DATA PROCESSING AGREEMENT Last updated on 17 October 2026 1. WHAT THIS AGREEMENT IS This agreement is between you, the customer who holds a Reelwire workspace ("you"), and Tim Zierer, trading as Reelwire, Calle 47A x 47Y 100-1 #818, Fraccionamiento Las Americas 2, 97302 Merida, Yucatan, Mexico, sole trader ("we"). It is part of our Terms and Conditions and applies automatically, with nothing to sign, wherever we process personal data on your behalf and the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection or a similar law applies to that processing. Where Mexican data protection law applies, we are your encargado under the same terms. You are the controller of that data and we are your processor. Words such as "personal data", "processing", "controller", "processor", "sub-processor" and "personal data breach" mean what they mean in the GDPR. If you need a copy signed by both of us, write to contact@reelwire.io and we will send one with the same text. Where this agreement and the Terms and Conditions disagree about personal data we process for you, this agreement prevails. 2. WHAT WE PROCESS FOR YOU Subject matter: running Reelwire for your workspace, as the Terms and Conditions describe. Duration: for as long as your workspace exists, and then until the data is deleted as section 10 describes. Nature and purpose: storing what you put into Reelwire; rendering it into video clips; handing clips and their texts over by email, by webhook and through the platform connectors you switch on; passing them on to your syndication participants; keeping the records of your workspace, including, on Enterprise, its compliance record; and helping you when you ask us to. Personal data, as far as you put it there: - the personal data in your workspace's content: names, pictures, voices and other details of people shown or named in the media, posts, brands and data you upload or send over the API; - your syndication participants' details: email addresses, webhook addresses and the contact address given for them, the participant ID your own site passes, the channels they chose, and the record of what was sent to them; - the names and addresses of the people in your workspace, as your workspace's records and compliance record keep them beside what each of them did. Data subjects: people shown or named in your content; your syndication participants; the people in your workspace; and anybody else whose details you send us. Special categories: Reelwire is not made for special categories of personal data (such as health, religion or political opinions) or for data about criminal convictions. Do not put them into Reelwire unless the law allows you to and you have told us first. The personal data we decide on ourselves, such as your account, your billing details and the server logs, is described in our Privacy Policy and is not covered by this agreement. 3. YOUR INSTRUCTIONS We process the data in section 2 only on your documented instructions, transfers included. Your instructions are the Terms and Conditions, this agreement, and what you and your workspace do in Reelwire: the settings you choose, the content you send, the API calls your keys make and the approvals you give. Further instructions need to be agreed in writing. If the law makes us process the data in another way, we will tell you before we do, unless that law forbids telling you. If we believe an instruction infringes data protection law, we will tell you at once and may hold it until you confirm or change it. 4. THE PEOPLE WHO PROCESS IT Everybody we allow to process the data is bound to confidentiality, by contract or by law, and only processes it as far as their work for Reelwire needs. 5. SECURITY We keep the data secure with the technical and organisational measures in Annex 1, which take into account the state of the art, the cost, and the nature, scope, context and purposes of the processing and its risks to people. We may improve them; we will not make them less protective. 6. SUB-PROCESSORS You authorise us generally to use sub-processors. Those we use today are in Annex 2. Before we add or replace one, we will update Annex 2 and tell the owners of affected workspaces by email at least 30 days ahead. You may object on reasonable data protection grounds within those 30 days. If we cannot meet the objection, you may end your subscription before the change takes effect, and we will refund the unused part of a period you have paid for. Every sub-processor is bound by contract to data protection obligations that protect the data at least as well as this agreement does. We remain responsible to you for what our sub-processors do. The services you choose yourself are not our sub-processors: the AI services you connect with your own keys, the platforms your platform connectors post to, the webhook addresses and posting services you hand clips to, the mail server you give for your syndication emails, and your syndication participants. They receive what you or your workspace send them, on your instruction, under your own agreement with them. 7. TRANSFERS OUTSIDE THE EUROPEAN UNION The servers that hold the data are in the European Union (Annex 2). We are established in Mexico, and we reach the data from there to run and support the service; some sub-processors in Annex 2 are in the United States. For a transfer of personal data from the European Economic Area to us, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), apply and are part of this agreement, with you as the data exporter and us as the data importer, as follows: - clause 7 (docking clause) applies; - clause 9: option 2, general authorisation, with the 30 days of notice in section 6; - clause 11: the optional wording does not apply; - clause 13: the supervisory authority competent for you; - clause 17: the law of the EU member state in which you are established, or, where that law does not allow third-party beneficiary rights, the law of Ireland; - clause 18: the courts of that member state; - Annexes I, II and III