Snapshot 36515
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Campaign Registry October 30, 2025
AGREEMENT
This agreement (“Agreement”) is made and entered into as of (“Effective Date”) between
Campaign Registry, Inc., a Delaware corporation with a principal office at 1775 Tysons Blvd, 5th Floor,
McLean, VA 22102 (“Company”) and $docusign:Text:Company:Customer1(Company){fontSize:Size9}
,a( corporation, with a
principal office at $docusign:Text:Address:Customer1(Address){fontSize:Size9}
(“User”).
User may be referred to as “you,” and Company and User are collectively referred to as the “parties.”
1. Definitions
“Affiliate” means with respect to a party, any entity that directly or indirectly controls, is controlled by, or is
under common control with such party, where “control” (or variants of it) shall mean the ability (whether
directly or indirectly) to direct the affairs of another by means of ownership, contract or otherwise. For the
purposes of this definition, an entity shall control another entity if the first entity: (a) owns, beneficially or of
record, more than fifty percent (50%) of the voting securities of the other entity; (b) has the ability to elect a
majority of the directors of the other entity or (c) provides day to day management of such entity under
contract or as managing general partner.
“Application-to-Person” or “A2P” shall mean the process of sending mobile messages from an application
to an End User.
“Brand” shall mean the applicable company on whose behalf the campaign and End User communications
are conducted.
“Brand Assets” means the property of a Brand, including logos and trademarks, displayed in messaging with
End Users.
“Brand Vetting” or “Vetting” means reputational vetting, provided by a Verification Authority, taking into
account factors such as past and current lawsuits or fines, or non-compliance with messaging codes of
conduct.
“Campaign Service Provider” or “CSP” shall mean the company responsible for submitting a Brand’s
Campaign Registry Information to the Campaign Registry and contracting with the Brand, which includes
managing Brand’s campaign content, database of End Users who have consented to receive 10-Digit Long
Code (“10DLC”) Messages, obtaining End User consent and connectivity into the DCA, either directly, or via
an intermediary messaging company.
“Campaign Registry” means the database and systems created and maintained by and on behalf of the
Company to authenticate CSP A2P messaging campaigns using 10-digit telephone numbers.
“Confidential Information” shall mean all non-public information, trade secrets and know-how disclosed by
a Party pursuant to this Agreement, which is either designated as proprietary and/or confidential, or by the
nature of the circumstances surrounding disclosure that should be reasonably understood to be confidential.
“Connectivity Partner” shall mean an entity that is part of the message delivery chain between the CSP and
the MNO Gateway(s). The CSPs may have direct connections with the MNO Gateway(s) and therefore not
need any Connectivity Partners, or the CSPs may nominate their Connectivity Partner(s), who in turn may
nominate their own Connectivity Partner(s).
1
Campaign Registry October 30, 2025
“Credential” means a confirmation that a company meets certain criteria (such as being a non-profit) or has
the rights to use certain assets (such as a logo or a trademark).
“Data” shall mean all data and other information uploaded by Customer to the Campaign Registry for the
registration of 10DLC A2P and RBM messaging campaigns.
“DCA” (Direct Connect Aggregator) shall mean the entity that transmits the message to the MNO for
delivery to the End User.
“End User” shall mean the person with a mobile phone and an account with an MNO.
“Gateway” shall mean the company which manages the connectivity between the DCA and the MNO.
“Google Partner” means a company contracted with Google to exchange RCS traffic with the Google RBM
platform, as managed by Google.
“RBM” means RCS for Business, a subset of RCS.
“RBM Agent”, or “Agent” means a programmatic entity that acts on behalf of a Brand to send messages to
End Users.
“RBM Campaign” means a dataset that includes the mandatory RBM Agent dataset, as documented by
Google, as well as other attributes as defined by Company to provide an enhanced view of who is sending the
RBM traffic, and what is being communicated. When approved and launched by an RBM DCA, the RBM
Campaign becomes an RBM Agent running on the Google platform.
“RBM DCA” means a company that is contracted with the MNO as a DCA for RBM, and may also be a
Google Partner, if required in order to deliver RBM traffic to Google.
“RCS” means Google’s Rich Communication Services as defined by Google.
“Mobile Network Operator” or “MNO” shall mean the company that provides the mobile
telecommunications service to the End User.
“Verification Authority” means an entity authenticating a claim, such as the identity of a Brand, or a Brand’s
ownership of an asset such as a logo.
2. Service Terms
a. Available services.
i. US 10DLC, see Exhibit F
ii. US RBM Onboarding, see Exhibit G
b. License. The Campaign Registry is proprietary to the Company and is protected by
intellectual property laws and international intellectual property treaties. User’s access to the Campaign
Registry is licensed and not sold. Subject to the timely payment of all Fees and the terms and limitations set
forth in this Agreement, Company agrees to provide User with a personal, non-transferable and non-exclusive
account enabling User to access the Campaign Registry. Company reserves all rights not expressly granted to
User, including, but not limited to, the right to alter, modify, update, enhance, or improve the Campaign
Registry and the right to modify or update this Agreement. If you have an active account, we will notify you
by email when there has been an update or modification of the terms and conditions of this Agreement and/or
of third party services offered through TCR, and your continued use of the account following such email shall
2
Campaign Registry October 30, 2025
be deemed as your acceptance of these modifications. If changes to the Campaign Registry are unacceptable
to you, you may terminate this Agreement upon written notice. The rights granted by Company in this
Agreement are personal to User and may not be sub-licensed or otherwise transferred or delegated, and any
attempt to do so shall be void.
c. Accessibility. User agrees that from time to time the Campaign Registry may be inaccessible
or inoperable for any reason, including, without limitation: (i) equipment malfunctions; (ii) periodic
maintenance procedures or repairs which Company may undertake from time to time; or (iii) causes beyond
the control of Company or which are not foreseeable by Company. Company makes no guarantee and does
not represent or warrant that User will be able to access or use the Campaign Registry at times of User’s
choosing.
d. Equipment. User shall be solely responsible for providing, maintaining and ensuring the
compatibility of all hardware, software, electrical and other physical requirements necessary for User’s use of
the Registry, including, without limitation, telecommunications and internet access connections and links, web
browsers or other equipment, programs and services required to access and use the Service. User is solely
responsible for all charges related thereto.
e. Transactions. User acknowledges that by interacting with the Campaign Registry, User is
voluntarily choosing to engage in certain transactions enabled by the Campaign Registry.
f. Feedback. User agrees that if Company receives from User any suggestions, ideas,
improvements, modifications, feedback, error identifications or other information related to the Campaign
Registry (collectively, “Feedback”), Company may use, disclose and exploit such Feedback without
restriction, including to improve the Campaign Registry and to develop, market, offer, sell and provide other
products and services, without any obligation to pay any royalties or other compensation in respect thereof.
g. Authentication. Company will use best practices for Brand identity verification, with
solutions including multi-factor authentication, biometrics, and direct capture of Brand attestations, and may
use Credentials, digital wallets, and other related technologies for Brands to hold and manage their
information. Company may provide the relevant parties including Verification Authorities, MNOs, Google,
Google Partners, DCAs, CSPs and Brands, with the tools to issue, hold, present, and verify the Credentials,
with no obligation for the use of such tools.
h. Use of Data. Any Data you provide shall remain your property, which Company will hold
securely in accordance with our internal security policy and the law. Company will take reasonable measures
to protect your Data with security safeguards appropriate to the sensitivity of the Data, through the use of
technological measures (e.g., firewalls, passwords, encryption) and training of employees. CSPs will have
access only to Data regarding Brands and Campaigns the CSP has registered with the Campaign Registry.
Company will not redistribute your Data, except as provided herein, including that (a) Company may disclose
Data including Brand identities and Brand-Campaign pairings to MNOs and Connectivity Partners solely for
traffic management and spam mitigation purposes; (b) For 10DLC, Company shall register the campaigns
with the NetNumber Services Registry (to include campaign ID and campaign status, derived campaign class
as per MNO specifications, and if included, obfuscated sender IDs); and (c) For RBM, Company may share
Brand and Campaign information with Google, Google Partners, MNOs, and other parties as needed in
support of RBM Agent onboarding and compliance management.
