Legal

This Data Processing Agreement ("DPA") forms part of the Agreement between Catchy Media Sp. z o.o. and the Client and is incorporated by reference into the General Terms and Conditions. Upon its incorporation, it takes precedence over the General Terms and Conditions in respect of data processing matters.

Version: v2026-06

Effective Date: 30 June 2026

Registered: NIP 9571150950, Gdańsk, Poland

Governing Law: Polish law, courts competent for the registered office of Catchy Media Sp. z o.o. in Gdańsk

Contact: Catchy Media Sp. z o.o., Al. Grunwaldzka 56/113, 80-241 Gdańsk, Poland — [email protected] (business hours)

Catchy Media Sp. z o.o. acts as a Data Processor in respect of Company Personal Data processed by it on behalf of the Client.

The Client acts as the Data Controller in respect of Company Personal Data.

The parties seek to implement a data processing agreement that complies with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR").

The parties wish to lay down their respective rights and obligations in accordance with Article 28 GDPR.

In this DPA, the following capitalised terms have the meanings set out below. Where a term is used in the singular, it includes the plural and vice versa.

Catchy Media / We / Us Catchy Media Sp. z o.o., a limited liability company incorporated and established in Gdańsk, Poland, NIP 9571150950.

Client / You The natural person or legal entity that enters into an Agreement with Catchy Media Sp. z o.o. for the provision of Services, acting as the Data Controller in respect of Company Personal Data.

Agreement This Data Processing Agreement, the General Terms and Conditions, any applicable quotation or order confirmation, and all Schedules.

Company Personal Data Any Personal Data processed by Catchy Media Sp. z o.o. on behalf of the Client pursuant to or in connection with the Agreement.

Data Protection Laws Means the GDPR and any applicable national implementing legislation, as amended or replaced from time to time.

EEA European Economic Area

GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Services The digital tools, platforms, and services provided by Catchy Media Sp. z o.o. as described in the General Terms and Conditions.

Sub-processor Any third party appointed by Catchy Media Sp. z o.o. to process Company Personal Data on its behalf in connection with the Agreement.

The terms "Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Processor", and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.

Subject Matter

Catchy Media Sp. z o.o. processes Company Personal Data on behalf of the Client for the purpose of providing the Services as described in this DPA and the Agreement.

Nature and Purpose

The nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects are set out in the Processing Activities section of this DPA.

Duration

Catchy Media Sp. z o.o. shall process Company Personal Data for the duration of the Agreement, unless otherwise agreed in writing or required by applicable law. Upon termination or expiry of the Agreement, Catchy Media Sp. z o.o. shall handle Company Personal Data in accordance with the Deletion or Return of Company Personal Data section of this DPA.

Catchy Media Sp. z o.o. shall:

process Company Personal Data only on the documented instructions of the Client, unless required to do so by applicable law, in which case Catchy Media Sp. z o.o. shall, to the extent permitted by law, inform the Client of that legal requirement before processing;

ensure that persons authorised to process Company Personal Data are bound by appropriate confidentiality obligations;

implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, in accordance with Article 32 GDPR and the Security Measures section of this DPA;

assist the Client in fulfilling its obligations to respond to Data Subject requests under Chapter III of the GDPR, taking into account the nature of the processing;

assist the Client in meeting its obligations under Articles 32 to 36 of the GDPR (security, breach notification, DPIAs, and prior consultation), taking into account the nature of the processing and the information available to Catchy Media Sp. z o.o.;

at the choice of the Client, delete or return all Company Personal Data to the Client upon termination or expiry of the Agreement, and delete existing copies unless retention is required by applicable law;

make available to the Client all information reasonably necessary to demonstrate compliance with this DPA and the obligations set out in Article 28 GDPR; and

notify the Client promptly if, in Catchy Media Sp. z o.o.'s opinion, an instruction from the Client infringes applicable Data Protection Laws.

