Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Brand Terms of Service between Attribyte App Inc. ("Attribyte") and the Brand that uses the Attribyte platform (the "Brand"). It applies where Attribyte processes personal data on the Brand's behalf, and it contains the joint-controller arrangement for storefront attribution data in Annex A. Capitalized terms not defined here have the meaning given in the Brand Terms of Service.

The Brand accepts this DPA by connecting a commerce store, installing the Attribyte web pixel or connecting an advertising account. A countersigned copy is available on request to legal@attribyte.app.

1. Roles

1.1 Processor

For Brand personal data that Attribyte processes solely to provide the Platform on the Brand's instructions, Attribyte is the processor and the Brand is the controller. Examples:

• order, product and customer-identifier data received through a commerce integration and shown back to the Brand;
• ad-account data imported through a Connected Ad Account and shown back to the Brand; and
• the Brand's team member accounts.

1.2 Joint Controllers

For storefront attribution data, the data generated when a shopper arrives through a tracking link and interacts with the Brand's storefront, Attribyte and the Brand are joint controllers. Annex A sets out the arrangement required by Article 26 GDPR.

1.3 Independent Controller

Where Attribyte processes personal data for its own purposes, such as account, billing, payout and Earnings records, fraud prevention and Platform usage data, it is an independent controller and the Privacy Policy applies instead of this DPA.

2. Subject Matter and Duration

Attribyte processes personal data to provide the Platform features the Brand enables, including commerce integrations, the web pixel, attribution, Earnings and fee calculation, Connected Ad Account features, hosting, security and support. Processing continues for the term of the Brand's use of the Platform and until deletion or return under Section 12.

3. Nature and Purpose

Processing includes collection through the web pixel, commerce and advertising integrations and conversion events the Brand sends from its own systems; storage; use for attribution, reporting and Earnings calculation; erasure or anonymization; and disclosure to the sub-processors on the Sub-processor List.

The purpose is to provide the Platform under the Brand Terms of Service and the Brand's documented instructions, including product configuration and the permissions granted through Shopify, Meta, TikTok and Snapchat.

4. Types of Personal Data and Data Subjects

4.1 Data Subjects

Data subjects may include the Brand's staff users; Creators collaborating with the Brand; and the Brand's shoppers and visitors whose data reaches Attribyte through the features the Brand enables.

4.2 Categories of Personal Data

• Store, customer, visitor and session identifiers
• Order and line-item data needed for attribution and refund handling
• IP address (stored only as a one-way hash, never in plain text) and country
• Browser and device information, including the user agent
• Page URL and referrer recorded with clicks
• Campaign, click and Tracking Parameters
• An email address from an order, stored only as a keyed one-way hash and never in plain text
• Lead events, without contact details in plain text
• Credentials and tokens for connected platforms
• Creator account data linked to the Brand's Programs
• A hashed identifier derived from an email address or phone number where the Brand sends conversion events from its own systems
• Ad-account performance data

4.3 Buyer Contact Data

Attribyte does not store buyer names, postal addresses, phone numbers or payment details. It does not request names, phone numbers or postal addresses from a commerce platform and removes them before storage if received. An email address from an order is kept only as a keyed one-way hash, used to match refunds and prevent fraud, and is never stored in plain text. Customer identifiers are retained. Some retained fields may identify a buyer depending on how the store is configured.

4.4 Sensitive Data

The Platform is not intended for special category or criminal-offence personal data. The Brand will not instruct Attribyte to process it.

5. Instructions

5.1 Documented Instructions

Attribyte will process personal data only on documented instructions from the Brand, including the Brand Terms of Service, product configuration and platform-required compliance webhooks, unless EU, EEA, UK or Swiss law requires otherwise, in which case Attribyte informs the Brand before that processing unless legally prohibited.

5.2 Infringing Instructions

Attribyte will inform the Brand without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.

5.3 Brand Responsibility

The Brand is responsible for the lawfulness of the personal data it provides and of its instructions, including having a legal basis and giving data subjects the information the law requires.

6. Confidentiality

Attribyte ensures that persons authorized to process personal data are bound by contractual or statutory confidentiality obligations that survive the end of their engagement.

7. Security

Attribyte implements the technical and organizational measures in Annex B and will not materially reduce their overall level of protection during the term.

8. Sub-processors

8.1 Authorization

The Brand authorizes Attribyte to use the sub-processors on the Sub-processor List, as updated from time to time. Attribyte imposes data-protection obligations no less protective than this DPA on each sub-processor and remains responsible to the Brand for each sub-processor's performance.

8.2 Changes and Objections

Attribyte will update the Sub-processor List and notify the Brand by email or by a prominent notice in the Platform at least 14 days before a new sub-processor begins processing Brand personal data. The Brand may object on reasonable data-protection grounds within that period. The parties will work in good faith to address the objection; if they cannot, the Brand may stop using the affected features and terminate this DPA as it applies to them.

9. International Transfers

Personal data is hosted on Amazon Web Services in the eu-north-1 region (Stockholm, Sweden), inside the European Economic Area. Attribyte is established in the United States, and its staff and certain sub-processors access or receive personal data from there.

Where personal data is transferred from the EEA, the UK or Switzerland to a third country, Attribyte will ensure an appropriate safeguard applies, such as:

• the EU Standard Contractual Clauses (Module Two, controller to processor, for Section 1.1 data and Module One, controller to controller, for Annex A data);
• the UK International Data Transfer Addendum; or
• certification under the EU-US Data Privacy Framework.

The Standard Contractual Clauses are incorporated into this DPA by reference, with the Brand as data exporter and Attribyte as data importer, Annex I completed by the details in Sections 2 to 4 of this DPA and the Brand's registration information, and Annex II completed by Annex B. In the event of conflict, the Standard Contractual Clauses prevail over this DPA.

