Data Processing Addendum

1. Definitions

• "Customer Personal Data" means personal data of people other than you and your personnel that is in Your Content and that we process on your behalf to provide the Services.
• "Data Protection Laws" means the laws on privacy and personal data that apply to the processing under this Addendum, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").
• "Controller," "Processor," "Data Subject," "Personal Data," "Processing," "Personal Data Breach," and "Supervisory Authority" have the meanings given in the GDPR.
• "Sub-processor" means a third party that we engage to process Customer Personal Data for the Services.
• "Standard Contractual Clauses" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
• Other capitalized terms, such as Services, User, Your Content, Outputs, Build, and Balance, have the meanings given in the Agreement.

2. Processing of Personal Data

2.1 Roles of the Parties

(a) We are your Processor for Customer Personal Data. You are its Controller, or a processor acting for another controller, in which case we are your sub-processor. This Addendum governs that processing.

(b) We are a Controller for information about you. Your account, contact, sign-in, billing, and usage information, and that of your personnel, is processed by us as a Controller under our Privacy Policy, not under this Addendum. So is the review of Your Content described in Section 2.4.

(c) Independent controllers. Polar Software, Inc., the merchant of record for the funds you add, and Stripe, Inc., which processes those payments, process your billing information as independent controllers under their own terms. They are not our Sub-processors and receive no Customer Personal Data.

2.2 Your Obligations

You are responsible for having a lawful basis for the Customer Personal Data you put in Your Content, for giving the people concerned any notice the law requires, and for having the right to upload it and to have the Services process it. Your instructions to us must comply with Data Protection Laws.

2.3 Our Processing on Your Instructions

We process Customer Personal Data only on your documented instructions, including with regard to transfers outside the EEA, the UK, and Switzerland, unless the law requires otherwise; in that case we will tell you before we process it, unless the law forbids that. Your instructions are the Agreement, this Addendum, what you ask for through the Services (each file you upload, each Build Request, and each request to the design generator), and any further written instruction we agree to. We will tell you if, in our opinion, an instruction infringes Data Protection Laws.

2.4 No Processing for Our Own Purposes

We do not sell Customer Personal Data, use it for advertising, or use it to develop, train, retrain, fine-tune, or evaluate any machine-learning model or AI system, also where you opted in to training under our Privacy Policy. Two things are not affected: (i) the review of Your Content described in Section 3.5 of our Privacy Policy, which we do as a Controller to enforce the Agreement, to prevent misuse, and to comply with the law; and (ii) statistics in aggregate that do not identify any person.

2.5 Details of the Processing

The subject matter, duration, nature, and purpose of the processing, the types of Customer Personal Data, and the categories of Data Subjects are set out in Annex 1.

3. Our Obligations

3.1 Confidentiality

We ensure that the people we authorize to process Customer Personal Data are bound by obligations of confidentiality.

3.2 Security

We implement and maintain the technical and organizational measures in Annex 3 to protect Customer Personal Data against a Personal Data Breach.

3.3 Sub-processors

You give us general written authorization to engage Sub-processors. Our current Sub-processors are listed in Annex 2.

We will tell you by email at least 30 days before we add or replace a Sub-processor, and update Annex 2. You may object on reasonable data-protection grounds within 15 days of our notice. We will then work with you in good faith to resolve the objection. If we cannot offer a commercially reasonable alternative within 30 days, you may close your Account, and the unused part of the funds you added is refunded to the payment method you used within 30 days of the closure. That is your remedy for an objection.

We engage each Sub-processor by a written contract that imposes on it the same data protection obligations as this Addendum imposes on us. We remain fully liable to you for the performance of each Sub-processor's obligations, as Article 28(4) GDPR requires.

3.4 Data Subject Requests

Taking into account the nature of the processing, we assist you, as far as we can, in responding to requests from Data Subjects exercising their rights under Data Protection Laws. If a Data Subject asks us directly, we will pass the request on to you where we can tell which User it concerns, and we will not answer it ourselves except to direct the person to you.