General Authorisation

The Client provides general authorisation to Catchy Media Sp. z o.o. to engage Sub-processors for the purposes of providing the Services. The current list of approved Sub-processors is set out in the Approved Sub-processors section of this DPA. An up-to-date list of approved Sub-processors is available to Clients upon written request at [email protected].

New Sub-processors

Catchy Media Sp. z o.o. may add or replace Sub-processors at any time. An up-to-date list of approved Sub-processors is available upon written request at [email protected] in accordance with the General Authorisation section. The Client may object to any Sub-processor in writing at any time. If Catchy Media Sp. z o.o. is unable to accommodate a reasonable, documented objection, the Client may terminate the Agreement or the relevant part of the Services with 30 days' written notice, without penalty.

Objection

If the Client raises a reasonable, documented objection to a new Sub-processor and Catchy Media Sp. z o.o. is unable to accommodate that objection, the Client may terminate the Agreement or the relevant part of the Services with 30 days' written notice, without penalty.

Sub-processor Obligations

Catchy Media Sp. z o.o. shall impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA. Catchy Media Sp. z o.o. remains fully liable to the Client for the performance of each Sub-processor's obligations.

Assistance with Data Subject Requests

Catchy Media Sp. z o.o. shall, taking into account the nature of the processing, assist the Client by implementing appropriate technical and organisational measures to enable the Client to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).

Notification of Requests

Catchy Media Sp. z o.o. shall promptly notify the Client if it receives a Data Subject request in respect of Company Personal Data, and shall not respond to such request except on the documented instructions of the Client, or as required by applicable law.

Technical measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, Catchy Media Sp. z o.o. shall implement and maintain appropriate technical and organisational security measures, including:

encryption of Company Personal Data in transit and at rest;

ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

the ability to restore availability and access to Company Personal Data in a timely manner in the event of a physical or technical incident;

a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing;

access controls ensuring that Company Personal Data is accessible only to authorised personnel on a need-to-know basis;

pseudonymisation of Company Personal Data where appropriate and reasonably practicable.

Confidentiality obligations

Catchy Media Sp. z o.o. shall take reasonable steps to ensure that any staff with access to Company Personal Data are subject to appropriate confidentiality obligations.

Processing on Documented Instructions

Catchy Media Sp. z o.o. shall ensure that any staff authorised to process Company Personal Data do so only in accordance with the documented instructions of the Client and the terms of this DPA.

Notification Obligation

Catchy Media Sp. z o.o. shall notify the Client without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Company Personal Data.

Content of Notification

Such notification shall include, to the extent then available:

a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects affected and records concerned;

the name and contact details of the data protection contact at Catchy Media Sp. z o.o.;

a description of the likely consequences of the Personal Data Breach; and

a description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

Phased Notification

Where all information required under the Content of Notification section is not available at the time of initial notification, Catchy Media Sp. z o.o. shall provide the remaining information in phases without undue delay.

Cooperation and Remediation

Catchy Media Sp. z o.o. shall cooperate with the Client and take reasonable steps to assist in the investigation, mitigation, and remediation of any Personal Data Breach. Catchy Media Sp. z o.o. will provide the Client with sufficient information to enable the Client to meet its own notification obligations under applicable Data Protection Laws.

DPIA Assistance

Catchy Media Sp. z o.o. shall provide reasonable assistance to the Client with any data protection impact assessments (DPIAs) and prior consultations with Supervisory Authorities or other competent data privacy authorities which the Client reasonably considers to be required under Articles 35 and 36 of the GDPR, in each case solely in relation to the processing of Company Personal Data by Catchy Media Sp. z o.o. and taking into account the nature of the processing and the information available to Catchy Media Sp. z o.o.

Proactive DPIA Notification

Where Catchy Media Sp. z o.o. becomes aware that a new processing activity is likely to require a DPIA under Article 35 GDPR, it shall inform the Client accordingly.

Information and Compliance Evidence

Catchy Media Sp. z o.o. shall make available to the Client, upon reasonable written request, all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and Article 28 GDPR.

