MRNMarket Data Processing Addendum

Effective Date: 27 February 2026

Last Updated: 27 February 2026

Issued by: MRN Global Market LLC, doing business as MRNMarket

Website: https://www.mrnmarket.com

Address: 1001 S Main St, STE 500, Kalispell, MT 59901-1498, United States

Support Contact: support@mrnmarket.com

Legal Contact: legal@mrnmarket.com

1. Purpose of This Addendum

This Data Processing Addendum explains certain data processing terms that may apply where MRNMarket processes Personal Data on behalf of another party, where another party processes Personal Data on behalf of MRNMarket, or where applicable privacy or data protection laws require additional processing terms.

This Addendum is intended to support lawful, secure, and transparent processing of Personal Data connected to the MRNMarket Platform.

This Addendum should be read together with the MRNMarket Privacy Policy, Cookie & Tracking Policy, Terms & Conditions, Seller Privacy / Buyer Data Handling Policy, Seller Agreement, Service Provider Agreement, and other applicable MRNMarket policies.

2. Scope of This Addendum

This Addendum may apply to Personal Data processed in connection with:

1. user accounts;
2. Orders;
3. Transactions;
4. Seller activity;
5. Buyer activity;
6. Affiliate activity;
7. Delivery Partner activity;
8. Service Provider activity;
9. payment review;
10. payout review;
11. refunds;
12. returns;
13. disputes;
14. verification;
15. KYC, KYB, AML, and sanctions review;
16. fraud prevention;
17. customer support;
18. marketing where permitted;
19. security;
20. analytics;
21. legal compliance; and
22. other Platform-related activity.

This Addendum applies only to the extent required by applicable privacy or data protection laws or incorporated into a written agreement with MRNMarket.

3. Definitions

For purposes of this Addendum:

“Personal Data” or “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identifiable person, household, account, or device, as defined under applicable privacy laws.

“Processing” means any operation performed on Personal Data, including collection, use, storage, access, disclosure, transfer, deletion, restriction, modification, analysis, protection, or other handling of Personal Data.

“Controller” means the party that determines the purposes and means of Processing Personal Data, or the equivalent term under applicable law.

“Processor” means the party that Processes Personal Data on behalf of a Controller, or the equivalent term under applicable law.

“Service Provider” means a party that Processes Personal Data on behalf of another party under applicable privacy laws.

“Subprocessor” means a third party engaged by a Processor or Service Provider to Process Personal Data on behalf of the Controller.

“Data Subject” means the individual to whom Personal Data relates, or the equivalent term under applicable law.

4. Roles of the Parties

Depending on the activity, MRNMarket may act as:

1. an independent Controller;
2. a joint Controller where applicable;
3. a Processor;
4. a Service Provider;
5. or another role recognized under applicable privacy laws.

For example:

1. MRNMarket generally acts as an independent Controller for Platform account management, marketplace operations, fraud prevention, compliance, security, legal obligations, and general Platform administration.
2. MRNMarket may act as a Processor or Service Provider where it Processes Personal Data on behalf of a business User under a written agreement.
3. Sellers, Delivery Partners, Affiliates, and Service Providers may act as independent Controllers, Processors, or Service Providers depending on their role and applicable law.

Nothing in this Addendum changes the parties’ roles unless a written agreement expressly states otherwise.

5. Processing Instructions

Where MRNMarket acts as a Processor or Service Provider, MRNMarket will Process Personal Data only:

1. according to documented instructions;
2. as required to provide Platform services;
3. as required by applicable agreements;
4. as permitted by MRNMarket policies;
5. as required by applicable law;
6. as needed for security, fraud prevention, and compliance;
7. as needed to protect rights and safety; or
8. as otherwise permitted under applicable privacy laws.

If MRNMarket believes an instruction violates applicable law, MRNMarket may notify the instructing party where legally permitted.

6. Categories of Personal Data

Personal Data processed under this Addendum may include:

1. name;
2. email address;
3. phone number;
4. physical address;
5. billing address;
6. shipping address;
7. account information;
8. order information;
9. transaction information;
10. payment-related information;
11. payout-related information;
12. tax information;
13. identity verification information;
14. business verification information;
15. communication records;
16. support records;
17. delivery information;
18. tracking information;
19. dispute information;
20. refund and return information;
21. device and usage information;
22. IP address;
23. cookie identifiers;
24. fraud and risk review information;
25. compliance review information;
26. and other Personal Data connected to Platform activity.

