Data Processing Addendum

Last Revised: October 13, 2026

This Data Processing Addendum (the “DPA”) is entered into by and between Porkbun LLC (“Porkbun” or “Processor”) and the customer identified in the applicable Porkbun account (“Customer”) (collectively, the “Parties”). This DPA is incorporated into and forms part of the Product Terms of Service and any other agreements between Customer and Porkbun governing the Services (collectively, the “Agreement”), and reflects the Parties’ agreement with respect to the Processing of Controller Data.

In providing the Services to Customer pursuant to the Agreement, Porkbun may Process Personal Data on behalf of Customer and the Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith. This DPA supplements the Agreement and in the event of any conflict between the terms of this DPA and the terms of the Agreement, the terms of this DPA prevail with regard to the specific subject matter of this DPA. This DPA is effective on the Effective Date, and amends, supersedes and replaces any prior agreement relating to data processing and/or data protection entered into by the Parties.

1. DEFINITIONS

Any capitalized terms used but not defined in this DPA has the meaning provided to it in the Agreement,

• (a) “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. Control, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

• (b) “Applicable Data Protection Law” means (a) all data protection laws and regulations in the European Economic Area and Switzerland, including the EU General Data Protection Regulation 2016/679 (“EU GDPR”), and EU Member State laws supplementing the GDPR; (b) the UK Data Protection Act of 2018, and the UK GDPR (“UK GDPR”); (c) the Swiss Federal Data Protection Act (“Swiss FDPA”); (d) California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq., as amended and its implementing regulations (“CCPA”) and all other similar applicable consumer privacy laws and regulations in other U.S. states, and (e) any other laws and regulations applicable to the Controller Data under the Agreement.

• (c) “Authorized Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Customer, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.

• (d) “Controller” as used in this DPA, means Customer.

• (e) “Controller Data” means any Personal Data Processed by Processor on behalf of Customer pursuant to or in connection with the Agreement. Controller Data does not include Personal Data relating to Customer’s own account, identity verification, billing, or use of the Services, which Porkbun processes as an independent controller as described in its Privacy Policy.

• (f) “Customer” means the entity which determines the purposes and means of the Processing of Personal Data and includes any Authorized Affiliates of the Customer, and to the extent applicable includes a “Business” as defined under the CCPA.

• (g) “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.

• (h) “EEA” means the European Economic Area.

• (i) “Effective Date” means the date on which Customer first accepts the Agreement, or first uses the Services, whichever occurs first; provided that any updates to this DPA will take effect in accordance with the modification provisions of this DPA.

• (j) “Permitted Purpose” means the use of the Controller Data to the extent necessary for provision of the Services by Processor to the Controller.

• (k) “Personal Data” has the meaning given by Applicable Data Protection Laws and shall include information (regardless of the medium in which it is contained), whether alone or in combination with other available information that directly or indirectly identifies a Data Subject. Personal Data shall have the same meaning as “personal information” under Applicable Data Protection Law.

• (l) “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, sharing, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

• (m) “Processor” means Porkbun and any Porkbun entities, including its Affiliates, which Processes Personal Data on behalf of the Customer, and to the extent applicable, includes a “Service Provider” as defined under the CCPA.

• (n) “Regulator” means any supervisory authority with authority under Applicable Data Protection Law over all or any part of the provision or receipt of the Services or the Processing of Personal Data.

• (o) “Restricted Transfer” means: (a) where the EU GDPR applies, transferring Personal Data collected from a Data Subject located in the EEA either directly or via onward transfer to a country that has not been issued an adequacy determination by the European Commission; (b) where the UK GDPR applies, transferring, either directly or via onward transfer, Personal Data collected from a Data Subject located in the United Kingdom to or within any other country which is not subject based on adequacy regulations under Section 17A of the United Kingdom Data Protection Act 2018; and (c) where the Swiss FDPA applies, transferring either directly or via onward transfer Personal Data collected from a Data Subject located in Switzerland to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner.

• (p) “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Controller Data transmitted, stored or otherwise processed by Processor

• (q) “Sell,” “Selling,” “Sale,” or “Sold” shall means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data by Processor to a third party for monetary or other valuable consideration

• (r) “Services” means the products and services that are ordered by Controller through a link or via an Order pursuant to the Agreement and made available online by Processor.

