Data Processing Addendum

“Customer Personal Information” means personal information included in Customer Content that CPG Playbook processes on Customer’s behalf to provide the Service. “Data Protection Law” means privacy and data-security law applicable to that processing. “Agreement” means the parties’ agreement for the Service, including the instrument accepting this Addendum. “Security Incident” means a confirmed unauthorized acquisition, access, use, disclosure, alteration, or destruction of Customer Personal Information in systems controlled by CPG Playbook; it excludes unsuccessful attempts that do not compromise that information.

Customer acts as controller or business, and CPG Playbook acts as processor, service provider, or contractor, as those roles are defined by applicable Data Protection Law. If Customer itself acts for another controller, it must have authority to give instructions and enter this Addendum. Information CPG Playbook handles for its own account administration, legal compliance, security, or business purposes is governed by the Privacy Policy and applicable law rather than treated as Customer-directed processing solely because the person also uses Customer’s workspace.

CPG Playbook will process Customer Personal Information only on Customer’s documented instructions to provide, support, secure, and maintain the agreed Service, or as required by applicable law. The Agreement, Customer’s authorized configuration and feature use, and separately agreed written instructions constitute those instructions. CPG Playbook will inform Customer if it reasonably believes an instruction violates Data Protection Law and may suspend the affected processing while the parties resolve the issue.

Where law requires processing outside those instructions, CPG Playbook will notify Customer before that processing unless legally prohibited. Customer is responsible for the lawfulness, accuracy, and minimum necessary scope of information it supplies, required notices and authorizations, and the authority of users and instruction-givers. Customer will not submit prohibited or specially regulated information without a separate written agreement covering the necessary controls.

For Customer Personal Information covered by this Addendum, CPG Playbook will not sell it, share it for cross-context behavioral advertising, or retain, use, or disclose it outside the specified business purposes and direct business relationship, except as permitted by Data Protection Law. It will not combine it with personal information from another customer or from its own independent interactions except where law permits the combination for an agreed service purpose. It will not use it to train a general-purpose model except on Customer’s separately documented authorization and under an agreed lawful arrangement.

Personnel authorized to process Customer Personal Information will be subject to confidentiality obligations and access limited to their responsibilities. CPG Playbook will ensure that subprocessors are bound by appropriate written obligations for the functions they perform. These are commitments for processing under an executed Addendum; the parties must confirm that the selected provider arrangements can meet them before initiating that processing.

CPG Playbook will maintain technical and organizational measures appropriate to the nature of the processing and the risks to individuals, taking account of available technology and implementation costs. The security schedule below identifies the baseline controls supporting the Service. CPG Playbook may update measures without materially reducing the protection of covered information.

No certification, independent audit result, service level, data-residency guarantee, or fixed recovery objective is incorporated unless the parties expressly accept it in writing. Customer remains responsible for its credentials, devices, user permissions, sharing decisions, and connected services.

Customer authorizes the subprocessors disclosed in the Service-provider Register at the time this Addendum is accepted, to the extent needed for Customer’s agreed features. For processing routes that involve a downstream provider, CPG Playbook will identify the applicable provider and confirm its contractual coverage before using that route for processing subject to this Addendum. A general routing description does not substitute for an identified, covered subprocessor.

CPG Playbook will impose data-protection obligations appropriate to each subprocessor’s processing and remain responsible for its performance of those obligations to the extent required by the Agreement and Data Protection Law. It will give Customer advance notice of a proposed addition or replacement and a reasonable opportunity to object on documented data-protection grounds before the new subprocessor processes covered information. Notices may be sent to Customer’s authorized contract contact.

The parties will work in good faith to resolve an objection, including using an available alternative or limiting the affected feature. If no reasonable resolution is available, Customer may discontinue the affected processing or terminate the affected service under the Agreement without authorizing processing by the disputed subprocessor. Existing payment and refund terms apply except where law or the parties’ written resolution requires otherwise.

Taking account of the processing and information available to it, CPG Playbook will reasonably assist Customer with requests to access, obtain a copy of, correct, delete, restrict, or otherwise exercise applicable rights over Customer Personal Information. It will notify Customer of a request directed to it where the request concerns Customer-controlled information, unless prohibited by law, and will not independently respond on Customer’s behalf except as instructed or legally required.

CPG Playbook will provide reasonable assistance with security obligations, impact assessments, and regulator consultations that apply to covered processing. Customer must provide sufficient detail and lawful instructions. The parties may agree reasonable charges for extraordinary assistance, but charges will not excuse either party’s mandatory obligations.

CPG Playbook will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Information. As available, the notice will describe the nature of the incident, the information and people affected, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be provided in stages as the investigation develops.

CPG Playbook will take reasonable steps to contain and investigate the incident, mitigate its effects, and cooperate with Customer’s legally required response. Notification is not an admission of liability. Customer is responsible for notices to individuals or authorities relating to its role, except where law requires CPG Playbook to notify directly. The parties will coordinate communications where lawful and practicable.

At the end of covered processing, CPG Playbook will, at Customer’s choice and subject to applicable law, return Customer Personal Information in a reasonably usable form or delete it, and delete remaining copies unless retention is legally required. The parties will document a secure method and practical completion schedule appropriate to the systems and records involved, without limiting any mandatory legal deadline.

If information is retained because of a legal obligation, CPG Playbook will identify the applicable basis where permitted and restrict its use to that purpose. Backup copies will remain protected and will be removed through the applicable backup cycle; if restored before removal, the relevant deletion instructions must be reapplied. This Addendum does not authorize Customer to delete another organization’s independently controlled records.

CPG Playbook will make available information reasonably necessary to demonstrate compliance with this Addendum and cooperate with reasonable assessments required by Data Protection Law. Assessments should first use relevant documentation or available independent reports. If further review is reasonably necessary, the parties will arrange proportionate review on reasonable notice, during normal business hours, subject to confidentiality, security, and protection of other customers’ information. These arrangements do not restrict a regulator’s lawful authority.

CPG Playbook will notify Customer if it determines it can no longer meet applicable obligations. Customer may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorized processing, as permitted by law. CPG Playbook certifies that it understands and will comply with the contractual restrictions applicable to its service-provider or contractor role under an executed Addendum.

The Service is offered to United States businesses. Where a proposed transfer requires a specific international-transfer mechanism, the parties must establish that mechanism before the covered transfer. This Addendum does not by itself incorporate standard contractual clauses or assert participation in a certification framework.

This Addendum prevails over conflicting terms of the Agreement concerning Customer Personal Information. Other terms, including governing law, dispute venue, and liability limits, remain applicable except where Data Protection Law prohibits their application. An invalid provision does not invalidate the remainder. The Addendum lasts for as long as CPG Playbook processes Customer Personal Information subject to it.

The baseline service controls include:

• Supabase-backed authentication and session management, with role and workspace access controls in the application and database.
• HTTPS delivery and transport-security headers for applicable application requests.
• Server-side handling of privileged credentials rather than exposing them in public client code.
• Restricted administrative actions and checks on access to private workspace material.
• Application-selected telemetry with property filtering and sanitization of diagnostic errors; browser session recording is disabled in the measurement configuration.
• Separation of public sharing from restricted workspace access, subject to Customer’s selected permissions.

These controls describe the service baseline; they do not represent an independent security certification or an assurance that every operational control has been audited. Additional requirements, including a specific backup schedule, geographic restriction, recovery target, audit report, or downstream-provider restriction, apply only when expressly agreed and supported for the covered processing.