Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Pancake Laboratories Inc., DBA ShortStack.com ("ShortStack") Terms and Conditions of Service and Use of ShortStack.com, the ShortStack Privacy Policy, and any other written or electronic agreement by and between ShortStack and its affiliates (collectively, "Pancake Laboratories, Inc." referred to herein as "Pancake") and the undersigned customer of ShortStack ("Customer") for the purchase of online services ("Services") from Pancake (the "Agreement") to reflect the parties' agreement with regard to the Processing of Personal Data.

In the course of providing the Services to Customer pursuant to the Agreement, Pancake may Process Personal Data on behalf of Customer. Both Pancake and Customer agree to comply with the following provisions with respect to any Personal Data submitted by or for Customer to Pancake or collected and processed by or for Customer using Pancake Services. In connection with the Services, the parties anticipate that Pancake may Process outside of the European Economic Area ("EEA"), Switzerland, the United Kingdom, and other jurisdictions, Personal Data in respect of which the Customer or any member of the Customer Group may be a data controller under applicable Data Protection Laws.

In this DPA, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:

2.1. Roles of the Parties

The parties acknowledge and agree that with regard to the Processing of Personal Data when using the Services provided by Pancake, Customer is the Controller, Pancake is the Processor, and that Pancake will engage Subprocessors pursuant to the requirements set forth in Section 5 "Subprocessors" below.

2.2. Customer's Processing of Personal Data

Customer shall, in its use of the Services, Process Personal Data in accordance with the requirements of Applicable Data Protection Laws. For the avoidance of doubt, Customer's instructions for the Processing of Personal Data shall comply with Applicable Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data.

2.3. Pancake's Processing of Personal Data

Pancake shall treat Personal Data as Confidential Information and shall Process Personal Data in a manner compliant with Applicable Data Protection Laws. Pancake will only Process Personal Data to the extent necessary to perform the Services in accordance with the Agreement and in accordance with Customer's documented instructions, unless Processing is required by applicable law to which Pancake is subject, in which case Pancake shall (to the extent permitted by law) inform Customer of that legal requirement before the relevant Processing. Pancake shall immediately inform Customer if, in Pancake's opinion, an instruction from Customer infringes Applicable Data Protection Laws.

2.4. Prohibited Data

Customer will not provide (or cause to be provided) any Sensitive Data to Pancake for Processing under the Agreement, and Pancake will have no liability whatsoever for Sensitive Data, whether in connection with a Customer Data Incident or otherwise.

2.5. Details of the Processing

The subject-matter of Processing of Personal Data by Pancake is the performance of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data, and categories of Data Subjects Processed under this DPA are further specified in Annex I.B (Description of Transfer) to this DPA.

2.6. Restrictions on Use of Personal Data

Pancake shall not:

• (a) Sell or Share Customer Personal Data;
• (b) retain, use, disclose, or otherwise Process Customer Personal Data for any purpose other than for the specific business purposes of performing the Services under the Agreement;
• (c) retain, use, disclose, or otherwise Process Customer Personal Data outside of the direct business relationship between Pancake and Customer, except as permitted under Section 13 (Assignment); or
• (d) combine Customer Personal Data with personal data that Pancake receives from or on behalf of another person or that Pancake collects from its own interactions with individuals, except to the extent necessary to perform the Services.

2.7. Certification

Pancake certifies that it understands and will comply with the restrictions set forth in Section 2.6 and will notify Customer if it determines that it can no longer meet its obligations under this Section.

3.1. Data Subject Request

Pancake shall promptly notify Customer if Pancake receives a request from a Data Subject to exercise their rights under Applicable Data Protection Laws with respect to Personal Data (including access, rectification, restriction, deletion, portability, or the right to correct, as applicable). Taking into account the nature of the request, Pancake shall assist Customer by appropriate technical and organizational measures, to the extent legally required, for the fulfillment of Customer's obligation to respond to a Data Subject Request under Applicable Data Protection Laws.

