Filmadex Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Filmadex Terms of Service or another written agreement that incorporates this DPA (the "Agreement") between Okliko Inc., a Delaware corporation and the operator of Filmadex ("Okliko," "Processor," "Service Provider," "Contractor," "we," "us," or "our"), and the customer that accepts the Agreement ("Customer," "Controller," "Business," or "you").

This DPA applies only to the extent Okliko Processes Customer Personal Data on behalf of Customer in connection with the Filmadex Service. Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1. Definitions

"Applicable Data Protection Law" means privacy, data-protection, and data-security law applicable to the Processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR, UK GDPR, CCPA, and substantially similar U.S. state privacy laws.

"CCPA" means the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations.

"Customer Personal Data" means Personal Data Processed by Okliko on behalf of Customer under the Agreement. Customer Personal Data does not include Personal Data for which Okliko determines the purposes and means of Processing as an independent Controller.

"Data Subject," "Controller," "Processor," "Processing," and "Personal Data" have the meanings assigned by Applicable Data Protection Law.

"GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as incorporated into United Kingdom law.

"Personal Data Breach" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by Okliko.

"Subprocessor" means a third party engaged by Okliko to Process Customer Personal Data on behalf of Customer.

2. Scope and Roles

2.1 Customer is the Controller or Business and Okliko is the Processor, Service Provider, or Contractor with respect to Customer Personal Data. If Customer acts as a Processor for another Controller, Okliko acts as Customer's Subprocessor.

2.2 Okliko may act as an independent Controller for account administration, billing, support, security, fraud prevention, service analytics, legal compliance, and its own business operations, as described in the Filmadex Privacy Policy. This DPA does not govern that independent Controller Processing.

2.3 Customer is solely responsible for determining whether this DPA meets Customer's legal and contractual obligations and for identifying any additional requirements before submitting Customer Personal Data.

3. Customer Instructions and Responsibilities

3.1 Customer instructs Okliko to Process Customer Personal Data as necessary to provide, secure, support, maintain, troubleshoot, and improve the operation of the Service; comply with the Agreement; prevent abuse; and follow Customer's documented use of Service features.

3.2 Okliko will Process Customer Personal Data only on documented instructions from Customer, including with respect to transfers, unless Applicable Data Protection Law requires otherwise. Where legally permitted, Okliko will inform Customer of a conflicting legal requirement before Processing.

3.3 Customer represents and warrants that: (a) it has all rights, notices, consents, and lawful bases needed for the Processing; (b) its instructions comply with law; (c) it will not instruct Okliko to violate law or third-party rights; and (d) it will not submit Prohibited Sensitive Data except under a separate written agreement expressly authorizing that Processing.

3.4 Customer is responsible for the accuracy, quality, legality, and minimization of Customer Personal Data; its relationships with Data Subjects; and responding to Data Subjects except to the extent Okliko must assist under this DPA.

3.5 "Prohibited Sensitive Data" includes government identifiers, complete payment credentials, passwords, authentication secrets, medical records, genetic data, biometric identifiers used for unique identification, criminal records, data concerning children, and information subject to specialized regimes that Okliko has not expressly agreed in writing to support.

4. Confidentiality and Personnel

4.1 Okliko will ensure that persons authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations.

4.2 Access will be limited to personnel and service providers who require access for the Service, security, support, legal compliance, or another authorized purpose.

4.3 Customer will maintain confidentiality and appropriate access controls for its accounts, projects, credentials, administrators, and collaborators.

5. Security

5.1 Okliko will maintain commercially reasonable technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the Processing, available technology, implementation cost, and risk.

5.2 The current categories of measures are described in Schedule 2. Okliko may modify those measures without materially reducing the overall security of the Service during the Agreement term.

5.3 Customer acknowledges that security is a shared responsibility. Customer is responsible for configuring permissions, using secure credentials, controlling collaborators, keeping devices secure, maintaining independent copies of critical content, and avoiding Prohibited Sensitive Data.

6. Subprocessors

6.1 Customer grants Okliko general written authorization to engage Subprocessors as reasonably necessary to provide, maintain, secure, support, troubleshoot, and improve the Service.

6.2 Okliko will require each Subprocessor that Processes Customer Personal Data to enter into written obligations that provide a level of data protection materially consistent with the obligations applicable to Okliko under this DPA, to the extent required by Applicable Data Protection Law. Okliko remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law.

6.3 Information identifying Okliko's current Subprocessors that Process Customer Personal Data will be made available to Customer upon reasonable written request to [email protected].

6.4 Okliko will notify Customer of an intended material addition or replacement of a Subprocessor that Processes Customer Personal Data through the Service, the email address associated with Customer's account, or another reasonable method.

