Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the agreement between PerkUp, Inc., a Delaware corporation (“PerkUp”), and the customer identified on the applicable Order Form (“Customer”) governing PerkUp’s services (the “Agreement” — PerkUp’s Master Services Terms as incorporated by an Order Form, or another written services agreement between the parties that incorporates this DPA). This DPA is the “Data Terms” described in Section 15.1 of the PerkUp Master Services Terms. It applies to PerkUp’s Processing of Personal Data within Customer Data, and it reflects the parties’ agreement on that Processing.
No signature is required: this DPA is incorporated into the Agreement by Section 15.1 of the Master Services Terms and applies automatically to PerkUp’s Processing of Personal Data under the Agreement.
1. Definitions
“Applicable Data Protection Laws” means all laws and regulations applicable to PerkUp’s Processing of Personal Data under the Agreement, including, to the extent applicable, the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), and US Privacy Laws (defined in Section 12).
“Customer Data” has the meaning given in the Agreement.
“Personal Data” means Customer Data that relates to an identified or identifiable natural person.
“Processing” (and its cognates) means any operation performed on Personal Data, whether or not by automated means, as defined by Applicable Data Protection Laws.
“Security Incident” means a confirmed unauthorized access to, or acquisition, disclosure, accidental or unlawful destruction, loss, or alteration of, Personal Data in the possession or control of PerkUp or of a Sub-processor Processing it on PerkUp’s behalf. Unsuccessful attempts and activity that does not result in unauthorized access to, or acquisition, disclosure, destruction, loss, or alteration of, Personal Data — including blocked attacks, pings, port scans, denial-of-service attacks, and failed log-in attempts — are not Security Incidents. This definition supplements the Security Incident definition in the Master Services Terms by also covering unauthorized disclosure and the Sub-processor chain; the two definitions operate together and neither limits the other.
“SCCs” means the standard contractual clauses for the transfer of personal data to third countries annexed to European Commission Implementing Decision (EU) 2021/914.
“Sub-processor” means a third party PerkUp engages to Process Personal Data on Customer’s behalf in connection with the Services.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner.
Capitalized terms not defined in this DPA have the meanings given in the Agreement. “Controller,” “processor,” “data subject,” “supervisory authority,” and similar terms have the meanings given by Applicable Data Protection Laws.
2. Roles and scope of processing
2.1 Roles. Customer is the controller of Personal Data (or, where Section 4 applies, a processor acting on behalf of its own customers), and PerkUp Processes Personal Data as Customer’s processor. Each party will comply with Applicable Data Protection Laws as they apply to its role.
2.2 Documented instructions. PerkUp will Process Personal Data only on Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law to which PerkUp is subject (which, for Processing subject to the EU GDPR or the UK GDPR, means Union or Member State law or UK law, respectively; government and law-enforcement requests are governed by Section 10.4) — in which case PerkUp will inform Customer of that legal requirement before Processing, unless the law prohibits doing so on important grounds of public interest. Customer’s documented instructions are: (a) this DPA and the Agreement; (b) Customer’s and its users’ configuration of, and actions in, the Services (including orders placed, rewards sent, integrations connected, and settings chosen); and (c) any other written instructions the parties agree to in writing. Customer instructs PerkUp to Process Personal Data to provide, maintain, secure, and support the Services; to produce, fulfill, ship, and deliver orders (including disclosing recipient information as Section 6.5 describes); and to create aggregated and de-identified data as permitted by Section 15.3 of the Agreement. If PerkUp believes an instruction infringes Applicable Data Protection Laws, it will inform Customer without undue delay and may suspend the affected Processing until the parties resolve the issue; PerkUp is not obligated to assess the law of every jurisdiction that may apply to Customer.
2.3 Description of Processing. The subject matter, duration, nature and purposes of Processing, the types of Personal Data, and the categories of data subjects are described in Annex I.
2.4 Additional instructions. Instructions outside the scope of Section 2.2 require the parties’ prior written agreement, and PerkUp may charge a reasonable fee for complying with them where they require material additional work.
2.5 Affiliates. Where Customer’s Affiliates use the Services under the Agreement, this DPA — including the SCCs — applies to Personal Data of those Affiliates and their users, and references to Customer Data include that data. Customer enters into this DPA on behalf of each such Affiliate and warrants that it is authorized to do so; each such Affiliate is a controller (or, where Section 4 applies, a processor) of its Personal Data and a data exporter for purposes of Section 10. Affiliates exercise all rights under this DPA solely through Customer, which will coordinate their exercise so that the rights in Sections 6.3, 8, 9, and 11 are exercised once for Customer and its Affiliates together rather than separately by each entity, and the aggregate liability of and to Customer and its Affiliates remains subject to Section 15.1.