• (s) “Share,” “Shared,” or “Sharing” shall have the meaning assigned to it in the CCPA.

• (t) “Sub-processor” means any third-party data processor engaged by Processor, who receives Personal Data from Processor for processing on behalf of Controller and in accordance with Controller's instructions (as communicated by Processor) and the terms of its written subcontract.

• (u) The terms, “Commission”, “Data Breach”, “Member State”, and “Supervisory Authority” shall have the same meaning as in the Applicable Data Protection Laws, and their cognate terms shall be construed accordingly.

2. PURPOSE

2.1 Controller and Processor have entered into the Agreement pursuant to which Controller is granted a right to access and use the Services. In providing the Services, Processor will engage on behalf of Controller, in the processing of Personal Data submitted to and stored within the Services by Controller.

2.2 The Parties are entering into this DPA to ensure that the Processing by Processor of Controller Data, within the Services by Controller and/or on its behalf, is done in a manner compliant with Applicable Data Protection Law and its requirements regarding the collection, use and retention of Personal Data of Data Subjects.

3. AUTHORITY

3.1 Roles of the Parties.

• (a) To the extent the EU GDPR or UK GDPR apply to the Controller Data, the Parties acknowledge and agree that Customer is a Controller and Porkbun is a Processor acting on behalf of Customer. When Customer is acting as a Processor of Controller Data, Porkbun is a Sub-processor of the Customer.

• (b) In relation to any Controller Data subject to the CCPA, Porkbun will act as a Service Provider in its performance of its obligations under the Agreement. Porkbun will (i) only use Controller Data to provide the Services under the Agreement; (ii) not Share, Sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, Controller Data to another person or entity: (a) for monetary or other valuable consideration; or (b) for Cross-Context Behavioural Advertising purposes for the benefit of a business in which no money is exchanged; or (c) combine Controller Data with Personal Data that Processor receives from or on behalf of another person or entity or collects from its own interactions with a Data Subject; (iii) in cases where Processor receives Deidentified Information from Customer, commit to maintain and use the Deidentified Information in deidentified form, take reasonable measures to ensure that Deidentified Information cannot be associated with a Data Subject, and not attempt to reidentify the Deidentified Information; and (iv) inform Customer if, in its opinion, the execution of an instruction could violate any Applicable Data Protection Laws. Notwithstanding anything to the contrary in the Agreement (including this DPA), Controller acknowledges that Processor shall have a right to Process Personal Data in relation to the support and/or use of the Services for its legitimate business purposes.

3.2 Controller’s Instructions. Customer represents and warrants that (i) it has complied, and will continue to comply, with all applicable laws, including Applicable Data Protection Law, in respect of its Processing of Controller Data and any Processing instructions it issues to Processor; and (ii) it has provided, and will continue to provide, all notice and has obtained, and will continue to obtain, all consents and rights necessary under Applicable Data Protection Law for Processor to process Controller Data for the purposes described in the Agreement. Customer shall have sole responsibility for the accuracy, quality, and legality of Controller Data and the means by which Customer acquired the Controller Data. Controller specifically acknowledges that its use of the Services will not violate the rights of any Data Subject that has opted-out from the disclosure of Personal Data to the extent applicable under the CCPA.

3.3 Purpose Limitation. Processor shall process Controller Data only in accordance with Customer’s documented lawful instructions as set forth in this DPA, for Permitted Purposes, as necessary to comply with applicable law, or as otherwise agreed to in writing. The Parties agree that the Agreement and this DPA set out Customer’s complete and final instructions to Processor in relation to the processing of Controller Data, and processing outside the scope of these instructions (if any) shall require prior written agreement between the Parties.

3.4 Data Subject and Regulator Requests. Customer shall be responsible for communications and leading any efforts to comply with all requests made by Data Subjects under the Applicable Data Protection Law, and all communications from Regulators that relate to the Controller Data.

4. OBLIGATIONS OF PROCESSOR

4.1 Confidentiality. Processor will restrict access to the Controller Data to its personnel who need access to meet Processor’s obligations under the Agreement. Processor shall take commercially reasonable steps to ensure the reliability of any Processor personnel engaged in the Processing of Controller Data.