4.1. Confidentiality

Pancake shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data and Service Data and have received appropriate training on their responsibilities.

4.2. Reliability

Pancake shall take commercially reasonable steps to ensure the reliability of any Pancake personnel who may have access to Customer Personal Data or who may be engaged in the Processing of Personal Data.

4.3. Limitation of Access

Pancake shall ensure that Pancake's access to Personal Data is limited to those Pancake personnel who need to know or access the relevant Personal Data while performing Services in accordance with the Agreement.

4.4. Data Protection Officer

Pancake has appointed a data protection officer, who can be reached at support@shortstack.com.

5.1. Appointment of Subprocessors

Customer acknowledges and agrees that Pancake may engage third-party Subprocessors in connection with the provision of the Services. Pancake has entered into a written agreement with each Subprocessor imposing on the Subprocessor data protection obligations no less protective than those set forth in this DPA.

5.2. List of Current Subprocessors

Pancake maintains a current list of Subprocessors at /subprocessors/ (or such other URL as Pancake may designate). Pancake will notify all customers of any change to the Subprocessor list, including the addition or replacement of a Subprocessor, in-app and by email before authorizing the new Subprocessor to Process Personal Data.

5.3. Notification of New Subprocessors

Pancake shall provide notification of a new Subprocessor(s) before authorizing any new Subprocessor(s) to Process Personal Data in connection with the provision of the applicable Services. Notification will be supplied via the mechanism described in Section 5.2.

5.4. Objection Right for New Subprocessors

5.5. Resolution of Objections

In the event Customer objects to a new Subprocessor pursuant to Section 5.4, Pancake and Customer shall work together in good faith to find a mutually acceptable resolution. If the parties are unable to resolve such objection, either party may terminate the applicable Service by providing written notice to the other party. Any refund or credit of prepaid fees following such termination shall be determined by Pancake in its sole discretion, acting reasonably and in good faith, consistent with the Payment and Refunds section of the Terms and Conditions.

5.6. Liability

Where a Subprocessor fails to fulfill its data protection obligations under its agreement with Pancake, Pancake will remain liable to the Customer for the performance of such Subprocessor's data protection obligations.

As between Customer and Pancake, Customer retains all right, title, and interest in and to the Personal Data collected through use of the Services. For the avoidance of doubt, to the extent that the Agreement grants Pancake any license to use information submitted to ShortStack for the purpose of improving or modifying ShortStack, such license shall not apply to Personal Data, which is governed exclusively by this DPA.

7.1. Controls for the Protection of Customer Data

Pancake will implement and maintain technical, physical, administrative, and organizational measures to protect Personal Data against theft, unauthorized or unlawful acquisition, access, or Processing, accidental loss, destruction, alteration, or damage as described in Annex II (Technical and Organisational Measures) of this DPA, as well as any other minimum security requirements required by Applicable Data Protection Laws. Pancake will not materially decrease the overall security of the Services during a subscription term.

7.2. Security Documentation

Upon Customer's written request at reasonable intervals (not more than once per twelve-month period), Pancake shall make available to Customer that is not a competitor of Pancake (or Customer's independent, third-party auditor that is not a competitor of Pancake) documentation reasonably necessary to demonstrate Pancake's compliance with its obligations under this DPA, including Pancake's then-current security practices and procedures, subject to reasonable confidentiality obligations.

7.3. Audit Rights

Pancake shall allow for and contribute to audits and inspections conducted by Customer or an independent auditor mandated by Customer, for the purpose of demonstrating Pancake's compliance with its obligations under this DPA and Applicable Data Protection Laws. Such audits shall be subject to the following conditions:

• (a) Customer shall provide at least thirty (30) days' prior written notice;
• (b) audits shall be conducted during normal business hours and shall not unreasonably disrupt Pancake's operations;
• (c) audits shall not be conducted more than once per twelve-month period, unless required by a supervisory authority or following a Customer Data Incident;
• (d) any third-party auditor shall not be a competitor of Pancake and shall be bound by appropriate confidentiality obligations; and
• (e) Customer shall bear its own costs associated with any such audit.

