Data Processing Agreement

Version 2026-10-14.

This Data Processing Agreement ("DPA") is part of the Terms of Service between Pixel Studio AI, Inc. ("Huuve", "we", "us") and the business that uses Huuve ("you", "the customer"). You accept it, on behalf of your business, when you accept the Terms while creating a workspace. No separate signature is needed.

1. Roles

• You are the controller of the personal data you bring into Huuve or that Huuve receives from the channels you connect.
• We are your processor for that data. We process it only to run Huuve for you, on your documented instructions.
• For our own account, billing, security and product data, we are a controller. Our Privacy Policy covers that processing, not this DPA.

2. What we process, and why

3. Your instructions

We process personal data only on your documented instructions. The Terms, this DPA and what you do in Huuve (what you connect, ask for and approve) are your instructions. If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you first unless the law forbids it.

4. Confidentiality

Everyone at Huuve who can access personal data is bound by confidentiality and accesses it only as needed to run and support the service.

5. Security

We take the technical and organisational measures described in Annex 1, appropriate to the risk. We may improve them over time, but never below the level described there.

6. Subprocessors

You give us general written authorisation to use subprocessors. The current list is in Annex 2. Each subprocessor is bound by a written contract with data protection obligations no less protective than this DPA, and we remain responsible for them.

We will tell you at least 30 days before we add or replace a subprocessor, by email or in the product. You may object on reasonable data protection grounds within that time. If we cannot address your objection, you may end the affected part of the service, and we will refund any fees you paid in advance for it.

7. Helping you

• Requests from people. Taking into account what the service does, we help you answer requests from data subjects to access, correct, delete, restrict, move or object to their data. If someone contacts us directly about data you control, we pass the request to you.
• Assessments. We give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority about Huuve.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we tell you without undue delay, and within 48 hours of becoming aware of it. We tell you what we know (what happened, the data and people affected, likely consequences, and what we are doing about it) and follow up as we learn more. We take reasonable steps to contain it.

9. Deletion at the end

When you delete your workspace, it and its data are deleted at the end of your paid period, and no later than 30 days after you delete it. Until then you can restore it or export what you need. Copies held in backups and system logs are deleted as those expire in the normal course and stay protected until then. We keep data longer only where the law requires it.

10. Audits

We make available the information you need to show that we meet Art. 28 GDPR, including a description of our measures and our subprocessors. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do so, once a year on at least 30 days' written notice, during business hours and in a way that does not disrupt the service or other customers' data. You bear your own audit costs.

11. International transfers

We are based in the United States, and personal data may be processed there and in other countries where our subprocessors operate. Where data from the European Economic Area, Switzerland or the United Kingdom is transferred to a country without an adequacy decision, the transfer is protected by:

• the European Commission's Standard Contractual Clauses (Decision 2021/914): Module 2 (controller to processor) between you and us, and Module 3 (processor to processor) between us and our subprocessors, incorporated into this DPA by reference;
• for the United Kingdom, the UK International Data Transfer Addendum to those clauses, and for Switzerland, the clauses as adapted for Swiss law;
• where a recipient is certified under the EU-US Data Privacy Framework (or its UK and Swiss extensions), that certification.

For the clauses: the governing law and courts are those of Ireland, the competent supervisory authority is the one that is competent for you, and the optional docking clause applies. Annexes 1 and 2 of this DPA give the information the clauses' annexes ask for, together with section 2.

12. Liability and order

Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow it to be limited. If this DPA and the Terms conflict on the protection of personal data, this DPA wins. If the Standard Contractual Clauses conflict with this DPA, the clauses win.

13. Changes and contact

We may update this DPA to reflect changes in law or in the service. We will tell you about material changes before they take effect, and an update never lowers the protection of your data. Questions go to legal@huuve.com.

Annex 1. Security measures

• Encryption. Data is encrypted in transit (TLS) and at rest by our hosting providers.
• Access control. Only the members of your workspace can see its data. Our staff access it only to run and support the service, with individual accounts protected by strong sign-in.
• Least privilege. Systems and people get only the access their task needs. Secrets and API keys are kept in a secret manager, never in code.
• Separation. Each workspace's data is kept apart by workspace, and the database rules enforce who can read and write it.
• Logging. Changes record who made them and when, and our providers keep access and system logs.
• Backups and resilience. We run on managed cloud infrastructure with replication and recovery built in.
• Vendors. We review each subprocessor's security and data protection terms before using it.
• People. Everyone with access is bound by confidentiality.
• Incidents. We follow section 8 for any personal data breach.

Annex 2. Subprocessors

The location of each subprocessor and the transfer safeguard it relies on are available from legal@huuve.com.