3.5 Personal Data Breach

We will notify you without undue delay, and no later than 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. We will give you the information you need to meet any obligation to report it to a Supervisory Authority or to the people concerned, as it becomes available, and take reasonable steps to contain it.

3.6 Deletion and Return

You can delete a file, a design, or a built garment at any time, and the Customer Personal Data in it is deleted with it. When the Agreement ends, we will, at your choice, return Customer Personal Data to you or delete it: ask for a copy at legal@beforewear.com before you close your Account. We delete it from our active systems within 30 days of the deletion or the closure, as our Privacy Policy describes. Copies may remain for a time in our backups and in stored earlier versions of files, which we keep only to recover from failures and do not process for anything else. This does not apply where the law requires us to keep the data.

3.7 Information and Audits

We make available the information necessary to demonstrate compliance with this Addendum: on written request, no more than once a year, we answer a reasonable security questionnaire and provide the certifications or audit reports of our Sub-processors that they make available (such as Amazon Web Services' SOC 2 and ISO 27001 reports). Where that information is not enough, we allow an audit by you or by an independent auditor bound by confidentiality, at your cost, on at least 30 days' notice, once in any 12 months, during business hours, and without access to other Users' data. These limits do not apply where a Supervisory Authority requires an audit or after a Personal Data Breach.

3.8 Impact Assessments

At your reasonable request, we assist you with data protection impact assessments and prior consultations with Supervisory Authorities, in each case only as they concern our processing of Customer Personal Data.

3.9 California and Other U.S. State Laws

Where the CCPA or a similar U.S. state law applies, we are your "service provider" or "processor" for Customer Personal Data. We do not sell or share it; we do not keep, use, or disclose it outside our direct business relationship with you or for any purpose other than the Services; and we do not combine it with personal data we receive from others, except as those laws allow. We comply with those laws and will tell you if we can no longer meet our obligations under them. You may take reasonable steps to stop and remedy any use of Customer Personal Data that those laws do not allow.

4. International Transfers

We process Customer Personal Data in the United States and in the countries where our Sub-processors are (Annex 2).

From the EEA. Where a transfer of Customer Personal Data from the EEA to us is not covered by an adequacy decision, the Standard Contractual Clauses are incorporated into this Addendum: Module Two (controller to processor) where you are a Controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer. Clause 7 (docking) applies. Under Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 3.3. The optional wording in Clause 11 does not apply. Under Clause 13, the competent Supervisory Authority is the one that Clause 13(a) designates. Under Clause 17, Option 1 applies, and the law is that of Ireland. Under Clause 18, the courts are those of Ireland. Annexes I and II of the Standard Contractual Clauses are completed by Annexes 1 and 3 of this Addendum, and the list of sub-processors is Annex 2.

From Switzerland. For transfers subject to the FADP, the Standard Contractual Clauses apply as above, with these changes: references to the GDPR are to the FADP, the competent Supervisory Authority is the Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland, so that Data Subjects in Switzerland can bring claims where they habitually reside.

From the UK. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated. Its Table 1 is completed with the parties in Annex 1, Table 2 with the modules and clauses chosen above, and Table 3 with Annexes 1 to 3. Under Table 4, neither party may end it as its Section 19 allows.

5. General Provisions

5.1 Term

This Addendum applies for as long as we process Customer Personal Data on your behalf.

5.2 Precedence

In a conflict about the processing of Customer Personal Data, the Standard Contractual Clauses (where they apply) prevail over this Addendum, and this Addendum prevails over the rest of the Agreement.

5.3 Governing Law

This Addendum is governed by the law that governs the Agreement (Section 10.1 of the Agreement), except the Standard Contractual Clauses, which are governed as Section 4 sets out, and except where Data Protection Laws require otherwise.

5.4 Liability

Each party's liability arising out of or related to this Addendum is subject to the limitation of liability in Section 7.5 of the Agreement, except where the Standard Contractual Clauses or Data Protection Laws do not allow it to be limited.

5.5 Changes

We may update this Addendum to reflect changes in law or in our Sub-processors (Section 3.3), with notice as Section 10.3 of the Agreement provides. A change will not lower the protection that this Addendum gives Customer Personal Data.

