Data Processing Agreement

Preamble

This Data Processing Agreement ("DPA") forms part of the agreement between the customer identified in the applicable Order Form or account registration ("Customer") and Tapp.so Ltd, Unit 4.07 The Tea Building, 56 Shoreditch High Street, London, United Kingdom, E1 6JJ ("Tapp.so"), consisting of Tapp.so's General Terms and Conditions and any Order Form (the "Agreement"). This DPA reflects the Parties' agreement with regard to the Processing of Personal Data by Tapp.so on behalf of Customer in connection with the Services and is entered into pursuant to Article 28(3) of the UK GDPR and, where applicable, the EU GDPR. It applies automatically upon Customer's acceptance of the Agreement; the Parties may additionally execute it using the signature block at the end.

1. Definitions

1.1. "Data Protection Laws" means all laws applicable to the Processing of Personal Data under the Agreement, including the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), and the UK Privacy and Electronic Communications Regulations and EU ePrivacy Directive, each as amended or replaced.

1.2. "Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" shall have the meanings ascribed to them in the UK GDPR / EU GDPR.

1.3. "Customer Personal Data" means Personal Data contained in Customer Data (as defined in the Agreement) that Tapp.so Processes on behalf of Customer in providing the Services, as described in Annex 1.

1.4. "Restricted Data" has the meaning given in Section 8 of the General Terms and Conditions.

1.5. "Sub-processor" means a third party engaged by Tapp.so to Process Customer Personal Data on Customer's behalf.

2. Roles and Scope

2.1. As between the Parties, Customer is the Controller and Tapp.so is the Processor of Customer Personal Data. Annex 1 sets out the subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects.

2.2. Where Customer itself acts as a processor for a third-party controller, Customer warrants that its instructions to Tapp.so, including the appointment of Tapp.so as another processor, have been authorised by the relevant controller, and references in this DPA to "Controller" shall be construed accordingly. Tapp.so's obligations under this DPA are owed solely to Customer.

2.3. Each Party shall comply with its respective obligations under Data Protection Laws. Customer warrants that it has, and will maintain, a lawful basis for the Processing of Customer Personal Data (including, where required, valid End User consents under Section 7.4 of the General Terms and Conditions) and that it has provided all legally required notices to Data Subjects.

3. Instructions

3.1. Tapp.so shall Process Customer Personal Data only on documented instructions from Customer, including with regard to transfers to a third country, unless required to do otherwise by applicable law; in such a case, Tapp.so shall inform Customer of that legal requirement before Processing, unless the law prohibits this on important grounds of public interest.

3.2. Customer's complete documented instructions consist of: (a) the Agreement and this DPA (including Annex 1); (b) Customer's configuration of the Services, the SDK and the Dashboard; and (c) any further written instructions agreed by the Parties. Tapp.so shall inform Customer if, in its opinion, an instruction infringes Data Protection Laws; Tapp.so may suspend performance of such instruction until it is confirmed or modified.

3.3. Restricted Data is outside the scope of Customer's instructions. Customer instructs Tapp.so to Process only the categories of Personal Data described in Annex 1 and shall not transmit Restricted Data to the Services (Section 8 of the General Terms and Conditions). Tapp.so has no obligation to monitor Customer Data for Restricted Data. If Tapp.so becomes aware that Restricted Data has been transmitted to the Services, it will notify Customer and delete such data in accordance with Section 8.4 of the General Terms and Conditions, and the remaining provisions of this DPA (other than its security obligations under Clause 5) shall not apply to such data to the maximum extent permitted by law.

4. Confidentiality

4.1. Tapp.so shall ensure that persons authorised to Process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and Process the data only as needed to perform the Services.

5. Security

5.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk to Data Subjects, Tapp.so shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate the measures referred to in Article 32(1) UK GDPR / EU GDPR. Tapp.so's current measures are described in Annex 2. Tapp.so may update these measures from time to time, provided the updates do not materially reduce the overall level of protection.

6. Sub-processors

6.1. Customer grants Tapp.so general written authorisation to engage Sub-processors for the Processing of Customer Personal Data. The Sub-processors engaged at the date of this DPA are listed in Annex 3 and at [https://tapp.so/legal/subprocessors — TAPP TO CONFIRM URL], and are hereby approved.

6.2. Tapp.so shall inform Customer at least thirty (30) days in advance of any intended addition or replacement of a Sub-processor (by email to the account contact or via the page referenced above, to which Customer may subscribe), thereby giving Customer the opportunity to object on reasonable data protection grounds. If Customer objects, the Parties shall discuss in good faith a resolution; if no resolution is found within thirty (30) days, Customer may terminate the affected Services upon written notice and Tapp.so shall refund prepaid fees for the unused remainder of the Term of the affected Services on a pro-rata basis. This is Customer's sole remedy for an objection.

