Data Processing Addendum

Capitalized terms not defined in this DPA have the meaning given in the Terms. For the purposes of this DPA:

• "Data Protection Laws" means all laws and regulations applicable to the processing of Personal Data under this DPA, including the GDPR, the UK GDPR, and applicable U.S. state privacy laws.
• "Controller," "Processor," "Data Subject," "Personal Data," and "Processing" have the meanings given in the GDPR (and equivalent terms such as "Business," "Service Provider," and "Consumer" under U.S. state privacy laws apply correspondingly).
• "Member Personal Data" means Personal Data of your community members that TradeUniv processes on your behalf in connection with the Platform.
• "Sub-processor" means any third party engaged by TradeUniv to process Member Personal Data.

With respect to Member Personal Data processed in connection with your community, the parties agree that you (the Creator) are the Controller and TradeUniv is the Processor, acting on your documented instructions. TradeUniv remains an independent Controller for the limited purposes described in our Privacy Policy (for example, platform security, fraud prevention, billing TradeUniv to Creators, and improving the Platform), and this DPA does not apply to that independent-Controller processing.

Where TradeUniv acts as a "Service Provider" or "Processor" under U.S. state privacy laws, TradeUniv will not sell or share Member Personal Data, and will not retain, use, or disclose it for any purpose other than performing the services or as permitted by Data Protection Laws.

Subject matter and duration: TradeUniv processes Member Personal Data for the duration of your use of the Platform and until deletion in accordance with Section 9 (Return and Deletion).

Nature and purpose: TradeUniv processes Member Personal Data solely to provide the Platform to you, including to: enable your community functions (membership, access control, content delivery, messaging, and Discord and third-party integrations you enable); provide analytics and engagement insights about your community; and manage subscriptions, payments, and revenue on or through the Platform.

Types of Personal Data: name, email address, account and profile identifiers, Discord IDs and usernames, community membership and tier data, payment-related identifiers (such as payment-processor customer IDs), and platform activity data (such as logins, content views, watch time, points, and engagement metrics).

Categories of Data Subjects: your community members, prospective members, and other individuals whose Personal Data you submit to or collect through the Platform.

TradeUniv agrees that it will:

• Process on documented instructions: process Member Personal Data only on your documented instructions (including as set out in this DPA, the Terms, and your configuration of the Platform), unless required to do otherwise by applicable law, in which case TradeUniv will inform you of that legal requirement unless prohibited from doing so.
• Confidentiality: ensure that personnel authorized to process Member Personal Data are bound by appropriate obligations of confidentiality.
• Security: implement appropriate technical and organizational measures to protect Member Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art and the risks of the processing. A summary of these measures is set out in Annex B.
• Personal data breach notification: notify you without undue delay after becoming aware of a Personal Data breach affecting Member Personal Data, and provide information reasonably available to TradeUniv to assist you in meeting your own breach-notification obligations.
• Assistance with Data Subject rights: taking into account the nature of the processing, provide reasonable assistance (including, where appropriate, by making available self-service tooling) to help you respond to requests by Data Subjects to exercise their rights under Data Protection Laws.
• Assistance with compliance: provide reasonable assistance with your data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to TradeUniv.

General authorization: You provide TradeUniv with general authorization to engage Sub-processors to process Member Personal Data, including the categories listed in Annex C. TradeUniv will impose data protection obligations on each Sub-processor that are substantially similar to those in this DPA, and remains responsible for its Sub-processors' performance of those obligations.

Changes to Sub-processors: TradeUniv will maintain the list of Sub-processor categories in Annex C and will make a reasonable effort to give notice (for example, by updating this page) before authorizing a new Sub-processor that materially changes the processing. If you reasonably object to a new Sub-processor on legitimate data protection grounds, your sole remedy is to stop using the affected feature or to terminate your community.

