Whimful Data Processing Addendum

Effective Date: May 20, 2026

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the Whimful Terms of Service or any other written agreement between you (the "Customer") and Whimful FZ-LLC ("Whimful") covering Customer's use of the Services (the "Agreement"). This DPA applies to the extent Whimful Processes Customer Personal Data on Customer's behalf in connection with the Services.

In the event of any conflict between this DPA and the Agreement with respect to the Processing of Customer Personal Data, this DPA controls.

1. Definitions

Capitalized terms used but not defined in this DPA have the meaning given in the Agreement. The following additional definitions apply:

"Customer Personal Data" means personal data Processed by Whimful on behalf of Customer under the Agreement.
"Data Protection Laws" means all laws and regulations applicable to the Processing of personal data under the Agreement, including, where applicable: the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK Data Protection Act 2018 and the GDPR as incorporated into UK law ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); and any successor or equivalent laws.
"Controller," "Processor," "Data Subject," "Personal Data," "Personal Data Breach," "Processing," and "Special Categories of Personal Data" have the meanings given in the GDPR (or the equivalent terms in the applicable Data Protection Laws).
"Restricted Transfer" means a transfer of Customer Personal Data from a jurisdiction whose Data Protection Laws restrict cross-border transfers (e.g., the EEA, the UK, or Switzerland) to a jurisdiction that does not benefit from an adequacy decision.
"SCCs" means the standard contractual clauses approved by the European Commission in Decision 2021/914 of 4 June 2021, as amended or replaced from time to time.
"Sub-processor" means any third party engaged by Whimful (or by a Whimful affiliate) to Process Customer Personal Data on Whimful's behalf.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as updated from time to time.

2. Scope and Roles

a. Roles

With respect to Customer Personal Data, the parties agree that Customer is the Controller (or, where Customer is itself a Processor, the Processor acting on behalf of a third-party Controller) and Whimful is the Processor (or sub-Processor, as applicable). Each party will comply with its respective obligations under applicable Data Protection Laws.

b. Customer Instructions

Whimful will Process Customer Personal Data only on documented instructions from Customer, including with regard to Restricted Transfers, unless required to do so by applicable law (in which case Whimful will, where legally permitted, inform Customer of that legal requirement before Processing). The Agreement, this DPA, and Customer's use of the Services configured in accordance with the Agreement constitute Customer's documented instructions.

c. Customer Responsibilities

Customer is solely responsible for: (i) the accuracy, quality, and lawfulness of Customer Personal Data and the means by which Customer acquired it; (ii) providing all notices and obtaining and maintaining all consents, permissions, and legal bases required under applicable Data Protection Laws before Customer Personal Data is Processed by the Services; (iii) honoring Data Subject rights requests and choices and instructing Whimful accordingly; and (iv) ensuring that Customer's instructions to Whimful comply with applicable Data Protection Laws.

3. Details of Processing

Subject matter and nature of Processing: Provision of the Services to Customer as described in the Agreement, including the collection, recording, organization, structuring, storage, retrieval, transmission, and erasure of Customer Personal Data as necessary to deliver the Services.
Purpose of Processing: To enable Customer to use the Services and for the legitimate business purposes set out in the Agreement and this DPA, including operating, securing, supporting, and improving the Services.
Duration of Processing: For the term of the Agreement, plus the period needed for return or deletion under Section 10 of this DPA.
Categories of Data Subjects: Customer's end users and any other individuals whose personal data Customer transmits to the Services, which may include website visitors, app users, customers, prospects, or employees of Customer.
Categories of Personal Data: Identifiers (e.g., IP address, device identifiers, cookie identifiers, hashed email or phone identifiers), commercial information (e.g., transaction or event data), internet or other electronic activity information (e.g., browsing or interaction events), inferences drawn from such data, and any other personal data Customer chooses to transmit to the Services.
Special Categories of Personal Data: The Services are not intended for the Processing of Special Categories of Personal Data or other sensitive data restricted under Section 3(g) of the Terms of Service. Customer will not transmit such data to the Services unless expressly agreed in writing.

4. Whimful Obligations

a. Confidentiality

Whimful will ensure that personnel authorized to Process Customer Personal Data are bound by written confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

b. Security

Whimful will implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing as well as the risk to the rights and freedoms of natural persons. Such measures include, as appropriate:

Encryption of Customer Personal Data in transit over public networks and at rest where applicable;
Logical access controls, including role-based access, multi-factor authentication for administrative access, and the principle of least privilege;
Logical segregation of Customer Personal Data so that one customer cannot access another customer's data through the Services;
Network protections, including firewalls, intrusion detection, and vulnerability scanning;
Secure software development practices, including code review and dependency management;
Backup, redundancy, and disaster recovery procedures;
Periodic review and testing of these measures.

c. Personal Data Breach Notification

Whimful will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide Customer with information reasonably available to Whimful to assist Customer in meeting its obligations to notify supervisory authorities and Data Subjects. Whimful's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

d. Assistance with Data Subject Rights

Taking into account the nature of the Processing, Whimful will provide reasonable assistance to Customer, by appropriate technical and organizational measures, insofar as possible, to enable Customer to respond to requests from Data Subjects exercising rights under Data Protection Laws. Where Whimful receives a Data Subject request directly, Whimful will, where legally permitted, promptly forward it to Customer.

e. Assistance with DPIAs and Prior Consultation

Whimful will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities required under Articles 35 and 36 of the GDPR (or equivalent provisions of other Data Protection Laws), taking into account the nature of the Processing and the information available to Whimful.

