. SECURITY INCIDENT NOTIFICATION** Where a Security Incident affects data processed pursuant to the Organizations Feature, Klaviyo will notify the Organization-level administrator designated by Customer. The notification will identify which linked accounts’ Personal Data was affected. Customer is responsible for downstream notification to individual linked account controllers and to data subjects. Customer’s authorization under Section 4.3 extends to receipt of Security Incident notifications on behalf of linked account controllers. This Section supplements and does not limit Klaviyo’s obligations under clause 8 of the DPA. **7. ACCEPTANCE AND EFFECTIVE DATE** 7.1 By enabling the Organizations Feature through the in-product authorization flow, Customer agrees to be bound by the terms of this Addendum, effective as of the date such action is completed (the “**Addendum Effective Date**”). 7.2 This Addendum may be accepted electronically, and such electronic acceptance shall have the same force and effect as a handwritten signature. 7.3 This Addendum remains in effect for as long as the Organizations Feature is enabled for Customer’s account(s), and automatically terminates upon Customer disabling the Organizations Feature for all linked accounts, without prejudice to any rights or obligations accrued prior to termination.