Data Processing Agreement

Last updated: November 26, 2025

Between:

1. The Customer (as defined in the Principal Agreement), hereinafter referred to as the "Controller" or "Company"; and
2. StudioStacks B.V., a private company with limited liability incorporated under the laws of The Netherlands, having its registered office at Dr Huber Noodtstraat 84 E, 7001 DZ Doetinchem, registered with the Chamber of Commerce under number 70828474, hereinafter referred to as the "Processor";

(together the "Parties").

Whereas:

1. The Company acts as a Data Controller.
2. The Company wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor.
3. The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Applicability & Effective Date

This Data Processing Agreement (“DPA”) forms an integral part of the Terms of Service (“Principal Agreement”) between StudioStacks B.V. and the User (“Controller”).

By creating an account, upgrading to a paid plan, or using the Services, the User automatically accepts and agrees to be bound by the terms of this DPA. This DPA is effective as of the date of such action.

It is agreed as follows:

1. Definitions and Interpretation

1.1. Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:

• "Agreement" means this Data Processing Agreement and all Schedules;
• "Company Personal Data" means any Personal Data Processed by a Contracted Processor on behalf of Company pursuant to or in connection with the Principal Agreement;
• "Contracted Processor" means a Subprocessor;
• "Data Protection Laws" means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;
• "EEA" means the European Economic Area;
• "EU Data Protection Laws" means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR;
• "GDPR" means EU General Data Protection Regulation 2016/679;
• "Principal Agreement" means the Terms of Service or any other agreement governing the use of the Services between the Parties;
• "Services" means the software-as-a-service solutions provided by Processor, including but not limited to NowButtons, Call Now Button, NowChats (Live Chat), Meeting Scheduler, and related widgets;
• "Subprocessor" means any person appointed by or on behalf of Processor to process Personal Data on behalf of the Company in connection with the Agreement.

1.2. The terms, "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR.

2. Processing of Company Personal Data

2.1. Processor shall:

• 2.1.1. comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
• 2.1.2. not Process Company Personal Data other than on the relevant Company's documented instructions.

2.2. The Company instructs Processor to process Company Personal Data to provide the Services as described in the Principal Agreement and Annex 1.

3. Processor Personnel

Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor who may have access to the Company Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Company Personal Data, as strictly necessary for the purposes of the Principal Agreement, and ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

4. Security

4.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall in relation to the Company Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

4.2. Specific security measures implemented by the Processor are set forth in Annex 2.

5. Subprocessing

5.1. General Authorization. The Company agrees that the Processor may engage third-party Subprocessors to process the Personal Data on the Company's behalf. The Subprocessors currently engaged by the Processor and authorized by the Company are listed in Annex 3.

5.2. Changes. The Processor shall notify the Company if it adds or removes Subprocessors at least 14 days prior to any such change. The Company may object to such changes for valid data protection reasons. If the Parties cannot resolve the objection, the Company may terminate the Agreement.

5.3. Liability. Where the Processor engages a Subprocessor, it shall do so by way of a written contract which imposes on the Subprocessor, in substance, the same data protection obligations as strictly required by this Agreement. The Processor remains liable to the Company for the performance of the Subprocessor's obligations.

6. Data Subject Rights

6.1. Taking into account the nature of the Processing, Processor shall assist the Company by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company obligations, as reasonably understood by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.

6.2. Processor shall:

• 6.2.1. promptly notify Company if it receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data; and
• 6.2.2. ensure that it does not respond to that request except on the documented instructions of Company or as required by Applicable Laws.

7. Personal Data Breach

7.1. Processor shall notify Company without undue delay upon Processor becoming aware of a Personal Data Breach affecting Company Personal Data, providing Company with sufficient information to allow the Company to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

7.2. Processor shall co-operate with the Company and take reasonable commercial steps as are directed by Company to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

8. Data Protection Impact Assessment

Processor shall provide reasonable assistance to the Company with any data protection impact assessments, and prior consultations with Supervising Authorities, which Company reasonably considers to be required by article 35 or 36 of the GDPR.