of the clauses are filled in by section 2 and sections 1 and 2 of this agreement, by Annex 1 and by Annex 2. For a transfer from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies on top of those clauses. For a transfer from Switzerland, the same clauses apply with the Swiss Federal Act on Data Protection in place of the GDPR where that act governs, and the Swiss Federal Data Protection and Information Commissioner as the competent authority. Our sub-processors in the United States receive the data under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses, as Annex 2 says. 8. HELPING YOU If somebody asks us to exercise their rights over data we process for you, we will pass the request on to you without undue delay and not answer it ourselves, except to tell them we have done so. Reelwire lets you find, correct, export and delete that data yourself: your media library, your posts and their texts, your syndication participants and what each was sent. Where you cannot, we will help you, as far as the nature of the processing allows. We will also help you, taking into account the nature of the processing and the information we have, to keep the data secure, to deal with a personal data breach, and to carry out a data protection impact assessment or consult a supervisory authority where you have to. 9. PERSONAL DATA BREACHES If we become aware of a personal data breach affecting data we process for you, we will tell you without undue delay, and where we can within 48 hours, by email to your workspace's owners. We will say what happened, which data and people are likely to be affected, what it is likely to mean, and what we have done and propose to do about it, and add what we learn as we learn it. Telling you is not an admission of fault. 10. AT THE END You can download your media, your clips and, on Enterprise, your compliance record's export before you delete your workspace. When the workspace is deleted, the data we processed for you is deleted from the service at once, the working copies a renderer made within a day, and any copy that remains in logs or other records within 30 days, unless the law requires us to keep it. A workspace that leaves Enterprise keeps its compliance record for 90 days for a last export, and then it is deleted. 11. SHOWING THAT WE COMPLY, AND AUDITS We will make available to you the information needed to show that we meet this agreement and Article 28 of the GDPR, and answer a reasonable security questionnaire once a year. Where that is not enough, you, or an independent auditor you appoint who is bound to confidentiality, may audit our compliance with this agreement once a year, or more often where a supervisory authority requires it or after a personal data breach. Ask us at least 30 days ahead, in writing; the audit takes place in working hours, at your cost, and so as not to disturb the service or reveal other customers' data. The data centres themselves are our hosting provider's, and for them we rely on that provider's own audits and certifications. 12. LIABILITY, AND WHAT ELSE APPLIES Each of us is liable under this agreement as the Terms and Conditions say, except where the law does not allow liability to be limited. Where this agreement and the standard contractual clauses in section 7 disagree, the clauses prevail. Otherwise this agreement is governed by the law and the courts the Terms and Conditions name. 13. CHANGES We may change this agreement when the law, our sub-processors or the service change. A change that makes it less protective for you will be notified to account holders by email at least 30 days before it takes effect, as the Terms and Conditions describe, and the date at the top will move. ANNEX 1: TECHNICAL AND ORGANISATIONAL MEASURES - Traffic to and from Reelwire is encrypted in transit. - Credentials kept for use are encrypted at rest: keys for AI services, platform connector credentials, API keys kept for copying again, mail server passwords, and the secrets of two-factor sign-in. Passwords and API keys are stored as one-way hashes. - Every workspace's data is kept apart from every other's by the application, which adds the workspace to every request it makes of the database. - People sign in with a password, and can add two-factor sign-in with an authenticator app. One signed-in session at a time per person, ended after an hour without use. - Inside a workspace, each person holds only the permissions they are given, API keys hold only the areas they are given, and an audit log records what changed and who changed it. - Approval before anything goes out, Stop everything, planned silences and, on Enterprise, a sealed compliance record, so that you control and can prove what was published. - The servers are in the European Union, in data centres run by a provider with its own physical security and certifications (Annex 2). Administrative access is limited to the people who operate the service and protected beyond a password. - Server logs, which hold IP addresses, are deleted after 30 days. - Every change to the software is recorded before it is deployed, and the same recorded version runs on every server. ANNEX 2: SUB-PROCESSORS Hetzner Online GmbH, Germany: hosting. The service runs in Hetzner's data centre near Helsinki, Finland (operated by its subsidiary Hetzner Finland Oy); our development systems run in its data centre in Nuremberg, Germany. Both are in the European Union. AC PM LLC (Postmark), United States: sending emails, including the emails that hand posts over and the emails to your syndication participants. EU-U.S. Data Privacy Framework, and the European Commission's standard contractual clauses as an alternative. Google LLC (Google Workspace), United States: our mailboxes, which hold what you or your people write to us, including anything you send us for support. EU-U.S. Data Privacy Framework, and the European Commission's standard contractual clauses. Contact for anything about this agreement: contact@reelwire.io, or the postal address in section 1.