Data Processing Addendum

Last updated: October 8, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between WickedSelf LLC, doing business as SmashTheFeed ("Processor", "we" or "us"), and the Customer ("Controller" or "you"). It applies automatically when you accept the Terms, without a separate signature. Capitalized terms not defined here have the meaning given in the Agreement.

1. Definitions

2. Roles and scope

2.1 You are the controller (or "business") and we are the processor (or "service provider") of Customer Personal Data. Where you act as a processor for another controller (for example, an agency or franchisor acting for a business), we are your subprocessor, and you are responsible for obtaining any authorizations needed from that controller.

2.2 This DPA does not apply to personal information we process as a controller, such as account, billing and website visitor data, which our Privacy Policy covers.

2.3 The details of the processing are set out in Annex 1.

3. Your responsibilities

You are responsible for: the lawfulness of the Customer Personal Data you provide or have us collect from Connected Platforms; giving all notices and obtaining all consents and permissions required for us to process it under the Agreement, including from people who appear in your photos, videos and audio; the accuracy of your instructions; and not submitting Sensitive Data. You will not instruct us to process Customer Personal Data in violation of Data Protection Laws.

4. Our obligations

4.1 Instructions. We will process Customer Personal Data only on your documented instructions, which are the Agreement, your configuration and use of the Service, and any other reasonable written instructions you give us that are consistent with the Agreement. We will tell you if we believe an instruction violates Data Protection Laws, unless the law prohibits it. We may process Customer Personal Data where required by law, after telling you where legally allowed.

4.2 Confidentiality. We ensure that people authorized to process Customer Personal Data are bound by confidentiality obligations.

4.3 Security. We implement and maintain the technical and organizational measures described in Annex 2, which we may update as long as they do not materially reduce the overall level of protection.

4.4 CCPA and U.S. state law terms. We will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for a commercial purpose other than providing the Service; retain, use or disclose it outside the direct business relationship between you and us; or combine it with personal information we receive from others, except as permitted by Data Protection Laws (for example, to create Aggregated Data that does not identify any person, to improve the Service, or to detect security incidents and protect against fraud). We will comply with the obligations that apply to service providers and processors under those laws, will provide the same level of privacy protection they require, and will notify you if we can no longer meet them. You may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data. We certify that we understand and will comply with these restrictions.

4.5 De-identified data. Where we create de-identified data from Customer Personal Data, we will take reasonable measures to ensure it cannot be associated with an individual, publicly commit to maintain and use it in de-identified form, and not attempt to re-identify it.

5. Subprocessors

5.1 You give us general authorization to engage Subprocessors. Our current Subprocessors are listed on our Subprocessors page.

5.2 We will impose data protection terms on each Subprocessor that are at least as protective as this DPA, to the extent applicable to the services it provides, and we remain responsible for its performance of those obligations.

5.3 We will update the Subprocessors page at least 15 days before a new Subprocessor begins processing Customer Personal Data, except in an emergency affecting the Service's security or availability, in which case we will update it as soon as reasonably possible. You may object on reasonable data protection grounds by emailing privacy@smashthefeed.com within that period. We will try in good faith to resolve the objection; if we cannot, you may terminate the affected part of the Service, and we will refund any prepaid fees for the unused part of the current billing period for it. This is your sole remedy for an objection.

5.4 Connected Platforms you choose to connect (such as Meta, Google, TikTok or booking systems) are not our Subprocessors. Data you direct us to send to or receive from them is governed by your relationship with them.

6. Assisting you

6.1 Data subject requests. Taking into account the nature of the processing, we will provide reasonable assistance, through the Service's features or otherwise, to help you respond to requests from individuals to exercise their rights. If we receive a request directly that identifies you, we will forward it to you or tell the individual to contact you, and will not respond ourselves except to confirm the request was redirected, unless required by law.

6.2 Assessments and authorities. We will provide reasonable information you need to carry out data protection impact assessments and prior consultations with regulators required by Data Protection Laws, to the extent you do not otherwise have access to it.

6.3 Costs. Assistance beyond what the Service's features provide may be charged at our reasonable rates where the law permits.

7. Security Incidents

We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a Security Incident. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of records and individuals concerned, the likely consequences, and the measures taken or proposed. We will take reasonable steps to contain, investigate and mitigate the incident, and will provide reasonable information to help you meet your own notification obligations. Our notification is not an acknowledgement of fault or liability. Unsuccessful attempts that do not compromise security (such as pings, port scans and failed sign-in attempts) are not Security Incidents.

8. Deletion and return

After the Agreement ends, or when you delete your account, we will delete Customer Personal Data as described in our Privacy Policy, except where we must keep it by law, and except for copies in backups, which are deleted on our providers' normal backup cycles and protected in the meantime. You may export or download your content through the Service's features before termination; we are not otherwise obliged to return it.

9. Audits

On written request, no more than once in any 12-month period (or after a Security Incident, or where a regulator requires it), we will provide information reasonably necessary to demonstrate our compliance with this DPA, such as written answers to a reasonable security questionnaire and summaries of our security practices. If that information is not sufficient to meet a requirement of Data Protection Laws, you may conduct an audit, at your own cost, by an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours, in a way that does not disrupt our operations or reveal other customers' data, and subject to a mutually agreed scope. Audits of our Subprocessors are satisfied by the reports and certifications they make available.

10. International transfers

10.1 Customer Personal Data is processed in the United States and other countries where we and our Subprocessors operate.

10.2 To the extent Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. For the SCCs: Clause 7 (docking clause) applies; Option 2 (general authorization) applies to Clause 9, with the notice period in Section 5.3; the optional wording in Clause 11 does not apply; Clause 17 Option 1 applies with the law of Ireland; Clause 18 courts are those of Ireland; Annex I is Annex 1 of this DPA (you are the data exporter and we are the data importer); and Annex II is Annex 2 of this DPA.

10.3 For transfers subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner is incorporated, with its tables completed using the information in this DPA, and either party may end it as its Section 19 allows. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the competent authority being the Swiss Federal Data Protection and Information Commissioner.

10.4 If an approved transfer mechanism is invalidated or replaced, we will work with you in good faith to adopt an appropriate alternative.

11. Liability and precedence

Each party's liability under or in connection with this DPA, including the SCCs to the extent permitted by them, is subject to the limitations and exclusions of liability in the Agreement. If this DPA conflicts with the Agreement, this DPA controls as to the processing of Customer Personal Data. If the SCCs conflict with this DPA, the SCCs control.

Annex 1: Details of processing

Annex 2: Technical and organizational measures