Data Processing Agreement

Effective as of 17, August 2026

1. Purpose and Scope

1.1. "DPA" means this Data Processing Agreement, which forms part of and supplements the Agreement.

1.2. This DPA applies to the extent that Whatagraph processes Personal Data on behalf of Customer in connection with the provision of the Service under the Agreement.

1.3. The purpose of this DPA is to set out the terms governing Whatagraph's processing of Personal Data on behalf of Customer and to ensure that such processing is carried out in compliance with applicable Data Protection Laws, including Article 28 of the GDPR.

1.4. In the event of any conflict or inconsistency between this DPA and the Agreement with respect to the processing of Personal Data, the provisions of this DPA shall prevail to the extent of such conflict or inconsistency.

2. Definitions

2.1. In this DPA, the following terms shall have the meanings set out below. Capitalised terms used but not defined herein shall have the meanings given to them in the Agreement or, where applicable, in Article 4 of the GDPR.

2.2. "Agreement" means the agreement between Whatagraph and Customer governing Customer's access to and use of the Service, including the Whatagraph Terms and Conditions (available at Terms & Conditions, as updated from time to time) and any other documents, schedules, or annexes forming part thereof.

2.3. "Customer" means the legal entity or natural person entering into the Agreement with Whatagraph.

2.4. "Data Protection Laws" means the GDPR, together with any laws, regulations, and binding decisions of competent supervisory authorities supplementing, implementing, or made pursuant to the GDPR, and any other legislation applicable to the processing of Personal Data under this DPA.

2.5. "Parties" means Customer and Whatagraph collectively.

2.6. "Service" means the marketing analytics platform and related services provided by Whatagraph to the Customer pursuant to the Agreement.

2.7. "Supervisory Authority" means an authority pursuant to Article 51 of the GDPR, responsible for monitoring the application of Data Protection Laws.

2.8. "Whatagraph" means Whatagraph B.V., a company incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 67082068, with its registered office at Herengracht 420, 1017 BZ Amsterdam, the Netherlands.

3. Roles and Processing Instructions

3.1. The Parties acknowledge and agree that, for the purposes of this DPA and within the meaning of the GDPR, Customer acts as the controller and Whatagraph acts as the processor.

3.2. Customer, as controller, is responsible for: (a) ensuring that Personal Data is processed in compliance with the GDPR and other applicable Data Protection Laws; (b) determining the purposes and means of processing; and (c) ensuring that the processing entrusted to Whatagraph has a valid legal basis under applicable Data Protection Laws.

3.3. Whatagraph shall process Personal Data only in accordance with the documented instructions of Customer, except where processing is required by European Union or Member State law applicable to Whatagraph, in which case Whatagraph shall inform Customer of that legal requirement before processing, unless such law prohibits such notification on grounds of substantial public interest. Customer's instructions as at the date of this DPA are set out in Annex I. Customer may issue further documented instructions during the term of this DPA; provided, however, that all such instructions shall be consistent with the rights and obligations of the Parties under this DPA and shall be recorded in writing.

3.4. If Customer issues instructions that Whatagraph reasonably considers to be in breach of applicable Data Protection Laws, Whatagraph shall be entitled to suspend processing pursuant to such instructions pending written confirmation or amendment from Customer. Customer shall indemnify and hold Whatagraph harmless from and against any claims, penalties, losses, or damages arising directly from Whatagraph acting in good faith upon Customer's documented instructions.

3.5. Customer is responsible for ensuring that its instructions to Whatagraph comply with applicable Data Protection Laws and that Customer has obtained a valid legal basis for the processing of Personal Data contemplated under the Agreement. .

4. Confidentiality

4.1. Whatagraph shall ensure that all persons authorised to process Personal Data on its behalf are subject to an appropriate obligation of confidentiality, whether contractual or statutory.

4.2. Whatagraph shall ensure that access to Personal Data is limited to those personnel who require such access for the purpose of providing, maintaining or supporting the services under the Agreement.

5. Data Subject Rights

5.1. Whatagraph shall, taking into account the nature of the processing and the information available to it, assist Customer by appropriate technical and organisational measures in fulfilling Customer's obligation to respond to requests from data subjects exercising their rights under the GDPR.