Annex 1: Details of the Processing

A. The Parties

Controller and data exporter: the User, contacted at the email address of its Account. Its activities are those for which it uses the Services.
Processor and data importer: Algorithmic Labs, LLC, 169 Madison Ave, STE 11762, New York, NY 10016 US, legal@beforewear.com. Its activities are providing the Services.

Each party accepts the Standard Contractual Clauses, where they apply, by entering into the Agreement.

B. Subject Matter and Duration

The processing of Customer Personal Data to provide the Services under the Agreement, for as long as the Agreement lasts and until the data is deleted or returned under Section 3.6.

C. Nature and Purpose of the Processing

• Storing the files you upload, your designs, and your Outputs, and showing them to you
• Reading your files to build a garment from them, putting your design on a garment, and making mockups and print files
• Sending your requests written in words, and the words and images you give the design generator, to the AI model providers that read them or that make or change the design, and removing the background of an image
• Finding out why a Build failed or was refused, and helping you when you ask for support
• Keeping the Services secure and working

D. Types of Personal Data

• Images of people, such as a model shown in a product photo or a person in artwork
• Names, logos, signatures, or other identifiers written in a file, a design, or a request
• Any other personal data that you put in Your Content

We do not ask for special categories of personal data. A photograph of a person may reveal some incidentally, and the measures in Annex 3 apply to it as to all Customer Personal Data.

E. Categories of Data Subjects

People shown or named in the files, designs, or requests that a User gives the Services.

F. Frequency of Transfer and Retention

Continuous, as you use the Services. Customer Personal Data is kept with the file that contains it and deleted as Section 3.6 describes.

G. Competent Supervisory Authority

The one designated under Clause 13 of the Standard Contractual Clauses (Section 4).

Annex 2: Sub-processors and Independent Controllers

These Sub-processors may process Customer Personal Data:

• Amazon Web Services, Inc. (USA): hosting, the storage of files and Outputs, databases, the computers with GPUs that Builds are done on, and the emails we send
• Google LLC (USA): AI models that read requests written in words, and that make or change designs from the words and images given to the design generator; the mailboxes that receive your emails to us
• OpenAI, Inc. (USA), Anthropic, PBC (USA), OpenRouter, Inc. (USA), and Features & Labels, Inc. ("fal") (USA): AI models that read requests written in words, and that make or change designs from the words and images given to the design generator
• PhotoRoom SAS (France): background removal in the design generator

These parties are not Sub-processors and receive no Customer Personal Data:

• Polar Software, Inc. (USA) and Stripe, Inc. (USA): the merchant of record for the funds you add, and its payment processor, acting as independent controllers under their own terms
• Google LLC (Google Analytics) (USA), PostHog, Inc. (USA), and Cloudflare, Inc. (USA): website and product analytics, and the check on the sign-in page; they do not receive the contents of the files you upload

Annex 3: Security Measures

• Encryption in transit: Connections to the Services, from browsers and from the Developer Tools, and our connections to Sub-processors use TLS.
• Encryption at rest: Files and Outputs are stored with server-side encryption, and our database is encrypted with keys managed in AWS Key Management Service.
• Access control: Access to production systems is limited to authorized personnel who need it, through individual accounts. Your Content is not made available to other Users (Section 5.2 of the Agreement).
• Minimization: The Services ask for no personal data in files. AI model providers receive only what the request needs. In the record of calls made through the Developer Tools, fields such as email addresses, phone numbers, tokens, and keys are hidden, and long text is cut.
• Logging: Our servers' logs of the requests made to them are kept for 30 days and used to keep the Services secure and working.
• Backups and recovery: The database is backed up automatically and protected against deletion, and earlier versions of stored files are kept, so that the Services can recover from a failure.
• Incident response: We monitor the Services for security incidents and respond to a Personal Data Breach as Section 3.5 sets out.
• Sub-processors: We choose Sub-processors for the security they provide and bind them by written contract (Section 3.3).
• Personnel: Everyone who can access Customer Personal Data is bound by confidentiality.