Company may use Data: (a) solely to exercise its rights and perform its obligations under this
Agreement, including by verifying the identity of Brands (e.g., via multifactor authentication) and subject to
Company’s privacy policy available at https://www.campaignregistry.com/privacy/ and the Data Processing
Addendum attached as Exhibit E to this Agreement; and (b) to support the development of new services and
service improvement related to spam mitigation and traffic management in support of the MNOs. The Data
provided to the MNOs, Google, Google Partners, Connectivity Partners and other parties shall be usable by
3
Campaign Registry October 30, 2025
them only for traffic routing, traffic management, customer service and to confirm campaign compliance with
laws and this Agreement. Company will not sell or disclose Data provided by CSPs for marketing purposes
(e.g., attempting to directly contract with and/or provide services to the Brands, DCAs or CSPs; or using the
Data as a lead generation tool for internal marketing or messaging aggregation services). Company may
disclose Data to its employees, Affiliates and third parties such as governmental authorities, third party
vetting services, gateway providers and MNO spam filter providers, as is reasonably required in connection
with the exercise of Company’s rights and performance of its obligations under this Agreement; or as
otherwise required by law.
3. Fees and Payments
a. Fees. The Campaign Registry fees are detailed in Exhibit A. Fees may be paid by credit card
or other such payment methods as may be provided in Exhibit A. All amounts payable under this Agreement
will be paid without setoff or counterclaim, and without any deduction or withholding. The Company reserves
the right to change fees for any existing service at its discretion with sixty (60) days prior written notice and to
introduce new campaign types or new third party vetting options with their corresponding fees immediately.
All other fees shall be due net thirty (30) days from the date of invoice. Late fees shall accrue interest at the
rate of one percent (1%) per month. All payment obligations are noncancelable and all amounts paid are
nonrefundable, except as specifically provided for in this Agreement.
b. Disputes. If User withholds the payment of any amount invoiced under this Agreement
because it in good faith disputes the amount in question, User must (i) pay all undisputed amounts by the
applicable Due Date and (ii) provide written notice of the dispute by that same Due Date. In addition, if User
does not notify Company in writing of a dispute within sixty (60) days of the invoice date, the invoice will be
deemed to be correct and binding upon User. Any amounts unpaid by User, including disputed amounts, are
subject to any other remedies available to Company.
c. Taxes. All fees are exclusive of taxes, which we may charge or withhold as applicable. You
agree to pay any taxes applicable to your use of the Campaign Registry, unless you provide Company with a
valid tax exemption certificate authorized by the appropriate taxing authority.
d. Suspension of Services. The services may be suspended at any time if you are in breach of
any payment obligations hereunder.
e. 3rd Party Services: Fees for 3rd party services such as identity verification are listed in Exhibit
A under the section titled “3rd Party Verification, Vetting & RBM” and are covered by the Third Party Terms
& Conditions found here:
https://www.campaignregistry.com/TCR-Third%20Party%20Terms%20%26%20Conditions.pdf. Your use of
those third party services is deemed to be acceptance of those 3rd Party Terms & Conditions.
4. Security Requirements and Acceptable Use
a. Security Requirements. The Parties shall act in compliance with the Security Requirements
detailed in Exhibit B. User shall be solely responsible for the security, confidentiality and
integrity of all content that User receives. User shall be solely responsible for any authorized
or unauthorized access to User’s account by any person. User agrees to bear all responsibility
for the confidentiality of User’s passwords and all usage or other charges incurred from use of
the Campaign Registry with User’s passwords.
b. Acceptable Use. User acknowledges that all information and other material transmitted
(collectively, “Content”), is the sole responsibility of the person from which such Content
originated or the person transmitting it. As between User and Company, User is responsible
for all Content that User transmits. Company does not monitor or control the Content and, as
such, does not guarantee the accuracy, integrity or quality of the Content. Under no
4
Campaign Registry October 30, 2025
circumstances will Company be liable in any way for any Content, including, but not limited
to, for any errors or omissions in any Content, or for any loss or damage of any kind incurred
as a result of the use of any Content posted, emailed or otherwise transmitted by User.
c. User agrees not to use the Campaign Registry to publish any Content or undertake any
Campaign:
● that is unlawful, harmful, threatening, abusive, harassing, tortious, defamatory,
vulgar, obscene, libelous, invasive of another’s privacy, hateful, or racially,
ethnically or otherwise objectionable;
● that impersonates any person or entity, including, but not limited to, any state or
federal government employee or representative, forum moderator, guide or host, or
falsely states or otherwise misrepresents your affiliation with a person or entity;
● that User does not have a right to transmit under any law or under contractual or
fiduciary relationships (such as inside information, proprietary and confidential
information learned or disclosed as part of employment relationships or under
nondisclosure agreements);
● that infringes any patent, trademark, trade secret, copyright or other proprietary
rights of any party;
● that contains software viruses, or any other computer code, files or programs
designed to interrupt, destroy, or limit the functionality of any computer software or
hardware or telecommunications equipment;
● that interferes with or disrupts the servers or networks of communications carriers,
or disobeys any requirements, procedures, policies or regulations of public
communications networks; or
● that violates, or causes Campaign Registry to violate, any applicable local, state,
national or international law.
d. User Acknowledgements. User’s privilege to use the Campaign Registry depends on User’s
compliance with the requirements set forth above. Company may immediately suspend or
terminate, in its sole discretion, User’s registration privileges, access to the Campaign
Registry, and/or take any other appropriate measures to enforce these requirements.
e. Compliance. User must access and use the Campaign Registry in compliance, at all times,
with the following: (i) the terms of this Agreement; and (ii) all applicable laws and
regulations. User may not access or use the Campaign Registry for any Brand that is located
in or under the control of any country subject to a comprehensive U.S. economic embargo
(currently including Cuba, Iran, North Korea, Syria, and the Crimea region of Ukraine), any
Brand that is owned or controlled by the Government of Venezuela, or for any Brand that is
on any U.S. Government restricted party list, including but not limited to the U.S. Treasury
Department’s List of Specially Designated Nationals and Blocked Persons.
f. No Sale or Purchase by Individuals or Minors. User may not be an individual; you must be a
corporation or partnership.
5
Campaign Registry October 30, 2025
5. Intellectual Property
The intellectual property utilized in providing the Campaign Registry is the valuable, confidential and
copyrighted property of Company and its licensors. User may use the Campaign Registry as permitted herein
and may not otherwise modify, adapt, translate, or create derivative works based on the Campaign Registry
without the prior written consent of Company. User may not use or reference the Campaign Registry or permit
it to be used or referenced, to aid in the creation of a competitive alternative to the Campaign Registry. As
between the parties, Company owns all right, title, and interest in and to the Campaign Registry, including
without limitation, all ancillary and interface software, all current and future enhancements, revisions, new
releases and updates thereof and any derivative works based thereon and all documentation thereto, all
copyrights, trade secrets, patents, and goodwill therein. “Campaign Registry” and the stylized “Campaign
Registry” logo are service marks of Company. All other trademarks, service marks and logos used on the
website or through the Campaign Registry are the trademarks, service marks or logos of their respective
owners.