3. Customer responsibilities
3.1 Customer is responsible for the lawfulness of its Processing instructions, including having a lawful basis for the Processing; providing any required notices to, and obtaining any required consents and authorizations from, data subjects (including employees, gift recipients, and other individuals whose Personal Data Customer submits); and the accuracy, quality, and content of Personal Data it provides.
3.2 No special categories. The Services do not require, and PerkUp does not request, special categories of personal data (Article 9 GDPR), payment-card primary account numbers, government-issued identification numbers (except as Annex I describes for customs clearance), health information, or biometric data. Customer must not submit such data except as it may appear incidentally in free-text content Customer or its users author or in fields Customer configures for synchronization from its HRIS or directory systems (for example, employer-assigned leave-of-absence labels), and Customer is responsible for such submissions.
3.3 Customer-directed disclosures. Where Customer or its users connect, enable, or direct a disclosure of Personal Data to a third-party service — including identity providers, HRIS and directory systems, Slack and other workspace tools, CRM systems, and any integration Customer configures — that third party receives the data on Customer’s instructions, is not a Sub-processor, and Customer’s agreement with that third party governs its processing.
4. Customer as processor
Where Customer acts as a processor on behalf of its own customers or clients (each an “Underlying Controller”), the following applies: (a) Customer warrants that it is authorized to engage PerkUp as a sub-processor, to agree to this DPA (including the Sub-processors authorized under Section 6) on behalf of each Underlying Controller, and that its instructions to PerkUp reflect the Underlying Controllers’ instructions; (b) Customer remains PerkUp’s sole counterparty and point of contact, and PerkUp discharges any obligation owed to an Underlying Controller by performing it for Customer; and (c) for transfers subject to the GDPR, Module Three of the SCCs applies as Section 10 describes.
5. Confidentiality and personnel
PerkUp ensures that persons it authorizes to Process Personal Data are bound by written confidentiality obligations or are under an appropriate statutory duty of confidentiality, receive security and privacy training, and are granted access on a need-to-know basis consistent with Annex II.
6. Security; sub-processors
6.1 Security measures. PerkUp implements and maintains the technical and organizational measures described in Annex II, and will not materially diminish the overall protection of Personal Data during a subscription term. PerkUp maintains a security program audited annually under SOC 2 Type II and will maintain that attestation (or a successor certification providing at least equivalent assurance) during the term of the Agreement.
6.2 General authorization. Customer provides general written authorization for PerkUp to engage Sub-processors, subject to this Section 6. PerkUp’s current Sub-processors are listed at perkupapp.com/legal/data-subprocessors (the “Sub-processor List”), which identifies PerkUp’s Sub-processors, their purposes, and their locations — individually or, for per-order fulfillment partners, by category as Section 6.5 describes — and which is incorporated into this DPA by reference.
6.3 Notice of changes; objection. The Sub-processor List offers a mechanism to subscribe to change notifications. PerkUp will give at least thirty (30) days’ advance notice (via the subscription mechanism, by notice to the addresses Customer designates under Section 16, and by updating the Sub-processor List) before a new Sub-processor Processes Personal Data, except that where a Sub-processor must be replaced urgently for security, continuity, or legal reasons, PerkUp may make the replacement on the shortest notice the circumstances reasonably allow (in advance where possible) and will complete the notice as soon as reasonably practicable. Engaging a production, fulfillment, warehousing, or customs-brokerage partner within a category already identified on the Sub-processor List (as Section 6.5 describes) is within Customer’s existing authorization and the List’s category entries, and is not a new Sub-processor engagement requiring advance notice under this Section. Customer may object within thirty (30) days of notice on reasonable, documented data-protection grounds. The parties will work in good faith to resolve the objection (including by PerkUp proposing a reasonable alternative), and where Customer objects before the new Sub-processor has begun Processing Customer’s Personal Data, PerkUp will use commercially reasonable efforts to ensure that Sub-processor does not Process Customer’s Personal Data while the parties work to resolve the objection. If no resolution is reached within thirty (30) days of the objection, Customer may, as its sole and exclusive remedy, cease using and terminate only the affected Services or features that cannot be provided without the objected-to Sub-processor, on written notice. A termination under this Section is not a termination for PerkUp’s breach: it does not reduce or excuse amounts already incurred or committed under the Agreement (including Platform Fees for the then-current term and any Bulk Spend Commitment), creates no refund right, and does not affect the remainder of the Services.
