Data Processing Agreement

In this Data Processing Agreement ("DPA"), the following terms have the meanings set out below:

• "Controller" means the natural or legal person who determines the purposes and means of the processing of Personal Data. Where a business customer uses the Endromeda platform and provides Personal Data of their own customers or users to Endromeda, that business customer is the Controller.
• "Processor" means a natural or legal person who processes Personal Data on behalf of the Controller. Endromeda acts as Processor when processing data provided by business customers pursuant to their use of the Endromeda app or Done-For-You Brand service.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined by applicable Data Protection Laws.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or erasure.
• "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including the EU General Data Protection Regulation (GDPR) 2016/679, the UK GDPR, the California Consumer Privacy Act (CCPA), and any amendments or implementing legislation thereof.
• "Sub-processor" means any third party engaged by Endromeda to process Personal Data on behalf of the Controller.
• "Standard Contractual Clauses" or "SCCs" means the standard data protection clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR for the transfer of Personal Data to third countries.
• "Services" means the Endromeda app, Done-For-You Brand service, Brand DNA Kit, and Full Creator System, as described in the Terms of Service.

The roles of the parties depend on the nature of the processing activity:

Where Endromeda acts as a Processor, it shall process Personal Data only on documented instructions from the Controller (i.e., in the course of delivering the Services), unless required to do so by applicable law.

Subject matter: The processing of Personal Data in connection with the provision of the Services described in the Terms of Service.

Duration of processing: For the term of the customer's subscription or engagement, and as required for legal, tax, and compliance obligations thereafter (see Section 9).

Nature of processing: Storage, retrieval, analysis, display, and transmission of Personal Data within the Endromeda platform and to Sub-processors as necessary to deliver the Services.

Purposes of processing:

• Providing access to and operating the Endromeda dashboard app and its features.
• Generating AI-assisted content, scripts, hooks, and brand strategy outputs.
• Storing content, tasks, notes, and session data within the platform.
• Processing payments and managing subscriptions via Stripe.
• Delivering Done-For-You Brand services, including audience research and brand asset creation.
• Providing customer support and responding to service-related inquiries.
• Complying with legal and regulatory obligations.

Types of Personal Data processed:

• Identity data: name, email address, Instagram handle, business name.
• Account data: login credentials (hashed), account preferences, session tokens.
• Content data: text inputs, content ideas, scripts, captions, brand materials submitted to or generated within the platform.
• Usage data: feature interactions, task completions, login timestamps, session durations.
• Payment data: billing name, email, subscription status (card details processed exclusively by Stripe — not accessible to Endromeda).
• Communications: support ticket content, email correspondence.

Categories of Data Subjects:

• Endromeda customers and app users.
• For Done-For-You Brand clients: data about the client's own business, team, and audience where shared with Endromeda as part of the engagement.

Where Endromeda acts as a Processor on behalf of a Controller, Endromeda shall:

4.1 Process only on instructions

Process Personal Data only in accordance with the Controller's documented instructions (including as set out in the Terms of Service and this DPA), unless processing is required by applicable law, in which case Endromeda will inform the Controller of that legal requirement before processing (unless prohibited by law on important grounds of public interest).

4.2 Confidentiality

Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Personal Data is limited to those team members who need it to provide the Services.

4.3 Security

Implement appropriate technical and organisational security measures to protect Personal Data, as described in Section 8 of this DPA and Section 08 of the Privacy Policy (Security Statement).

4.4 Sub-processors

Not engage any new Sub-processor without informing the Controller in advance and giving the Controller the opportunity to object. Current approved Sub-processors are listed in Section 7. We maintain an up-to-date sub-processor list and will notify Controllers of changes with at least 14 days' advance notice.

4.5 Data Subject Rights

Assist the Controller in fulfilling its obligations to respond to Data Subject rights requests (access, correction, deletion, portability, restriction, objection). We will promptly notify the Controller of any Data Subject request received and provide reasonable assistance to enable the Controller to respond within applicable legal deadlines.

4.6 Data Protection Impact Assessments

Provide reasonable assistance to the Controller in carrying out data protection impact assessments (DPIAs) and prior consultations with supervisory authorities, where required under Article 35 and 36 of the GDPR.

