Effective Date: August 14, 2026
1. PREAMBLE AND SCOPE
1.1. Introduction. This Data Processing Agreement (this "DPA") is entered into by and between the Pinkdude Group (acting as the "Processor" or "Service Provider", hereinafter "Provider") and the Customer (acting as the "Controller" or "Business", hereinafter "Customer") (collectively, the "Parties").
1.2. Incorporation. This DPA is incorporated by reference into the Master Terms of Service (Document 2.1) and forms an integral part of the Agreement between the Parties. It applies to the extent that the Provider processes Personal Data on behalf of the Customer in the course of providing the Services defined in the Master Terms.
1.3. Order of Precedence. In the event of any conflict or inconsistency between this DPA and the Master Terms, this DPA shall prevail with respect to the subject matter of data protection and privacy, EXCEPT that the Limitations of Liability set forth in Section 15 of the Master Terms shall strictly govern and cap the Provider’s liability under this DPA. For clarity, nothing in this DPA shall be construed to expand the Provider's financial liability beyond the caps agreed in the Master Terms.
2. DEFINITIONS
For the purposes of this DPA, the following terms shall have the meanings set forth below. Capitalized terms used but not defined herein shall have the meanings given to them in the Master Terms or applicable Data Protection Laws.
"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity.
"CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (CPRA) of 2020, and any regulations promulgated thereunder.
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. For the purposes of this DPA, the Customer is the Controller.
"Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data and privacy that apply to the processing of Personal Data under this DPA, including the EU GDPR, the UK GDPR, the Swiss FADP, the CCPA, and strictly applicable local laws.
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
"EEA" means the European Economic Area.
"EU GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
"High-Risk Data" means specific categories of data that require enhanced protection, including Special Categories of Data, financial identifiers, government IDs, and protected health information.
"Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject") that is uploaded to the Services by the Customer. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
"Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller. For the purposes of this DPA, the Provider is the Processor.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"Sub-processor" means any third party (including any Affiliate of the Processor) engaged by the Processor to assist in fulfilling its obligations with respect to providing the Services pursuant to the Agreement or this DPA.
3. ROLES AND RESPONSIBILITIES (SHARED RESPONSIBILITY MODEL)
3.1. Role of the Customer (Controller). The Customer warrants and represents that:
(a) Lawful Basis: It has a valid legal basis for processing the Personal Data and for sharing it with the Provider.
(b) Instructions: Its instructions to the Provider regarding the processing of Personal Data comply with all applicable Data Protection Laws.
(c) Consents: It has obtained all necessary consents, authorizations, and permissions from Data Subjects required for the processing described in this DPA.
(d) Accuracy: It is solely responsible for the accuracy, quality, and legality of the Personal Data and the means by which it acquired the Personal Data.
3.2. Role of the Provider (Processor). The Provider shall:
(a) Documented Instructions: Process Personal Data only on documented instructions from the Customer (which include the Master Terms and this DPA), unless required to do so by applicable law to which the Provider is subject. In such a case, the Provider shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(b) Purpose Limitation: Not process Personal Data for any purpose other than for the specific purpose of performing the Services, protecting the security and integrity of the Platform, or improving the Services (on an aggregated and anonymized basis).
(c) Confidentiality: Ensure that persons authorized to process the Personal Data (e.g., employees, contractors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(d) Passive Infrastructure Status: The Parties acknowledge that the Provider acts as a passive infrastructure provider. The Provider does not monitor, review, or inspect the content of Personal Data stored on its servers. The Provider assumes no actual or constructive knowledge of the specific nature of the data uploaded by the Customer.
3.3. SHARED RESPONSIBILITY MODEL (INVESTOR-GRADE). The Parties acknowledge and agree to the following allocation of security responsibilities:
(a) Provider Responsibility ("Security OF the Cloud"): The Provider is responsible for protecting the infrastructure that runs all of the Services. This infrastructure is composed of the hardware, software, networking, and facilities that run the Cloud Services.
(b) Customer Responsibility ("Security IN the Cloud"): The Customer is responsible for managing its data (including encryption options), classifying its assets, and using IAM tools to apply the appropriate permissions. The Customer is responsible for configuring the Services securely (e.g., firewall rules, user access policies) and for patching any guest operating systems or applications it installs.
3.4. AUTOMATED PROCESSING DISCLAIMER. The Customer acknowledges that the Services may utilize automated processing, machine learning, or algorithmic tools. The Provider does not make legal determinations regarding Personal Data uploaded to the Services and relies entirely on Customer instructions. The Provider shall not be liable for any automated decision-making outcomes derived solely from the Customer's configuration of the Services.
