Effective July 3, 2026 · Version 1.0

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the Terms of Service between Pixla and the customer ("Customer," "you") for use of the online Services. It applies where and to the extent Pixla processes Personal Data on Customer's behalf as a processor in connection with Pixla Hosting and Pixla Mail. Where there is a conflict, this DPA controls over the Terms with respect to the processing of Customer Personal Data.

1. Definitions

• "Data Protection Laws" means all laws applicable to the processing of Personal Data under this DPA, including the EU GDPR, the UK GDPR, and applicable U.S. state privacy laws (e.g., the CCPA/CPRA).
• "Personal Data," "controller," "processor," "data subject," and "processing" have the meanings given in the applicable Data Protection Laws.
• "Customer Personal Data" means Personal Data contained in User Content that Pixla processes on Customer's behalf under the Terms (e.g., recipient data in Pixla Mail; data within applications deployed on Pixla Hosting).
• "Subprocessor" means a third party engaged by Pixla to process Customer Personal Data.

2. Roles and scope

• Customer is the controller (or a processor acting for a third-party controller) of Customer Personal Data. Pixla is the processor (or subprocessor) acting on Customer's documented instructions.
• For Pixla's own account, billing, website, and security data, Pixla acts as an independent controller under the Privacy Policy; that processing is not governed by this DPA.

3. Details of processing

• Subject matter: provision of the Pixla Hosting and Pixla Mail Services.
• Duration: the term of the Terms, plus any period until deletion of Customer Personal Data in accordance with this DPA.
• Nature and purpose: hosting, storing, transmitting, building, serving, and — for Pixla Mail — sending email on Customer's behalf, and providing related functionality and support.
• Types of Personal Data: as determined by Customer, which may include names, email addresses, and any Personal Data Customer includes in its User Content, recipient lists, or deployed applications.
• Categories of data subjects: as determined by Customer, which may include Customer's end users, contacts, and email recipients.

4. Customer instructions

Pixla will process Customer Personal Data only on Customer's documented instructions, including as set out in the Terms and this DPA and as necessary to provide the Services, unless required by law (in which case Pixla will, where legally permitted, inform Customer). Pixla will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

5. Confidentiality

Pixla ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

6. Security

Pixla will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, and purposes of processing. These measures include encryption in transit, access controls, and secured infrastructure, as further described in the Privacy Policy and Pixla's security practices.

7. Subprocessors

• Customer provides general authorization for Pixla to engage Subprocessors to process Customer Personal Data. Pixla's current Subprocessors are listed at https://pixla.app/legal/subprocessors.
• Pixla will impose data-protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for its Subprocessors' performance.
• Pixla will notify Customer of any intended addition or replacement of a Subprocessor with a reasonable opportunity to object on reasonable data-protection grounds before the Subprocessor begins processing. [SPECIFY NOTICE PERIOD AND OBJECTION MECHANISM.]

8. Data subject requests

Taking into account the nature of the processing, Pixla will provide reasonable assistance to help Customer respond to requests from data subjects to exercise their rights. If Pixla receives such a request directly, it will, where permitted, refer the data subject to Customer.

9. Personal data breach

Pixla will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to Pixla to help Customer meet its notification obligations.

10. International transfers

Where Pixla transfers Customer Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties will rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated by reference. [ATTACH/REFERENCE THE APPLICABLE SCC MODULES AND ANNEXES.]

11. Deletion and return

Upon termination or expiry of the Services, Pixla will delete or return Customer Personal Data in accordance with the Terms and the retention periods described in the Privacy Policy, unless retention is required by law.

12. Audits

Pixla will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to reasonable confidentiality, scope, frequency, and notice conditions. [SPECIFY AUDIT PROCEDURE.]

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms.

14. Term

This DPA takes effect when incorporated into the Terms and continues until Pixla has ceased all processing of Customer Personal Data.

15. Contact

Data protection: privacy@pixla.app

Pixla LLC · 5706 Neubert Springs Rd, Knoxville, TN 37920