Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between
ManageCanvas ("Processor", "we") and the Artist ("Controller", "you"). It applies where we process
personal data of your buyers, contacts, and site visitors ("Buyer Data") on your behalf. Where you
sell to individuals in the EU/UK, this DPA implements Article 28 GDPR obligations.

1. Roles

You are the controller of Buyer Data collected through your storefront (orders, contact messages,
marketing contacts, and the personal data in certificates). We are your processor for that data. We
are an independent controller for your account data and platform analytics, which are governed
by our Privacy Policy, not this DPA.

2. Scope and instructions

We process Buyer Data only to provide the Service and on your documented instructions (your
configuration and use of the Service being such instructions), and as required by law (we will tell
you first unless the law forbids it). Subject matter, duration, nature, purpose, data types, and
data-subject categories are described in the Annex below.

3. Confidentiality and security

Personnel who process Buyer Data are bound by confidentiality. We maintain technical and
organizational security measures appropriate to the risk, including encryption in transit, encryption
of payment credentials at rest, access controls, tenant isolation (Buyer Data is scoped to your
account), and audit logging of administrative actions.

4. Sub-processors

You authorize us to engage the sub-processors listed on our
Sub-processors page to process Buyer Data as needed to provide the Service
(payments, print fulfilment, shipping quotes, hosting, email, and media processing). We impose data-
protection terms on each. We will update that page and give you a way to be notified of changes; you
may object on reasonable data-protection grounds.

5. Data-subject requests

The Service gives you tools to access, export, correct, and erase Buyer Data yourself (in your
dashboard). We will additionally assist you, taking into account the nature of processing, to respond
to data-subject requests you cannot fulfil through those tools.

6. Personal-data breaches

We will notify you without undue delay after becoming aware of a personal-data breach affecting your
Buyer Data, with the information you reasonably need to meet your own notification obligations.

7. Deletion and return

On termination, or on your instruction, we will delete or return Buyer Data, except copies we must
retain by law and delivered certificates (permanent public attestations that do not contain buyer
personal data once scrubbed). Our tools let you export before deletion.

8. Audits

We will make available information reasonably necessary to demonstrate compliance with Article 28 and,
on reasonable notice and confidentiality terms, allow audits limited to that purpose (which may be met
by third-party reports where available).

9. International transfers

Where Buyer Data is transferred out of the EEA/UK to a country without an adequacy decision, the
parties agree that the applicable Standard Contractual Clauses [REVIEW BY COUNSEL: select module
and complete] are incorporated by reference, with us as data importer for the relevant flows and our
sub-processors bound by equivalent terms.

Annex — details of processing

• Subject matter / duration: provision of the Service for the term of your account.
• Nature and purpose: hosting your storefront; recording and fulfilling orders; issuing
  certificates; sending transactional and (opt-in) marketing email on your behalf; quoting shipping.
• Categories of data subjects: your buyers, people who contact you, and your marketing contacts.
• Categories of personal data: name, email, postal/shipping address, phone, order and certificate
  details, message content, and marketing-consent status. No payment-card data (handled by the
  payment provider) and no special-category data are intended to be processed.

Contact

privacy@managecanvas.com

Draft pending legal review. This is contractual language and must be reviewed and completed by
qualified counsel, including selection and completion of Standard Contractual Clauses.