4.2 Disclosure to Third Parties. Processor will not disclose Controller Data to third parties except as permitted by this DPA or the Agreement. If requested or required by a competent governmental authority to disclose Controller Data, to the extent legally permissible and practicable, Processor will provide Customer with sufficient prior written notice in order to permit Customer the opportunity to oppose any such disclosure.

4.3 Retention and Deletion. Processor will retain Controller Data only for as long as the Customer deems it necessary for the Permitted Purpose, or as required by applicable law. At the termination of this DPA, or upon Customer’s written request, Processor will either destroy or return the Controller Data to Customer, unless legal obligations require storage of the Controller Data.

4.4 Data Subject and Regulator Requests. Processor shall, to the extent legally permitted, promptly notify Controller in writing of any complaints, questions or requests received from Data Subjects or Regulators regarding the Controller Data. In taking into account the nature of the Processing and to the extent reasonably possible, Processor will provide Controller with commercially reasonable assistance in relation to the handling of a Data Subject’s request. To the extent Controller, in its use of the Services, does not have the ability to correct, block or delete Controller Data, Processor shall comply with any commercially reasonable request by Controller to facilitate such actions to the extent Processor is legally permitted to do so.

4.5 Data Protection Impact Assessment. To the extent required under the Applicable Data Protection Law, upon Customer’s request, Processor will provide reasonable assistance to Customer necessary for Customer to fulfil its obligation under the Applicable Data Protection Law to carry out a data protection impact assessment related to Customer’s use of the Services, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Processor.

4.6 Security. Processor will implement and maintain appropriate technical, physical and administrative measures to protect Controller Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access provided that such measures shall take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, so as to ensure a level of security appropriate to the risks represented by the processing and the nature of the Controller Data to be protected.

(a) Customer acknowledges that the security measures are subject to technical progress and development and that Processor may update or modify the security measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by Customer. Customer is responsible for reviewing the information made available by Processor relating to data security and making an independent determination as to whether the Services meet Controller’s requirements and legal obligations under Applicable Data Protection Law.

(b) Notwithstanding the above, Customer agrees that except as provided by this DPA, Customer is responsible for its secure use of the Services, including securing its account authentication credentials, protecting the security of Controller Data when in transit to and from the Services and taking any appropriate steps to securely encrypt or backup any Controller Data uploaded to the Services.

5. SECURITY INCIDENTS

5.1 Notification. If Processor becomes aware of any Security Incident, Processor will promptly notify Customer, but in no event later than seventy-two (72) hours after Processor has confirmed a Security Incident occurred. To the extent known, the Processor shall advise Customer of: (a) the nature of the Security Incident; (b) the date and time upon which the Security Incident took place and was discovered; (c) the number of Data Subjects affected by the Security Incident; (d) the categories of Controller Data involved; (e) the measures – such as encryption, or other technical or organizational measures – that were taken to address the incident, including measures to mitigate the possible adverse effects; (f) whether such proposed measures would result in a disproportionate effort given the nature of the incident; (g) the name and contact details of the Data Protection Officer or other contact; and (h) a description of the likely consequences of the Security Incident. Processor’s obligation to report or respond to a Data Breach under this Section is not and will not be construed as an acknowledgement by Processor of any fault or liability with respect to the Data Breach.

5.2 Coordination. Processor will investigate the Security Incident and will take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident. Processor shall assist with or perform reasonable remediation efforts required by Applicable Data Protection Law, provided that nothing in this section shall prevent either party from complying with its obligations under the Applicable Data Protection Law. The Parties agree to coordinate in good faith on developing the content of any related public statements.

5.3 Caused by Controller. The obligations in this section shall not apply to a Data Breach that is caused by Customer.

5.4 Customer Responsibilities. Customer is responsible for (a) properly configuring the Services and using the security features and controls made available by Porkbun; (b) maintaining the security and confidentiality of its account credentials; and (c) ensuring that content Customer places or causes to be placed within the Services, including software, plugins, and themes in Customer’s hosted environment, is free of malicious code and vulnerabilities. A compromise of Controller Data resulting from Customer’s failure to satisfy these responsibilities is not a compromise of Porkbun’s systems and is the responsibility of Customer.

