Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Funnelish Terms of Service (the “Agreement”) between the Customer and its contracting party. Funnelish Pte. Ltd. or Ginigo Ltd, as determined by the Agreement (“Funnelish”, “we”). It applies automatically whenever Funnelish processes personal data on the Customer’s behalf in providing the Services, and no signature is required. Where the parties have signed a separate data processing agreement, that agreement prevails to the extent it conflicts.

For Customer Personal Data, personal data relating to the Customer’s shoppers, subscribers, leads and other end users that the Customer collects through the Services, the Customer is the controller (or “business”) and Funnelish is the processor (or “service provider” / “contractor”). Both Group companies may process Customer Personal Data as processors; each is bound by this DPA, and the Customer’s contracting party is responsible for the other’s compliance.

For account, billing, usage and contact data about the Customer and its staff, the Group companies are independent or joint controllers as described in the Privacy Policy; this DPA does not apply to that data.

Capitalised terms not defined here have the meaning given in the Agreement or in Data Protection Law. “Data Protection Law” means all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the Singapore PDPA, the California Consumer Privacy Act as amended by the CPRA and other U.S. state privacy laws, and comparable laws elsewhere.

Instructions

Funnelish will process Customer Personal Data only on the Customer’s documented instructions, which are: the Agreement, this DPA, the Customer’s configuration and use of the Services, and any further written instructions the parties agree. Funnelish will tell the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend that instruction until it is resolved. Funnelish may process Customer Personal Data where required by a law it is subject to, in which case it will inform the Customer unless the law prohibits it.

Confidentiality

Funnelish ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations and receive appropriate training.

Security

Funnelish implements and maintains the technical and organisational measures in Annex 2 and will not materially reduce the overall level of protection during the term.

Assistance

Taking into account the nature of the processing, Funnelish will assist the Customer, through the functionality of the Services and otherwise as reasonably needed, in responding to data-subject requests and in meeting the Customer’s obligations regarding security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. Funnelish will forward to the Customer, without responding on the merits, any request it receives from a data subject relating to Customer Personal Data. Assistance beyond what the Services provide may be charged at Funnelish’s then-current rates.

Personal data breaches

Funnelish will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its own notification obligations, updated as the investigation proceeds. Notification is not an admission of fault.

Records and cooperation

Funnelish maintains records of its processing activities as required by Data Protection Law and will cooperate with supervisory authorities as required.

The Customer warrants that it has, and will maintain, a lawful basis for the processing it instructs; that it has given data subjects all required notices (including a privacy policy on each store) and obtained all required consents (including for cookies, pixels, marketing and any sensitive data); that its instructions comply with Data Protection Law; and that it will not instruct Funnelish to process data of children under the age at which consent is required in the relevant jurisdiction, except where the Customer holds the consent of a parent or guardian. The Customer is responsible for the accuracy, quality and legality of Customer Personal Data and the means by which it was obtained, and for configuring the Services (including retention, access, exports and integrations) appropriately.

The Customer gives Funnelish general authorisation to engage sub-processors, including the other Group company and the third parties listed at funnelish.com/sub-processors. Funnelish will:

• impose on each sub-processor, by written contract, data protection obligations that provide at least the level of protection in this DPA;

• remain liable to the Customer for the sub-processor’s performance of those obligations;

• publish changes to the list and, for additions or replacements affecting Customer Personal Data, give at least 30 days’ notice by email to account owners who subscribe to notifications on that page, or by in-app notice.

The Customer may object to a new sub-processor on reasonable data protection grounds within the notice period. The parties will then discuss in good faith; if Funnelish cannot reasonably accommodate the objection, the Customer may terminate the affected Services on notice and receive a pro-rated refund of prepaid, unused fees.