4. PROHIBITED DATA CATEGORIES (HIGH-RISK BAN)
4.1. General Prohibition. Unless explicitly authorized in a separate written agreement (e.g., a "BAA" for HIPAA compliance), the Customer shall not upload, store, process, or transmit any of the following "High-Risk Data" to the Services:
(a) Special Categories: Special Categories of Data as defined in Article 9 of the GDPR (e.g., racial/ethnic origin, political opinions, religious beliefs, trade union membership).
(b) Biometric & Genetic: Biometric identifiers (e.g., facial scans, fingerprints) or genetic data.
(c) Health Data: Protected Health Information (PHI) subject to HIPAA or similar medical privacy laws.
(d) Criminal Records: Data relating to criminal convictions or offenses.
(e) Children's Data: Personal Data of children under the age of 16 (or the applicable age of digital consent).
4.2. Liability Waiver. If the Customer uploads High-Risk Data in violation of this Section 4, the Provider shall have no liability for any such data in the event of a Data Breach, and the Customer shall fully indemnify the Provider for any resulting regulatory fines or penalties.
5. SECURITY OF PROCESSING
5.1. Technical and Organizational Measures (TOMs). Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Provider shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These measures include, but are not limited to:
(a) Pseudonymization and Encryption: Using industry-standard encryption protocols (e.g., AES-256) for Personal Data at rest (on disk) and secure transport layer security (TLS 1.2 or higher) for Personal Data in transit over public networks.
(b) Confidentiality and Integrity: Implementing strict access controls, multi-factor authentication (MFA), and role-based access control (RBAC) to ensure that only authorized personnel have access to Personal Data.
(c) Availability and Resilience: Utilizing redundant storage systems (RAID), automated backups (for Paid Plans), and disaster recovery protocols to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
(d) Testing and Evaluation: Regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing (e.g., vulnerability scanning, penetration testing).
5.2. Risk-Based Approach. The Customer acknowledges that security measures are risk-based and not absolute. The Provider does not guarantee that the Services are completely secure or error-free. The Provider's security obligations are limited to reasonable commercial efforts to protect the Infrastructure.
5.3. Customer Responsibility. The Customer is solely responsible for:
(a) Credentials: Managing and securing its Authorized Users' authentication credentials (passwords, API keys).
(b) Encryption: Encrypting Personal Data prior to uploading it to the Services ("Client-Side Encryption") if such data is of a sensitive nature requiring higher security than standard infrastructure protection.
(c) Backups: Maintaining independent, off-site backups of Personal Data.
6. SUB-PROCESSING
6.1. General Authorization. The Customer hereby grants the Provider a general authorization to engage Sub-processors to assist in fulfilling its obligations under the Agreement. The Customer acknowledges that the Provider’s business model relies on a network of trusted infrastructure partners (e.g., data center operators, upstream network carriers, DDoS mitigation services).
6.2. Sub-processor Obligations. Where the Provider engages a Sub-processor to carry out specific processing activities on behalf of the Customer, the Provider shall do so by way of a written contract which imposes on the Sub-processor, in substance, the same data protection obligations as the ones imposed on the Provider under this DPA.
(a) Compliance: The Provider shall ensure that the Sub-processor provides sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the Data Protection Laws.
(b) Liability: The Provider shall remain fully liable to the Customer for the performance of the Sub-processor’s obligations. If the Sub-processor fails to fulfill its data protection obligations, the Provider shall remain fully liable to the Customer for the performance of the Sub-processor’s obligations subject always to the liability limitations in the Master Terms..
6.3. List of Current Sub-processors. A current list of Sub-processors is available in the Platform Framework (Document 0). The Customer acknowledges and agrees to the use of the Sub-processors listed therein as of the Effective Date.
6.4. Changes to Sub-processors. The Provider shall inform the Customer of any intended changes concerning the addition or replacement of other Sub-processors, thereby giving the Customer the opportunity to object to such changes.
(a) Notification: The Provider will provide notice of such changes via the Customer Dashboard or email at least ten (10) days prior to engaging the new Sub-processor.
(b) Objection: If the Customer has a reasonable basis to object to the use of a new Sub-processor (e.g., significant security concerns), the Customer shall notify the Provider in writing within five (5) days after receipt of the Provider’s notice.
(c) Resolution: In the event of such an objection, the Provider will use reasonable efforts to make available a change in the Services or recommend a commercially reasonable change to the Customer’s configuration to avoid the processing of Personal Data by the objected-to new Sub-processor. If the Provider is unable to make such a change within a reasonable period of time, the Customer may terminate the applicable Order Form with respect to those Services which cannot be provided by the Provider without the use of the objected-to new Sub-processor.