6.4 Flow-down; responsibility. PerkUp enters a written agreement with each Sub-processor imposing data protection obligations materially as protective as this DPA with respect to the Personal Data the Sub-processor Processes, including a valid transfer mechanism where Applicable Data Protection Laws require one. Each such agreement requires the Sub-processor to notify PerkUp without undue delay of any incident affecting Personal Data so that PerkUp can perform Section 7. Where a Sub-processor Processes Personal Data subject to US Privacy Laws, PerkUp’s agreement with it imposes restrictions consistent with Section 12.2 (and, for de-identified data, Section 12.4). PerkUp remains responsible to Customer for each Sub-processor’s performance of PerkUp’s obligations under this DPA.
6.5 Fulfillment disclosures. The Services include producing, shipping, and delivering physical goods and rewards worldwide. Customer authorizes and instructs PerkUp to disclose recipient-level order information — name, delivery address, contact details, and order contents, sizing, and personalization — to production suppliers, fulfillment and warehousing partners, carriers, and customs brokers in or serving the production and destination regions (including, where Customer’s orders route there, production and destination regions outside the United States and the EEA — such as China, Hong Kong, India, and the United Arab Emirates — as identified on the Sub-processor List), in each case limited to what is needed to produce, clear, deliver, and support the order. These parties are identified on the Sub-processor List individually or by category, and on written request PerkUp will identify the specific production, fulfillment, warehousing, and customs-brokerage entities (and their locations) that Process Personal Data in connection with Customer’s orders. Carriers, postal and express delivery services, and customs authorities Process recipient data under their own terms of carriage, tariffs, or legal obligations, determining their own purposes and means: they receive that data as independent controllers and are not Sub-processors; Customer instructs PerkUp to disclose recipient data to them as this Section describes, and their processing is governed by their own terms and applicable law.
6.6 AI Sub-processors. Sub-processors providing artificial-intelligence capabilities are identified as such on the Sub-processor List, including the features they serve. Section 13 (AI Commitments) applies to all Processing by or through them.
7. Security incidents
7.1 Investigation and notice. PerkUp will investigate suspected Security Incidents without undue delay. Upon confirming a Security Incident, PerkUp will notify Customer in writing without undue delay, and in any event within seventy-two (72) hours of confirmation. “Confirming” (and “confirmation”) means establishing with reasonable certainty that a Security Incident has occurred; it does not require completing PerkUp’s investigation or remediation. PerkUp will not unreasonably delay confirmation and will not condition notice on completing its investigation or remediation: the initial notice will describe what PerkUp then knows — the nature of the incident, the categories and approximate volume of Personal Data and data subjects concerned (where known), the likely consequences (where known), a PerkUp contact point, and measures taken or planned — and PerkUp will supplement the notice in phases as its investigation progresses.
7.2 Legal floors. Where Applicable Data Protection Laws require notice to Customer in a shorter period, on a different trigger, or with different content, PerkUp will notify within the period, on the trigger, and with the content that law requires.
7.3 Cooperation. PerkUp will take reasonable steps to contain and remediate a Security Incident, and will provide information reasonably required for Customer to meet its own notification obligations (including under Articles 33 and 34 GDPR). PerkUp will not identify Customer in any public statement about a Security Incident without Customer’s prior written consent, except as required by law. Customer controls its own notifications to data subjects and authorities concerning its data.
7.4 No fault; Customer-caused incidents. PerkUp’s notice of a Security Incident is not an admission of fault or liability by either party. An incident caused by Customer’s or its users’ acts or omissions (including compromised Customer credentials not resulting from a PerkUp failure) is not of itself a breach of this DPA or the Agreement by PerkUp; PerkUp will still notify Customer of such an incident as this Section 7 provides where it is a Security Incident, will reasonably assist Customer with it, and may charge for investigation and remediation assistance beyond that notice and the Services’ tools as Section 8.3 provides. Incidents occurring solely in systems outside the possession or control of PerkUp and its Sub-processors are not Security Incidents and are outside this Section.