You are responsible for your own compliance with Data Protection Laws as Controller. You represent, warrant, and covenant that:

• You have a valid lawful basis (and, where required, have obtained and will maintain all necessary consents) to collect, share, and process Member Personal Data through the Platform, including any data you import into or collect through TradeUniv.
• You will provide your members with all legally required privacy notices and disclosures, including disclosure of your use of TradeUniv and any third-party integrations, trackers, or pixels you enable.
• You are responsible for managing your members' opt-outs, marketing preferences, and the lawfulness of any communications you send to them.
• Your instructions to TradeUniv for the processing of Member Personal Data will comply with Data Protection Laws, and you are responsible for the accuracy, quality, and legality of Member Personal Data and the means by which you acquired it.
• You will not use the Platform to process special categories of data or data relating to children under the age of majority, except as expressly permitted by the Terms and applicable law.

TradeUniv operates from the United States, and Member Personal Data may be processed in the United States and other countries. To the extent your transfer of Member Personal Data to TradeUniv requires an approved transfer mechanism under Data Protection Laws, the parties agree that the European Commission's Standard Contractual Clauses (Module Two: Controller to Processor) and, for UK transfers, the UK International Data Transfer Addendum, are incorporated into this DPA by reference and apply to such transfers. Where those clauses require selections, the governing law and forum are those of the relevant clauses, and TradeUniv's contact details in Section 11 serve as the data importer's contact point.

TradeUniv will make available to you information reasonably necessary to demonstrate compliance with this DPA. Any audit right under Data Protection Laws will be satisfied, where available, by TradeUniv providing relevant documentation, security summaries, or third-party certifications. On-site audits, where strictly required by Data Protection Laws, will be limited to once per twelve-month period, conducted on reasonable prior written notice, during business hours, subject to confidentiality obligations, in a manner that does not disrupt TradeUniv's operations or compromise the data of other Creators, and at your expense.

This DPA takes effect when you accept it and continues for as long as TradeUniv processes Member Personal Data on your behalf. Upon termination of your community or your decoupling of connected services (such as disconnecting your payment-processor account), TradeUniv will cease processing Member Personal Data on your behalf and will delete or anonymize it in accordance with TradeUniv's standard retention practices, except to the extent TradeUniv is required to retain it by applicable law or retains it as an independent Controller (for example, transaction records required for tax, accounting, fraud-prevention, or legal-defense purposes).

Consistent with Section 7 of the Terms (Data Portability and Stripe Account Disconnection), where you process Member Payments through your own connected payment-processor account, that account and its billing records remain under your ownership and control; TradeUniv does not export payment tokens or recreate active subscription plans on competing software.

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Terms, and any reference in the Terms to a party's liability means the aggregate liability of that party under the Terms and this DPA combined.

In the event of a conflict between this DPA and the Terms with respect to the processing of Member Personal Data, this DPA controls. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control. Except as expressly modified by this DPA, the Terms remain in full force and effect.

For any questions about this DPA or to exercise rights related to data protection, contact us at the addresses below.

• Controller: the Creator.
• Processor: Prime Edge Systems LLC (operating as TradeUniv).
• Subject matter: processing of Member Personal Data to provide the Platform.
• Duration: the term of your use of the Platform plus the retention period in Section 9.
• Nature and purpose: as described in Section 3.
• Types of Personal Data: as described in Section 3.
• Categories of Data Subjects: as described in Section 3.

TradeUniv maintains appropriate technical and organizational security measures, which may include:

• Encryption of data in transit (TLS) and application-layer encryption of sensitive data.
• Role-based access controls and the principle of least privilege for personnel access to Member Personal Data.
• Authentication controls, including support for OAuth-based sign-in and account security measures.
• Network, infrastructure, and application security controls, including rate limiting and abuse protection.
• Logging, monitoring, and regular database backups, including encrypted off-site backups retained in object storage.
• Use of reputable infrastructure, payment, and communications Sub-processors that maintain their own recognized security practices.

TradeUniv engages the following categories of Sub-processors to process Member Personal Data in connection with the Platform:

• Payment processing: Stripe, Whop, and Gumroad (subscription billing, checkout, and payouts).
• Community and messaging integrations: Discord and other integrations you enable for your community.
• Cloud hosting and infrastructure: hosting, database, storage, and content-delivery providers used to operate the Platform.
• Communications: transactional email and notification providers.
• Analytics and operations: providers used for product analytics, error monitoring, and platform operations.

This list describes categories of Sub-processors and may be updated as described in Section 5. For the specific identity of a Sub-processor in any category, contact [email protected].