5.2. If a data subject submits a request directly to Whatagraph to exercise any of its rights under Chapter III of the GDPR, Whatagraph shall, without undue delay, forward such request to Customer, unless otherwise agreed between the Parties or required by applicable law.

5.3. If Whatagraph receives any correspondence, enquiry, or complaint from a Supervisory Authority relating to the processing of Personal Data under this DPA, Whatagraph shall, without undue delay, inform Customer and cooperate with Customer in preparing an appropriate response, unless such notification is prohibited under applicable law.

5.4. Upon Customer's reasonable request, Whatagraph shall provide Customer with reasonable assistance in carrying out data protection impact assessments and, where required, in any prior consultation with the relevant Supervisory Authority. The scope, terms, and any associated costs of such assistance shall be agreed between the Parties in writing in advance.

6. Data Security

6.1. Whatagraph shall implement and maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

6.2. Details of Whatagraph’s technical and organisational security measures are set out in Annex II to this DPA and may be further described in Whatagraph’s Security Policy, available at https://whatagraph.com/security-policy. Whatagraph may update such measures from time to time, provided that any such update does not materially diminish the overall level of protection afforded to Personal Data.

6.3. Whatagraph shall notify Customer of any Personal Data Breach involving Personal Data processed under this DPA without undue delay and, in any event, no later than forty eight (48) hours after becoming aware of such breach. Such notification shall include, to the extent reasonably available at the time of notification:

- a description of the nature of the Personal Data Breach;

- the name and contact details of Whatagraph's data protection contact point;

- a description of the likely consequences of the Personal Data Breach; and

- a description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects.

6.4. If a Personal Data Breach is attributable to Whatagraph's processing of Personal Data, Whatagraph shall cooperate with Customer and provide reasonable assistance and information to enable Customer to fulfil its obligations under the GDPR, including notifying the relevant Supervisory Authority and, where required, affected Data Subjects.

6.5. Each Party shall bear its respective costs associated with managing a Personal Data Breach and fulfilling its obligations under this DPA and applicable Data Protection Laws.

7. Sub-processors

7.1. Customer hereby provides Whatagraph with a general written authorisation to engage sub-processors in connection with the provision of the services and the processing of Personal Data under this DPA. A list of Whatagraph’s authorised sub-processors is set out in Annex I to this DPA.

7.2. Whatagraph shall notify Customer of any intended changes to the list of sub-processors, including the addition or replacement of any sub-processor, by providing written notice to Customer no later than thirty (30) days prior to the intended change taking effect.

7.3. Customer may object to any such intended change by notifying Whatagraph in writing within fourteen (14) days of receipt of the notification referred to in Clause 7.2. If Customer raises a reasonable objection and the Parties are unable to resolve the matter within thirty (30) days, either Party may terminate this DPA and the Agreement upon written notice to the other Party, without prejudice to any fees or charges already accrued prior to the effective date of such termination.

7.4. Whatagraph shall impose on each sub-processor, by way of a written agreement, data protection obligations no less protective than those set out in this DPA, including, in particular, the requirement to implement appropriate technical and organisational measures such that the processing meets the requirements of the GDPR.

7.5. Whatagraph shall remain fully liable to Customer for the performance of each sub-processor's data protection obligations to the extent that such sub-processor fails to fulfil those obligations. Nothing in this Clause shall affect the respective responsibilities of Customer or Whatagraph under the GDPR.

8. International Data Transfers

8.1. Customer hereby authorises Whatagraph to transfer and process Personal Data outside the European Economic Area ("EEA"), provided that any such transfer is carried out in accordance with one of the lawful transfer mechanisms set out in the GDPR and in accordance with Customer's documented instructions as set out in Annex I.

8.2. Where required under applicable Data Protection Laws, Whatagraph shall implement appropriate safeguards for such transfers, including the European Commission’s standard contractual clauses or any other lawful transfer mechanism recognised under Chapter V of the GDPR.

8.3. Information regarding relevant international transfers and applicable transfer mechanisms is set out in Annex I to this DPA.