8. Data subject requests; assistance
8.1 Requests. Taking into account the nature of the Processing, PerkUp will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer’s obligation to respond to data subjects’ requests to exercise their rights (access, rectification, erasure, restriction, portability, objection). The Services’ self-service tools (administrator data management, exports, member and recipient record management) are the primary means of that assistance. If a data subject submits a request directly to PerkUp that identifies Customer, PerkUp will forward it to Customer within five (5) business days and will not respond substantively except to direct the data subject to Customer, unless law requires otherwise.
8.2 Other assistance. PerkUp will provide reasonable assistance with Customer’s data protection impact assessments, consultations with supervisory authorities, and compliance with Articles 32 to 36 GDPR (and equivalent provisions of other Applicable Data Protection Laws), in each case taking into account the nature of the Processing and the information available to PerkUp, and including reasonable cooperation with risk assessments, cybersecurity audits, and automated-decisionmaking compliance obligations under US Privacy Laws to the extent they concern PerkUp’s Processing.
8.3 Costs. Assistance under this DPA (including this Section 8 and Sections 7.4, 10.4, and 14) is provided at no charge to the extent it is self-service or requires only reasonable effort using information already available to PerkUp. Where requests are excessive, repetitive, or require material work beyond the Services’ tools and PerkUp’s standard security documentation, PerkUp may charge a reasonable, documented fee, and will tell Customer before incurring it.
9. Audits and security documentation
9.1 Security documentation. On written request and under confidentiality obligations, PerkUp will provide its then-current security documentation: its most recent SOC 2 Type II report, a summary of its most recent third-party penetration test, and the Sub-processor List. This documentation, together with the Annexes to this DPA, is PerkUp’s response to security due-diligence inquiries, and — as the Agreement provides — PerkUp will in addition complete one (1) reasonable written security questionnaire per rolling twelve (12) months, within thirty (30) days of receipt. On written request and under the same confidentiality obligations, PerkUp will also make available the additional information in its possession reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, to the extent the documentation above does not already provide it.
9.2 Audit rights. The documentation in Section 9.1 satisfies Customer’s audit and information rights under this DPA and Applicable Data Protection Laws in the first instance. Where (a) Applicable Data Protection Laws or Customer’s supervisory authority require an audit or inspection that the documentation cannot satisfy, (b) the documentation is insufficient to reasonably demonstrate compliance with this DPA, or (c) a Security Incident materially affecting Customer’s Personal Data has occurred in the preceding twelve (12) months, Customer (or an independent auditor it mandates that is not a PerkUp competitor, under written confidentiality obligations) may audit PerkUp’s compliance with this DPA: no more than once per rolling twelve (12) months (except for an audit a supervisory authority requires, or an audit under clause (c) following a Security Incident), on at least thirty (30) days’ written notice, during normal business hours, with scope agreed in advance, in a manner that does not access other customers’ data or unreasonably disrupt PerkUp’s operations, and at Customer’s cost (including PerkUp’s reasonable time at then-current rates where the audit exceeds one business day). Audit findings are Confidential Information of both parties. This Section, together with Section 9.1, is the parties’ agreed implementation of Clause 8.9 of the SCCs.
10. International transfers
10.1 Processing locations. PerkUp Processes Personal Data primarily in the United States (Google Cloud Platform), with Sub-processors in the locations stated on the Sub-processor List and fulfillment disclosures as described in Section 6.5.
10.2 Transfer mechanisms. Where Applicable Data Protection Laws require a transfer mechanism for Personal Data transferred to PerkUp or its Sub-processors, the transfer is made (in this order): (a) under an applicable adequacy decision (including, if PerkUp certifies in the future, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions); otherwise (b) under the SCCs, which are incorporated into this DPA by reference and deemed executed by the parties upon the DPA taking effect, completed as follows:
Module Two (controller → processor) applies where Customer is a controller; Module Three (processor → processor) applies where Section 4 applies, with Customer’s Underlying Controllers’ instructions conveyed through Customer.
Clause 7 (docking) is included. Clause 9(a): Option 2 (general written authorization), with the notice periods in Section 6.3 (thirty (30) days or, for urgent replacements under Section 6.3, as much advance notice as the circumstances reasonably allow). Clause 11(a): the optional independent-redress language is not included. Clause 13 / Annex I.C: where Customer is established in an EU member state, the supervisory authority of that member state; where Customer is not established in the EU but is subject to Article 3(2) GDPR and has appointed a representative under Article 27 GDPR, the supervisory authority of the member state where the representative is established; otherwise, the supervisory authority of a member state in which the data subjects whose data is transferred are located or, failing one, the Irish Data Protection Commission. Clause 17: the laws of Ireland. Clause 18: the courts of Ireland.