6.3. Tapp.so shall impose on each Sub-processor, by way of contract, data protection obligations that are in substance no less protective than those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Tapp.so remains fully liable to Customer for the performance of each Sub-processor's obligations.

7. Data Subject Rights

7.1. Taking into account the nature of the Processing, Tapp.so shall assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests for exercising Data Subjects' rights under Chapter III of the UK GDPR / EU GDPR (including access, rectification, erasure, restriction, portability and objection).

7.2. If Tapp.so receives a request from a Data Subject relating to Customer Personal Data, it shall promptly forward the request to Customer and shall not respond to it except to direct the Data Subject to the Customer, unless required by law.

7.3. Customer acknowledges that, because Customer Personal Data is pseudonymous, Tapp.so may not be in a position to identify the Data Subject (Article 11 UK GDPR / EU GDPR). In such cases Tapp.so shall inform Customer accordingly, and its assistance obligations apply only to the extent identification is possible with reasonable means (e.g., where Customer provides the relevant pseudonymous identifier).

8. Personal Data Breach

8.1. Tapp.so shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall, to the extent then available (and may be provided in phases), describe the nature of the breach, the categories and approximate numbers of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

8.2. Tapp.so shall provide reasonable assistance to Customer in complying with Customer's obligations under Articles 33 and 34 UK GDPR / EU GDPR, taking into account the nature of the Processing and the information available to Tapp.so. Tapp.so's notification of, or response to, a Personal Data Breach shall not be construed as an acknowledgement of fault or liability.

9. Data Protection Impact Assessments

9.1. Taking into account the nature of the Processing and the information available to it, Tapp.so shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities that Customer is required to carry out under Articles 35 and 36 UK GDPR / EU GDPR, in each case solely in relation to the Processing of Customer Personal Data by Tapp.so.

10. Deletion and Return

10.1. During the Term, Customer may access and export Customer Personal Data through the Services as described in the Documentation.

10.2. Upon termination or expiry of the Agreement, at the choice of Customer, Tapp.so shall return (by making available for export for thirty (30) days) and/or delete all Customer Personal Data, and shall delete existing copies within ninety (90) days of the effective date of termination, unless applicable law requires storage of the Personal Data, in which case Tapp.so shall protect it in accordance with this DPA and Process it only as required by such law. Customer Personal Data in routine backups shall be deleted in accordance with Tapp.so's backup rotation cycle, not exceeding [TAPP TO CONFIRM, e.g., 180] days, and shall not be restored to production except as needed for disaster recovery. On request, Tapp.so shall confirm deletion in writing.

11. Information and Audit

11.1. Tapp.so shall make available to Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 UK GDPR / EU GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer.

11.2. Tapp.so may first satisfy an audit request by providing up-to-date documentation, summaries of penetration tests, and third-party certifications or audit reports, where available [TAPP TO CONFIRM any certifications, e.g., ISO 27001 / SOC 2]. Where an on-site or remote inspection remains reasonably required, it shall (except where a Supervisory Authority requires otherwise or following a Personal Data Breach): take place no more than once per twelve (12) months, upon at least thirty (30) days' prior written notice, during normal business hours, without unreasonable disruption to Tapp.so's operations, subject to confidentiality undertakings, and shall not extend to data or systems of other customers. Each Party bears its own costs of an audit.

12. International Transfers

12.1. Tapp.so shall not transfer Customer Personal Data to a country outside the United Kingdom or the European Economic Area unless the transfer is (a) to a country benefiting from an applicable adequacy decision or adequacy regulations, or (b) subject to appropriate safeguards in accordance with Data Protection Laws, such as the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and/or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

12.2. Where such safeguards are required for a transfer between Customer and Tapp.so, the relevant clauses are deemed incorporated into this DPA with the Parties' details and the processing description in Annex 1, Tapp.so acting as data importer and Customer as data exporter; the Parties shall execute further documents where required for validity. Where Tapp.so engages Sub-processors outside the UK/EEA, Tapp.so shall ensure appropriate safeguards are in place for the onward transfer.

12.3. Current hosting location of Customer Personal Data: [TAPP TO CONFIRM, e.g., EU (Ireland) / UK, with (cloud provider)].

13. Liability, Precedence, Term

13.1. Each Party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement, to the maximum extent permitted by applicable law. Nothing in this Clause affects a Data Subject's rights under Data Protection Laws.

13.2. This DPA prevails over the Agreement in the event of a conflict with respect to the Processing of Personal Data. This DPA is governed by the laws of England and Wales; mandatory rights and obligations under Data Protection Laws of another jurisdiction applicable to a Party remain unaffected.