6. User Representations
User represents and warrants to Company that: (a) the person registering and operating the User’s account is
over the age of eighteen (18) and has the power and authority to enter into and perform User’s obligations
under this Agreement; (b) all information provided by User to Company is truthful, accurate and complete;
(c) if User provides a credit or charge card for payment of fees for the Service, User is the authorized
signatory of the credit or charge card provided to Company to pay the fees; (d) User shall comply with all
terms and conditions of this Agreement, including, without limitation, the provisions set forth in this Section
6; (e) User has provided and will maintain accurate and complete registration information with Company,
including, without limitation, User’s legal name, address and telephone number; (f) User’s access to and / or
use of the Campaign Registry does not and will not constitute a breach or violation of any other agreement,
contract, terms of use, or similar policy or understanding to which User is or may be subject; (g) User shall
comply with all laws attendant upon its performance of its obligations under this Agreement; (h) User and/or
the Brand have obtained, and will maintain, all applicable consents, approvals, or permissions required by
applicable law, including, without limitation, the Telephone Consumer Protection Act (“TCPA”), 27 U.S.C. §
27, as amended from time to time, to transmit or otherwise send messages to any End User; (i) User and/or
Brand is operating in accordance with the current version of the CTIA Messaging Principles and Best
Practices, found at:
https://api.ctia.org/wp-content/uploads/2023/05/230523-CTIA-Messaging-Principles-and-Best-Practi
ces-FINAL.pdf; and (j) User and/or Brand is operating in accordance with rules, regulations, best practices
and guidelines published by MNOs.
7. Term and Termination
This Agreement will commence on the Effective Date and shall continue for an initial term of two (2) years.
Thereafter, the term will automatically renew for successive one (1) year renewal terms unless terminated by
either party pursuant to this Agreement (collectively, the “Term”). Notwithstanding the foregoing, either party
may terminate this Agreement, or any service provided hereunder, at the expiration of the initial term or at
any other time thereafter by providing sixty days’ prior written notice of termination to the other party.
Notwithstanding the above, the Term of this Agreement shall extend through the completion of the term of
any then current service. Unless otherwise provided herein, Company may terminate this Agreement upon 30
days’ written notice if User fails to comply with any material provision of this Agreement and User fails to
cure such failure during such 30 day period; provided that with respect to a breach of the terms of this
Agreement solely with respect to a particular Brand and/or Campaign, such termination shall relate solely to
the Brand and/or Campaign which is the subject of the failure to comply with any material provision of this
Agreement. Termination for any reason shall not affect Company’s entitlement to any sums due in respect of
User’s use of the Campaign Registry prior to such termination, or any additional remedies provided by law or
equity. Under no circumstances shall User be entitled to any refund on any portion of fees paid in connection
6
Campaign Registry October 30, 2025
with this Agreement Notwithstanding the above, User is under no obligations to purchase any minimum
volume of services from Company.
8. Disclaimer of Warranties
THE CAMPAIGN REGISTRY IS PROVIDED ON AN “AS IS” AND A “WHERE IS” BASIS WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USE OF THE CAMPAIGN REGISTRY IS AT
USER’S SOLE RISK.COMPANY DOES NOT WARRANT THAT ACCESS TO THE CAMPAIGN
REGISTRY WILL BE UNINTERRUPTED OR ERROR FREE, NOR DOES COMPANY MAKE ANY
WARRANTY AS TO ANY RESULTS THAT MAY BE OBTAINED BY USE OF THE CAMPAIGN
REGISTRY. COMPANY MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING,
WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE, IN RELATION TO THE CAMPAIGN REGISTRY.
9. Limitation of Liability
UNDER NO CIRCUMSTANCES SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR
ANY OTHER PERSON FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL OR
PUNITIVE DAMAGES FOR ANY MATTER ARISING FROM OR RELATING TO THIS AGREEMENT,
THE CAMPAIGN REGISTRY OR, INCLUDING, WITHOUT LIMITATION, USER’S USE OR
INABILITY TO USE THE CAMPAIGN REGISTRY, ANY CHANGES TO OR INACCESSIBILITY OF
THE CAMPAIGN REGISTRY, DELAY, FAILURE, UNAUTHORIZED ACCESS TO OR ALTERATION
OF ANY TRANSMISSION OR DATA, ANY MATERIAL OR DATA SENT OR RECEIVED OR NOT
SENT OR RECEIVED, ANY TRANSACTION OR AGREEMENT ENTERED INTO THROUGH THE
CAMPAIGN REGISTRY, OR ANY DATA OR MATERIAL FROM A THIRD PERSON ACCESSED ON
OR THROUGH THE CAMPAIGN REGISTRY, WHETHER SUCH LIABILITY IS ASSERTED ON THE
BASIS OF CONTRACT, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE. IN NO EVENT SHALL
EITHER PARTY’S TOTAL LIABILITY FOR DIRECT DAMAGES EXCEED THE TOTAL FEES, IF ANY,
PAID TO COMPANY BY USER OR IN RESPECT OF USER’S USE OF THE CAMPAIGN REGISTRY IN
THE SIX (6) MONTH PERIOD PRIOR TO THE ACT, OMISSION, OR EVENT GIVING RISE TO THE
LIABILITY. SOME STATES PROHIBIT THE EXCLUSION OR LIMITATION OF INCIDENTAL OR
CONSEQUENTIAL DAMAGES; THUS, THIS LIMITATION OF LIABILITY MAY NOT APPLY. IN
SUCH STATES, THE LIABILITY OF A PARTY WILL NONETHELESS BE LIMITED TO THE FULLEST
EXTENT PERMITTED BY LAW. BREACHES OF EITHER PARTY’S INDEMNIFICATION
OBLIGATIONS HEREUNDER SHALL BE EXEMPTED FROM THE FOREGOING LIMITATIONS. IF
USER IS DISSATISFIED WITH THE CAMPAIGN REGISTRY, USER’S SOLE AND EXCLUSIVE
REMEDY SHALL BE FOR USER TO DISCONTINUE USE OF THE CAMPAIGN REGISTRY AND
TERMINATE THIS AGREEMENT IN ACCORDANCE WITH SECTION 7.
COMPANY IS NOT AN INSURER WITH REGARD TO OPERATION OF THE CAMPAIGN REGISTRY.
THE DISCLAIMER OF WARRANTIES AND THE LIMITATION OF LIABILITY AND REMEDY ARE A
REFLECTION OF THE RISKS ASSUMED BY THE PARTIES IN ORDER FOR USER TO OBTAIN THE
RIGHTS TO USE THE CAMPAIGN REGISTRY AT THE SPECIFIED PRICE, IF ANY. USER AGREES
TO ASSUME THE RISK FOR: (i) ALL LIABILITIES DISCLAIMED BY COMPANY CONTAINED
HEREIN; AND (ii) ALL ALLEGED DAMAGES IN EXCESS OF THE AMOUNT, IF ANY, OF THE
LIMITED REMEDY PROVIDED HEREUNDER.
10. Indemnification
a. User agrees to indemnify, hold harmless and defend Company, its members, officers,
employees and agents from and against any action, cause, claim, damage, debt, demand or liability, including
reasonable costs and attorney’s fees, asserted by any person or entity, arising out of or relating to: (a) this
Agreement; (b) User’s use of the Campaign Registry, including any Data or other Content transmitted or
received by User; (c) any unacceptable use of the Campaign Registry by User or through User’s account,
7
Campaign Registry October 30, 2025
including, without limitation, any statement, Data or other Content made, transmitted or republished by User
which is prohibited as unacceptable at Section 4.c; and (d) any breaches of Section 6 of this Agreement.
b. Company agrees to indemnify, hold harmless and defend User, its members, officers,
employees and agents from and against any third party action, cause, claim, damage, debt, demand or liability,
including reasonable costs and attorney’s fees, asserted by any person or entity, arising out of or relating to
this Agreement.
11. Publicity
Neither party may issue press releases or any other public announcement of any kind relating to the Agreement
without the other party’s prior written consent. Notwithstanding the foregoing, Company may use the User’s
name and logo (a) on Company’s website; (b) for promotional and marketing purposes; and (c) in connection
with its provision of the Campaign Registry, including providing User’s name to MNOs that have signed
agreements with Company to provide authentication services. Except as set forth herein, neither party may use
the trademarks of the other party without its prior written consent.