Annex I.A/I.B to the SCCs are completed by Annex I to this DPA; Annex II to the SCCs is completed by Annex II to this DPA; Annex III is the Sub-processor List.
10.3 UK and Switzerland. For transfers subject to UK data protection law, the UK Addendum applies: Table 1 is completed by Annex I.A of this DPA; Table 2 is completed by Section 10.2 (the SCCs as incorporated there, with the modules, clauses, and elections it states); Table 3’s Appendix Information is Annexes I and II of this DPA and the Sub-processor List (Annex III); and in Table 4, “Importer and Exporter” is selected; any replacement transfer instrument issued by the UK Information Commissioner applies per Section 10.5. For transfers subject to the FADP: references to the GDPR are read as references to the FADP; references to the EU and member states include Switzerland; the Swiss Federal Data Protection and Information Commissioner is the competent authority; and data subjects in Switzerland may enforce their rights in Switzerland.
10.4 Government requests. PerkUp has not created, and will not create, back doors or similar programmatic access for any government to Personal Data, and has not been subject to an order requiring it to do so. Unless legally prohibited, PerkUp will notify Customer before disclosing Personal Data in response to a government or law-enforcement request, will review the legality of each such request and — where PerkUp concludes there are reasonable grounds to consider it unlawful or over-broad — use commercially reasonable efforts to resist or narrow it (including as Clause 15.2 of the SCCs provides for SCC-governed transfers), and will disclose only the minimum required. On request, PerkUp will provide reasonable information and assistance for Customer’s transfer impact assessments, as assistance under Section 8 (including Section 8.3).
10.5 Successor instruments; fallback. If the European Commission, the UK Information Commissioner, or the Swiss authorities adopt instruments that replace or supplement the SCCs or UK Addendum, those instruments apply to the transfers they govern upon the earlier of their mandatory application or PerkUp’s publication of an updated DPA incorporating them. If a transfer mechanism this DPA relies on is invalidated or suspended, the parties will cooperate in good faith to implement a lawful alternative promptly, and PerkUp will suspend or conform the affected transfers to the extent Applicable Data Protection Laws require in the interim.
11. Return and deletion
11.1 During the term. Customer can retrieve Customer Data through the Services’ administrative and export tools during the term; for categories of Customer Data those tools do not cover, PerkUp will provide a reasonable export in a commonly used, machine-readable format within a reasonable time of Customer’s written request.
11.2 On termination. Upon termination or expiration of the Agreement, Customer Data remains available for electronic retrieval in a standard export format, at no charge, for thirty (30) days, as the Agreement provides; any other return method is assistance under Section 8 (including Section 8.3). Customer may request deletion of Personal Data in writing at any time after termination or expiration, and PerkUp will complete the requested deletion from its production systems within thirty (30) days of the written request, as the Agreement provides. Absent a written deletion request, PerkUp deletes Personal Data in the ordinary course under its standard data-retention schedule following the retrieval period. This Section 11 is the parties’ agreed implementation of the return-and-deletion requirements of Applicable Data Protection Laws (including Article 28(3)(g) GDPR and Clause 8.5 of the SCCs), with the choice between return and deletion exercised as this Section provides.
11.3 Carve-outs; backups. PerkUp may retain Personal Data that it must retain under applicable law, and aggregated or de-identified data as Section 15.3 of the Agreement provides; retained Personal Data remains protected by this DPA for as long as PerkUp holds it, and is Processed only for the purpose that justified its retention. Following deletion from production systems — which include PerkUp’s primary databases and the analytics stores derived from them — Personal Data remaining in backup and archival systems is not used for active Processing, remains protected by this DPA while retained, and is deleted or overwritten when the applicable backup copy expires under PerkUp’s backup retention schedule; PerkUp will not restore it except as needed for disaster recovery or as required by law, and will delete Personal Data so restored. On written request, PerkUp will certify in writing the deletion performed under this Section, and will describe its then-current standard data-retention schedule and the maximum length of its backup rotation cycle.