6.5 Customer may object in writing to an intended Subprocessor on reasonable and documented data-protection grounds within seven (7) days after notice. If Customer does not object within that period, Customer will be deemed to have authorized the intended Subprocessor.

6.6 The parties will work in good faith to address a timely and valid objection. Okliko may use commercially reasonable efforts to modify the affected Service, recommend an alternative configuration, or avoid the disputed Subprocessor. If Okliko determines that no commercially reasonable alternative is available, Okliko may discontinue the affected feature or either party may terminate the affected portion of the Service. Customer's sole and exclusive remedy for an unresolved objection is to stop using or terminate the affected portion of the Service, subject to mandatory law and any express refund rights in the Agreement.

6.7 Identity Verification Subprocessor. When a user initiates identity verification, Okliko engages a specialized identity-verification Subprocessor that Processes government-identification images, selfie images, and verification metadata solely to perform and confirm the user's identity. Okliko does not store raw identity-document images, selfie images, or biometric templates; Okliko retains only the verification result, the provider inquiry reference identifier, the verification date, and associated audit metadata.

7. Data Subject Requests

7.1 Taking into account the nature of the Processing, Okliko will provide reasonable assistance to Customer with Data Subject requests to the extent Customer cannot fulfill the request through available Service functionality.

7.2 If Okliko receives a request concerning Customer Personal Data, Okliko may direct the requester to Customer or notify Customer, unless law requires Okliko to respond directly.

7.3 Customer is responsible for determining the legal validity and scope of a request. Okliko may charge reasonable fees for assistance that is unusually burdensome or outside standard Service functionality, to the extent permitted by law.

8. Regulatory Assistance and Assessments

8.1 Okliko will provide reasonable information and assistance concerning security, breach obligations, data-protection impact assessments, and regulator consultations, taking into account the nature of the Processing and information available to Okliko.

8.2 Assistance beyond standard documentation or functionality may be subject to reasonable fees and scheduling, except where prohibited by law.

8.3 Okliko is not responsible for Customer's legal conclusions, notices, consents, assessments, or regulatory filings.

9. Personal Data Breaches

9.1 Okliko will notify Customer without undue delay after Okliko confirms a Personal Data Breach affecting Customer Personal Data, unless Applicable Data Protection Law does not require notification.

9.2 Notification may be delivered to Customer's account email or designated security contact and will include information reasonably available to Okliko, which may be provided in phases.

9.3 Okliko's notice, investigation, mitigation, or response is not an admission of fault or liability.

9.4 Customer is solely responsible for determining whether to notify Data Subjects, regulators, business partners, or others, except where law assigns that duty directly to Okliko.

10. Return and Deletion

10.1 During the Agreement term, Customer may use available functionality to access, export, or delete Customer Personal Data, subject to plan, feature, format, and technical limitations.

10.2 Following termination or a valid written instruction, Okliko will delete or return Customer Personal Data within a commercially reasonable period, unless retention is required or permitted by law, security, fraud prevention, dispute preservation, backups, or the Agreement.

10.3 Data may remain in backups until overwritten under ordinary cycles. Okliko will protect retained data and will not actively Process it except for the purpose requiring retention.

10.4 Okliko is not responsible for copies retained by Customer, collaborators, public recipients, or third-party platforms.

11. Audits and Compliance Information

11.1 Okliko will make available information reasonably necessary to demonstrate compliance with this DPA, such as this DPA, security summaries, provider documentation, and audit or certification reports available to Okliko.

11.2 Customer must first review available documentation before requesting an audit.

11.3 To the extent legally required and available documentation is insufficient, Customer may request one audit in any twelve-month period, unless a confirmed Personal Data Breach or regulator requires an additional audit. The audit must be conducted by an independent qualified auditor, during normal business hours, on reasonable advance notice, and under confidentiality obligations.

11.4 Audits may not access source code, penetration-test production systems, disrupt operations, expose another customer's data, or reveal trade secrets beyond what Applicable Data Protection Law requires.

11.5 Customer bears audit costs unless a material violation by Okliko is established and Applicable Data Protection Law requires otherwise.

12. CCPA and U.S. State Privacy Terms

12.1 To the extent Okliko acts as a Service Provider or Contractor, Okliko will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship for a commercial purpose other than providing the Service; or combine it with personal information from another source, except as permitted by the CCPA.

12.2 Okliko certifies that it understands and will comply with applicable Service Provider and Contractor restrictions.

12.3 Customer may take reasonable and appropriate steps to help ensure Okliko's use is consistent with Customer's obligations, subject to Section 11.

12.4 Okliko will notify Customer if it determines it can no longer meet applicable Service Provider or Contractor obligations and will take reasonable steps to stop and remediate unauthorized use.