7. DATA SUBJECT RIGHTS
7.1. Notification. The Provider shall, to the extent legally permitted, promptly notify the Customer if it receives a request from a Data Subject to exercise their rights under Data Protection Laws (e.g., right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object to automated decision-making) (a "Data Subject Request").
7.2. No Direct Response. Taking into account the nature of the processing, the Provider shall not respond to that request except on the documented instructions of the Customer or as required by applicable laws to which the Provider is subject, in which case the Provider shall to the extent permitted by applicable laws inform the Customer of that legal requirement before the Provider responds to the request.
7.3. Assistance. The Provider shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
(a) Self-Service: The Customer acknowledges that the Services include features (e.g., "Export Data," "Delete User," "API Access") that allow the Customer to retrieve, correct, or delete Personal Data independently. The Customer agrees to use these features as the primary method for responding to Data Subject Requests.
(b) Additional Support: To the extent the Customer is unable to access the relevant Personal Data within the Services, the Provider shall provide commercially reasonable assistance to the Customer in responding to the request. The Customer shall be responsible for any costs arising from the Provider’s provision of such assistance (billed at the Provider's standard professional services rates), unless such assistance is required due to the Provider's failure to comply with this DPA.
8. PERSONAL DATA BREACH
8.1. Notification. The Provider shall notify the Customer without undue delay and within the timeframe required by applicable law after becoming aware of a confirmed Personal Data Breach affecting the Customer's Personal Data.
(a) Content: The notification shall describe the nature of the breach, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned.
(b) Contact: The notification shall communicate the name and contact details of the Data Protection Officer or other contact point where more information can be obtained.
(c) Mitigation: The notification shall describe the likely consequences of the Personal Data Breach and the measures taken or proposed to be taken by the Provider to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.
8.2. Cooperation. The Provider shall provide reasonable cooperation and assistance to the Customer in its investigation of the Personal Data Breach and in complying with the Customer's obligations under Data Protection Laws (e.g., notifying the supervisory authority and communicating the breach to Data Subjects).
8.3. No Admission. The Provider’s notification of or response to a Personal Data Breach under this Section 8 shall not be construed as an acknowledgment by the Provider of any fault or liability with respect to the Personal Data Breach.
9. AUDITS AND CERTIFICATIONS
9.1. Certifications (The "No Physical Access" Rule). The Customer acknowledges that the Provider operates a multi-tenant cloud infrastructure and that strictly controlling physical access to data centers is essential to maintaining security. Therefore, the Customer agrees that it shall not conduct physical audits of the Provider’s data centers or premises.
(a) Alternative: Instead, the Provider shall, upon written request (no more than once per year), make available to the Customer (Enterprise Tier only) a summary of its most recent third-party security audit reports (e.g., SOC 2 Type II, ISO 27001) or a redacted penetration test summary, subject to strict confidentiality obligations.
9.2. Regulatory Audits. If a Supervisory Authority (e.g., the ICO, CNIL) requires an audit of the processing facilities that exceeds the scope of the information provided under Section 9.1, the Provider will allow such an audit to the extent legally required. The Customer shall reimburse the Provider for any time and resources expended in facilitating such a regulatory audit.
10. INTERNATIONAL DATA TRANSFERS
10.1. Transfer Mechanism. The Provider operates a global infrastructure. If the Provider transfers Personal Data to a country outside the European Economic Area (EEA), the United Kingdom, or Switzerland that has not been recognized by the European Commission (or the relevant authority) as providing an adequate level of data protection (a "Third Country"), such transfers shall be governed by the following transfer mechanisms:
(a) EU SCCs: The Standard Contractual Clauses (Module 2: Controller-to-Processor) annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 are hereby incorporated by reference.
Clause 7 (Docking Clause): Included.
Clause 9 (Use of Sub-processors): Option 2 (General written authorization) applies.
Clause 11 (Redress): The optional language is excluded.
Clause 17 (Governing Law): Ireland.
Clause 18 (Choice of Forum and Jurisdiction): The courts of Ireland.
(b) UK Addendum: The International Data Transfer Addendum to the EU SCCs issued by the UK ICO is incorporated by reference for transfers from the UK.
(c) Swiss Addendum: To the extent the Swiss FADP applies, the EU SCCs shall apply with necessary modifications (e.g., FDPIC as the authority).
10.2. Customer Authorization. By using the Services and selecting a specific Infrastructure Region in the Platform Framework (Document 0), the Customer explicitly authorizes the transfer of Personal Data to that region and to the Sub-processors necessary to operate that region.