12. US state privacy laws
12.1 For purposes of this Section, “US Privacy Laws” means the California Consumer Privacy Act as amended (CCPA), and the comprehensive consumer privacy laws of other US states in effect from time to time that apply to the Processing (together with any similar US state law as it takes effect); “personal information,” “business purpose,” “commercial purpose,” “consumer,” “de-identified,” “sell,” “share,” “service provider,” “contractor,” and “processor” have the meanings given there. PerkUp Processes Personal Data as Customer’s service provider or processor (or, where US Privacy Laws treat the engagement as a contractor relationship, as Customer’s contractor, subject to the same restrictions). For this Section, Personal Data includes all personal information PerkUp Processes on Customer’s behalf under the Agreement.
12.2 The specific business purposes for which PerkUp Processes Personal Data are those identified in Annex I (Description of Processing): providing, maintaining, securing, and supporting the Services; producing, fulfilling, shipping, and delivering orders and rewards; sending Service communications and providing support; and creating aggregated and de-identified data as the Agreement permits. PerkUp will not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than those business purposes — including for any commercial purpose other than those business purposes, or outside the direct business relationship with Customer — except as US Privacy Laws permit; or (c) combine Personal Data with personal information it receives from other sources, except as US Privacy Laws permit (including to perform the Services or as consistent with the aggregated and de-identified data provisions of the Agreement). PerkUp certifies that it understands the restrictions in this Section 12.2 and will comply with them.
12.3 PerkUp will: comply with applicable obligations under US Privacy Laws and provide the same level of privacy protection as US Privacy Laws require (including as they require of businesses); notify Customer if it determines it can no longer meet its obligations under US Privacy Laws; and, upon notice, permit Customer to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data and — through the mechanisms in Section 9 — to help ensure that PerkUp uses Personal Data in a manner consistent with Customer’s obligations under US Privacy Laws. On Customer’s documented instruction given to comply with a verified consumer request, PerkUp will delete or correct the relevant Personal Data (and will direct affected Sub-processors to do the same), except where US Privacy Laws permit or require its retention; the Services’ self-service tools (Section 8.1) are the primary means of doing so. Customer’s audit and assessment rights under US Privacy Laws are satisfied as Section 9 provides; deletion and data subject requests are otherwise handled as Sections 8 and 11 provide; Sub-processor engagement is governed by Section 6 (each Sub-processor being bound as Section 6.4 requires).
12.4 De-identified data. Where PerkUp receives or creates de-identified data, PerkUp will: (a) take reasonable measures to ensure the data cannot be associated with any individual or household; (b) maintain and use the data only in de-identified form and not attempt to re-identify it; and (c) contractually obligate any recipient of the data to comply with the requirements of this Section 12.4. This published DPA is PerkUp’s public commitment to maintain and use de-identified data in de-identified form and not to attempt to re-identify it.
13. AI commitments
PerkUp will not use Customer Data — including Personal Data, and including inputs to and outputs of PerkUp’s AI-assisted features — to train, fine-tune, or improve any generative artificial-intelligence or foundation model, and this commitment extends to aggregated and de-identified data derived from Customer Data, as Section 15.3 of the Agreement provides. As that Section also provides, aggregated and de-identified data identifies neither Customer nor any individual, PerkUp does not sell Customer Data, and PerkUp never attempts to re-identify de-identified data. Sub-processors providing AI capabilities are identified as such on the Sub-processor List; PerkUp’s AI features do not send Personal Data to them, any Customer Data an AI Sub-processor receives is Processed solely to provide the Services, and they are contractually prohibited from using Customer Data to train their models.
14. Regulated customers; other jurisdictions
14.1 PerkUp acknowledges that Customer may be a financial institution or other regulated entity subject to service-provider oversight requirements (including the GLBA Safeguards Rule and SEC Regulation S-P). The measures in Annex II are designed to protect customer information consistent with the objectives of such requirements, and PerkUp will reasonably cooperate with Customer’s required service-provider oversight and assessments through the mechanisms in Section 9.
14.2 Where a mandatory provision of Applicable Data Protection Laws in another jurisdiction requires processor terms not contained in this DPA (for example, consignment terms under Korea’s PIPA or operator terms under Brazil’s LGPD), the parties will execute a reasonable jurisdiction-specific rider implementing the mandatory terms, which forms part of this DPA for the affected Processing.
15. Liability; precedence; term; updates
15.1 Liability. Each party’s and its affiliates’ aggregate liability arising out of or relating to this DPA (including the SCCs and any annex or rider), whether in contract, tort, or any other theory, is subject to the limitations and exclusions of liability in the Agreement (including Section 13 of the Master Services Terms), measured together in the aggregate with liability under the Agreement; this DPA does not change how that cap is calculated or shared. Nothing in this Section limits either party’s liability to data subjects or supervisory authorities under the SCCs or Applicable Data Protection Laws, or any other liability that cannot lawfully be limited.