7.4. Customer Responsibilities

Customer agrees that except as provided by this DPA, Customer is responsible for its secure use of the Services, including securing its account authentication credentials.

8.1. Notification

After becoming aware of a Customer Data Incident, Pancake shall notify Customer without undue delay, and in any event within forty-eight (48) hours. Pancake shall make reasonable efforts to identify the cause of such Customer Data Incident and take those steps as Pancake deems necessary and reasonable in order to remediate the cause of such Customer Data Incident to the extent the remediation is within Pancake's reasonable control. Pancake shall take reasonable measures to mitigate the effects and to minimize any damage resulting from the Customer Data Incident. The obligations herein shall not apply to incidents that are caused by Customer or Customer's users.

8.2. Content of Notification

Pancake's notice shall include the following information to the extent it is reasonably available to Pancake at the time of the notice, and Pancake shall update its notice as additional information becomes reasonably available:

• (a) the dates and times of the Customer Data Incident;
• (b) the facts that underlie the discovery of the Customer Data Incident;
• (c) a description of the Personal Data involved in the Customer Data Incident; and
• (d) the measures planned or underway to remedy or mitigate the vulnerability giving rise to the Customer Data Incident.

8.3. Cooperation

Pancake shall cooperate with Customer and take commercially reasonable steps to assist Customer in complying with its obligations under Articles 33 and 34 of the GDPR (or equivalent provisions under other Applicable Data Protection Laws), including any obligation to notify a supervisory authority or communicate a breach to affected Data Subjects, taking into account the nature of the Processing and the information available to Pancake.

Pancake shall provide reasonable assistance to Customer with any data protection impact assessments, and prior consultations with supervisory authorities or other competent data privacy authorities, which Customer reasonably considers to be required by Applicable Data Protection Laws, in each case solely in relation to Processing of Personal Data by, and taking into account the nature of the Processing and information available to, Pancake.

10.1. Duration of Processing

Pancake will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

10.2. Termination

Following termination or expiration of the Agreement ("Termination of Service"), Pancake shall, within thirty (30) days, delete Customer Personal Data. Pancake may retain Personal Data to the extent and for such period required by Applicable Data Protection Laws.

10.3. Customer Request

Subject to Section 10.4, Customer may by written notice (via email) to Pancake at support@shortstack.com within seven (7) days of the Termination of Service require Pancake to (a) return a complete copy of all Customer Personal Data to Customer in a commonly used machine-readable format; and (b) delete and procure the deletion of all other copies of Customer Personal Data Processed by Pancake and any Subprocessor.

10.4. Legal Retention

Pancake and Subprocessors employed by Pancake may retain Customer Personal Data to the extent required by Applicable Data Protection Laws and only to the extent and for such period as required by such laws, provided that Pancake shall ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose. Upon expiration of any applicable legal retention period, Pancake shall delete or destroy all remaining Customer Personal Data within thirty (30) days.

11.1. Data Center Locations

Customer acknowledges that Pancake may transfer and Process Customer Data to and in the United States and anywhere else in the world where Pancake or its Subprocessors maintain data processing operations. Pancake shall at all times ensure that such transfers are made in compliance with the requirements of Applicable Data Protection Laws and this DPA.

11.2. Transfers Outside of Europe

In connection with the Services, the parties anticipate that Pancake will transfer outside of the European Economic Area ("EEA"), Switzerland, and the United Kingdom to Pancake's Services environment located in the United States, and Process Personal Data in respect of which the Customer or any member of the Customer Group may be a data controller under Applicable Data Protection Laws.