12. Miscellaneous
a. Independent Contractors. The parties and their respective personnel are and shall be
independent contractors and neither party by virtue of this Agreement shall have any right, power or authority
to act or create any obligation, express or implied, on behalf of the other party.
b. Waiver. No waiver of any term, provision or condition of this Agreement, whether by
conduct or otherwise, in any one or more instances, shall be deemed to be, or shall constitute, a waiver of any
other term, provision or condition hereof, whether or not similar, nor shall such waiver constitute a continuing
waiver of any such term, provision or condition hereof. No waiver shall be binding unless executed in writing
by the party making the waiver.
c. Severability. If any provision of this Agreement is determined to be illegal or unenforceable,
then such provision will be enforced to the maximum extent possible and the other provisions will remain
fully effective and enforceable.
d. Relationship of the Parties. Nothing in this Agreement shall create any joint venture or
principal-agent relationship between Company and User. Each party will be responsible for its own costs to
comply with its obligations hereunder.
e. Assignment. User may not assign this Agreement or any rights or obligations under this
Agreement in whole or in part without the prior written consent of Company; provided, however, that such
consent shall not be required for assignment by an Affiliate or successor to its business by merger,
consolidation, asset sale or other acquisition. Any attempted assignment in violation of the preceding sentence
will be void. This Agreement will bind and inure to the benefit of the respective successors and permitted
assigns.
f. Notice. To be effective, any notice under this Agreement must be in writing (unless otherwise
expressly provided) and must be sent by (a) registered or certified mail, postage prepaid, return receipt
requested; (b) hand or messenger delivery; or (c) Federal Express or similar overnight delivery service, to the
other party at its address(es) for notices set forth below (or such other address(es) as such party may designate
by notice to the other given in accordance with this). Any notice, report, or approval under this Agreement
will be deemed given on the date actually delivered (except if such date is a Saturday, Sunday or legal
holiday, in which case it will be deemed given on the next business day for the recipient).
8
Campaign Registry October 30, 2025
When Company is the intended recipient:
1775 Tysons Blvd, 5th Floor
McLean, VA 22102
Attn: Soren Schafft
With a Courtesy Copy (which shall not constitute notice) to:
Glenn S. Richards, Partner
Dickinson Wright LLP
1825 I St, NW, Suite 900
Washington, DC 20006
[email protected]
When User is the intended recipient:
Name: $docusign:Text:FullName:Customer1(FullName){fontSize:Size9}
Address: $docusign:Text:Address:Customer1(Address){fontSize:Size9}
City: $docusign:Text:City:Customer1(City){fontSize:Size9} State: $docusign:Text:State:Customer1(State){fontSize:Size9}
Zip: $docusign:Text:Zip:Customer1(Zip){fontSize:Size9}
Email: $docusign:Text:Email:Customer1(Email){fontSize:Size9}
g. Governing Law. This Agreement shall be interpreted in accordance with and governed by the
laws of the Commonwealth of Virginia, USA, without regard to conflict of law principles, as though it were
executed and performed entirely in Fairfax County, Virginia, USA. The rights and obligations under this
Agreement shall not be governed by the United Nations Convention on Contracts or the International Sale of
Goods, the application of which is expressly excluded, but such rights and obligations will instead be
governed by the laws of the Commonwealth of Virginia, USA.
h. Forum. Any controversy or claim arising out of or relating to this Agreement, or the breach
thereof, shall be settled by arbitration administered by the American Arbitration Association in accordance
with its Commercial Arbitration Rules, and judgment on the award rendered by the arbitrator(s) may be
entered in any court having jurisdiction thereof. Class action lawsuits, class-wide arbitrations, private
attorney-general actions, and any other proceeding where someone acts in a representative capacity are
disallowed.
i. Process. The parties irrevocably submit and consent, and irrevocably waive any and all
objections which any party may now or hereafter have, to process being served in any such suit, action or
proceeding referred to in the preceding subsection pursuant to the rules of the applicable court, including,
without limitation, service by certified or registered mail, return receipt requested. No provision of this section
shall affect the right of any party to serve process in any manner permitted by law or limit the right of any
party to bring suits, actions or proceedings to enforce in any lawful manner a judgment issued by the state or
federal courts of the Commonwealth of Virginia.
j. Action. No action arising under this Agreement may be brought by User more than one (1)
year after the cause of action has accrued.
k. Attorney’s Fees. If any action in law or in equity is necessary to enforce the terms of this
Agreement, the prevailing party will be entitled to reasonable fees of attorneys, accountants, and other
professionals, and costs and expenses in addition to any other relief to which such prevailing party may be
entitled.
9
Campaign Registry October 30, 2025
l. Headings. The captions and headings of this Agreement are included for ease of reference
only and will be disregarded in interpreting or construing this Agreement.
m. Force Majeure. If the performance of any part of this Agreement by either party (other than
the payment of money) is prevented, hindered, delayed or otherwise made impracticable by reason of any
flood, riot, fire, judicial or governmental action, labor disputes, act of God or any other causes beyond the
control of either party, that party shall be excused from such to the extent that it is prevented, hindered or
delayed by such causes.
n. Survival. The terms and provisions of Sections 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 and 12 shall
survive any termination or expiration of this Agreement.
o. Counterparts. This agreement may be executed in several counterparts and by electronic or
facsimile signatures, and each counterpart shall be deemed as original and all such counterparts together shall
constitute one and the same instrument.
p. Entire Agreement. This Agreement constitutes the complete and exclusive statement of the
agreement between the parties and supersedes any and all prior or contemporaneous communications,
representations, statements and understandings, whether oral or written, between the parties with respect to its
subject matter.
IN WITNESS WHEREOF, each of the parties has executed this Agreement as of the date first written above.
CAMPAIGN REGISTRY, INC. CUSTOMER
Signature $docusign:SignHere::InternalSigner
Signature $docusign:SignHere::Customer1
Name $docusign:FullName::InternalSigner
Name: $docusign:Text:Name:Customer1(Name){fontSize:Size9}
Title: $docusign:Title::InternalSigner
Title: $docusign:Title::Customer1
Date: $docusign:DateSigned::InternalSigner
Date: $docusign:DateSigned::Customer1
10
Campaign Registry October 30, 2025
EXHIBIT A
FEES AND PAYMENT TERMS
Current fees for the Campaign Registry services are set forth below. Please note:
● All campaign registrations are created for an initial three-month period except for political use case
campaigns which have a one month minimum. After the three-month period, all campaigns will be
renewed monthly unless terminated by the User ahead of the renewal date.
● Campaign fees are billed, upon campaign creation and then monthly thereafter on the anniversary
date of the campaign creation.
● The following billing example is provided for illustrative purposes only:
Billing example
Campaign creation May 5
First Monthly Charge On May 31 Invoice (end of calendar month of campaign
creation)
Second Monthly Charge On June 30 Invoice
Third Monthly Charge On July 31 Invoice
Cancellation notice due (to avoid renewal billing) August 4 (Day before campaign renewal)
First Campaign renewal (anniversary) date August 5
First Monthly charge in second cycle August 31 (end of calendar month of renewal date)
The campaign continues to be renewed and billed on
a monthly cycle until the campaign is terminated
● The Company does not guarantee that any MNOs, or any particular MNO, will approve or maintain
approval of any campaign.
● The fees are non-refundable, irrespective of whether the applicable campaigns are terminated or
suspended for any reason, whether by the CSP, DCA, Company or MNOs.
● Brands have the option to register through multiple CSPs, but registrations and the corresponding
fees are specific to each CSP and not transferrable.
*See table below for pricing details
11
Campaign Registry October 30, 2025
TCR Services
One Time Setup and CSP Registration Fees $200 One time, non-refundable
Migration Fees application fee, which includes
validation with MNOs and DCAs.
There is no fee for maintenance or
renewal of CSP accounts.
CSP Brand/Campaign $0.50 Charge per associated campaign
Migration when migrating specified brands
from one CSP to another. Note:
Sole Proprietor brands and
campaigns cannot be migrated.