10.3. Supplementary Measures. The Provider represents and implemented supplementary technical measures (including encryption in transit and at rest) to protect Personal Data against government surveillance in Third Countries.
11. LIMITATION OF LIABILITY (THE "FINANCIAL SHIELD")
11.1. Liability Cap. The Provider’s liability arising out of or related to this DPA, whether in contract, tort, breach of statutory duty, or otherwise, is subject to the limitations and exclusions of liability set forth in Section 15 of the Master Terms of Service (Document 2.1).
(a) Free Services: For the avoidance of doubt, the Provider’s total aggregate liability for any Data Breach, security incident, or failure to comply with this DPA involving Free Services shall be limited to ZERO EUROS (€0.00).
(b) Paid Services: The Provider’s total aggregate liability for Paid Services under this DPA shall not exceed the caps defined in the Master Terms (i.e., the greater of 12 months' fees paid or €10,000, subject to the specific plan tier).
11.2. Exclusion of Damages. In no event shall the Provider be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, loss of business, loss of goodwill, or loss of data, even if advised of the possibility of such damages.
12. CUSTOMER INDEMNIFICATION (CRITICAL PROTECTION)
12.1. Indemnity Scope. The Customer shall defend, indemnify, and hold harmless the Provider, its Affiliates, and their respective officers, directors, employees, and agents (collectively, the "Indemnified Parties") from and against any and all claims, damages, regulatory penalties, fines, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:
(a) Unlawful Data: The Customer’s upload or processing of any Personal Data in violation of this DPA (including the "High-Risk Data" prohibition in Section 4);
(b) Lack of Basis: The Customer’s failure to have a valid legal basis for processing;
(c) Consent Failures: The Customer’s failure to obtain necessary consents from Data Subjects;
(d) Violation of Laws: The Customer’s violation of any applicable Data Protection Laws; or
(e) Unlawful Instructions: Any claim that the Provider’s processing in accordance with the Customer’s documented instructions infringes the rights of a third party or violates applicable law.
12.2. Regulatory Fines. To the extent permitted by law, if a Supervisory Authority issues a fine against the Provider arising from the Customer’s breach of its obligations under this DPA (e.g., uploading unencrypted health data), the Customer shall reimburse the Provider for the full amount of such fine.
13. TERM AND TERMINATION
13.1. Duration. This DPA shall remain in effect for as long as the Provider carries out Personal Data processing operations on behalf of the Customer.
13.2. Deletion or Return of Data. Upon termination or expiration of the Master Terms, the Provider shall (at the Customer's election) delete or return all Personal Data to the Customer.
(a) Automatic Deletion: If the Customer does not make an election within thirty (30) days of termination, the Provider shall securely delete all Personal Data.
(b) Abuse Exception: Notwithstanding the foregoing, if the Customer's account was terminated for Abuse, Fraud, or Violation of the AUP, the Provider reserves the right to retain specific "Hash Data" (e.g., cryptographic hashes of email addresses, phone numbers, and device fingerprints) indefinitely in a "Blocklist" to prevent re-registration. The Customer acknowledges that this retention is necessary for the purposes of network security and fraud prevention (Recital 47 GDPR).
14. GENERAL PROVISIONS
14.1. Governing Law. This DPA shall be governed by the laws of the jurisdiction specified in the Contracting Entity Matrix in the Platform Framework (Document 0).
14.2. Severability. If any provision of this DPA is held invalid or unenforceable, the remainder of the DPA shall remain valid and in force.
14.3. Entire Agreement. This DPA, together with the Master Terms and the Platform Framework, constitutes the entire agreement between the Parties with respect to the subject matter hereof.
APPENDIX A: SECURITY MEASURES (SUMMARY)
The following technical and organizational measures are implemented by the Provider:
Pseudonymization & Encryption:
At Rest: AES-256 encryption for all block storage and object storage.
In Transit: TLS 1.2+ for all data transmission over public networks.
Confidentiality & Access Control:
Physical: Tier III/IV Data Centers with biometric entry controls.
Logical: Role-Based Access Control (RBAC) enforcing "Least Privilege."
MFA: Multi-Factor Authentication mandatory for all engineering staff.
Integrity & Availability:
Redundancy: RAID storage arrays and geographically distributed availability zones.
DDoS Protection: Automated scrubbing centers (L3/L4).
Backups: Daily automated snapshots (retention policy varies by plan).
Vulnerability Management:
Scanning: Automated weekly vulnerability scans.
Pen Testing: Annual third-party penetration testing.