11.3. Transfer Mechanisms

With respect to transfers of Personal Data under this DPA from the EEA, Switzerland, and/or the United Kingdom to countries which do not ensure an adequate level of data protection within the meaning of Applicable Data Protection Laws, Pancake makes available the following transfer mechanisms:

11.3.1. EU SCCs

The EU SCCs set forth in Schedule 1 to this DPA shall apply to transfers subject to the GDPR.

11.3.2. Swiss Transfers

The EU SCCs set forth in Schedule 1 to this DPA shall apply to transfers subject to the nFADP, with the modifications required to comply with the nFADP, including that the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner, and disputes shall be resolved before the courts of Switzerland.

11.3.3. UK Transfers

The UK Addendum, completed with the relevant information set out in the Annexes to this DPA, shall apply to transfers subject to the UK GDPR. The UK Addendum shall be governed by the laws of England and Wales, and disputes shall be resolved before the courts of England and Wales.

11.3.4. EU-U.S. Data Privacy Framework

Pancake has certified its adherence to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Pancake will maintain its DPF certification for the term of the Agreement and will provide at least the level of privacy protection required by the DPF Principles. Details of Pancake's certification are available at https://www.dataprivacyframework.gov/.

11.3.5. Order of Precedence

In the event that Services are covered by more than one transfer mechanism, the transfer of Personal Data will be subject to a single transfer mechanism in accordance with the following order of precedence: (a) the Standard Contractual Clauses (including the UK Addendum, as applicable); and (b) Pancake's EU-U.S. Data Privacy Framework certification.

12.1. Limitation of Liability

Any claims brought in connection with this DPA (including, where applicable, the SCCs) shall be subject to the Terms and Conditions, including but not limited to the exclusions and limitations set forth in the Agreement. In no event shall any party limit its liability with respect to any Data Subject rights under this DPA.

12.2. EU GDPR

Pancake will Process Personal Data in accordance with the GDPR requirements directly applicable to Pancake's provision of its Services.

12.3. Legal Effect

This DPA becomes legally binding upon Customer's execution of the Agreement or, where applicable, upon Customer's use of the Services following the effective date of this DPA.

12.4. Modification of DPA

This DPA may not be amended or modified except through a written agreement signed by both Parties hereto, or through Pancake's publication of an updated DPA to which Customer assents by continued use of the Services.

12.5. Duration

The DPA will remain in force as long as Pancake Processes Personal Data on behalf of Customer under the Agreement.

12.6. Entire DPA

This DPA, together with its Schedules and Annexes, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous data processing agreements or addenda between the Parties.

13.1. Assignment to a Successor

Pancake may assign this DPA and the Agreement, in whole, to a successor in interest in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets or equity, provided that the successor assumes in writing all of Pancake’s obligations under this DPA. Customer Personal Data may be transferred to such successor as part of that transaction so that Customer may continue to use the Services without interruption.

For the avoidance of doubt, a transfer permitted under this Section 13.1 does not constitute retaining, using, disclosing, or otherwise Processing Customer Personal Data outside of the direct business relationship between Pancake and Customer for the purposes of Section 2.6(c), because the direct business relationship transfers to the successor rather than terminating.

13.2. Data Privacy Framework Data

Where Customer Personal Data was received in reliance on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework, the successor must continue to apply the Data Privacy Framework Principles to that Personal Data or provide a level of protection at least equivalent to that required by the Principles. Where the successor will not agree to do so, that Personal Data will not be transferred to it.

13.3. Notice

Pancake shall notify Customer of any assignment under this Section 13 without undue delay. Customer may not assign this DPA or the Agreement without Pancake’s prior written consent, except to a successor in interest in connection with a transaction of the kind described in Section 13.1.