Monthly Campaign Public Safety (Restricted) $10.00/Month Invoiced monthly for an initial
Use Case Fees three month period, after which
will be renewed monthly.
UCaaS Low Volume $1.50/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Sole Proprietor $2.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Low Volume Mixed $1.50/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Charity $3.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Emergency $5.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Agents and Franchises $30.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Platform Free Trial $0/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
2FA $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
12
Campaign Registry October 30, 2025
Account Notification $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Carrier Exemptions $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Customer Care $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Delivery Notification $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Fraud Alert Messaging $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Higher Education $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Marketing $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Mixed $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Political $10.00/Month Invoiced monthly.
Polling and Voting $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Public Service Announcement $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Security Alert $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Social $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Sweepstake $10.00/Month Invoiced monthly for an initial
three month period, after which
13
Campaign Registry October 30, 2025
will be renewed monthly.
Proxy $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
K-12 Education $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renew
ed monthly.
UCaaS High Volume $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
M2M (Machine to Machine) $10.00/Month Invoiced monthly for an initial
three month period, after which
will be renewed monthly.
Other Services CSP Extra Portal users (10 $20/Month Hosting costs for an additional 10
additional users) CSP user accounts.
DCA Extra Portal users (10 $20/Month Hosting Costs for an additional 10
additional users) DCA user accounts.
14
Campaign Registry October 30, 2025
3rd Party Verification, Vetting & RBM
3rd Party Verification Brand Registration $4.50 Registration cost for Government,
and Vetting Fees (Government, Non-Profit, Non-Profit, Private Profit and
Private Profit and Public Public Profit entity type brands,
Profit) includes initial brand identity
verification
Brand Identity Resubmit $4.50 per Resubmission of identity
(Government, Non-Profit, resubmit verification for Government,
Private Profit and Public Non-Profit, Private Profit and
Profit) Public Profit entity type brands.
This is charged for both successful
and unsuccessful auth+ requests
Brand Registration (Sole $4.00 Registration cost for Sole
Proprietor) Proprietor entity type brands.
Includes One-Time Password
(OTP) services for brand identity
verification.
Authentication+ $12.50 This is charged for both successful
verification and unsuccessful auth+ requests
Standard Vet (Aegis and $41.50 per vet One-time, non-refundable vetting
WMC) fee for a successful standard vet.
Enhanced Vet (Aegis) $101.50 per One-time, non-refundable vetting
vet fee for a successful Enhanced vet.
Political Vet with email or $66 per vet One-time, non-refundable, vetting
standard PIN delivery fee for a successful Political vet.
Political Vet with express $96 per vet One-time, non-refundable vetting
mail PIN Delivery fee for a successful Political vet
with express mail PIN delivery.
Appeal Fee (Identity $11 per appeal One-time, non-refundable fee for a
Verification, Auth+ and manual review of an identity
Aegis Standard Vet verification, Auth+ or an Aegis
standard vet.
Failed Standard Vet (Aegis $5 Cost for a failed Aegis or WMC
and WMC) Standard vet.
Failed Enhanced Vet (Aegis $6 per failed Cost for a failed Aegis Enhanced
and WMC) vet vet.
Failed Political Vet (Aegis) $22 per failed Cost for a failed Aegis Political
vet vet.
15
Campaign Registry October 30, 2025
3rd party RBM RBM Verified Sender $75 Non-refundable vetting fee
Vetting Fees Vetting (Aegis) charged for an RBM Vet. This
includes checks on the brand’s
validity, integrity, legal standing,
financial history, and a two-factor
authentication (2FA) process with
the brand.
RBM Appeal (Aegis) $20 Fee for appealing any failed RBM
Vet, logo verification or banner
verification.
RBM Logo Verification $75 Non-refundable vetting fee
(Aegis) charged for logo verification to
ensure the logo image is associated
with the brand. Verification of
each logo image will incur a
separate charge.
RBM Banner Verification $50 Non-refundable vetting fee
(Aegis) charged for banner verification to
ensure a banner image is
associated with the brand.
Verification of each banner image
will incur a separate charge.
16
Campaign Registry October 30, 2025
EXHIBIT B
SECURITY REQUIREMENTS
Campaign Registry Security Measures
In addition to the User’s security obligations outlined elsewhere in this Exhibit B, in the Agreement, or other
relevant instruments between the parties, the Company will implement reasonable and appropriate measures to
help secure the content in the Campaign Registry against accidental or unlawful loss, access, or disclosure.
The Company may, at its sole discretion, provide detailed security options and/or requirements ("Updated
Requirements") from time to time. We will make efforts to provide such requirements with at least ten (10)
business days' advance notice, unless urgent implementation and/or compliance is required to avoid major
disruption or irreparable harm.
However, it's important to note that the Company cannot guarantee that the Campaign Registry will be entirely
free of viruses, cyber-attacks, cyber threats, data corruption, data loss, or similar occurrences ("Security
Threats").
User’s Security Obligations
In addition to the responsibilities outlined elsewhere in the Agreement:
● You agree to comply with any Updated Requirements; failure to do so may result in suspension or
termination of services.
● You must take all commercially reasonable efforts to prevent the introduction of any Security
Threats into the Campaign Registry or any connected networks.
● You are responsible for ensuring proper access and use of the Campaign Registry, safeguarding
your credentials and/or systems against improper access, and appropriately securing, protecting,
and backing up your content. You must not share, sell, or transfer your access rights to any third
party without prior written approval from us. Nonetheless, you are accountable for all acts or
omissions of your subcontractors or agents as though performed by you.
17
Campaign Registry October 30, 2025
Exhibit C
Customer Support & Service Level Agreement
1. Service Level Agreement Table
Priority Level Description Response Time Guideline
(During business hours)
Priority 1 Complete outage of service preventing ● Notification to client within 1hr
client’s ability to communicate with
platform and process campaigns ● Resolution or work around by next
business day, else work will
continue until fully resolved.
● Daily client updates
Priority 2 Service degradation with accessible work ● Notification to client within 2hrs of
around. incident identification
● Resolution or work around in 2
business days, else work will
continue until fully resolved.
● Daily client updates.
Priority 3 Minor performance degradation with ● Initial response to customer within 1
accessible work around. business day
● Resolution or work around in 5
business days for issues under
TCR’s direct control, with regular
follow up when the issue is external
to TCR
● Clients will be notified as updates
become available.
Priority 4 Information request, portal access, billing ● Initial response to customer within 3
record request, miscellaneous. business day
● Resolution or work around in 7
business days for issues under
TCR’s direct control, with regular
follow up when the issue is external
to TCR
● Clients will be notified as updates
become available.
18
Campaign Registry October 30, 2025
2. Escalation Matrix
Level Escalation
1st [email protected]
2nd Support Manager
3rd VP of Operations
1. Maintenance Windows & Notifications
a. Customer Notifications
i. Scheduled Maintenance Notifications will be posted to our status page
(https://status.campaignregistry.com/).
ii. In the event emergency maintenance is necessary, Emergency Maintenance Notifications will
be posted to our status page (and notifications sent to subscribers) with as much advance notice
as the emergency allows.
b. Production release is scheduled every other Thursday from 7am to 9am ET (two-hour maintenance
window).
2. Business Hours and Service Availability
c. Support hours are 9am-5pm ET Monday to Friday except holidays.
d. TCR Portals and APIs are set up to be operational around the clock, with a targeted availability of
better than 99.5% during support hours.
19
Campaign Registry October 30, 2025
Exhibit D
Agreement for the Sole Proprietor and Platform Free Trial use cases
This exhibit requires a separate signature. Please contact [email protected] if you wish to sign
this additional agreement.
