Data processing addendum

Vloggi Pty Ltd

Effective Date: 10 April 2026

This Data Processing Addendum (“DPA”) forms part of and supplements the agreement between Vloggi Pty Ltd (“Vloggi”, “Processor”, “we”) and the Project Owner / Customer (“Controller”, “you”) governing the use of the Vloggi Platform (the “Agreement”), including but not limited to:

• the Vloggi User Terms

• the Content Assignment Agreement

• the Vloggi Privacy Policy

In the event of conflict, this DPA shall prevail with respect to the processing of Personal Data.

1. Definitions

Unless otherwise defined, terms in this DPA have the meanings given in applicable Data Protection Laws, including the General Data Protection Regulation and California Consumer Privacy Act.

“Controller” means the entity determining the purposes and means of processing Personal Data (Project Owner).

“Processor” means Vloggi, processing Personal Data on behalf of the Controller.

“Personal Data” means any information relating to an identified or identifiable natural person.

“Processing” means any operation performed on Personal Data.

“Contributor” means an individual submitting Content via the Platform.

“Content” includes video, audio, images, text, and associated metadata.

2. Roles of the Parties

2.1 The Controller acts as the Data Controller in respect of all Personal Data collected through Projects.

2.2 Vloggi acts as a Data Processor, processing Personal Data solely on behalf of the Controller.

2.3 Vloggi does not determine:

• the purposes of processing

• the categories of data collected

• the retention periods

These are determined exclusively by the Controller.

3. Scope of Processing

3.1 Vloggi processes Personal Data solely to provide the Platform and related services.

3.2 Categories of Personal Data may include:

• Contributor-submitted Content (video, audio, images)

• personal identifiers (name, email, contact details)

• zero-party data provided via forms or prompts

• technical data (IP address, device metadata, timestamps)

3.3 Data Subjects include:

• Contributors

• users of the Platform

• individuals appearing in submitted Content

4. Lawful Basis and Contributor Consent

4.1 The Controller is responsible for establishing a lawful basis for processing Personal Data.

4.2 The Controller acknowledges that Contributor consent and rights assignment are obtained through:

• the Vloggi uploader and consent mechanisms

• the Content Assignment Agreement

• project-specific terms defined by the Controller

4.3 Vloggi relies on the Controller’s instructions and representations regarding lawful processing.

5. Processing Instructions

5.1 Vloggi shall process Personal Data only:

• in accordance with documented instructions from the Controller

• as necessary to provide the Platform

5.2 The Agreement and use of the Platform constitute the Controller’s instructions.

6. Security Measures

6.1 Vloggi implements appropriate technical and organisational measures, including:

• encryption of data in transit (HTTPS)

• access controls and authentication mechanisms

• logging and monitoring

• secure cloud infrastructure (AWS)

6.2 Security measures are designed to protect against:

• unauthorised access

• accidental loss

• destruction or alteration

7. Sub-processors

7.1 The Controller authorises Vloggi to engage sub-processors, including cloud infrastructure providers.

7.2 Vloggi shall ensure sub-processors:

• are subject to appropriate data protection obligations

• provide adequate safeguards

7.3 A list of sub-processors is available upon request.

8. International Data Transfers

8.1 Personal Data may be processed in Australia and other jurisdictions where Vloggi or its sub-processors operate.

8.2 Where required, Vloggi implements appropriate safeguards for international transfers.

8.3 Where region-specific hosting is configured, Vloggi will process data within the designated region, subject to limited operational processing required for platform functionality.

9. Data Subject Rights

9.1 The Controller is responsible for responding to Data Subject requests.

9.2 Vloggi shall provide reasonable assistance to enable the Controller to fulfil such requests, including:

• access

• correction

• deletion

10. Data Breach Notification

10.1 Vloggi shall notify the Controller without undue delay upon becoming aware of a Personal Data breach affecting Controller data.

10.2 Notification will include:

• nature of the breach

• likely impact

• steps taken or proposed

11. Data Retention and Deletion

11.1 Vloggi retains Personal Data only as necessary to provide the Platform.

11.2 The Controller determines retention periods for Contributor data.

11.3 Upon request, Vloggi will:

• delete Personal Data

• or return Personal Data where technically feasible

11.4 Vloggi may retain limited data where required for:

• legal obligations

• security

• audit purposes

12. Audit and Compliance

12.1 Vloggi maintains internal practices aligned with industry standards.

12.2 Upon reasonable request, Vloggi may provide information necessary to demonstrate compliance.

12.3 Formal audits shall be subject to reasonable notice and confidentiality.

13. Liability

13.1 Each party’s liability under this DPA is subject to the limitations set out in the Agreement.

13.2 The Controller remains responsible for:

• lawful collection of Personal Data

• compliance with applicable laws

• content submitted and processed

14. Term and Termination

14.1 This DPA remains in effect for the duration of the Agreement.

14.2 Upon termination, clauses relating to data protection and confidentiality shall survive.

15. Order of Precedence

In the event of conflict:

1. This DPA

2. Content Assignment Agreement

3. User Terms / Platform Agreement