7. Categories of Data Subjects

Personal Data may relate to:

1. Buyers;
2. Sellers;
3. Affiliates;
4. Delivery Partners;
5. Service Providers;
6. account holders;
7. visitors;
8. support contacts;
9. business representatives;
10. beneficial owners;
11. employees or contractors of business Users;
12. payment account holders;
13. recipients of deliveries;
14. complainants;
15. dispute participants;
16. and other persons who interact with MRNMarket or Users.

8. Purposes of Processing

MRNMarket may Process Personal Data for purposes including:

1. operating the Platform;
2. creating and managing Accounts;
3. processing Orders and Transactions;
4. supporting payment and payout review;
5. supporting refunds and returns;
6. supporting delivery confirmation;
7. providing customer support;
8. managing disputes;
9. verifying identity or business information;
10. KYC, KYB, AML, and sanctions review;
11. fraud prevention;
12. security monitoring;
13. enforcing MRNMarket policies;
14. protecting Users and the Platform;
15. analytics and service improvement;
16. communications and notices;
17. legal compliance;
18. tax and accounting obligations;
19. responding to lawful requests;
20. establishing, exercising, or defending legal claims; and
21. other purposes described in the Privacy Policy or applicable agreements.

9. Duration of Processing

MRNMarket may Process Personal Data for as long as necessary to provide the Platform, fulfill the purposes described in this Addendum, comply with applicable law, resolve disputes, enforce policies, prevent fraud, maintain records, support tax or accounting obligations, and protect legal rights.

Retention periods may vary depending on the data type, User role, transaction activity, legal requirements, risk, disputes, and business needs.

10. Confidentiality

MRNMarket will require personnel who access Personal Data to be subject to confidentiality obligations or appropriate professional obligations.

Personnel may access Personal Data only as needed for authorized business, operational, security, support, compliance, legal, or Platform-related purposes.

11. Security Measures

MRNMarket will use reasonable administrative, technical, and organizational measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

Security measures may include, as appropriate:

1. access controls;
2. authentication measures;
3. encryption or secure transmission where appropriate;
4. account protection tools;
5. monitoring and logging;
6. vulnerability management;
7. data minimization;
8. personnel confidentiality;
9. incident response procedures;
10. service provider review;
11. backup and recovery controls;
12. and other safeguards appropriate to the nature of the Processing.

No system, platform, transmission, or storage method is completely secure, and MRNMarket does not guarantee absolute security.

12. Subprocessors and Service Providers

MRNMarket may engage Subprocessors and service providers to support Platform operations, including:

1. hosting providers;
2. cloud service providers;
3. payment processors;
4. payout providers;
5. fraud prevention providers;
6. identity verification providers;
7. sanctions screening providers;
8. analytics providers;
9. customer support providers;
10. email and communication providers;
11. delivery and logistics providers;
12. tax and accounting providers;
13. security providers;
14. legal and compliance providers; and
15. other operational service providers.

MRNMarket will use commercially reasonable efforts to require Subprocessors to protect Personal Data and use it only for authorized purposes.

13. International Transfers

MRNMarket is operated from the United States and may Process, store, or transfer Personal Data in the United States or other countries where MRNMarket, its service providers, Payment Processors, or partners operate.

Where required by applicable law, MRNMarket may use appropriate safeguards for international transfers.

Users and business partners are responsible for ensuring that their own transfers of Personal Data comply with applicable law.

14. Data Subject Requests

Where required by applicable law, MRNMarket may assist with Data Subject requests relating to Personal Data processed under this Addendum.

Data Subject requests may include requests to:

1. access Personal Data;
2. correct Personal Data;
3. delete Personal Data;
4. restrict Processing;
5. object to Processing;
6. request portability;
7. withdraw consent where applicable;
8. opt out of certain processing where applicable; or
9. appeal certain privacy decisions where required by law.

MRNMarket may verify the requester’s identity and may decline or limit requests where permitted by applicable law, including for fraud prevention, security, legal compliance, recordkeeping, dispute resolution, or legal claims.

15. Assistance With Compliance

Where MRNMarket acts as a Processor or Service Provider and where required by applicable law, MRNMarket may provide reasonable assistance with:

1. responding to Data Subject requests;
2. security obligations;
3. data incident review;
4. privacy impact assessments where required;
5. regulatory inquiries;
6. deletion or return of Personal Data;
7. and other compliance obligations.

Assistance may be subject to reasonable limitations, technical feasibility, security requirements, legal restrictions, and reimbursement of reasonable costs where permitted.

16. Data Incidents

MRNMarket will maintain procedures designed to identify, review, and respond to certain Personal Data security incidents.

Where required by applicable law or agreement, MRNMarket may notify affected parties of a Personal Data breach or security incident involving Personal Data processed under this Addendum.

Notice may include, where available and appropriate:

1. general description of the incident;
2. categories of data involved;
3. affected categories of persons;
4. known or suspected cause;
5. steps taken or planned;
6. recommended actions;
7. and contact information.

Notification of an incident does not mean MRNMarket admits fault, liability, or legal responsibility.

17. Deletion or Return of Personal Data

Where MRNMarket acts as a Processor or Service Provider, and where required by applicable law or written agreement, MRNMarket may delete, return, anonymize, or restrict Personal Data after termination of services or upon valid request.

MRNMarket may retain Personal Data where necessary or permitted for:

1. legal compliance;
2. tax or accounting obligations;
3. fraud prevention;
4. dispute resolution;
5. security;
6. backup retention;
7. platform integrity;
8. policy enforcement;
9. regulatory requirements;
10. or legal claims.

18. Audits and Information Requests

Where required by applicable law or written agreement, MRNMarket may make available reasonable information necessary to demonstrate compliance with this Addendum.

Any audit or review must be:

1. reasonable in scope;
2. subject to confidentiality;
3. scheduled in advance;
4. conducted without disrupting MRNMarket operations;
5. limited to information relevant to the Processing;
6. compliant with security requirements;
7. and subject to reasonable restrictions to protect other Users, confidential information, trade secrets, security systems, and third-party obligations.

MRNMarket may satisfy audit obligations through certifications, summaries, policies, security information, or other documentation where appropriate.

19. Restricted Processing

Where applicable law requires MRNMarket to act as a Service Provider, Processor, contractor, or similar role, MRNMarket will not sell, share, retain, use, or disclose Personal Data outside the permitted business purposes except as allowed by applicable law.

MRNMarket may still Process Personal Data as permitted for:

1. security;
2. fraud prevention;
3. compliance;
4. debugging;
5. service improvement where allowed;
6. internal operations;
7. legal obligations;
8. and other purposes permitted by applicable privacy laws.

20. Sensitive Personal Data

MRNMarket may Process sensitive Personal Data only where necessary for permitted purposes, such as:

1. identity verification;
2. payment review;
3. fraud prevention;
4. account security;
5. legal compliance;
6. sanctions screening;
7. dispute review;
8. tax compliance;
9. safety;
10. or other purposes permitted by law.

Sensitive Personal Data must not be used for prohibited purposes under applicable law.

21. User and Business Partner Obligations

Users, Sellers, Affiliates, Delivery Partners, Service Providers, and business partners must:

1. provide Personal Data lawfully;
2. have required rights, authority, notices, and consents;
3. comply with applicable privacy laws;
4. use Personal Data only for permitted purposes;
5. protect Personal Data appropriately;
6. avoid unauthorized disclosure or misuse;
7. respond to MRNMarket privacy and security requests;
8. notify MRNMarket of suspected unauthorized access or misuse where required;
9. and comply with applicable MRNMarket policies.

22. Conflict With Other Terms

This Addendum should be read together with the MRNMarket Privacy Policy, Cookie & Tracking Policy, Terms & Conditions, Seller Privacy / Buyer Data Handling Policy, Seller Agreement, Service Provider Agreement, and other applicable MRNMarket policies.

If this Addendum conflicts with a more specific data processing agreement, privacy notice, or legally required disclosure, the more specific or legally required document will control for that issue.

Nothing in this Addendum limits rights or remedies that cannot be waived under applicable law.

23. Changes to This Addendum

MRNMarket may update this Data Processing Addendum from time to time to reflect changes in the Platform, applicable law, privacy requirements, data processing practices, service providers, risk controls, operational needs, or other policies.

Updated versions will be published on the Platform with a revised effective date or last updated date.

Continued use of the Platform after updates are published means the User acknowledges the updated Addendum.

Where required by law, MRNMarket may provide additional notice or request consent for material changes.

24. Contact Information

For questions about this Data Processing Addendum or MRNMarket’s data processing practices, contact:

MRN Global Market LLC

1001 S Main St, STE 500

Kalispell, MT 59901-1498

United States

Website: https://www.mrnmarket.com

Legal Contact: legal@mrnmarket.com

Support Contact: support@mrnmarket.com