20
Campaign Registry October 30, 2025
Exhibit E
Data Processing Addendum
This Data Processing Addendum (“Addendum”) forms part of the agreement (the “Agreement”) between
THE CAMPAIGN REGISTRY INC (“TCR”) acting on its own behalf and as agent for each TCR Affiliate,
and the undersigned customer (“Customer”) (each a “party” and collectively the “parties”) and reflects the
party’s agreement with regard to the processing of Personal Data in accordance with the requirements of the
applicable Data Protection Legislation. This Addendum is effective as of the date it is signed by both parties
(the “Effective Date”).
The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not
otherwise defined herein shall have the meaning given to them in the Agreement. Except as modified below,
the terms of the Agreement shall remain in full force and effect. In the event of any conflict or inconsistency
between this Addendum and the Agreement, the more restrictive data processing and security terms shall
prevail.
In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and
conditions set out below shall be added as an addendum to the Agreement. This Addendum forms part of
the Agreement and will have the same force and effect as if set out in the body of this Agreement. Except
where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement
as amended by, and including, this Addendum.
1. DEFINITIONS
1.1 The following terms shall have the following meanings:
(a) “Applicable Law” means all applicable laws, statues, codes, ordinances, decrees, rules,
regulations, municipal by-laws, judgements, orders, decisions, rulings or awards of any
government, quasi-government, statutory or regulatory body, ministry, government agency or
department, court, agency or association of competent jurisdiction.
(b) “Controller” means an entity which, alone or jointly with others, determines the purposes and
means of the processing of Personal Data, and shall also mean a “Business”, where applicable,
as defined by the CCPA.
(c) “Customer Personal Data" shall have the meaning given to it in Clause 3.1.
(d) “Data Protection Legislation” means all applicable data protection and privacy laws and
regulations, including (without limitation) state, federal and national laws and regulations of
the United States, such as the California Consumer Privacy Act of 2018, and its implementing
regulations, as amended, the Virginia Consumer Data Protection Act, Colorado Privacy Act,
Connecticut Data Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and
Security Act, and/or the Utah Consumer Privacy Act, the laws of the European Union (“EU”),
the European Economic Area (“EEA”), their Member States and the United Kingdom which
are applicable to the processing of Personal Data under the Agreement including (without
limitation) the GDPR, the UK Data Protection Act 2018 (“UK DPA”), and the Swiss Federal
Data Protection Act.
21
Campaign Registry October 30, 2025
(e) “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regards to the processing of Personal
Data and on the free movement of such data and repealing Directive 95/46/EC (General Data
Protection Regulation). For the purposes of this Addendum, “GDPR” shall be construed as
also referring to the GDPR as it applies in the United Kingdom by virtue of the European
Union (Withdrawal) Act 2018 and as amended by the UK Data Protection, Privacy and
Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“UK GDPR”).
Any references to specific articles of the GDPR shall be construed as also referring to the
equivalent sections of the UK GDPR, where applicable.
(f) “Personal Data” means any information relating to an identified or identifiable natural person
(a “Data Subject”) and/or any such information as may be defined as constituting personal
data. Personally identifiable information or any equivalent thereof, in any applicable Data
Protection Legislation.
(g) “Process” and variants of it, such as “processing” and “processed” (whether capitalized or not)
means any operation or set of operations performed upon Personal Data or sets of Personal
Data, whether or not by automated means, such as collection, recording, organization,
structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by
transmission, dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction.
(h) “Processor” means an entity which processes Personal Data on behalf of the Controller and
shall also mean a “Service Provider”, where applicable as defined by the CCPA.
(i) “Services” means those services and other activities to be provided to, or carried out on behalf
of, Customer by TCR pursuant to the Agreement.
(j) “Standard Contractual Clauses” means, as applicable: (i) the standard contractual clauses
for the transfer of personal data to third countries, as approved by the European Commission
in Decision (EU) 2021/914 and as set out in Schedule 1 to this Addendum (“EU SCCs”); (ii)
the EU SCCs as amended by the International Data Transfer Addendum to the European
Commission’s Standard Contractual Clauses as approved by the UK Information
Commissioner’s Office under section 119A(1) of the UK DPA as set out in Schedule 2 to this
Addendum; or (iii) any set of clauses approved by the European Commission, UK
Information Commissioner’s Office, or a Supervisory Authority (as applicable) which
subsequently amends, replaces or supersedes the same, in each case as amended and
interpreted in accordance with Clause 7.3; and
(k) “Subprocessor” means any person or entity appointed by or on behalf of TCR (or the
relevant intermediate Subprocessor) to process Customer Personal Data as described in
Clause 6, and
(l) “Supervisory Authority” means a supervisory authority established by and EEA Member
State or the United Kingdom, pursuant to Article 51 of the GDPR, or any other competent
government authority with jurisdiction over the processing of Personal Data under the
Agreement.
1.2 For the purpose of this Addendum, references to Clauses, Schedules, and Appendixes shall be
deemed to be references to the clauses, schedules and appendixes of this Addendum, unless otherwise
stated or if the context otherwise requires.
22
Campaign Registry October 30, 2025
2. ROLES OF THE PARTIES
2.1 Both parties will comply with all applicable requirements of the Data Protection Legislation. This
Clause 2.1 is in addition to, and does not relieve, remove or replace, either party's obligations under
the Data Protection Legislation or under the Agreement.
2.2 The parties acknowledge and agree that for the purposes of the Data Protection Legislation,
Customer is the Controller and TCR is the Processor. To the extent TCR requests Customer to
process data, the parties further acknowledge and agree that TCR is the Processor and Customer is a
Subprocessor.
2.3 Customer shall ensure that it has and will continue to have, the right to transfer, or provide access to,
Customer Personal Data to TCR for processing in accordance with the Agreement. For the
avoidance of doubt, Customer’s instructions for the processing of Customer Personal Data shall
comply with applicable Data Protection Legislation. TCR will immediately inform Customer if it
considers, in its opinion, that any of Customer’s instructions infringe applicable Data Protection
Legislation. Customer shall have sole responsibility for the accuracy, quality, and legality of
Customer Personal Data and the means by which Customer acquires Customer Personal Data and
shall be responsible for ensuring that the processing of Personal Data, which TCR is instructed to
perform, has a valid legal basis.
3. SCOPE OF PROCESSING
3.1 Customer agrees that TCR, its Affiliates and agents, may process Personal Data on behalf of
Customer to perform its obligations under the Agreement for the term of the Agreement (“Customer
Personal Data”) in accordance with this Addendum. A list of the categories of data subjects, types
of Customer Personal Data and the processing activities are set out in the Appendix. The duration of
the processing corresponds to the duration of the Services as described in the Agreement, unless
otherwise stated in the Agreement or this Addendum.
3.2 TCR shall process Customer Personal Data only on the written instructions of Customer unless TCR
is required by Applicable Law to process such data. Where TCR is relying on Applicable Law as the
basis for processing Customer Personal Data, TCR shall notify Customer of this before performing
the processing required by Applicable Law unless those Applicable Laws prohibit TCR from
notifying Customer. Concerning Customer Personal Data to which the GDPR applies. “Applicable
Law” as used in this section is limited to the laws of any member state of the EU, the United
Kingdom or by the laws of the EU applicable to TCR.
3.3 The following is deemed an instruction by Customer to process Customer Personal Data, subject to
TCR’s compliance with this Addendum and the Data Protection Legislation: (i) processing necessary
to perform the Services in accordance with the Agreement; (ii) processing initiated by Customer (or
its authorized representative) in their use of the Services; and (iii) processing necessary to comply
with other reasonable instructions provided by Customer where such instructions are consistent with
the Agreement.
3.4 For the avoidance of doubt, the instructions set out at Clause 3.3(i) include (without limitation): (i)
instructions to share certain Customer Personal Data with Direct Connect Aggregators (or other
Connectivity Partners) and Mobile Network Operators as necessary for the authorization of the
Customer’s messages to be sent to End Users; and (ii) instructions to process Customer Personal
Data as needed to verify information provided by Customer (e.g., if Mobile Network Operators
23
Campaign Registry October 30, 2025
require Customer to have such information verified before messages will be sent). In accordance
with Clause 2.3, Customer shall be responsible for ensuring any such actions taken by TCR on
behalf of Customer comply with applicable Data Protection Legislation.