4.7 Breach Notification

Notify the Controller of any Personal Data breach affecting the Controller's data without undue delay and, where feasible, within 48 hours of becoming aware of the breach, providing sufficient information to allow the Controller to meet its own notification obligations. See Section 9 of this DPA for full breach notification terms.

4.8 Deletion or Return on Termination

At the Controller's choice, delete or return all Personal Data at the end of the service relationship, and delete existing copies, unless applicable law requires retention.

4.9 Audit Rights

Make available all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits and inspections by the Controller or a third-party auditor mandated by the Controller, subject to reasonable prior notice and appropriate confidentiality obligations.

Where a business customer acts as a Controller in connection with the Services, that Controller agrees to:

• Ensure it has a valid legal basis under applicable Data Protection Laws for all Personal Data provided to Endromeda for processing.
• Provide all necessary notices to, and obtain all required consents from, Data Subjects whose Personal Data is shared with Endromeda.
• Ensure that its instructions to Endromeda comply with applicable Data Protection Laws.
• Promptly inform Endromeda of any changes to applicable Data Protection Laws that may affect Endromeda's obligations as Processor.
• Not instruct Endromeda to process Personal Data in any way that would violate applicable law, infringe third-party rights, or conflict with this DPA.

Endromeda operates globally and may process Personal Data in countries outside the European Economic Area (EEA) or United Kingdom, including the United States. Where such transfers occur, Endromeda relies on appropriate safeguards to ensure an adequate level of protection:

Transfer mechanisms used:

• Standard Contractual Clauses (SCCs) — For transfers from the EEA to third countries, we rely on the European Commission's SCCs (as adopted by Decision 2021/914) incorporated by reference into this DPA.
• UK IDTA — For transfers from the UK, we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs where applicable.
• Adequacy decisions — Where the European Commission or UK ICO has issued an adequacy decision in respect of the recipient country, we rely on that adequacy decision.
• Sub-processor certifications — Where our Sub-processors are certified under frameworks such as EU-US Data Privacy Framework (DPF), we rely on that certification.

The SCCs are incorporated into and form part of this DPA. In the event of any conflict between this DPA and the SCCs, the SCCs shall prevail.

Endromeda currently uses the following Sub-processors in connection with the Services. We update this list when Sub-processors are added or removed. Controllers will be notified at least 14 days before a new Sub-processor is engaged.

Controllers who wish to object to the use of a new Sub-processor must notify Endromeda in writing within 14 days of receiving notice. Objection must be based on reasonable grounds relating to data protection. If Endromeda is unable to accommodate the objection, the Controller may terminate the relevant Services on written notice without penalty, receiving a pro-rata refund for any prepaid unused period.

Endromeda implements and maintains the following technical and organisational security measures (as required by Article 32 GDPR) to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access:

Technical Measures

• Encryption in transit: TLS 1.2+ (HTTPS) enforced on all connections. HTTP connections are rejected.
• Encryption at rest: AES-256 encryption for all Personal Data stored in our database. Passwords hashed using bcrypt with a work factor of 12 or higher.
• Access control: Role-based access control (RBAC) at the application layer. Row-level security (RLS) in the database layer, ensuring users can only access their own data.
• Authentication: Short-lived JWT access tokens with enforced expiry and rotating refresh tokens. Multi-factor authentication (MFA) required for all internal admin accounts.
• API security: All Anthropic API keys stored as server-side secrets in Supabase Edge Function environment variables. No API keys exposed to client-side browsers.
• Network security: API rate limiting, input validation and sanitisation, and CSRF protection implemented across all endpoints.
• Audit logging: Authentication events and administrative data access logged and retained for security monitoring.
• Vulnerability management: Regular dependency audits and patch management process.

Organisational Measures

• Least privilege: Access to Personal Data and production systems limited to personnel with a business need. No shared credentials or service accounts with excess permissions.
• Confidentiality obligations: All personnel with access to Personal Data are bound by confidentiality obligations.
• Sub-processor due diligence: Security assessments of Sub-processors prior to engagement, including review of their certifications, policies, and data protection terms.
• Incident response plan: Documented procedure for detecting, reporting, assessing, and notifying data breaches, with defined responsibilities and 48-hour notification target.
• Data minimisation: Collection limited to what is necessary for the stated processing purpose.
• Retention and deletion: Documented data retention schedule with secure deletion procedures for expired data.

These measures are subject to periodic review and updated as appropriate given the evolving threat landscape and changes to the state of the art in information security.

