MODA DATA PROCESSING ADDENDUM

Last Updated: October 21, 2026

This Data Processing Addendum (“DPA”) forms part of and is incorporated by reference into the Terms of Service (available at https://moda.app/terms) or other agreement governing Customer’s access to and use of the Services (the “Underlying Agreement”) between Nullframe, Inc. d/b/a Moda (“Moda”) and the customer party to the Underlying Agreement (“Customer”). This DPA applies to Moda’s Processing of Personal Data on behalf of Customer in connection with the Services. Capitalized terms not defined in this DPA have the meanings given in the Underlying Agreement.

1. Scope and Roles

This DPA applies to Moda’s Processing of Personal Data on behalf of Customer in connection with the Services (“Customer Personal Data”). “Data Protection Laws” means privacy and data protection laws applicable to such Processing. The terms “Controller,” “Business,” “Processor,” “Service Provider,” “Contractor,” “Personal Data,” “Personal Information,” “Process,” and “Processing” have the meanings given under applicable Data Protection Laws. To the extent Moda processes Customer Personal Data on Customer’s behalf, Customer is the Controller or Business and Moda is the Processor, Service Provider, or Contractor, as applicable. Each party will comply with the obligations applicable to its respective role. For clarity, this DPA does not apply to Personal Data that Moda Processes for its own independent purposes as a Controller or Business, which is governed by Moda’s Privacy Policy (located at https://moda.app/privacy) and, where applicable, the Terms of Service.

2. Processing

Customer instructs Moda to process Customer Personal Data on Customer’s behalf as necessary to provide the Services and otherwise in accordance with the Underlying Agreement and Customer’s documented instructions, as set forth in Schedule 1, unless otherwise required by applicable law. Moda will inform Customer if, in Moda’s reasonable opinion, an instruction violates applicable Data Protection Laws. Customer is responsible for the lawfulness of Customer Personal Data and its instructions to Moda, including providing required notices and obtaining any required consents or other lawful basis for the Processing.

3. Confidentiality and Security

Moda will ensure that persons authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations and will maintain reasonable and appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and accidental loss, destruction, alteration, or disclosure. Such technical and organizational measures are set forth in Schedule 2. Customer acknowledges that security measures may evolve over time, provided Moda does not materially decrease the overall security of the Services during the applicable subscription term.

4. Subprocessors

Customer generally authorizes Moda to engage subprocessors to Process Customer Personal Data. Moda will require each subprocessor to be subject to written data protection obligations appropriate to the Processing and will remain responsible for its subprocessors to the extent required by Data Protection Laws. Moda’s current subprocessors are identified as set forth in Schedule 3. Where required by Data Protection Laws, Moda will provide notice of any material addition or replacement of a subprocessor. Customer may object within ten (10) days of such notice on reasonable data protection grounds. The parties will work in good faith to resolve any objection; if they cannot, Moda may discontinue the affected portion of the Services or Customer may terminate the affected Services.

5. Assistance and Security Incidents

Taking into account the nature of the Processing and information available to Moda, Moda will provide reasonable assistance to Customer with data-subject requests, security obligations, data protection impact assessments, regulatory consultations, cybersecurity audits, risk assessments, and other obligations imposed by applicable Data Protection Laws. Moda will notify Customer without undue delay after becoming aware of a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Breach”) and will provide information reasonably available to Moda concerning the Personal Data Breach. To the extent Customer requests assistance requiring material effort beyond functionality or information ordinarily provided as part of the Services, Moda may charge its reasonable costs for such assistance, except to the extent the request results from Moda’s breach of this DPA.

6. Return and Deletion

Upon termination of the applicable Services, Moda will delete Customer Personal Data in accordance with its standard retention practices unless Customer requests return of such data before deletion or applicable law requires retention. Customer Personal Data maintained in routine backups may be retained until deleted in the ordinary course, provided it remains protected in accordance with this DPA.

7. Compliance and Audits

Moda will make available information reasonably necessary to demonstrate compliance with its obligations under applicable Data Protection Laws. Moda may satisfy audit or assessment requests by providing then-current third-party audit reports, certifications, security documentation, or questionnaires. If such materials are reasonably insufficient to satisfy a requirement under applicable Data Protection Laws, Customer may conduct an audit, subject to reasonable advance notice, confidentiality and security requirements, during normal business hours and without unreasonable interference with Moda’s operations. Unless required by a regulator or following a Personal Data Breach, audits will occur no more than once annually and will be at Customer’s expense, except where an audit identifies Moda’s material noncompliance with this DPA.

8. U.S. Privacy Laws

To the extent Moda acts as a Service Provider, Contractor, or Processor under applicable U.S. Data Protection Laws, Moda will Process Customer Personal Data solely for the limited and specified business purposes described in Schedule 1 and as otherwise permitted by applicable Data Protection Laws. Moda will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than the purposes set forth in Schedule 1 or as otherwise permitted by applicable Data Protection Laws; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer; or (d) combine Customer Personal Data with Personal Data obtained from another source except as permitted by applicable Data Protection Laws. Moda will provide the level of privacy protection required of a Service Provider, Contractor, or Processor under applicable Data Protection Laws; notify Customer if Moda determines it can no longer meet its applicable obligations; and permit Customer to take reasonable and appropriate steps required by law to verify compliance and stop and remediate unauthorized Processing.