13. International Transfers

13.1 Customer authorizes Okliko and its authorized Subprocessors to Process Customer Personal Data in the United States and other countries in which they operate, subject to Applicable Data Protection Law and the transfer terms in Schedule 3.

13.2 Where an eligible transfer of Customer Personal Data protected by the GDPR requires Standard Contractual Clauses, the European Commission's 2021 Standard Contractual Clauses are incorporated as described in Schedule 3. Module 2 applies where Customer is a Controller and Okliko is a Processor; Module 3 applies where Customer is a Processor and Okliko is a Subprocessor.

13.3 For restricted transfers from the United Kingdom, the then-current approved United Kingdom International Data Transfer Addendum to the EU Standard Contractual Clauses is incorporated as described in Schedule 3.

13.4 For Switzerland, references will be interpreted to include the Swiss Federal Act on Data Protection and the competent Swiss authority, as legally required.

13.5 If another lawful transfer mechanism applies, including an adequacy decision, approved certification, or another legally recognized safeguard, Okliko may rely on that mechanism.

13.6 Each party will comply with the obligations assigned to it under the applicable transfer mechanism. Customer is responsible for completing any transfer assessment required of Customer as data exporter. Okliko will provide information reasonably available to it for that purpose.

14. Liability and Indemnification

14.1 Liability under this DPA is subject to the exclusions, limitations, and remedies in the Agreement, to the maximum extent permitted by law.

14.2 Customer will defend, indemnify, and hold harmless Okliko and the protected parties identified in the Agreement against third-party claims arising from Customer's unlawful instructions, lack of lawful basis, deficient notices or consents, Prohibited Sensitive Data, or violation of Applicable Data Protection Law, subject to the Agreement.

14.3 Nothing in this DPA limits a Data Subject's rights or liability that cannot legally be limited.

15. Term, Changes, and Conflict

15.1 This DPA remains effective while Okliko Processes Customer Personal Data on Customer's behalf.

15.2 Okliko may update this DPA to reflect changes in Applicable Data Protection Law, the Service, or Okliko's processing practices. Okliko will provide notice of material changes where required by law or the Agreement. No update will materially reduce the protection of Customer Personal Data during a current paid subscription term unless required by law or necessary to address a material security, legal, or provider change.

15.3 If this DPA conflicts with the Agreement concerning Processing of Customer Personal Data, this DPA controls. If the Standard Contractual Clauses, UK Addendum, or another mandatory transfer instrument conflicts with this DPA, the mandatory instrument controls.

15.4 The governing-law and dispute provisions of the Agreement apply except where Applicable Data Protection Law or an incorporated transfer instrument requires otherwise.

16. Contact

Privacy and DPA communications may be sent to [email protected].

Schedule 1 - Details of Processing

Schedule 2 - Technical and Organizational Measures

Schedule 3 - International Transfer Terms

1. EEA SCCs. Where Customer Personal Data protected by the GDPR is transferred to Okliko in a country not recognized as adequate and no other valid mechanism applies, the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 are incorporated by reference.

2. Module. Module 2 applies to Controller-to-Processor transfers. Module 3 applies to Processor-to-Processor transfers.

3. Docking. The optional docking clause applies.

4. Subprocessor authorization. For Clause 9 of the Standard Contractual Clauses, Option 2 (general written authorization) applies. The notice period is the period stated in Section 6 of this DPA.

5. Complaints. Data Subjects may contact [email protected].

6. Supervisory authority. The competent supervisory authority is determined under Clause 13 of the Standard Contractual Clauses based on the data exporter and applicable GDPR rules.

7. Governing law and forum. For Standard Contractual Clause purposes, the governing law and courts will be those of an EU Member State that permits third-party beneficiary rights and is selected by the data exporter. If a selection is required and no valid selection has been made, Irish law and the courts of Ireland will apply, subject to mandatory law.

8. Annexes. Schedule 1 supplies the description of the parties, Processing, transfer, data categories, and Data Subjects to the extent applicable. Schedule 2 supplies the technical and organizational measures. Information concerning authorized Subprocessors is available to Customer upon reasonable written request under Section 6.

9. United Kingdom. For restricted transfers under UK law, the EU Standard Contractual Clauses are supplemented by "Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses." The information in Schedules 1 and 2 and the applicable Agreement details fill the corresponding tables to the extent applicable.

10. Switzerland. For transfers protected by Swiss data-protection law, references in the Standard Contractual Clauses will be adapted as legally required to recognize Switzerland, the Swiss Federal Act on Data Protection, and the competent Swiss authority.

11. Precedence. The Standard Contractual Clauses, UK Addendum, or another mandatory transfer mechanism controls over conflicting terms to the extent required.