Data Processing Agreement

1. Definitions

"Applicable Data Protection Law" means all laws applicable to the processing of Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended ("CCPA"), and Chilean Law No. 19.628 as amended by Law No. 21.719. "Personal Data", "processing", "data subject", "controller", "processor", "business" and "service provider" have the meanings given in Applicable Data Protection Law. "Customer Personal Data" means Personal Data contained in Customer Content processed by Snapflow on Customer's behalf. "Subprocessor" means a third party engaged by Snapflow to process Customer Personal Data. "SCCs" means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914.

2. Roles and Scope

Customer is the controller (or a processor acting on behalf of another controller) and Snapflow is the processor of Customer Personal Data. Each party will comply with its obligations under Applicable Data Protection Law. Details of the processing are set out in Annex A. Where the CCPA applies, Snapflow acts as a "service provider", will not sell or share Customer Personal Data, and will not retain, use or disclose it for any purpose other than providing the Service or as permitted by the CCPA.

3. Customer Instructions

Snapflow will process Customer Personal Data only on Customer's documented instructions, including as set out in the Agreement, this DPA and Customer's configuration and use of the Service, unless required otherwise by law (in which case Snapflow will inform Customer unless legally prohibited). Snapflow will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Customer is responsible for the lawfulness of the Personal Data it submits and for providing any required notices and obtaining any required consents.

4. Confidentiality and Personnel

Snapflow ensures that persons authorized to process Customer Personal Data are bound by confidentiality obligations and access Customer Personal Data only as needed to provide the Service.

5. Security

Snapflow will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as described in Annex B. Snapflow may update these measures provided the overall level of protection is not materially reduced.

6. Subprocessors

Customer provides general authorization for Snapflow to engage the Subprocessors listed in Annex C. Snapflow will impose data-protection obligations on Subprocessors that are no less protective than those in this DPA and remains liable for their performance. Snapflow will give Customer at least 30 days' prior notice of any new Subprocessor (by updating its subprocessor list and providing a notification mechanism); Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection, and if it cannot be resolved, Customer may terminate the affected portion of the Service and receive a prorated refund of prepaid unused fees. Third-party AI or cloud providers whose credentials Customer connects to the Service ("BYO keys") are engaged directly by Customer, act under Customer's own agreements with them, and are not Snapflow Subprocessors.

7. Data Subject Requests

Taking into account the nature of the processing, Snapflow will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection). If a data subject contacts Snapflow directly regarding Customer Personal Data, Snapflow will promptly redirect the request to Customer and will not respond except as legally required.

8. Personal Data Breach

Snapflow will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting Customer Personal Data, and will provide information reasonably available to assist Customer in meeting its notification obligations, followed by timely updates as the investigation progresses.

9. Assistance

Taking into account the nature of the processing and the information available to it, Snapflow will provide reasonable assistance to Customer with data-protection impact assessments and prior consultations with supervisory authorities, where required of Customer under Applicable Data Protection Law.

10. International Transfers

Snapflow processes Customer Personal Data primarily in the United States. Where Customer Personal Data protected by the GDPR, UK GDPR or Swiss law is transferred to Snapflow in a country without an adequacy decision, the parties incorporate the SCCs (Module Two: controller to processor) into this DPA by reference, with Customer as data exporter and Snapflow as data importer; the optional docking clause applies; option 2 of Clause 9(a) applies with the notice period in Section 6; the governing law and forum are those of Ireland; Annexes A to C serve as the SCC annexes; and, for UK transfers, the UK International Data Transfer Addendum applies. For transfers from Chile or other jurisdictions with transfer requirements, the parties rely on the safeguards in this DPA and the SCCs mutatis mutandis to the extent recognized.

11. Audits

Snapflow will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires and its infrastructure providers' certifications. If that information is not enough to demonstrate compliance, Snapflow will allow for and contribute to audits conducted by Customer or its independent auditor, at Customer's expense, no more than once per year (except after a Personal Data breach), on at least 30 days' notice, during business hours, subject to confidentiality, and without unreasonable disruption to Snapflow's operations.

12. Return and Deletion

Upon termination of the Agreement, Snapflow will, at Customer's choice, make Customer Personal Data available for export for 30 days and thereafter delete it, unless retention is required by law, in which case Snapflow will protect it and process it only as legally required. Deletion from backups occurs in the ordinary course of backup rotation.

13. Liability and Precedence

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. In case of conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA prevails; in case of conflict between this DPA and the SCCs, the SCCs prevail.

Annex A: Details of Processing

• Subject matter and duration: processing of Customer Personal Data to provide the Service, for the term of the Agreement plus the export/deletion period.
• Nature and purpose: hosting, storage, transmission, display, compilation and AI-assisted generation performed on Customer Content to provide the design system platform and related support.
• Categories of data subjects: Customer's authorized users; Customer's personnel and contractors; individuals whose data appears in Customer Content.
• Categories of Personal Data: names, business contact details, account identifiers, usage data of authorized users; any Personal Data Customer chooses to include in Customer Content. No special categories of data are intended to be processed, and Customer agrees not to submit them.
• Frequency: continuous, as driven by Customer's use of the Service.

Annex B: Technical and Organizational Measures

• Encryption of data in transit (TLS) and at rest.
• Access controls based on least privilege; role-based permissions; multi-factor authentication for administrative access.
• Logging and monitoring of production systems; alerting for anomalous activity.
• Regular backups managed by our infrastructure providers, with rotation and secure deletion.
• Vulnerability management, dependency updates and secure development practices, including code review.
• Personnel confidentiality commitments and security awareness.
• Hosting in professionally managed cloud data centers (Amazon Web Services) with physical security controls certified under recognized frameworks.
• Incident-response procedures covering identification, containment, remediation and notification.

Annex C: Subprocessors

• Amazon Web Services, Inc.: platform compute and storage: United States.
• Cloudflare, Inc.: network, DNS, delivery and protection of the platform: United States (global network).
• Google LLC (Google Workspace): support email and communications with Customer: United States.
• Stripe, Inc.: payment processing (billing data only), once paid plans are enabled: United States.