9. Deletion or return of Company Personal Data

9.1. Subject to this section 9 Processor shall promptly and in any event within 30 days of the date of cessation of any Services involving the Processing of Company Personal Data (the "Cessation Date"), delete and procure the deletion of all copies of those Company Personal Data, unless applicable law requires storage of the Personal Data.

10. Audit rights

10.1. Subject to this section 10, Processor shall make available to the Company on request all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by the Company or an auditor mandated by the Company.

10.2. Audit Limitations. Any audit or inspection shall: (i) be conducted during regular business hours; (ii) be subject to a minimum of 30 days prior written notice; (iii) occur no more than once every 12 months (unless there is a confirmed Data Breach); and (iv) be at the Company's sole expense. The Processor may object to an auditor if the auditor is a competitor of the Processor.

11. International Data Transfers

11.1. The Processor may transfer Data to countries outside the EEA, provided that such transfers comply with the requirements of Chapter V of the GDPR.

11.2. If Personal Data is transferred to a country that has not been recognized by the European Commission as providing an adequate level of data protection (such as the United States), the Parties agree to abide by the Standard Contractual Clauses (SCCs) for the transfer of personal data to processors established in third countries, as approved by the European Commission.

12. General Terms

12.1. Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement ("Confidential Information") confidential.

12.2. Governing Law. This Agreement shall be governed by Dutch law. Disputes shall be subject to the exclusive jurisdiction of Amsterdam, The Netherlands.

---

ANNEX 1: DETAILS OF PROCESSING

1. Nature and Purpose of Processing The Processor provides software widgets (SaaS) to the Company, including live chat, floating action buttons, and meeting scheduling tools. Processing is performed to facilitate communication between the Company and its website visitors and to schedule appointments.

2. Categories of Data Subjects

• Visitors of the Company's website(s).
• Customers/Users of the Company (where applicable for account management).

3. Categories of Personal Data

• Contact Information: Name, email address, phone number (if provided via button interaction).
• Communication Data: Chat logs, messages sent via widgets.
• Technical Data: IP address (masked/processed for session purposes), browser metadata, timestamps, API logs.
• Scheduling Data: Calendar availability, appointment details, OAuth tokens for calendar integration.

---

ANNEX 2: SECURITY MEASURES

The Processor has implemented the following technical and organizational security measures:

1. Encryption: All data in transit is encrypted via SSL/TLS (HTTPS). Sensitive data at rest is stored in encrypted databases where applicable.
2. Access Control: Access to production databases is restricted to authorized personnel via secure authentication.
3. Authentication: Use of OAuth tokens for calendar integrations ensures no passwords for external accounts are stored.
4. Network Security: Utilization of Cloudflare CDN for DDoS protection and secure traffic routing.
5. Data Minimization: IP addresses for EU traffic are discarded after session initialization (Google Analytics) or strictly used for session linking (Chat).
6. Availability: Use of DigitalOcean and Sentry for high availability, error monitoring, and automated backups.
7. Physical Security: The Processor maintains local backups on a secured server located at its registered office. Physical access to this server is strictly limited to authorized management personnel.

---

ANNEX 3: LIST OF SUBPROCESSORS

The Company authorizes the use of the following Subprocessors:

Name	Function	Location
DigitalOcean	Hosting & Database	EU / USA
Ably	Real-time WebSocket Messaging (Chat)	EU / UK
Brevo	Transactional Emails & Marketing	EU / FR
Postmark	DMARC & Email Security	USA
Sentry	Error Tracking & Monitoring	USA
Grafana Labs	Logging & API Observability	USA
Slack	Internal Notifications & Alerts	USA
Google	Cloud Platform, Analytics, Calendar API, Workspace	USA
Cloudflare	Content Delivery Network (CDN) & Security	Global / USA
Tally	Support Forms	EU / BE