10. Assistance

10.1 General

Taking into account the nature of the processing and the information available to it, Attribyte will assist the Brand with appropriate technical and organizational measures in responding to data-subject requests and in meeting the Brand's obligations under Articles 32 to 36 GDPR, including security, breach notification, data protection impact assessments and prior consultation.

10.2 Shopify Stores

Where the Brand's store runs on Shopify, Shopify's privacy webhooks are the primary path for shopper access and erasure requests and are actioned automatically. For other stores or other requests the Brand may email legal@attribyte.app.

11. Personal Data Breach

Attribyte will notify the Brand without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Brand personal data, and will provide the information reasonably available to help the Brand meet its notification duties. Notification is not an admission of fault or liability.

12. Deletion and Return

12.1 On Termination or Request

On termination or on the Brand's written request, Attribyte will, at the Brand's choice, return Brand personal data in a commonly used format or delete or anonymize it within 30 days, except where law requires retention. Data remaining in backups is isolated from ordinary processing and removed when the backup is rotated, at most 90 days later.

12.2 Integrations

Where the store runs on Shopify, Shopify's shop and customer redaction webhooks are followed. Where the Brand removes a Meta, TikTok or Snapchat connection, the data imported through it is deleted within 30 days. Raw webhook payloads are retained for 30 days.

12.3 Financial Records

Earnings, charge and payout records are retained as required by tax and financial reporting law, with personal details not required for the record removed.

13. Audits

Attribyte will make available the information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits by the Brand or an auditor it mandates, on at least 30 days' notice and no more than once per year unless a supervisory authority or a personal data breach requires more. Attribyte may satisfy an audit request with the documentation and third-party reports it holds where those address the request.

14. Liability

Liability under this DPA follows the liability terms in the Brand Terms of Service, except where mandatory data-protection law requires otherwise. Liability to data subjects is allocated by Article 82 GDPR.

15. Governing Law and Precedence

This DPA is governed by the law that governs the Brand Terms of Service. In the event of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Brand Terms of Service for the matters it covers.

16. Contact

Attribyte App Inc.
28 Geary St STE 650, #599
San Francisco, CA 94108
United States

Email: legal@attribyte.app

Annex A: Joint Controller Arrangement for Storefront Attribution Data

This Annex is the arrangement required by Article 26 GDPR.

A.1 Scope

This Annex covers the attribution data generated when a shopper arrives at the Brand's storefront through a link carrying Tracking Parameters and interacts with the storefront or places an order: the attribution identifier, tracking id, visitor identifier, click and page events (including a one-way hash of the IP address, the user agent, page URL and referrer), device information, order identifier, order value and a keyed one-way hash of the order email address.

It also covers the supplementary signals the Platform may use to attribute an order that carries no Tracking Parameters: (a) matching a one-way hash of the buyer's IP address against a recorded click on a Creator's tracking link for the same Brand shortly before the order, and (b) UTM and ad identifiers in the commerce platform's customer journey data that map to ads using a Creator's content.

A.2 Purposes

The Brand uses the data to run, evaluate and pay for its creator program. Attribyte uses the data to calculate Earnings and fees, to invoice the Brand and pay Creators, to prevent fraud and to maintain Platform integrity. Neither party uses the data for any other purpose, and Attribyte does not use it to build profiles of individual shoppers.

A.3 Responsibilities of the Brand

The Brand is responsible for:

• providing shoppers with the information required by Articles 13 and 14 GDPR on its storefront, including that Attribyte is a joint controller for attribution data, with a link to Attribyte's Privacy Policy;
• collecting any consent required for the attribution identifier under the ePrivacy rules applicable to its storefront and passing the consent state to the web pixel where its platform supports it; and
• responding to shopper requests that reach it.

A.4 Responsibilities of Attribyte

Attribyte is responsible for:

• the security of the attribution data and the measures in Annex B;
• limiting the data to what attribution requires, keeping IP addresses and order email addresses only as one-way hashes and never in plain text, and not storing shopper names, postal addresses, phone numbers or payment details;
• responding to shopper requests that reach it at legal@attribyte.app, and forwarding to the Brand any request it cannot fulfil alone;
• notifying the Brand of a personal data breach under Section 11; and
• the retention periods in the Privacy Policy.

A.5 Data Subject Rights

Shoppers may exercise their rights against either party. The parties will inform each other of requests received within 5 business days and cooperate to respond within the statutory period.

A.6 Contact Point

The contact point for shoppers is legal@attribyte.app. The Brand will publish that address alongside its own.

A.7 Essence

The essence of this arrangement is available to shoppers through Section 3 of Attribyte's Privacy Policy.

Annex B: Technical and Organizational Measures

• Hosting on Amazon Web Services in the eu-north-1 region (Stockholm, Sweden) with encryption at rest (AES-256) and TLS 1.2 or higher in transit.
• Role-based access control on the principle of least privilege. Multi-factor authentication required for all staff access to production systems and to the cloud account.
• Secrets held in a managed secrets store, never in source code.
• IP addresses stored only as a one-way hash for storefront events.
• Buyer contact fields dropped before storage of commerce webhooks.
• Payment card, bank and identity-verification data handled exclusively by the payment processor; Attribyte stores no card numbers or identity documents.
• Rate limiting and web application firewall on public endpoints. HMAC signature verification on all inbound webhooks.
• Daily encrypted backups with periodic restore testing.
• Centralized logging with 90-day retention and alerting on authentication anomalies.
• Dependency and vulnerability scanning in the build pipeline; production deployments through reviewed pull requests.
• Documented incident response procedure with a named owner and a 48-hour customer notification target.
• Confidentiality obligations for all staff and contractors; access revoked on offboarding.