Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Agreement between Catchy Media Sp. z o.o. and the Client and is incorporated by reference into the General Terms and Conditions. Upon its incorporation, it takes precedence over the General Terms and Conditions in respect of data processing matters.

Version: v2026-10-28

Effective Date: 30 June 2026

Registered: NIP 9571150950, Gdańsk, Poland

Governing Law: Polish law, courts competent for the registered office of Catchy Media Sp. z o.o. in Gdańsk

Contact: Catchy Media Sp. z o.o., Al. Grunwaldzka 56/113, 80-241 Gdańsk, Poland — [email protected] (business hours)

Catchy Media Sp. z o.o. acts as a Data Processor in respect of Company Personal Data processed by it on behalf of the Client.

The Client acts as the Data Controller in respect of Company Personal Data.

The parties seek to implement a data processing agreement that complies with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR").

The parties wish to lay down their respective rights and obligations in accordance with Article 28 GDPR.

In this DPA, the following capitalised terms have the meanings set out below. Where a term is used in the singular, it includes the plural and vice versa.

Catchy Media / We / Us Catchy Media Sp. z o.o., a limited liability company incorporated and established in Gdańsk, Poland, NIP 9571150950.

Client / You The natural person or legal entity that enters into an Agreement with Catchy Media Sp. z o.o. for the provision of Services, acting as the Data Controller in respect of Company Personal Data.

Agreement This Data Processing Agreement, the General Terms and Conditions, any applicable quotation or order confirmation, and all Schedules.

Company Personal Data Any Personal Data processed by Catchy Media Sp. z o.o. on behalf of the Client pursuant to or in connection with the Agreement.

Data Protection Laws Means the GDPR and any applicable national implementing legislation, as amended or replaced from time to time.

EEA European Economic Area

GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Services The digital tools, platforms, and services provided by Catchy Media Sp. z o.o. as described in the General Terms and Conditions.

Sub-processor Any third party appointed by Catchy Media Sp. z o.o. to process Company Personal Data on its behalf in connection with the Agreement.

The terms "Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Processor", and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.

Subject Matter

Catchy Media Sp. z o.o. processes Company Personal Data on behalf of the Client for the purpose of providing the Services as described in this DPA and the Agreement.

Nature and Purpose

The nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects are set out in the Processing Activities section of this DPA.

Duration

Catchy Media Sp. z o.o. shall process Company Personal Data for the duration of the Agreement, unless otherwise agreed in writing or required by applicable law. Upon termination or expiry of the Agreement, Catchy Media Sp. z o.o. shall handle Company Personal Data in accordance with the Deletion or Return of Company Personal Data section of this DPA.

Catchy Media Sp. z o.o. shall:

process Company Personal Data only on the documented instructions of the Client, unless required to do so by applicable law, in which case Catchy Media Sp. z o.o. shall, to the extent permitted by law, inform the Client of that legal requirement before processing;

ensure that persons authorised to process Company Personal Data are bound by appropriate confidentiality obligations;

implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, in accordance with Article 32 GDPR and the Security Measures section of this DPA;

assist the Client in fulfilling its obligations to respond to Data Subject requests under Chapter III of the GDPR, taking into account the nature of the processing;

assist the Client in meeting its obligations under Articles 32 to 36 of the GDPR (security, breach notification, DPIAs, and prior consultation), taking into account the nature of the processing and the information available to Catchy Media Sp. z o.o.;

at the choice of the Client, delete or return all Company Personal Data to the Client upon termination or expiry of the Agreement, and delete existing copies unless retention is required by applicable law;

make available to the Client all information reasonably necessary to demonstrate compliance with this DPA and the obligations set out in Article 28 GDPR; and

notify the Client promptly if, in Catchy Media Sp. z o.o.'s opinion, an instruction from the Client infringes applicable Data Protection Laws.

General Authorisation

The Client provides general authorisation to Catchy Media Sp. z o.o. to engage Sub-processors for the purposes of providing the Services. The current list of Sub-processors is available to the Client upon written request at [email protected].

New Sub-processors

Catchy Media Sp. z o.o. shall inform the Client in advance of any intended addition or replacement of a Sub-processor, giving the Client the opportunity to object.

Objection

If the Client raises a reasonable, documented objection to a new Sub-processor and Catchy Media Sp. z o.o. is unable to accommodate that objection, the Client may terminate the Agreement or the relevant part of the Services with 30 days' written notice, without penalty.

Sub-processor Obligations

Catchy Media Sp. z o.o. shall impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA. Catchy Media Sp. z o.o. remains fully liable to the Client for the performance of each Sub-processor's obligations.

Assistance with Data Subject Requests

Catchy Media Sp. z o.o. shall, taking into account the nature of the processing, assist the Client by implementing appropriate technical and organisational measures to enable the Client to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).

Notification of Requests

Catchy Media Sp. z o.o. shall promptly notify the Client if it receives a Data Subject request in respect of Company Personal Data, and shall not respond to such request except on the documented instructions of the Client, or as required by applicable law.

Technical and organisational measures

Catchy Media Sp. z o.o. shall implement and maintain technical and organisational measures ensuring a level of security appropriate to the risk, in accordance with Article 32 GDPR.

Confidentiality obligations

Catchy Media Sp. z o.o. shall take reasonable steps to ensure that any staff with access to Company Personal Data are subject to appropriate confidentiality obligations.

Processing on Documented Instructions

Catchy Media Sp. z o.o. shall ensure that any staff authorised to process Company Personal Data do so only in accordance with the documented instructions of the Client and the terms of this DPA.