4. DATA PROCESSING OBLIGATIONS
4.1 Without prejudice to the generality of Clause 2.1, TCR shall, in relation to any Customer Personal
Data processed in connection with the performance by TCR of its obligations under the Agreement:
(a) ensure that it has in place appropriate technical and organizational measures to protect the
security, confidentiality and integrity of Customer Personal Data, including protections
against accidental, unauthorized or unlawful processing, destruction, loss, alteration and
unauthorized disclosure of, or access to, Customer Personal Data (a “Personal Data
Breach”), appropriate to the harm that might result from a Personal Data Breach and the
nature of the data to be protected, having regard to the state of technological development
and the cost of implementing any measures;
(b) ensure that all personnel who have access to and/or process Customer Personal Data are
obliged to keep Customer Personal Data confidential, either pursuant to a written agreement
or under an appropriate statutory obligation;
(c) assist Customer in responding to any request from a Data Subject and in ensuring
compliance with its obligations under the Data Protection Legislation with respect to records
of processing, security, breach notifications, impact assessments and consultations with
supervisory authorities or regulators, provided that TCR may charge Customer a reasonable
fee on a time and materials basis in the event that TCR considers, in its reasonable discretion,
that such assistance is unnecessarily onerous, complex or repetitive. TCR will without delay,
to the extent permitted by law, notify Customer upon receipt of a request by a Data Subject
to exercise the Data Subjects rights under applicable Data Protection Legislation. Unless
required by Data Protection Legislation, TCR shall not respond to any such Data Subject
request without Customer’s prior written consent, except to confirm that the request relates
to Customer;
(d) without limitation of any obligation under the Agreement, notify Customer without undue
delay on becoming aware of a Personal Data Breach and shall provide Customer with further
information about the Personal Data Breach in phases as such information becomes available
to the TCR; and
(e) on the termination or expiration of the Agreement or upon written direction of Customer,
delete or return Customer Personal Data and copies thereof to Customer unless required by
Applicable Law to store Customer Personal Data, and in such case, TCR shall hold Customer
Personal Data in compliance with this Addendum and will not actively process the Customer
Personal Data being held other than as required by Applicable Law. Concerning Customer
Personal Data to which the GDPR applies. “Applicable Law” as used in this section is
limited to the laws of any member state of the EU, the United Kingdom or by the laws of the
EU applicable to TCR.
4.2 TCR shall maintain records and information to demonstrate its compliance with this Addendum.
Customer shall, with reasonable notice to TCR, have the annual right (unless required more
frequently by Data Protection Legislation, an order of a Supervisory Authority or competent court,
or in the event of a Personal Data Breach) to review such records.
24
Campaign Registry October 30, 2025
4.3 Upon Customer’s request. TCR shall, no more than once per calendar year (unless required more
frequently by Data Protection Legislation, an order of a Supervisory Authority or competent court,
or in the event of a Personal Data Breach) make available for Customer’s review copies of
certifications or reports demonstrating TCR’s compliance with this Addendum and the prevailing
data security standards applicable to the processing of Customer Personal Data.
4.4 Where Customer reasonably believes the information provided under Clause 4.2 and 4.3 above is not
sufficient to demonstrate TCR’s compliance with this Addendum, at Customer’s expense and subject
to clause 5, TCR shall permit Customer, or its appointed third party auditors (collectively,
“Auditor”) to audit the architecture, systems and procedures relevant to TCR’s compliance with this
Addendum and shall make available to the Auditor all information, systems and staff necessary for
the Auditor to conduct such audit. To the extent any such audit incurs in excess of 10 hours or TCR
personnel time, TCR may charge Customer on a time and materials basis for any such excess hours.
5. AUDITS
5.1 Before the commencement of an audit described in Clause 4.4, TCR and Customer will mutually
agree upon the reasonable scope, start date, duration of and security and confidentiality controls
applicable to the audit. Customer agrees that:
(a) audits will be conducted during TCR’s normal business hours;
(b) it will not exercise its on-site audit rights more than once per calendar year, (unless required
more frequently by Applicable Data Protection Law, an order of a Supervisory Authority or
competent court, or in the event of a Personal Data Breach);
(c) it will be responsible for any fees charged by any third-party auditor appointed by Customer
to execute any such audit;
(d) TCR may object to any third-party auditor appointed by Customer to conduct an audit if the
auditor is, in TCR’s reasonable opinion, not suitably qualified or independent, a competitor
of TCR or otherwise manifestly unsuitable. Any such reasonable objection by TCR will
require Customer to appoint another auditor or conduct the audit itself;
(e) unless specifically required by an order of a Supervisory Authority or competent court,
nothing in this Clause 5 will require TCR either to disclose to the Auditor, or to allow the
Auditor access to (a) any data processed by the TCR on behalf of any other organization, (b)
any TCR internal accounting or financial information, (c) any trade secret of TCR, (d) any
information that, in TCR’s opinion could (i) compromise the security of any TCR systems or
premises, or (ii) cause TCR to breach its obligations to Customer or any third party, or (e)
any information that Customer seeks to access for any reason other than the good faith
fulfillment of Customer's obligations under the Applicable Data Protection Law; and
(f) it shall provide TCR with copies of any audit reports completed by the Auditors, which
reports shall be subject to the confidentiality provisions of this Agreement.
6. APPOINTMENT OF SUBPROCESSORS
6.1 Customer authorizes TCR to appoint (and permit each Subprocessor appointed in accordance with
this Clause 6 to appoint) Subprocessors for the purpose of providing the Services in accordance with
this Clause 6 and any restrictions in the Agreement.
25
Campaign Registry October 30, 2025
6.2 TCR may continue to use those Subprocessors already engaged by TCR as at the Effective Date as
listed in Annex III to the Schedule, subject to TCR in each case as soon as practicable meeting the
obligations set out in Clause 6.4.
6.3 TCR shall give Customer prior notice of any intended changes concerning the appointment or
replacement of Subprocessors. If, within fourteen (14) days of receipt of that notice, Customer
notifies TCR in writing of any objections (on reasonable grounds) to the proposed appointment:
(a) TCR shall work with Customer in good faith to make available a commercially reasonable
change in the provision of the Services which avoids the use of that proposed Subprocessor;
and
(b) where such a change cannot be made within thirty (30) days from receipt by TCR of
Customer’s notice, notwithstanding anything in the Agreement, Customer may by written
notice to TCR terminate those Services which cannot be provided by TCR without the use of
the objected-to Subprocessor. This termination right is Customer’s sole and exclusive
remedy if Customer objects to any proposed Subprocessor.
6.4 With respect to each Subprocessor, TCR shall:
(a) ensure that the arrangement between on the one hand (a) TCR, or (b) the relevant
intermediate Subprocessor; and on the other hand, the Subprocessor, is governed by a written
contract including terms which offer at least the same level of protection for Customer
Personal Data as those set out in this Addendum and meet the requirements of Data
Protection Legislation, including, where applicable, Article 28(3) of the GDPR;
(b) to the extent that Subprocessor processes Customer Personal Data outside of the EU, EEA
and/or the United Kingdom, TCR will ensure that appropriate safeguards are at all relevant
times incorporated into the agreement between on the one hand (a) TCR, or (b) the relevant
intermediate Subprocessor; and on the other hand, the Subprocessor, or before the
Subprocessor first processes Customer Personal Data procure that it enters into an agreement
incorporating appropriate safeguards; and
(c) provide to Customer for review such copies of the agreements with Subprocessors (which
may be redacted to remove confidential commercial information not relevant to the
requirements of this Addendum) as Customer may request from time to time.
6.5 TCR may replace a Subprocessor if the need for the change is urgent and necessary to provide the
Services and the reason for the change is beyond TCR’s reasonable control. TCR shall notify
Customer of the replacement as soon as reasonably practicable, and Customer shall retain the right
to object to the replacement Subprocessor pursuant to Clause 6.3 above.