Audit and Inspection Rights

Catchy Media Sp. z o.o. shall allow for and contribute to audits and inspections conducted by the Client or a mandated third-party auditor, provided that:

the Client provides at least 30 days' prior written notice of any audit;

audits are conducted during normal business hours and in a manner that minimises disruption to Catchy Media Sp. z o.o.'s operations;

the auditor is bound by appropriate confidentiality obligations; and

the costs of the audit are borne by the Client, unless the audit reveals a material breach of this DPA by Catchy Media Sp. z o.o.

Certifications as Audit Equivalent

Catchy Media Sp. z o.o. may satisfy audit obligations in whole or in part by providing relevant security documentation or internal audit reports where available.

EU Data Residency

Catchy Media Sp. z o.o. stores and processes Company Personal Data within the European Economic Area (EEA) by default, using infrastructure hosted in the EU where available.

Transfers Outside the EEA

Where the use of a Sub-processor requires a transfer of Company Personal Data to a country outside the EEA that does not benefit from an adequacy decision under Article 45 GDPR, Catchy Media Sp. z o.o. shall ensure that such transfer is subject to appropriate safeguards, including:

Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) GDPR; or

any other transfer mechanism recognised as valid under applicable Data Protection Laws.

Sub-processor Transfer Mechanisms

The applicable transfer mechanisms for each Sub-processor are set out in the Approved Sub-processors section.

Return or Deletion Upon Termination

Upon termination or expiry of the Agreement, Catchy Media Sp. z o.o. shall, at the Client's choice:

make Company Personal Data available for export via the Platform for a period of 30 days following termination; and/or

securely delete or anonymise all Company Personal Data within 30 days of the end of the export period.

Confirmation of Deletion

Catchy Media Sp. z o.o. shall confirm the completion of deletion in writing upon the Client's reasonable request, subject to any legally mandated retention obligations.

Legally Mandated Retention

Notwithstanding the above, Catchy Media Sp. z o.o. may retain Company Personal Data to the extent required by applicable law (including Polish tax and accounting law requiring retention of financial records), in which case Catchy Media Sp. z o.o. shall ensure that such data is processed only for the purposes required by applicable law and is protected by appropriate security measures.

Sub-processor Deletion Obligations

Catchy Media Sp. z o.o. shall ensure that Sub-processors delete or return Company Personal Data in accordance with this Article upon termination of the relevant sub-processing arrangement.

Relationship with Agreement

This DPA forms part of and is subject to the Agreement. In the event of any conflict between this DPA and the General Terms and Conditions in respect of data processing matters, this DPA shall prevail.

Confidentiality

Each party shall keep the terms of this DPA and any information received about the other party in connection with it confidential, except to the extent required by applicable law or as necessary to perform obligations under this DPA.

Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the liability provisions of the General Terms and Conditions, except to the extent that applicable Data Protection Laws impose greater liability.

Notices

All notices under this DPA shall be given in accordance with the notice provisions of the General Terms and Conditions.

Amendments

Catchy Media Sp. z o.o. may update this DPA to reflect changes in Data Protection Laws or its processing activities, with at least 30 days' prior written notice to the Client.

Governing Law

This DPA is governed by Polish law. Any disputes arising in connection with this DPA shall be subject to the jurisdiction of the common courts competent for the registered office of Catchy Media Sp. z o.o. in Gdańsk, subject to mandatory provisions of law.

The following table sets out the subject matter, nature, purpose, categories of personal data, and categories of data subjects for each processing activity carried out by Catchy Media Sp. z o.o. on behalf of the Client.