Notification Obligation

Catchy Media Sp. z o.o. shall notify the Client without undue delay after becoming aware of any Personal Data Breach affecting Company Personal Data.

Content of Notification

Such notification shall include, to the extent then available:

a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects affected and records concerned;

the name and contact details of the data protection contact at Catchy Media Sp. z o.o.;

a description of the likely consequences of the Personal Data Breach; and

a description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

Phased Notification

Where all information required under the Content of Notification section is not available at the time of initial notification, Catchy Media Sp. z o.o. shall provide the remaining information in phases without undue delay.

Cooperation and Remediation

Catchy Media Sp. z o.o. shall cooperate with the Client and take reasonable steps to assist in the investigation, mitigation, and remediation of any Personal Data Breach. Catchy Media Sp. z o.o. will provide the Client with sufficient information to enable the Client to meet its own notification obligations under applicable Data Protection Laws.

DPIA Assistance

Catchy Media Sp. z o.o. shall provide reasonable assistance to the Client with any data protection impact assessments (DPIAs) and prior consultations with Supervisory Authorities or other competent data privacy authorities which the Client reasonably considers to be required under Articles 35 and 36 of the GDPR, in each case solely in relation to the processing of Company Personal Data by Catchy Media Sp. z o.o. and taking into account the nature of the processing and the information available to Catchy Media Sp. z o.o.

Information and Compliance Evidence

Catchy Media Sp. z o.o. shall make available to the Client, upon reasonable written request, all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and Article 28 GDPR.

Audit and Inspection Rights

Catchy Media Sp. z o.o. shall allow for and contribute to audits and inspections conducted by the Client or a mandated third-party auditor, provided that:

the Client provides at least 30 days' prior written notice of any audit;

audits are conducted during normal business hours and in a manner that minimises disruption to Catchy Media Sp. z o.o.'s operations;

the auditor is bound by appropriate confidentiality obligations; and

the costs of the audit are borne by the Client, unless the audit reveals a material breach of this DPA by Catchy Media Sp. z o.o.

Certifications as Audit Equivalent

Catchy Media Sp. z o.o. may satisfy audit obligations in whole or in part by providing relevant security documentation or internal audit reports where available.

Transfers Outside the EEA

Where the use of a Sub-processor requires a transfer of Company Personal Data to a country outside the EEA that does not benefit from an adequacy decision under Article 45 GDPR, Catchy Media Sp. z o.o. shall ensure that such transfer is subject to appropriate safeguards, including:

Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) GDPR; or

any other transfer mechanism recognised as valid under applicable Data Protection Laws.

Sub-processor Transfer Mechanisms

Information on the transfer mechanism applicable to each Sub-processor is available to the Client upon written request.

Return or Deletion Upon Termination

Upon termination or expiry of the Agreement, Catchy Media Sp. z o.o. shall, at the Client's choice, delete or return all Company Personal Data to the Client and delete existing copies, unless applicable law requires their storage.

Confirmation of Deletion

Catchy Media Sp. z o.o. shall confirm the completion of deletion in writing upon the Client's reasonable request, subject to any legally mandated retention obligations.

Legally Mandated Retention

Notwithstanding the above, Catchy Media Sp. z o.o. may retain Company Personal Data to the extent required by applicable law (including Polish tax and accounting law requiring retention of financial records), in which case Catchy Media Sp. z o.o. shall ensure that such data is processed only for the purposes required by applicable law and is protected by appropriate security measures.

Sub-processor Deletion Obligations

Catchy Media Sp. z o.o. shall ensure that Sub-processors delete or return Company Personal Data in accordance with this Article upon termination of the relevant sub-processing arrangement.

Relationship with Agreement

This DPA forms part of and is subject to the Agreement. In the event of any conflict between this DPA and the General Terms and Conditions in respect of data processing matters, this DPA shall prevail.

Confidentiality

Each party shall keep the terms of this DPA and any information received about the other party in connection with it confidential, except to the extent required by applicable law or as necessary to perform obligations under this DPA.

Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the liability provisions of the General Terms and Conditions, except to the extent that applicable Data Protection Laws impose greater liability.

Notices

All notices under this DPA shall be given in accordance with the notice provisions of the General Terms and Conditions.

Amendments

Catchy Media Sp. z o.o. may update this DPA to reflect changes in Data Protection Laws or its processing activities, with at least 30 days' prior written notice to the Client.

Governing Law

This DPA is governed by Polish law. Any disputes arising in connection with this DPA shall be subject to the jurisdiction of the common courts competent for the registered office of Catchy Media Sp. z o.o. in Gdańsk, subject to mandatory provisions of law.

Categories of Data Subjects: the Client's authorised users (employees and contractors) and persons whose Personal Data is contained in the accounts connected by the Client.

Categories of Personal Data: identification and contact data (such as name and email address), account and usage data, technical data (such as IP address and logs), and Personal Data contained in the accounts connected by the Client.

Nature and Purpose: providing, securing and supporting the Services.

Duration: the term of the Agreement, followed by deletion or return in accordance with the Deletion or Return of Company Personal Data section.

Special categories of personal data: Catchy Media Sp. z o.o. does not process special categories of personal data (as defined in Article 9 GDPR) on behalf of the Client under normal service conditions. If the Client requires processing of special category data, this must be agreed in writing with a specific legal basis documented prior to processing.

Last updated: October 28, 2026 - Version v2026-10-28