15.2 Precedence. This DPA is subject to the Agreement as Sections 15.1 and 20.1 of the Master Services Terms provide, and does not amend, limit, or override any provision of the Agreement — including Section 13 (Limitation of Liability) and PerkUp’s rights under Section 15.3 of the Master Services Terms. In case of conflict, the Agreement prevails over this DPA to the extent of the conflict; a provision of this DPA that is additional to, or more specific than, the Agreement and that can be performed consistently with it is not a conflict. The SCCs, the UK Addendum, and the Swiss adaptations are standard terms whose content the parties cannot and do not vary: where they apply, they are entered into as a distinct agreement between the parties, and — notwithstanding anything else in the Agreement or this DPA — they prevail over this DPA and the Agreement to the extent of any conflict for the transfers they govern, and no provision of this DPA or the Agreement applies so as to modify them, exclude or limit a party’s obligations or liability to data subjects under them, or restrict data subjects’ rights under them. As between the parties only, liability remains subject to Section 15.1 of this DPA to the maximum extent the SCCs and Applicable Data Protection Laws permit.
15.3 Breach; remedies. A breach of this DPA is a breach of the Agreement, subject to the Agreement’s notice, cure, termination, and remedy provisions. This DPA creates no separate termination or refund right except as expressly stated in Section 6.3 and except any termination or suspension right the SCCs provide for the transfers they govern (which creates no refund right).
15.4 Term. This DPA is effective for as long as PerkUp Processes Personal Data under the Agreement, and Sections 11 and 15 survive until PerkUp’s Processing ends.
15.5 Updates. PerkUp may update this DPA from time to time by publishing a revised version at the address above, provided no update materially diminishes the protections for Customer Data, as the Agreement provides. Updates required to reflect changes in Applicable Data Protection Laws or successor transfer instruments take effect on publication. Each version is dated, and prior dated versions remain archived at the same address. The version in effect as the Agreement provides governs; an executed data processing addendum between the parties supersedes the published version.
16. Notices and contacts
Privacy and security notices to PerkUp: legal@perkupapp.com (privacy and other legal notices) and security@perkupapp.com (incidents). Notices to Customer under this DPA (including Security Incident notices and Sub-processor notices) go to the email addresses Customer designates in the Platform or on the Order Form, and the Sub-processor subscription mechanism described in Section 6.3. PerkUp’s privacy contact for data subjects and authorities is legal@perkupapp.com.
Annex I — Description of processing
(This Annex completes Annex I.A and I.B of the SCCs and Tables 1 and 3 of the UK Addendum.)
A. Parties. Data exporter: Customer (contact as stated on the Order Form), a controller (or processor, where Section 4 of the DPA applies). Data importer: PerkUp, Inc., 651 North Broad Street, Suite 206, Middletown, Delaware 19709, USA; legal@perkupapp.com; a processor. Activities relevant to the data transferred: the Processing described in Section B of this Annex. Signature and date: by entering into the Agreement, each party is deemed to have signed the SCCs, including their Annexes, and (where it applies) the UK Addendum, as of the date this DPA takes effect for Customer under the Agreement.
B. Description.
Subject matter and nature of Processing: provision of PerkUp’s employee rewards, recognition, gifting, and swag platform and related fulfillment services — hosting, storage, transmission, display, order production and delivery, roster synchronization, notification delivery, support, security, and service analytics.
Purposes: to provide, maintain, secure, and support the Services; to produce, fulfill, ship, and deliver orders and rewards; to send Service communications; to provide customer support; and to create aggregated and de-identified data as the Agreement permits.
Duration: the term of the Agreement plus the wind-down and deletion periods in Section 11 of the DPA.
Frequency: continuous, for as long as Customer uses the Services.
Categories of data subjects: (i) Customer’s administrators and other personnel using the platform; (ii) Customer’s employees and other members who receive rewards or participate in programs; (iii) gift and swag recipients, including recipients who are not Customer personnel (e.g., clients, candidates, event attendees); (iv) visitors and purchasers in Customer’s swag stores and redemption pages.