Processing Activity Categories of Personal Data Data Subjects Purpose Retention

Account management & Platform access Name, email address, company name, job title, login credentials, usage logs Client's authorised users (employees / contractors) Platform access, subscription management, billing, support Duration of Agreement + 30 days

PPCMax AI Agent Google Ads account identifiers, campaign data, audience segment identifiers, performance metrics, content associated with client accounts Client and client's advertising audiences Automated reporting, audience analysis, content suggestions Session-based; logs retained for up to 90 days

Customer support Name, email address, support conversation content, usage context Client's authorised users Issue resolution and customer support 2 years from last interaction

Transactional email Name, email address Client's authorised users Service notifications, billing alerts, onboarding emails Duration of Agreement + 30 days

Product analytics IP address, session data, feature usage events, device/browser type Client's authorised users Platform improvement and product analytics Up to 12 months

Error logging and monitoring IP address, error context, user identifiers in logs Client's authorised users Platform stability and security, and error diagnostics Up to 90 days

Authentication Email address, authentication tokens, user identifiers Client's authorised users Secure user authentication and session management Duration of Agreement + 30 days

Special categories of personal data: Catchy Media Sp. z o.o. does not process special categories of personal data (as defined in Article 9 GDPR) on behalf of the Client under normal service conditions. If the Client requires processing of special category data, this must be agreed in writing with a specific legal basis documented prior to processing.

The following Sub-processors are approved as of the Effective Date of this DPA. Clients may request an up-to-date version of this list at any time by contacting [email protected].

Sub-processor Purpose Location Transfer Mechanism

Convex, Inc. Platform database, authentication handling, file storage and operational state of the Services USA / global infrastructure SCCs (Convex Data Processing Addendum)

Vercel Inc. Platform and website hosting, deployment infrastructure, monitoring data transport and routing of requests to AI model providers USA / global infrastructure SCCs (Vercel Data Processing Addendum)

Cloudflare, Inc. Internal Google Analytics 4 and Google Tag Manager integration service hosting and edge routing USA / global infrastructure SCCs (Cloudflare Data Processing Addendum)

Google LLC Google OAuth, Google Ads API, Google Merchant Center APIs, Google Cloud Logging and Gemini model inference where selected EU / USA / global infrastructure SCCs (Google Data Processing Terms)

Google LLC (Google Analytics 4) Analytics property access, analytics reporting and GA4 data retrieval where connected by the Client EU / USA / global infrastructure SCCs (Google Data Processing Terms)

Google LLC (Google Tag Manager) Tag Manager account, container and workspace access where connected by the Client EU / USA / global infrastructure SCCs (Google Data Processing Terms)

Firecrawl Retrieval and processing of publicly available product or competitor page content USA / global infrastructure SCCs or vendor data processing terms where applicable

Browser Use Remote browser automation and managed browser sessions for collecting data from websites USA / global infrastructure SCCs or vendor data processing terms where applicable

OpenAI, L.L.C. AI model inference where an OpenAI model is selected through Vercel AI Gateway USA / global infrastructure SCCs (OpenAI Data Processing Addendum)

Anthropic, PBC AI model inference where an Anthropic Claude model is selected through Vercel AI Gateway USA / global infrastructure SCCs (Anthropic Data Processing Addendum)

Stripe Payments Europe, Limited / Stripe, Inc. Payment method setup, payment processing, billing portal and subscription-related payment records EU / USA / global infrastructure SCCs (Stripe Data Processing Agreement)

Metronome Technologies, Inc. Package catalog, usage metering, billing contracts and invoice-related usage records USA / global infrastructure SCCs (Metronome Data Processing Addendum)

Sentry, Inc. Application error monitoring and diagnostic event context USA / EU region where available SCCs (Sentry Data Processing Addendum)

Note: Catchy Media Sp. z o.o. endeavours to use EU-region infrastructure wherever available. Some Sub-processors are used only when the relevant feature is enabled or selected by the Client, including Google Analytics 4 / Google Tag Manager access, retrieval of website content, and optional AI model providers. Where a Sub-processor is located outside the EEA, appropriate transfer safeguards (Standard Contractual Clauses or adequacy decisions) are in place. Clients may request copies of applicable SCCs by contacting [email protected].

Last updated: June 30, 2026 — Version v2026-06