6. AUDITS

6.1 Processor (or third parties engaged by Processor) audits its compliance against information security standards on a regular basis. The specific audits, and the information security certifications Porkbun has achieved, will vary depending on the nature of the Services in question. Subject to obligations of confidentiality, Porkbun will make available to Customer a summary of its most recent relevant audit report and/or other documentation reasonably required by Customer which Porkbun makes generally available to its customers, so that Customer can verify Processor’s compliance with this DPA.

6.2 To the extent that the Customer reasonably determines such report does not sufficiently verify Porkbun’s compliance with its obligations under this DPA, Customer may audit Processor’s compliance with this DPA up to once per year, unless requested by a Supervisory Authority. Such an audit will be conducted by an independent third party (“Auditor”) reasonably acceptable to Processor. Before the commencement of any such on-site audit, Customer must submit in writing a detailed proposed audit plan to Processor at least 30 business days in advance of the proposed audit date. The proposed audit plan must describe the proposed scope, duration and date of the audit, as well as the proposed Auditor. Processor will review the proposed audit plan and provide Customer with any concerns or questions and will work cooperatively with Customer to agree on a final audit plan. Prior to the start of an audit, the Parties will agree to reasonable time, duration, place and manner conditions for the audit, and a reasonable reimbursement rate payable by Customer to Processor for Processor’s audit expenses. The results of the audit and all information reviewed during such inspection will be deemed Processor’s confidential information, and subject to the Confidentiality provisions in the Agreement. Notwithstanding any other terms, the Auditor may only disclose to the Customer any specific violations of the DPA, if any, and the basis for such findings, and shall not disclose to the Customer any of the records or information reviewed during the inspection.

7. USE OF SUB-PROCESSORS

7.1 Consent. Customer consents to Porkbun subcontracting any of its activities under the Agreement to the Sub-Processors identified on Schedule 1, section C, and to Sub-Processors going forward subject to Porkbun entering into a written contract where Sub-Processor is bound by the same data protection obligations as Porkbun under this DPA, and subject to Section 7.2 for new Sub-Processors. Porkbun agrees to conduct reasonable diligence on such Sub-Processors to attain reasonable assurance that such Sub-Processors have in place proper organizational and technical safeguards to ensure the protection of Controller Data. Processor shall be liable for the acts and omissions of its Sub-processors use to provide the Services to the same extent Processor would be liable if performing the services of each Subprocessor directly under the terms of this DPA, except as otherwise set forth in the Agreement.

7.2 Objection to New Sub-Processor. Processor will provide twenty (20) days’ notice of a new sub-processor to Customer. Customer may object to Processor’s appointment or replacement of a sub-processor prior to its appointment or replacement, provided such objection is in writing and based on reasonable grounds relating to data protection, and such objection is made within 10 (ten) days after the notice of the new sub-processor provided by Processor. Any such written objection shall include Customer’s specific reasons for its objection and proposed options to mitigate alleged risk, if any. In such an event, the Parties agree to discuss commercial reasonable alternative solutions in good faith. If the Parties cannot reach a resolution within sixty (60) days from the date of Processor’s receipt of Customer’s written objection, Customer may discontinue the use of the affected Services by providing written notice to Processor. In the absence of timely and valid objection by Customer, such new Sub-processor may be commissioned to Process Controller Data.

8. INTERNATIONAL PROVISIONS

8.1 To the extent Customer’s use of the Services involves a Restricted Transfer of Controller Data, the terms set forth in Schedule 3 – Cross-Border Transfer Mechanisms will apply. In the event any conflict or inconsistency exists between this DPA and the terms set forth in Schedule 3, in relation to Controller Data collected from individuals while they were located in the European Economic Area, Switzerland or the United Kingdom, the terms in Schedule 3 shall apply.

8.2 Insofar as the Agreement involves the transfer of Controller Data from any jurisdiction where Applicable Data Protection Law requires that additional steps, or safeguards, be imposed before the data can be transferred to a second jurisdiction, Porkbun agrees to cooperate with Customer to take appropriate steps to comply with Applicable Data Protection Laws.