Categories of Personal Data: identity and contact data (name, work and personal email, phone); business and employment attributes synchronized from Customer’s HRIS or directory at Customer’s configuration (title, department, manager, location, start date, employment status, and leave-of-absence information, including status dates and any employer-assigned status or leave-type labels Customer’s HRIS supplies); dates of birth and work anniversaries where Customer enables them; shipping and delivery data (addresses, phone numbers, delivery instructions); national or tax identification numbers collected solely where destination-country customs clearance requires them (e.g., Brazil CPF, China Resident ID, Korea PCCC), used only for that purpose; photos and images voluntarily uploaded; free-text content authored by users (recognition and thank-you messages, gift notes); reward, order, redemption, and balance data; payment-instrument references limited to tokens and non-sensitive metadata (PerkUp does not store cardholder numbers — payments are processed by Stripe); device and usage data, including session-replay and product-analytics data collected for service quality, support, and security.
Special categories: none required or requested; the Services are not designed to Process special categories of personal data, and Customer agrees not to submit them except as they may appear incidentally in user-authored free text or in fields Customer configures for synchronization (Section 3.2 of the DPA).
Retention: for the duration described above, then returned or deleted per Section 11 of the DPA.
Transfers to Sub-processors: as described in Sections 6 and 10 of the DPA and the Sub-processor List; recipient shipping data is disclosed to production, fulfillment, carrier, and customs partners in the production and destination regions as needed to produce and deliver each order, in each case for the duration of the order or engagement concerned plus any legally required retention period.
C. Competent supervisory authority: identified in accordance with Clause 13 of the SCCs as Section 10.2 of the DPA states (for a Customer established in an EU member state, that member state’s supervisory authority).
Annex II — Technical and organizational measures
(This Annex completes Annex II of the SCCs and forms part of Table 3 of the UK Addendum. PerkUp’s security program is audited annually under SOC 2 Type II; the current report is available under Section 9.1 of the DPA.)
Governance and attestation: an information-security program with defined ownership, policies, and risk assessments, audited annually under SOC 2 Type II; annual third-party penetration testing with risk-based remediation of findings (summaries available under Section 9.1).
Access control: role-based access on least-privilege principles; logical tenant separation enforced at the database rule layer (customer data is partitioned by organization and access-checked on every read and write); deny-by-default access for external principals; server-mediated writes for financial and balance records; administrative and staff access gated by multi-factor authentication (time-based one-time-password second factor), with re-authentication required for sensitive operations and privileged-access changes logged.
Encryption: encryption in transit (TLS 1.2+) and at rest (provider-managed keys on Google Cloud Platform); application-layer AES-256-GCM encryption for high-sensitivity tokens and credentials; secrets managed in a dedicated secret-management service under least-privilege access controls; enforced TLS for email delivery (MTA-STS).
Infrastructure: hosted on Google Cloud Platform (United States), inheriting Google’s physical and environmental controls (ISO 27001, SOC 2); infrastructure defined as code with least-privilege service accounts, uniform bucket-level access, object versioning, and audit-log alerting; separated production and non-production environments, with production Personal Data not used in development or test environments.
Monitoring and logging: centralized logging and alerting on security-relevant events; security logs retained for at least thirty (30) days; error and anomaly monitoring on production services.
Vulnerability management: regular vulnerability scanning and dependency patching; risk-based remediation; annual third-party penetration test.
Resilience: daily backups of production data; redundancy via the cloud provider’s multi-zone infrastructure; business continuity and disaster recovery procedures appropriate to the Services.
Personnel: background checks where legally permitted; confidentiality obligations; security and privacy training on hire and periodically.
Data minimization controls: customer-configurable synchronization of HRIS fields (with sensitive-field blocking and an allow-list for custom fields); customer-controlled visibility settings for dates of birth; purpose-limited collection of customs identifiers; payment-card data handled solely by PerkUp’s PCI-DSS Level 1 payment processor.
Sub-processor management: written agreements per Section 6.4 of the DPA; a published, maintained Sub-processor List with advance notice of changes.
Annex III — Sub-processors
PerkUp’s current Sub-processors, their purposes, and locations are published at perkupapp.com/legal/data-subprocessors, which is incorporated by reference and offers a subscription mechanism for change notices. The list identifies (a) infrastructure, platform, and service Sub-processors individually, including Sub-processors providing AI capabilities (identified as such, with the features they serve); and (b) production, fulfillment, warehousing, and customs-brokerage partners engaged per order, individually or by category, by production and destination region. Carriers, postal operators, and customs authorities are identified by category for transparency as independent controllers (Section 6.5 of the DPA).
Effective: October 26, 2026