5. Sub-processors

a. General Authorization

Customer provides general authorization for Whimful to engage Sub-processors to Process Customer Personal Data in connection with the Services.

b. Sub-processor List

A current list of Whimful's Sub-processors that Process Customer Personal Data is available on request at legal@whimful.com. The list identifies each Sub-processor, the Processing activities for which it is engaged, and its location.

c. Notice of New Sub-processors

Whimful will give Customer reasonable prior notice of any intended addition or replacement of a Sub-processor by means of an email, in-product notice, or update to the Sub-processor list. Customer may, on reasonable grounds relating to data protection, object to a new Sub-processor by notifying Whimful in writing within fifteen (15) days of such notice. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Service for convenience and receive a pro-rata refund of any prepaid fees for the unused period.

d. Sub-processor Terms

Whimful will impose on each Sub-processor data protection terms that are no less protective of Customer Personal Data than those in this DPA, and will remain responsible to Customer for each Sub-processor's performance of its data protection obligations.

6. International Data Transfers

a. Transfers from the EEA, UK, and Switzerland

To the extent that Whimful's Processing of Customer Personal Data involves a Restricted Transfer, the parties agree that:

For transfers subject to the GDPR, the SCCs are hereby incorporated into this DPA by reference. Module Two (Controller to Processor) applies where Customer is a Controller of the Customer Personal Data, and Module Three (Processor to Sub-processor) applies where Customer is itself a Processor. For purposes of the SCCs: (i) Customer is the data exporter and Whimful is the data importer; (ii) the optional docking clause in Clause 7 applies; (iii) Option 2 of Clause 9(a) applies (general written authorization for Sub-processors, with the notice period set out in Section 5(c)); (iv) the optional language in Clause 11(a) (independent dispute resolution body) does not apply; (v) Clause 17 (governing law) is governed by the laws of Ireland; (vi) Clause 18 (forum and jurisdiction) is the courts of Ireland; (vii) Annex I.A (parties), I.B (description of transfer), and II (technical and organizational measures) are populated by the details set out in Section 3 and Section 4(b) of this DPA; and (viii) Annex I.C (competent supervisory authority) is the Irish Data Protection Commission.
For transfers subject to the UK GDPR, the UK Addendum is hereby incorporated into this DPA by reference and applies to the relevant transfer. Tables 1 to 4 of the UK Addendum are populated by the details set out in this DPA and the SCCs.
For transfers subject to the FADP, the SCCs apply with the following modifications: (i) references to the GDPR are deemed to include the FADP; (ii) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and (iii) the term "member state" must not be interpreted so as to prevent Data Subjects in Switzerland from suing for their rights in their place of habitual residence.

b. Conflict

If there is any conflict between this DPA and the SCCs or the UK Addendum with respect to a Restricted Transfer, the SCCs or UK Addendum (as applicable) control.

7. Aggregated and De-identified Data

Customer acknowledges and agrees that Whimful may Process Customer Personal Data to produce aggregated, anonymized, and/or de-identified information for Whimful's internal business purposes, including operating, securing, monitoring, supporting, and improving the Services, generating benchmarks, analytics, and statistical insights, and reporting, as further described in Section 3(e) of the Terms of Service. Such aggregated and de-identified information is not Customer Personal Data, and Whimful will not re-identify such data.

8. Audits

Whimful will make available to Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR (and equivalent provisions of other Data Protection Laws). Upon Customer's written request and no more than once in any twelve-month period (except where required by a supervisory authority or following a confirmed Personal Data Breach), Whimful will:

Provide written responses to a reasonable security and data protection questionnaire; and
Make available the most recent third-party audit reports or certifications Whimful holds (e.g., SOC 2, ISO 27001) under appropriate confidentiality obligations.

If, after reviewing the materials above, Customer reasonably believes an on-site audit is necessary, the parties will agree in good faith on the scope, timing, and conditions of such audit, which will be conducted at Customer's cost during normal business hours, with reasonable advance notice, and in a manner that minimizes disruption to Whimful's operations.

9. Data Subject Requests

If Whimful receives a request from a Data Subject relating to the Processing of Customer Personal Data, Whimful will, where legally permitted, promptly forward that request to Customer and will not respond to the Data Subject directly except on Customer's instructions or as required by applicable law.

10. Return or Deletion of Customer Personal Data

On termination or expiration of the Agreement, Whimful will, at Customer's choice and on written request made within thirty (30) days of termination or expiration, either return or delete Customer Personal Data in Whimful's possession or control. After this thirty (30) day window, Whimful will delete Customer Personal Data from its production systems within ninety (90) days, except to the extent that retention is required by applicable law, for tax, audit, or accounting purposes, or for the establishment, exercise, or defense of legal claims. Backups will expire and be overwritten in the ordinary course of Whimful's retention schedule.

11. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations and exclusions of liability set out in the Agreement. Any reference to a party's liability under the Agreement means the aggregate liability of that party under the Agreement and this DPA combined.

12. Order of Precedence

In the event of any conflict, the following order of precedence applies (highest first): (1) the SCCs or UK Addendum (with respect to Restricted Transfers only); (2) this DPA; (3) the Agreement.

13. Governing Law

This DPA is governed by the laws governing the Agreement, except where applicable Data Protection Laws require a different governing law for the SCCs or the UK Addendum, in which case those instruments are governed as specified in Section 6(a).

14. Contact

Questions about this DPA, requests for the current Sub-processor list, or requests to exercise any right under this DPA should be directed to:

Whimful FZ-LLC
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Email: legal@whimful.com