Data Processing Agreement

Customer acts as Controller. Leewou acts as Processor.

This DPA does not apply to processing activities for which Leewou acts as an independent Controller, including but not limited to: user account administration, platform security and fraud-prevention operations, abuse-prevention logs, billing metadata retained for legal or tax obligations, and the shared creator profile cache used to operate platform infrastructure. Those activities are governed by Leewou's Privacy Policy.

Leewou shall Process Personal Data only:

• on documented instructions from Customer, including as set out in the Agreement and this DPA;
• for the purpose of providing the Services;
• in accordance with applicable Data Protection Laws.

Where Leewou reasonably believes a Customer instruction infringes applicable Data Protection Laws, Leewou will promptly notify Customer.

Leewou implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk of Processing, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing. The specific measures currently implemented are set out in Schedule 2 to this DPA.

Leewou reviews and updates its security measures on an ongoing basis. Leewou may update Schedule 2 from time to time to reflect material changes to its security posture, provided that the overall level of protection afforded is not materially reduced.

Leewou shall ensure that persons authorised to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Customer authorises Leewou to engage the Subprocessors described in Leewou's current subprocessor list. The current list is available upon written request to privacy@leewou.com. Leewou will publish and maintain a public subprocessor page at leewou.com/subprocessors.

Leewou shall:

• enter into written agreements with Subprocessors imposing data protection obligations no less protective than those in this DPA;
• remain liable to Customer for the performance of its Subprocessors to the extent Leewou is liable under this DPA;
• update the subprocessor list to reflect any additions or replacements.

Leewou will provide Customer with no less than 30 days' prior written notice of any material addition or replacement of a Subprocessor, by updating the subprocessor page and notifying the team owner by email. If Customer objects to a new Subprocessor on reasonable data protection grounds, Customer must notify Leewou in writing within the notice period. The parties will work in good faith to resolve the objection; if no resolution is reached, either party may terminate the affected portion of the Services on written notice.

Customer authorises Leewou to transfer Personal Data to Subprocessors located outside the EEA or UK, provided that appropriate safeguards are in place in accordance with Article 46 GDPR or applicable UK data protection law.

Where such transfers occur, Leewou relies on one or more of:

• the European Commission's Standard Contractual Clauses (Decision 2021/914/EU);
• the UK International Data Transfer Addendum to the SCCs;
• the EU - US Data Privacy Framework (for participating US-based Subprocessors); or
• an adequacy decision applicable to the destination country.

Details of the transfer mechanism applicable to each Subprocessor are included in the subprocessor list available at leewou.com/subprocessors or upon request.

Taking into account the nature of Processing and the information available to Leewou, Leewou shall provide reasonable assistance to Customer to enable Customer to comply with its obligations under applicable Data Protection Laws, including in relation to:

• Data Subject rights requests - by providing technical means for Customer to access, correct, export, or delete Personal Data within Customer's workspace. Customer is responsible for responding directly to Data Subjects. Requests for Leewou's operational assistance should be submitted to privacy@leewou.com and will be addressed within 30 days;
• Data Protection Impact Assessments (DPIAs) - by making available information about Leewou's processing activities that is reasonably necessary to complete a DPIA;
• Supervisory authority consultations - by providing information and cooperation reasonably required for prior consultation under Article 36 GDPR.

Leewou may charge a reasonable fee for assistance that goes beyond what is technically necessary to provide the Services.

Customer acknowledges the following platform limitations that affect Data Subject rights fulfilment:

• Account deletion requests initiate a 30-day soft-delete grace period before permanent purge. During this window the account is inaccessible but not yet deleted from primary systems.
• Data export links expire 24 hours after generation. A new export may be requested at any time.
• Billing records (Paddle event logs) are retained for legal and tax purposes and cannot be deleted on request.
• Following subscription cancellation, Customer workspace data is retained for 90 days to allow data retrieval before deletion.
• Deleted data may persist in backup snapshots for a period consistent with Leewou's backup rotation schedule before being permanently overwritten.

Leewou shall notify Customer without undue delay, and where feasible no later than 72 hours after becoming aware of a Personal Data Breach that affects Personal Data Processed on behalf of Customer.

The notification shall include, to the extent then available:

• a description of the nature of the breach, including the categories and approximate number of Data Subjects and records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its effects;
• the name and contact details of Leewou's data protection contact.

Where full information is not available at the time of initial notification, Leewou will provide it in subsequent communications as it becomes available. Breach notifications shall be sent to the team owner's registered email address and to security@leewou.com for acknowledgement.

Customer is solely responsible for assessing whether a breach requires notification to a supervisory authority or to affected Data Subjects, and for making any such notifications required by applicable Data Protection Laws.

Upon reasonable written request, Leewou shall make available information necessary to demonstrate compliance with this DPA. Leewou satisfies audit requests through the following tiered process:

• Level 1 (default): completion of a written security questionnaire, provided within 30 business days;
• Level 2: provision of relevant security documentation, including Leewou's internal security audit report and architecture documentation, subject to a signed non-disclosure agreement;
• Level 3: a scheduled remote audit session, available once per 12-month period upon no less than 30 days' written notice and subject to a signed non-disclosure agreement and agreed scope;
• Level 4 (last resort): on-site audit, available only where required by mandatory applicable Data Protection Law and subject to mutual agreement on scope, notice, and cost allocation.

Customer bears the cost of any third-party auditors engaged by Customer. Audit activities must not unreasonably disrupt Leewou's operations.

Leewou does not currently hold SOC 2 Type II or ISO 27001 certification. In lieu of formal certification, Leewou may provide its internal security audit report as evidence of its security controls.

Upon termination or expiry of the Agreement, Customer may, for a period of 90 days following the effective date of termination, export their workspace data in CSV or XLSX format using the export functionality within the Services.

After the 90-day retrieval window, Leewou shall delete or irreversibly anonymise Customer Personal Data from its primary systems, except to the extent that retention is required or permitted by applicable law, including for legal proceedings, regulatory compliance, or enforcement of Leewou's rights.

Residual copies may persist in encrypted backup snapshots for a period consistent with Leewou's backup rotation schedule and will not be restored for operational use.

The following records are exempt from deletion:

• Paddle billing events and invoices, retained for applicable legal and tax periods;
• Security and abuse-prevention logs processed in Leewou's capacity as independent Controller, as described in the Privacy Policy.

Upon written request, Leewou will provide confirmation that deletion has been completed.

Liability of each party and each party's affiliates arising out of or in connection with this DPA, whether in contract, tort, or any other legal theory, shall be subject to the limitations and exclusions of liability set out in the Agreement.

Each party's total aggregate liability arising out of or in connection with this DPA shall not exceed the limits applicable under the Agreement for the relevant event.

This DPA shall be governed by and construed in accordance with the same governing law as the Agreement - namely the laws of Lebanon, without regard to conflict of law provisions.

Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Beirut, Lebanon.

Nothing in this clause limits the right of a Data Subject to bring proceedings before a competent supervisory authority or court in the Data Subject's jurisdiction of habitual residence.

For questions, DSAR assistance requests, or to exercise any rights under this DPA, contact: