Data Processing Addendum

• Data Protection Law means all laws applicable to the processing of personal data under this DPA, including Regulation (EU) 2016/679 (the GDPR), the Polish Act of 10 May 2018 on the Protection of Personal Data, the UK GDPR and Data Protection Act 2018, and applicable United States federal and state privacy laws.
• Controller, Processor, Data Subject, Personal Data, Processing, and Supervisory Authority each has the meaning given in the GDPR, and Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• Seller Personal Data means Personal Data that Fungies processes on your behalf and on your instructions in the course of providing the Services, as described in Annex I.
• Standard Contractual Clauses means the clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and for transfers subject to UK law the International Data Transfer Addendum issued by the UK Information Commissioner.
• Sub-processor means a third party engaged by Fungies to process Seller Personal Data.

Because Fungies acts as Merchant of Record, the parties hold different roles over different categories of data. This clause 2 sets out which role applies to what, and the rest of this DPA should be read accordingly.

1. Fungies as processor In respect of Seller Personal Data — the customer records, contact details, support correspondence, custom fields, and similar data you upload, configure, or generate through your use of the dashboard and the Services — you are the Controller and Fungies is the Processor. Fungies processes that data only on your documented instructions, as set out in clause 3.
2. Fungies as independent controller In respect of Transaction data that Fungies must process to discharge its own legal obligations as the legal seller of record, Fungies acts as an independent Controller and not as your Processor. That includes determining, collecting, reporting, and remitting Transaction Taxes; issuing receipts and invoices in its own name; fraud prevention and risk scoring; sanctions, anti-money-laundering, and know-your-customer screening; payment-network and processor compliance; chargeback and dispute handling; and retaining records that law requires it to keep.
3. Why the split exists You cannot instruct Fungies to stop processing data in the second category, because Fungies does not process it on your behalf — it processes it to meet obligations the law imposes on it directly as seller of record. Fungies is responsible for that processing under Data Protection Law, and handles it in accordance with its Privacy Policy at https://fungies.io/privacy-policy.
4. Your own role You are separately responsible for your own processing of Personal Data, including data you obtain from the Services and hold in your own systems. Where you and Fungies are each independent Controllers of the same data, neither is the other's Processor and neither is liable for the other's processing.
5. Your instructions and compliance You warrant that you have a lawful basis for the processing you instruct, that you have provided all notices and obtained all consents Data Protection Law requires, and that your instructions will not cause Fungies to breach Data Protection Law. You are responsible for the accuracy, quality, and legality of Seller Personal Data and of the means by which you acquired it.

1. Scope and purpose Fungies will process Seller Personal Data only for the purposes described in Annex I, in accordance with your documented instructions, and as necessary to provide, secure, and support the Services and to comply with law. The Terms & Conditions, this DPA, your configuration of the Services, and your use of the Services together constitute your documented instructions.
2. No other use Fungies will not sell Seller Personal Data, will not share it for cross-context behavioural advertising, and will not use it for its own unrelated commercial purposes. Fungies may create and use aggregated or de-identified data that cannot reasonably be used to identify a Data Subject, for the purposes of operating, securing, and improving the Services.
3. Unlawful instructions If Fungies considers that an instruction infringes Data Protection Law, it will inform you without undue delay and may suspend performance of that instruction until it is confirmed, withdrawn, or amended.
4. Required disclosures If Fungies is required by law to process or disclose Seller Personal Data other than on your instructions, it will inform you before doing so unless the law prohibits that notice, and will limit the disclosure to what the law requires.

1. Fungies will ensure that each person it authorises to process Seller Personal Data is subject to a binding duty of confidentiality, is informed of the confidential nature of the data, and receives appropriate training on their obligations under Data Protection Law.
2. Fungies will limit access to Seller Personal Data to those personnel who need it in order to provide, secure, or support the Services, and will operate access controls on a least-privilege basis.

1. Technical and organisational measures Fungies will implement and maintain appropriate technical and organisational measures to protect Seller Personal Data against a Personal Data Breach, having regard to the state of the art, the cost of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects. Those measures are described in Annex II.
2. Changes to measures Fungies may update the measures in Annex II from time to time provided the updates do not materially reduce the overall level of protection.
3. Your responsibilities You are responsible for configuring the Services appropriately for your own risk profile, for the security of the credentials and integrations you use, for the roles and permissions you grant your personnel, and for not transmitting Personal Data to Fungies through channels the Services do not support for that purpose. You must not send full payment-card data or other sensitive payment data except as clause 31 of the Terms & Conditions permits.