9. GDPR and International Transfers

To the extent the GDPR or UK GDPR applies to Moda’s Processing of Customer Personal Data on behalf of Customer, Customer acts as Controller and Moda acts as Processor, except where Customer acts as a Processor, in which case Moda acts as Customer’s Subprocessor. Sections 2 through 7 of this DPA are intended to satisfy the applicable requirements of Article 28 of the GDPR and corresponding requirements of the UK GDPR. The details of the Processing are set forth in Schedule 1.

Moda may Process Customer Personal Data in the United States and other countries where Moda or its subprocessors operate, subject to applicable Data Protection Laws.

Where Customer Personal Data subject to the GDPR is transferred to a country that has not been recognized by the European Commission as providing an adequate level of protection and no other lawful transfer mechanism applies, the Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 (“EU SCCs”) are incorporated into this DPA by reference. For purposes of the EU SCCs: (a) Module Two applies where Customer is a Controller and Moda is a Processor; (b) Module Three applies where Customer is a Processor and Moda is a Subprocessor; (c) Clause 7 applies; (d) Clause 9, Option 2 applies, with the notice period specified in Section 4; (e) Clause 11 does not apply; (f) the governing law will be the laws of Ireland and the courts of Ireland will have jurisdiction; and (g) Schedules 1, 2, and 3 constitute Annexes I, II, and III, respectively, as applicable.

For transfers subject to UK Data Protection Laws, the EU SCCs will apply together with the UK International Data Transfer Addendum. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with Section 119A of the Data Protection Act 2018 on February 2, 2022, as revised under Section 18 of those Mandatory Clauses, is incorporated into this DPA by reference.

For transfers subject to Swiss Data Protection Laws, the EU SCCs will apply with the modifications required by applicable Swiss law.

The applicable transfer terms control over this DPA or the Underlying Agreement to the extent of any conflict. Nothing in this Section prevents the parties from relying on another lawful transfer mechanism permitted by applicable Data Protection Laws.

10. Underlying Agreement; Liability

This DPA forms part of the Underlying Agreement. In the event of a conflict between this DPA and the Underlying Agreement regarding the Processing of Customer Personal Data, this DPA will control solely with respect to that conflict. Notwithstanding anything to the contrary in this DPA, all limitations, exclusions, and caps on liability set forth in the Underlying Agreement apply to this DPA and all liability arising out of or relating to the Processing of Personal Data. For the avoidance of doubt, this DPA does not create any separate or additional liability cap, and all liability arising under or relating to this DPA will count toward the applicable liability cap under the Underlying Agreement. Except as expressly modified by this DPA, all terms of the Underlying Agreement remain in full force and effect.

11. Changes to this DPA

Moda may update this DPA from time to time to reflect changes in Data Protection Laws, the Services, or Moda’s Processing activities, or to make other changes that do not materially diminish the protections afforded to Customer Personal Data. Moda will provide notice of material changes as required by the Underlying Agreement or Data Protection Laws. The updated DPA will become effective upon posting or on such later date specified by Moda, subject to applicable notice requirements.

SCHEDULE 1
DETAILS OF PROCESSING

Subject Matter and Purpose:
Processing Customer Personal Data as necessary to provide, maintain, secure, support, and improve the Services, including:

• Receiving data, including collection, accessing, retrieval, recording, and data entry;
• Providing and supporting the Services, including AI-enabled functionality requested or enabled by Customer, processing inputs, and generating outputs.
• Using data, including for analysis purposes;
• Protecting data, including restricting, encrypting, and security testing;
• Returning data to the data exporter; and
• Erasing data, including destruction and deletion.

Duration:
For the duration of the Services and any permitted retention period.

Nature of Processing:
Processing reasonably necessary to provide the Services.

Categories of Personal Data:
Business contact information, account information, Customer-provided content, usage information, and other Personal Data submitted to or generated through the Services.

Categories of Data Subjects:
Categories of Data Subjects include:

• Customer’s Authorized Users of the Services, including employees, contractors, and agents, and individuals invited by Customer to use or access the Services;
• Guest viewers of, and commenters on, content Customer shares through the Services;
• Visitors to websites Customer publishes through the Services, including individuals who submit forms or comments on those websites;
• Individuals whose Personal Data is included in Customer-provided content (for example, people named in, pictured in, or recorded in documents, presentations, images, audio, or video), or is retrieved from third-party services Customer connects to the Services (for example, Slack, Google Drive, Figma, GitHub, or other integrations);
• Customer’s billing and administrative contacts; and
• Any other individuals whose Personal Data Customer or its Authorized Users submit to the Services.

Sensitive Personal Data:
None, unless expressly agreed by Moda in writing.

SCHEDULE 2
TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Moda maintains technical and organizational measures appropriate to the nature of the Processing and the risks presented by the Processing, including, as applicable:

• encryption of Customer Personal Data in transit and at rest;
• access controls based on business need and least-privilege principles;
• authentication and account-security controls;
• logging, monitoring, and detection mechanisms;
• vulnerability management and security testing;
• backup, recovery, and business-continuity measures;
• incident-response procedures;
• personnel confidentiality and security obligations;
• vendor and subprocessor security review processes;
• measures designed to support deletion and retention requirements; and
• periodic review of the effectiveness of applicable security measures.

Moda may update these measures from time to time, provided that it does not materially decrease the overall security of the Services during the applicable subscription term.

SCHEDULE 3
SUBPROCESSORS

Customer generally authorizes Moda to engage the following subprocessors in connection with the Services:

Moda may update this list from time to time in accordance with Section 4 of the DPA.