• Schedule 1: Standard Contractual Clauses (EU SCCs, Module Two: Controller to Processor)
• UK Addendum: International Data Transfer Addendum to the EU SCCs
• Annex I.A: List of Parties
• Annex I.B: Description of Transfer
• Annex II: Technical and Organisational Measures
• Annex III: List of Subprocessors

A. List of Parties

Data Exporter

• Name: The Customer identified in the Agreement
• Address: As set forth in the Agreement
• Contact person: As set forth in the Agreement
• Activities: Use of the ShortStack platform and Services as described in the Agreement
• Role: Controller

Data Importer

• Name: Pancake Laboratories, Inc.
• Address: 518 Pyramid Way, Sparks, Nevada 89431, USA
• Contact: Data Protection Officer, support@shortstack.com
• Activities: Data importer operates a cloud-based marketing services platform, including online forms, contests, and interactive marketing features. The data importer will host and Process Personal Data in the course of providing its cloud-based Services to data exporter pursuant to the Agreement.
• Role: Processor

B. Description of Transfer

Categories of Data Subjects

Data exporter may submit Personal Data to the Pancake Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to, Personal Data relating to the following categories of data subjects: data exporter's contacts and other end users, including data exporter's collaborators, customers, prospects, employees, agents, advisors, freelancers, and suppliers (who are natural persons); and entrants in and participants in contests, sweepstakes, giveaways, quizzes, polls, and other campaigns created by the data exporter using the Services.

Categories of Personal Data Transferred

The Personal Data transferred may include, but is not limited to: first and last name; professional information (title, position, employer); contact information (email, phone, physical address); form submission data; social media interaction data (imported comments, posts collected through ShortStack Feeds); campaign interaction data (campaign views, entry storage records); application integration data; system usage data; and other electronic data submitted to the Services by the data exporter.

Special Categories of Data

Data exporter may submit special categories of data to the Pancake Services, the extent of which is determined and controlled by the data exporter in its sole discretion. For the sake of clarity, this includes Personal Data with information possibly revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. Pursuant to Section 2.4 of the DPA, Customer shall not provide Sensitive Data to Pancake for Processing.

Frequency of Transfer

Continuous, for the duration of the Agreement.

Retention Period

For the duration of the Agreement, and thereafter in accordance with Section 10 of the DPA.

Nature of the Processing

The data importer will host and Process Personal Data in the course of providing its cloud-based Services to data exporter pursuant to the Agreement, including collection, storage, organization, structuring, retrieval, use, disclosure by transmission, and erasure or destruction.

Purpose of the Data Transfer

The purpose of the data transfer is the provision of the Services by Pancake to Customer, including the operation of interactive marketing campaigns, online forms, contests, data collection, social media integration, and related cloud-based marketing features.

Pancake observes the technical and organizational security measures described in its Comprehensive Security Documentation and at /security-faqs. Pancake reserves the right to modify or update these practices at its sole discretion provided that such modification and update does not result in a material degradation in the protection offered by these practices. These measures include, without limitation:

• Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest
• Access controls and authentication measures, including role-based access and multi-factor authentication for administrative access
• Regular automated vulnerability scanning and web application security scanning. Pancake is amenable to customer-initiated penetration testing upon reasonable prior written notice.
• Network security measures including firewalls and intrusion detection

• Employee security awareness training
• Physical security measures at data processing facilities
• Regular backups and disaster recovery procedures
• Logging and monitoring of access to Personal Data

A current list of Subprocessors is maintained at /subprocessors and is incorporated herein by reference. Pancake will notify all customers of any change to the Subprocessor list in-app and by email.

The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor), are incorporated herein by reference. The parties agree that:

For transfers subject to the UK GDPR, the UK Addendum (International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, in force 21 March 2022, as issued by the UK Information Commissioner under Section 119A of the UK Data Protection Act 2018) is incorporated herein by reference, completed with the information set out in the Annexes to this DPA. In the event of any conflict between the UK Addendum and the EU SCCs, the UK Addendum shall prevail to the extent of the conflict for transfers subject to the UK GDPR.

Related Documents:

• Privacy Policy
• Subprocessors List
• Security FAQs
• Terms and Conditions