A "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

Endromeda's obligations on becoming aware of a breach:

1. Within 48 hours: Notify the affected Controller(s) of any Personal Data breach affecting their data, providing: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects affected; (c) the categories and approximate number of Personal Data records concerned; (d) the name and contact details of the data protection contact point; (e) the likely consequences of the breach; and (f) the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.
2. Where all information is not available at the time of initial notice: We will provide the available information first and supplement with additional details as they become available without undue delay.
3. Documentation: We will document all Personal Data breaches, including those not required to be notified, and make that documentation available to Controllers on request.

Controller's notification obligations: The Controller is responsible for determining whether a breach must be notified to the relevant supervisory authority (within 72 hours under GDPR Article 33) and/or to affected Data Subjects (where likely to result in high risk to their rights under GDPR Article 34). Endromeda will provide reasonable assistance to Controllers in meeting these obligations.

Taking into account the nature of the processing, Endromeda shall assist the Controller — by appropriate technical and organisational measures, insofar as possible — in fulfilling the Controller's obligation to respond to requests from Data Subjects exercising their rights under applicable Data Protection Laws:

Endromeda will promptly notify the Controller of any Data Subject rights request received directly, and will not respond to such requests independently without the Controller's authorisation, unless required by applicable law.

During the service relationship: Endromeda retains Personal Data for as long as necessary to provide the Services and fulfil the purposes described in this DPA and the Privacy Policy.

On termination or expiry: Within 30 days of the end of the service relationship (or upon written request from the Controller), Endromeda will, at the Controller's choice:

• Return — provide a complete export of the Controller's Personal Data in a structured machine-readable format (JSON or CSV); or
• Delete — securely delete all Personal Data processed on behalf of the Controller, and confirm deletion in writing.

Legal retention exceptions: Notwithstanding the above, Endromeda may retain Personal Data to the extent and for the duration required by applicable law (e.g., financial records retained for 7 years for tax purposes), in which case Endromeda will: (i) inform the Controller of the legal obligation; (ii) process the retained data only as required by law; and (iii) delete it promptly once the legal retention period expires.

Backups: Encrypted backup copies of deleted data may persist in automated backup systems for up to 90 days before being overwritten. During this period, backups are not actively accessible and are protected by the same security measures as live data.

Each party is responsible for its own compliance with applicable Data Protection Laws.

As between the parties, and to the maximum extent permitted by law:

• Where both parties have contributed to the same damage suffered by a Data Subject, liability between the parties is apportioned based on the degree of responsibility for the damage.
• Endromeda's total liability under this DPA (whether in contract, tort, or otherwise) is subject to the limitation of liability set out in Section 11 of the Terms of Service.
• Endromeda is not liable for any failure to comply with this DPA to the extent caused by the Controller's failure to fulfil its own obligations, including failure to provide lawful instructions or to obtain required consents.

Nothing in this DPA limits or excludes either party's liability in respect of death or personal injury caused by negligence, fraud, or any liability that cannot be excluded or limited under applicable law.

Duration: This DPA is effective from the date a customer first accepts the Terms of Service and shall remain in force for the duration of the service relationship, and thereafter for so long as Endromeda processes Personal Data on behalf of the Controller.

Termination: This DPA terminates automatically when the underlying service relationship ends and all Personal Data has been deleted or returned in accordance with Section 11.

Governing law: This DPA is governed by the same law as the Terms of Service. Where the SCCs or UK IDTA apply, those instruments are governed by the law specified within them.

Precedence: In the event of any conflict between this DPA and the Terms of Service, this DPA shall take precedence with respect to data protection matters. In the event of any conflict between this DPA and the Standard Contractual Clauses, the SCCs shall prevail.

Amendments: We may update this DPA from time to time to reflect changes in applicable law, our processing activities, or our Sub-processor list. Material changes will be notified in advance per the process described in Section 7 (Sub-processors) and in our Terms of Service.

For all enquiries relating to this DPA, data protection matters, Sub-processor objections, Data Subject rights assistance, or breach notifications, please contact us:

Include "DPA Enquiry" or "Data Breach Notification" in the subject line. We aim to respond to all data protection enquiries within 5 business days and to breach notifications within 48 hours.

If you are a business customer and require a countersigned copy of this DPA for your own compliance records, please request one at the address above and we will arrange execution.