9. Audit

9.1. Whatagraph shall make available to Customer, upon reasonable request, information necessary to demonstrate compliance with its obligations under this DPA and applicable Data Protection Laws.

9.2. To the extent available, such information may be provided through security documentation, audit reports, certifications, or other compliance materials made available by Whatagraph.

9.3. If the information made available by Whatagraph is not reasonably sufficient for Customer to verify compliance with this DPA, Customer may, no more than once per calendar year and upon at least thirty (30) days’ prior written notice, request an audit of Whatagraph’s relevant processing activities, provided that such audit:

- is limited in scope to matters relevant to this DPA;

- is conducted during normal business hours;

- does not unreasonably interfere with Whatagraph’s business operations; and

- is subject to appropriate confidentiality obligations.

9.4. Any such audit shall be conducted either by Customer or by an independent third-party auditor that is not a competitor of Whatagraph and is bound by appropriate confidentiality obligations.

9.5. Customer shall bear its own costs in connection with any audit under this Section.

10. Term and Termination

1. This DPA shall remain in effect for as long as Whatagraph processes Personal Data on behalf of Customer under the Agreement.

2. Upon termination or expiry of the Agreement, Whatagraph shall, at Customer’s election, return or securely delete all Personal Data processed on behalf of Customer, unless applicable law requires the continued retention of such Personal Data.

3. If Customer does not request the return of Personal Data within ninety (90) days following termination or expiry of the Agreement, Whatagraph shall delete such Personal Data in accordance with its standard retention and deletion practices.

4. Notwithstanding the foregoing, Whatagraph may retain Personal Data to the extent and for such period as required by applicable law, provided that such Personal Data shall remain subject to the protections set out in this DPA and applicable Data Protection Laws for so long as it is retained.

5. Any provisions of this DPA that, by their nature, are intended to survive termination or expiry shall continue in full force and effect following the termination or expiry of this DPA.

Annex I - Information on Processing of Personal Data

1. Details of Processing

Subject matter of the processing	The provision of Whatagraph’s reporting, analytics, dashboarding, data integration and related support services under the Agreement.
Duration of the processing	For the duration of the Agreement and, thereafter, for any period during which Whatagraph retains Personal Data in accordance with the DPA, the Agreement, or applicable law.
Nature and purpose of the processing	The processing of Personal Data as necessary to provide the services to Customer, including collection, import, organisation, storage, structuring, visualisation, retrieval, export, support, maintenance, troubleshooting, and related service operations.
Categories of Personal Data	Personal Data submitted to, stored on, or otherwise made available through the services by or on behalf of Customer, which may include account and contact details, user identifiers, campaign and performance data, CRM and lead data, customer-related data, device and usage data, and other Personal Data included in data sources connected by Customer.
Categories of data subjects	Customer’s users, employees, contractors, clients, prospects, leads, website visitors, end users, and any other individuals whose Personal Data is included in the data made available by Customer through the services.
Special categories of Personal Data	Customer shall not submit special categories of Personal Data to the services unless explicitly agreed otherwise in writing with Whatagraph.

2. Sub-processors

Whatagraph may engage sub-processors in connection with the provision of the services. A current list of authorised sub-processors is made available by Whatagraph and may be updated from time to time in accordance with this DPA.

Sub-processor	Purpose / Services Provided	Location
Google Cloud Platform (GCP)	Core infrastructure, data storage, data processing, integrations and data pipeline services.	Primary location: European Union. Limited processing may also occur in the United States.
Amazon Web Services (AWS)	Limited infrastructure services, including hosting of certain frontend assets and transactional email delivery support.	Primary location: European Union. Limited processing may also occur in the United States.
Salesforce	Customer relationship management (CRM), marketing automation, and communications.	Primary location: European Union. Limited processing may also occur in the United States.
Intercom	Customer support and in-app messaging platform.	Primary location: European Union. Limited processing may also occur in the United States.
Fathom	Sales and customer services call recording and analysis.	Primary location: United States.
Mixpanel	Product analytics and usage tracking.	Primary location: European Union. Limited processing may also occur in the United States.
Claude (Anthropic)	Customer service operations support and technical troubleshooting, including code analysis and debugging.	Primary location: European Union. Limited processing may also occur in the United States.
Gemini API	AI functionalities if enabled by the customer.	Primary location: European Union. Limited processing may also occur in the United States.
Datadog	Analytics and monitoring.	Primary location: European Union. Limited processing may also occur in the United States.
Twillio	Product analytics.	Primary location: European Union. Limited processing may also occur in the United States.

3. International Transfer

To the extent Personal Data is transferred outside the European Economic Area, Whatagraph shall ensure that such transfer is subject to an appropriate transfer mechanism in accordance with applicable Data Protection Laws.

Recipient	Country	Transfer Mechanism
Google Cloud Platform (GCP)	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Amazon Web Services (AWS)	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Salesforce	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Intercom	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Fathom	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Mixpanel	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Claude (Anthropic)	United States	Standard contractual clauses adopted by the European Commission (SCCs) supplemented by a transfer impact assessment (TIA).
Gemini API	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Datadog	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.
Twillio	United States	European Commission adequacy decision under the EU-U.S. Data Privacy Framework.

Annex II - Technical and Organisational Measures

Whatagraph implements and maintains appropriate technical and organisational measures designed to protect Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, as well as the risks for the rights and freedoms of natural persons.

The measures implemented by Whatagraph include, as appropriate, the following:

Control Area	Description of Measures
Identity and Access Management	Whatagraph implements access controls designed to ensure that access to Personal Data is limited to authorised personnel on a need-to-know basis. Access is granted based on role and business need, and internal access is managed using role-based access principles. Multi-factor authentication is used for relevant systems, and access rights are reviewed and revoked where appropriate, including upon employee separation or role change.
Authentication and Account Security	Unique user credentials are used for access to relevant systems and environments. Password and credential management practices are maintained to protect against unauthorised access, including procedures for password reset, credential revocation, and secure authentication controls.
Customer Access Controls	Whatagraph supports secure authentication and access controls for customer access to the Service. Customer accounts are logically separated, and customer users are granted access only within the relevant customer environment or workspace.
Infrastructure Security	Whatagraph maintains cloud-based infrastructure security measures designed to protect Personal Data and the Service environment. Such measures may include environment separation, firewalls, network access restrictions, secure configuration practices, and monitoring of infrastructure and service activity.
Data Access and Use Restrictions	Whatagraph applies measures designed to prevent unauthorised access to, use of, modification of, or disclosure of Personal Data. Access to Personal Data is restricted to authorised personnel whose job functions require such access in connection with the provision, maintenance or support of the Service.
Encryption and Secure Transmission	Whatagraph applies encryption and secure transmission measures, as appropriate, to protect Personal Data in transit and at rest. These measures may include encryption protocols, secure communication channels, and device-level protection controls.
Availability and Resilience	Whatagraph maintains measures designed to support the availability and resilience of the Service and related systems, including backup, recovery, monitoring, alerting, and other service continuity mechanisms, as appropriate.
Segregation of Data and Environments	Whatagraph applies logical separation measures designed to segregate Personal Data between customers and to separate production and non-production environments, where appropriate.
Vulnerability and Risk Management	Whatagraph maintains processes designed to identify, assess, prioritise and remediate security vulnerabilities and risks relevant to the Service and the processing of Personal Data.
Personnel Security and Awareness	Whatagraph requires personnel authorised to access Personal Data to be subject to confidentiality obligations and to receive appropriate security and privacy training. Personnel access is managed in accordance with internal security procedures.
Physical Security	Whatagraph relies on physical security measures implemented by its cloud infrastructure providers and any relevant facilities providers, designed to prevent unauthorised physical access to systems used to process Personal Data.
Third-Party Risk Management	Whatagraph maintains a process for selecting and managing vendors and sub-processors that may process Personal Data, including contractual safeguards and appropriate review of relevant security measures.
Incident Management	Whatagraph maintains procedures for detecting, responding to, and managing security incidents, including Personal Data Breaches, and for notifying Customer in accordance with this DPA where required.
Security Testing and Evaluation	Whatagraph maintains processes for reviewing and evaluating the effectiveness of its technical and organisational measures, which may include internal reviews, security monitoring, vulnerability assessments, and other appropriate testing activities.