6.6 Where the Subprocessor fails to fulfill its data protection obligations and TCR is the initial
Processor, TCR shall remain fully liable to Customer for the performance of that Subprocessors
obligations.
7. INTERNATIONAL TRANSFERS
7.1 TCR is self-certified to the Data Privacy Framework (the EU-US and/or Swiss-US self-certification
program operated by the U.S. Department of Commerce). TCR intends to maintain its Data Privacy
Framework certification during the term of this DPA, until such time as the Federal Trade
Commission determines it will no longer enforce the terms of Data Privacy Framework, or TCR
determines it is no longer useful to its customers.
26
Campaign Registry October 30, 2025
7.2 TCR and Customer may propose variations to this Addendum which the party reasonably considers
to be necessary to address the requirements of any Data Protection Legislation, and the parties shall
promptly discuss the proposed variations and negotiate in good faith with a view to agreeing and
implementing those or alternative variations designed to address the requirements identified in the
party's notice as soon as is reasonably practicable.
8. GENERAL TERMS
Termination
8.1 Subject to Clause 8.2, the parties agree that this Addendum shall terminate automatically upon
termination of the Agreement.
8.2 Any obligation imposed on TCR under this Addendum and the Agreement in relation to the
processing of Customer Personal Data shall survive any termination or expiration of this Addendum.
Governing law of this Addendum
8.3 This Addendum shall be governed by the governing law of the Agreement.
Choice of jurisdiction
8.4 The parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the Agreement
with respect to any disputes or claims howsoever arising under this Addendum.
Order of precedence
8.5 Nothing in this Addendum reduces TCR's obligations under the Agreement in relation to the
protection of Customer Personal Data or permits TCR to process (or permit the processing of)
Customer Personal Data in a manner which is prohibited by the Agreement. In the event of any
inconsistency between this Addendum and any other agreements between the parties, including but
not limited to the Agreement, the most restrictive obligation(s) shall prevail.
Severance
8.6 Should any provision of this Addendum be invalid or unenforceable, then the remainder of this
Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i)
amended as necessary to ensure its validity and enforceability, while preserving the parties’
intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid
or unenforceable part had never been contained therein.
27
Campaign Registry October 30, 2025
ANNEX I - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organizational security measures implemented by the data importer:
TCR has obtained ISO 27001:2013 certification in November 2020 by Perry Johnson Registrars, certificate
number C2020-03812, with an Information Management System (ISMS) covering all relevant information
security areas including Access Control, Human Resource Security, Asset Management, Backup
Management, Virus Management, Encryption, Physical and Environmental Security, VAPT testing, Change
Management, Data Retention, Infosec Risk Management, Incident Management, etc.
28
Campaign Registry October 30, 2025
ANNEX II – LIST OF SUBPROCESSORS
Customer has authorized the use of the following (sub) processors by TCR:
Name Address Contact person Description of processing
Aegis Mobile, 8850 Stanford Blvd, John Tullai Provider of identity verification
LLC Suite 4200, COO and optional vetting services.
Columbia, [email protected]
MD 21045
Amazon Web 410 Terry Hosting provider for TCR
Services, Inc. Avenue, applications and data.
(“AWS”) Seattle, WA
98109
Campaign 1215 31st NW [email protected] Non-partisan nonprofit service
Verify. PO Box 3554 for US Political campaigns,
parties and PACs to verify their
Washington,
identity
DC 20007-9998
Proofpoint, Inc. 892 Ross Drive, Mike Reading, Sr. Director, Messaging compliance / spam
Sunnyvale, CA Cloudmark Technical Services filter support to US MNOs,
94089 [email protected] with use of data shared by TCR
Wireless Media 11781 Lee Jackson Ian Matthews Provider of optional vetting
Consulting, Inc. Memorial CEO services.
d/b/ a WMC Highway, Suite [email protected]
Global 500, Fairfax, VA
22033
29
Campaign Registry October 30, 2025
Exhibit F
US 10DLC Services
Description. The Campaign Registry has been established to authenticate CSP A2P messaging campaigns
using 10-digit telephone numbers for the benefit of MNOs. CSPs shall provide required information necessary
for Company to perform a basic cybersecurity and identity check on the CSP and each individual Brand. The
cybersecurity and identity checks may be done using third party services. When registering new campaigns,
the required information shall include the identity of the Brand; the identity of the CSP; the use case (e.g.,
alerts, two-factor authentication, marketing) and the industry vertical (e.g., transportation, government,
non-profit). For some campaign types, additional information and/or third party vetting may be required at the
Company’s discretion. In such cases, Company may share the foregoing information with the applicable third
parties for the purposes of such vetting. Company may also require that CSP demonstrate it has an agreement
with a DCA or other connectivity partner. Once authenticated, Company shall register the campaign with the
NetNumber Services Registry and issue the Campaign ID number allowing CSPs to associate their sending
numbers with the campaign.
30
Campaign Registry October 30, 2025
Exhibit G
US RBM Services
1. Company will provide CSPs with the functionality to create RBM Campaigns, for verification by
Verification Authorities. Once an RBM Campaign is verified, it may be launched by the RBM DCAs,
resulting in an RBM Agent. Company will facilitate verification of Brands and Brand Assets through
approved Verification Authorities and will communicate approvals, Credentials, suspensions, and other
RBM Campaign related status changes to all ecosystem participants as needed, giving CSPs full life cycle
visibility of their Campaigns and related Agents. Company will provide support for appeals related to
DCA and MNO reviews, and suspensions. RBM DCAs will launch and manage the RBM Agents with
Google, and will be responsible for RBM Agent traffic and compliance as per their agreements with the
MNOs and with Google.
2. Company obligations:
a. Provide Portal, API and other functionality for creation of RBM Campaigns, with enhanced Brand
authentication, Brand Vetting, and Brand Assets verification through third party Verification
Authorities. Company will engage with CSPs and Brands for enhanced authentication, and may
capture additional inputs such as attestation letters confirming Brand-CSP relationships. Where
applicable, Company will use prior verifications to minimize the additional work needed for RBM.
b. Provide Portal and API support for management of RBM Campaigns. CSPs may choose their
connectivity partner for each RBM Campaign. When approved and launched by an RBM DCA, the
RBM Campaign becomes an RBM Agent running on the Google platform. Company may also link
the RBM Campaign to a corresponding SMS Campaign, with the opportunity for the SMS Campaign
to be used as a fallback campaign.
c. Communicate Agent status updates for events such as DCA approvals and MNO suspensions to the
relevant ecosystem parties through Portals, APIs and webhooks.
d. Provide expiry notices and support renewal of Credentials through Company Portals and APIs.
e. Support the introduction of open standards for RBM Credentials, and, where possible, accept valid
interoperable RBM Credentials presented to Company by CSPs or Brands. Company will also
promote that Credentials issued through Company are accepted by other ecosystems, including
non-RBM MNO messaging channels.
3. Customer obligations, as CSP:
a. Provide Brand contact information as required for RBM authentication purposes. This includes
providing non free-mail email addresses for Brands and contact information for individuals at each
Brand.
b. Execute the Company DPA as RBM Agent registration includes personally identifiable information.
4. Additional obligations for CSPs that are also DCAs:
a. Review Campaigns and communicate results including error codes, using Company APIs.
b. Provide Company with the Agent ID for all new, activated RBM Agents, using Company APIs.
c. In real time, for all Agents shared by Company to Customer, communicate status changes to
Company, using Company APIs.
d. Support the appeals process, using TCR systems, allowing CSPs to dispute RBM Campaign review or
suspension outcomes.
e. Optionally, share the DCAs credentials for MNO and/or Google APIs with TCR, for the purpose of
improving workflows and efficiency for the DCA.
5. RBM Verification Services:
a. Company will provide RBM Verification services from third parties. Pricing for these services is
shown in Exhibit A.
31