1. General authorisation You give Fungies a general authorisation to engage Sub-processors to process Seller Personal Data in connection with the Services, including hosting, infrastructure, payment, communications, analytics, fraud-prevention, tax-determination, and support providers.
2. Obligations on Sub-processors Before a Sub-processor processes Seller Personal Data, Fungies will impose on it data-protection obligations that are no less protective than those in this DPA, and will carry out appropriate diligence on its ability to meet them. Fungies remains responsible to you for the performance of each Sub-processor's obligations.
3. Current list and changes The current list of Sub-processors is available as described in Annex III. Fungies will give you notice of the addition or replacement of a Sub-processor before that Sub-processor begins processing Seller Personal Data, or as soon as reasonably practicable where a change must be made urgently to maintain the Services, security, or legal compliance.
4. Objection You may object to a new Sub-processor on reasonable data-protection grounds by notifying Fungies within 14 days after notice of the change. The parties will discuss the objection in good faith and Fungies will use reasonable efforts to make an alternative arrangement available. If it cannot do so without disproportionate effort, you may terminate the affected Services by written notice, and clause 13 will apply to the Seller Personal Data concerned.

1. The Services provide functionality that allows you to access, correct, export, restrict, and delete Seller Personal Data. You are responsible for responding to requests from Data Subjects in respect of data for which you are the Controller.
2. Taking into account the nature of the processing, Fungies will provide reasonable assistance to help you fulfil a Data Subject request, to the extent you cannot do so through the Services yourself.
3. If Fungies receives a request from a Data Subject that relates to Seller Personal Data for which you are the Controller, it will not respond to the substance of the request except on your instruction or as law requires, and will refer the Data Subject to you or forward the request to you without undue delay.
4. Where Fungies is an independent Controller under clause 2.2, it handles Data Subject requests itself in accordance with its Privacy Policy and Data Protection Law.

1. Fungies will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Seller Personal Data.
2. The notification will describe, to the extent then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a contact point for further information. Where the information is not all available at once, Fungies will provide it in phases as it is established.
3. Fungies will take reasonable steps to contain, investigate, and mitigate the breach, and will provide reasonable cooperation to help you meet your own notification obligations to a Supervisory Authority or to Data Subjects.
4. A notification under this clause 8 is not an acknowledgement of fault or liability by Fungies. You must notify Fungies without undue delay if you become aware of a Personal Data Breach affecting Seller Personal Data that arises in your own systems or from your use of the Services.

Taking into account the nature of the processing and the information available to it, Fungies will provide reasonable assistance with any data protection impact assessment and any prior consultation with a Supervisory Authority that you are required to carry out in respect of the processing of Seller Personal Data. Fungies may charge for assistance that goes materially beyond providing information about the Services and the measures described in this DPA.

1. Transfers outside the EEA Fungies operates from both the European Union and the United States, and Seller Personal Data may therefore be transferred to, or accessed from, a country outside the European Economic Area. Fungies will only make such a transfer where a valid transfer mechanism under Data Protection Law applies.
2. Adequacy and Standard Contractual Clauses Where the destination country is covered by an adequacy decision of the European Commission, the transfer is made on the basis of that decision. Where it is not, the Standard Contractual Clauses apply and are incorporated into this DPA by reference, with Module Two (controller to processor) applying where you are the Controller and Fungies is the Processor, and Module One (controller to controller) applying to a transfer between the parties as independent Controllers. Annex I, Annex II, and Annex III of this DPA populate the corresponding annexes of the Standard Contractual Clauses.
3. Populating the clauses For the purposes of the Standard Contractual Clauses: the data exporter is the Seller or the Fungies entity making the transfer, as applicable; the data importer is the recipient Fungies entity or Sub-processor; the optional docking clause applies; the governing law and forum are those of Poland where the transfer is made from the European Union; and the parties select the option under which the data importer notifies the data exporter of a Sub-processor change with a period for objection as set out in clause 6.4.
4. United Kingdom Where a transfer is subject to UK Data Protection Law, the International Data Transfer Addendum applies to the Standard Contractual Clauses, and references to the GDPR are read as references to the UK GDPR.
5. Government access If Fungies receives a legally binding request from a public authority for access to Seller Personal Data, it will handle the request in accordance with the Standard Contractual Clauses, including notifying you where the law permits, challenging the request where there are reasonable grounds to do so, and disclosing only the minimum amount of data the request requires.

1. Fungies will make available to you the information reasonably necessary to demonstrate compliance with this DPA, including documentation describing the measures in Annex II and, where Fungies holds them, relevant third-party certifications or audit reports.
2. Where that information is not sufficient to demonstrate compliance, you may request an audit no more than once in any twelve-month period, on at least 30 days' written notice, during business hours, in a manner that does not disrupt the Services or compromise the confidentiality or security of another customer's data. An additional audit may be carried out where Data Protection Law or a Supervisory Authority requires it, or following a Personal Data Breach affecting Seller Personal Data.
3. You will bear your own costs of an audit and will reimburse Fungies' reasonable costs of supporting it. Any auditor you appoint must not be a competitor of Fungies and must be bound by confidentiality obligations at least as protective as those in the Terms & Conditions.

Fungies retains Seller Personal Data for as long as necessary to provide the Services, and thereafter as clause 13 provides. Fungies retains Transaction records for which it is an independent Controller for the period required by tax, accounting, anti-money-laundering, payment-network, and other applicable law. Clause 27 of the Terms & Conditions separately requires you to keep your own records for at least the longer of the statutory period and seven years after the relevant Transaction.

1. On expiry or termination of the Services, or at your written request, Fungies will delete or return Seller Personal Data in accordance with your instruction. You may export Seller Personal Data through the Services before termination takes effect.
2. Fungies may retain Seller Personal Data to the extent, and for as long as, law requires it to do so, or where it is contained in a routine backup, in which case it will remain protected by this DPA and will be deleted in the ordinary course of Fungies' backup cycle.
3. This clause 13 does not require Fungies to delete data that it processes as an independent Controller under clause 2.2, where deletion would prevent it from meeting a legal obligation.

1. Liability Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms & Conditions, except to the extent Data Protection Law does not permit that limitation.
2. Term This DPA takes effect when you accept the Terms & Conditions or first use the Services, whichever is earlier, and continues until Fungies has ceased all processing of Seller Personal Data. Clauses that by their nature should survive termination will do so.
3. Changes Fungies may update this DPA where necessary to reflect a change in Data Protection Law, in the Services, or in a transfer mechanism, provided the update does not materially reduce the protection afforded to Seller Personal Data. Fungies will give reasonable notice of a material change.
4. Precedence In the event of a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms & Conditions, in each case in respect of the processing of Personal Data.
5. Contact Data-protection enquiries, Data Subject requests, and requests for the current Sub-processor list should be sent to support@fungies.io.

• Subject matter The provision of the Services described in the Terms & Conditions, comprising a hosted storefront, checkout, subscription billing, invoicing, customer portal, reporting, and related support.
• Duration The term of the Terms & Conditions, plus the retention periods described in clauses 12 and 13.
• Nature and purpose Hosting, storage, transmission, display, organisation, retrieval, back-up, support, and deletion of Seller Personal Data, in order to provide the Services and to secure and support them.
• Categories of Data Subject Your customers and prospective customers; your personnel and account administrators; and other individuals whose data you choose to submit through the Services.
• Categories of Personal Data Identification and contact data such as name, email address, and billing address; account and order data such as purchase history, subscription status, entitlements, and custom fields you configure; correspondence and support records; and technical data such as IP address, device and browser information, and log data. Payment-instrument data is processed by Fungies and its payment providers as independent Controllers and is not stored by you through the Services.
• Special category data The Services are not intended for the processing of special categories of Personal Data within the meaning of Article 9 of the GDPR, and you must not submit such data through the Services except with Fungies' prior written agreement.
• Frequency Continuous, for the duration of the Services.
• Competent Supervisory Authority Where the Standard Contractual Clauses apply to a transfer from the European Union, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland.

Fungies maintains the following measures, which it reviews periodically and may update in accordance with clause 5.2:

• Encryption Personal Data is encrypted in transit using current TLS versions, and encrypted at rest in the systems Fungies controls.
• Access control Role-based access on a least-privilege basis, unique named accounts, mandatory multi-factor authentication for administrative access, and revocation of access on role change or departure.
• Network and application security Segregation of production from non-production environments, managed firewalls, hardened configurations, dependency and vulnerability monitoring, and remediation of identified vulnerabilities on a risk-prioritised basis.
• Tenant separation Logical separation of each seller's data, with authorisation enforced at the data layer so that a request cannot return another seller's records.
• Logging and monitoring Audit logging of administrative and security-relevant events, monitoring and alerting on anomalous activity, and retention of logs for a defined period.
• Resilience Regular encrypted backups, restoration testing, and documented recovery objectives for the Services.
• Secure development Version control, peer review of changes, automated testing, separation of duties for deployment, and security review of material changes.
• Personnel Confidentiality obligations, background screening where lawful and appropriate to the role, and periodic data-protection and security training.
• Sub-processor management Diligence before engagement, contractual data-protection terms, and periodic review as described in clause 6.
• Incident response A documented incident-response process covering detection, triage, containment, investigation, notification under clause 8, and post-incident review.
• Payment data Payment-card data is handled by PCI DSS compliant payment providers through tokenised integrations. Fungies does not require sellers to store payment-card data, and clause 31 of the Terms & Conditions prohibits them from doing so without written authorisation.
• Deletion Documented processes for deletion and return of Personal Data in accordance with clause 13.

Fungies engages Sub-processors in the following categories to provide the Services: cloud hosting and infrastructure; payment processing and payout services; tax determination and reporting; fraud prevention, identity verification, and sanctions screening; transactional email and communications; customer support tooling; and product analytics and error monitoring.

Fungies routes payments through more than one payment provider, and the provider used for a given Transaction depends on the payment method, currency, and destination. Because that routing changes, the current list of Sub-processors — with each one's name, processing role, and location — is maintained separately rather than reproduced here. Request it, or subscribe to notice of changes, by emailing support@fungies.io.