Customer Personal Data is stored in Google Cloud’s us-east1 region in the United States, and is accessed by Funnelish staff and contractors from Singapore, the United Kingdom and other countries where they work. Funnelish may also process Customer Personal Data in other countries where its sub-processors operate, as listed on the sub-processor page, subject to the following:

EU and EEA

data Transfers of Customer Personal Data subject to the EU GDPR to countries without an adequacy decision are governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the “SCCs”), which are incorporated into this DPA by reference and deemed signed by the parties, with Module Two (controller to processor) applying where the Customer is a controller and Module Three (processor to processor) where the Customer is itself a processor, and with the following options: Clause 7 (docking clause) is included; Clause 9(a), Option 2 (general written authorisation) applies with the notice period in section 5; the optional language in Clause 11(a) is not included; Clause 13 applies as determined by the Customer’s establishment; Clause 17, Option 1, with Irish law governing; Clause 18, the courts of Ireland. Annexes 1 and 2 of the SCCs are completed by sections 2 and Annex 2 of this DPA, and Annex 3 by the sub-processor list. Where Swiss law applies, the SCCs are read with the modifications required by the Swiss Federal Data Protection and Information Commissioner, with the FDPIC as competent authority and Swiss law and courts under Clauses 17 and 18.

UK data

Transfers subject to the UK GDPR are governed by the SCCs as amended by the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) (the “UK Addendum”), incorporated by reference. Tables 1 to 3 of the UK Addendum are completed by sections 1, 2 and 6 and Annex 2; for Table 4, either party may end the UK Addendum as set out in section 19 of it.

Singapore data

For Customer Personal Data subject to the PDPA, Funnelish ensures that overseas recipients are legally bound to provide a standard of protection comparable to the PDPA, through this DPA, the SCCs or equivalent contractual terms.

Other jurisdictions

Where another law requires a specific transfer mechanism, the parties will cooperate to put it in place. Funnelish will provide a copy of the applicable safeguards on request. If a transfer mechanism is invalidated or a competent authority requires a change, the parties will cooperate in good faith to implement an alternative.

Where the CCPA/CPRA or another U.S. state privacy law applies to Customer Personal Data, Funnelish acts as a service provider, processor or contractor and: will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties, or combine it with personal data from other sources except as permitted by those laws; will comply with applicable obligations and provide the same level of privacy protection the law requires; will notify the Customer if it can no longer meet its obligations; and grants the Customer the right to take reasonable and appropriate steps to stop and remediate unauthorised use. Funnelish certifies that it understands these restrictions. The Customer may audit compliance as described in section 8.

Funnelish will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including summaries of any third-party security reports or certifications it holds, security questionnaires and responses to reasonable written enquiries. Where that information is not sufficient to meet a requirement of Data Protection Law, the Customer (or an independent auditor it appoints, bound by confidentiality and not a competitor of Funnelish) may conduct an audit of Funnelish’s relevant systems and records: no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach; on at least 30 days’ written notice; during normal business hours; without unreasonable disruption; at the Customer’s expense; and subject to Funnelish’s reasonable security requirements. Audits of sub-processors are conducted through the mechanisms those sub-processors make available.

During the term, the Customer can export Customer Personal Data through the Services. On termination or expiry of the Agreement, the Customer may export its data for 30 days. After that period Funnelish will delete Customer Personal Data from active systems within 90 days and from backups in the ordinary backup rotation (not more than 12 months), unless retention is required by law, in which case Funnelish will isolate and protect the data and process it only for that purpose. On written request Funnelish will confirm deletion.

Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations in the Agreement, except to the extent Data Protection Law or the SCCs do not permit limitation. In the event of conflict, the SCCs and UK Addendum prevail over this DPA, and this DPA prevails over the rest of the Agreement for matters relating to the processing of Customer Personal Data.

This DPA takes effect when the Customer accepts the Agreement and continues until Funnelish has deleted or returned all Customer Personal Data. Funnelish may update this DPA to reflect changes in Data Protection Law, regulatory guidance, transfer mechanisms or the Services; material changes are notified as the Agreement provides and do not reduce the protection of Customer Personal Data.