13.3. This DPA takes effect on the effective date of the Agreement and remains in force for as long as Tapp.so Processes Customer Personal Data.

Annex 1 — Details of the Processing

A. Subject matter: the provision of deep linking, attribution, referral and affiliate campaign management, analytics and Partner Payout facilitation services for Customer Apps, as described in the Agreement.

B. Duration: the Term of the Agreement, plus the deletion periods set out in Clause 10.

C. Nature and purpose of the Processing: collection via the SDK, APIs and Tapp links; hosting and storage; matching of link interactions to app installations and in-app events (including deferred deep linking using device-derived technical characteristics); attribution of installs and events to campaigns, links and Partners; calculation of programme rewards; fraud detection and prevention; generation of aggregated analytics and reports for Customer; facilitation of Partner Payouts; and related technical support — in each case solely to provide the Services to Customer.

D. Categories of Data Subjects:

• 1. End Users of Customer Apps who interact with Tapp links or with Customer Apps integrating the Tapp Technology.
• 2. Partners (creators, affiliates, influencers or End Users) participating in Customer's programmes, including recipients of Partner Payouts.

E. Types of Personal Data:

End Users:

• 1. Pseudonymous identifiers: a Tapp-generated device/installation identifier; pseudonymous user-level identifiers supplied by Customer (which must not directly identify a natural person).
• 2. Device and app information: device model identifier, platform and operating system version, screen resolution, language, region and locale settings, calendar, numbering and date-format settings, time zone, user agent, app bundle identifier, SDK version.
• 3. Network data: IP address (processed transiently for routing, attribution and fraud prevention).
• 4. Link and attribution data: link and campaign tokens/identifiers, deep link URLs and parameters, impressions and taps, referral relationships, timestamps of link interactions, installation and first app opening.
• 5. Event data as configured by Customer: event names, event URLs and event metadata (e.g., occurrence of a purchase or registration and associated non-identifying values), and information regarding which advertisements or links an End User has seen or clicked.
• 6. Where Customer enables a Mobile Measurement Partner integration (e.g., AppsFlyer, Adjust): attribution data exchanged with that partner as configured by Customer, which may include mobile advertising identifiers processed under Customer's and that partner's own terms and consent mechanisms.

Partners (where Customer enables payouts):

• 7. Partner programme data: Partner identifier, campaign/link assignment, referral performance, payout amounts and payout status. Identity, contact, tax and payment account details of Partners required for disbursement are collected and processed by Tapp.so's designated payment provider [TAPP TO CONFIRM provider and data split].

F. Special categories of Personal Data: none. The transmission of special categories of Personal Data, criminal offence data and other Restricted Data to the Services is prohibited under Section 8 of the General Terms and Conditions and is outside the scope of Customer's instructions.

G. Frequency of the Processing: continuous, for the duration of the Agreement.

Annex 2 — Technical and Organisational Measures (Art. 32 UK GDPR / EU GDPR)

Tapp.so implements and maintains, as appropriate, the following measures [TAPP TO CONFIRM each item against current practice]:

• 1. Encryption and pseudonymisation: encryption of data in transit (TLS 1.2 or higher for SDK, API and Dashboard traffic); encryption of data at rest; the Services are designed to operate on pseudonymous identifiers rather than directly identifying data (data minimisation by design).
• 2. Access control: role-based access on a need-to-know basis; unique accounts; multi-factor authentication and SSO for personnel access to production systems; prompt revocation of access on role change or departure; logical separation of customer data by account.
• 3. System security: hardening and patch management of production systems; vulnerability management; network segregation and firewalls; secrets management; protection against common web application attacks.
• 4. Logging and monitoring: logging of access to production systems and security-relevant events; monitoring and alerting for anomalous activity.
• 5. Availability and resilience: hosting with a reputable cloud infrastructure provider [TAPP TO CONFIRM provider/region]; redundancy; regular backups with defined rotation; disaster recovery procedures that are periodically tested.
• 6. Incident management: documented incident response procedures, including assessment, containment, remediation and the notification obligations in Clause 8.
• 7. Personnel: confidentiality undertakings; regular data protection and security awareness training; background screening where permitted by law.
• 8. Vendor management: due diligence on Sub-processors, contractual flow-down of data protection obligations (Clause 6) and periodic review.
• 9. Development practices: code review, separation of development/test and production environments, and no use of production Personal Data in development or testing except where protected by equivalent measures.
• 10. Data lifecycle: defined retention and deletion procedures, including end-of-contract deletion in accordance with Clause 10.

Annex 3 — Approved Sub-processors