9. LIMITATION ON LIABILITY

9.1 In no event will either Party or their respective directors, officers, agents, or employees be liable to the other party for any reason, whether in contract or in tort for any claims or liability arising out of or based upon this DPA, excess of the amount actually paid by the Customer to Processor in the twelve months preceding the first incident out of which the liability arose, regardless of the form in which any legal or equitable action may be brought.

9.2 For the avoidance of doubt, Processor’s and its Affiliates’ total liability for all claims from the Customer and all of its Authorized Affiliates arising out of or related to the Agreement and each DPA shall apply in the aggregate for all claims under both the Agreement and all DPAs established under this Agreement, including by Customer and all Authorized Affiliates, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Authorized Affiliate that is a contractual party to any such DPA.

10. MISCELLANEOUS

10.1 Severability. Any provision of this DPA that is prohibited or unenforceable in any jurisdiction shall, as to that jurisdiction alone, be ineffective to the extent of such prohibition or unenforceability without invalidating the remaining provisions hereof, and any such prohibition or unenforceability in any jurisdiction shall not invalidate or render unenforceable such provision in any other jurisdiction. The parties will attempt in good faith to agree upon a valid and enforceable provision that is a reasonable substitute and shall incorporate such substitute provision into this DPA.

10.2 Governing Law. This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Law.

10.3 Authorized Affiliates. Customer enters into this DPA on behalf of itself and, to the extent required under Applicable Data Protection Law, in the name and on behalf of its Authorized Affiliates, if and to the extent Porkbun processes Personal Data for which such Authorized Affiliates qualify as the Controller.

10.4 Modifications. This DPA may not be amended or modified except by the mutual agreement of the Parties; provided, however, Customer will be notified thirty (30) days in advance of any amendments or modifications to this DPA, which shall take effect in the next billing cycle, and Customer’s continued use of the Services shall constitute acceptance of such amendments and/or modifications. This DPA may be executed in counterparts.

10.5 No Assignment. Controller may not, directly or indirectly, by operation of law or otherwise, assign all or any part of its rights under this DPA or delegate performance of its duties under this DPA without Processor's prior consent, which consent will not be unreasonably withheld. Processor may, without Controller's consent, assign this DPA to any affiliate or in connection with any merger or change of control of Processor or the sale of all or substantially all of its assets provided that any such successor agrees to fulfil its obligations pursuant to this DPA.

Schedule 1: List of Parties, Processing Details and Subprocessor List
Schedule 2: Description of Technical and Organizational Security Measures
Schedule 3: Cross-Border Transfer Mechanism

This DPA does not require signature to be effective. By accepting the Agreement or using the Services, Customer is deemed to have accepted and entered into this DPA, including the Standard Contractual Clauses and their Annexes where applicable, as of the Effective Date. The version of this DPA posted at porkbun.com/legal, as updated from time to time in accordance with the Modification provisions above, governs the Processing of Controller Data.

SCHEDULE 1 - LIST OF PARTIES, PROCESSING DETAILS AND SUBPROCESSOR LIST

A. List of Parties

Name of Data Exporter: The Customer, as identified in the Customer’s Porkbun account

Address: As set out in the Customer’s Porkbun account information and applicable service orders

Contact Person’s Name: As set out in the Customer’s Porkbun account information and applicable service orders

Position: As set out in the Customer’s Porkbun account information and applicable service orders

Contact details: As set out in the Customer’s Porkbun account information and applicable service orders

Activities relevant to the data transferred under these Clauses: Engaging Data Importer to perform email hosting / SMTP relay, email forwarding, URL forwarding and web hosting services, and any other Services through which Data Importer processes personal data on Data Exporter’s behalf, pursuant to the Agreement and Ordering Forms entered into with Data Importer.

Role: Controller

Name of Data Importer: Porkbun LLC

Address: 742 Ocean Club Place, Fernandina Beach, FL 32034, USA

Contact Person’s Name: Porkbun Privacy Team

Position: Privacy & Legal Operations

Contact details: privacy@porkbun.com; +1 503 757 2510

Activities relevant to the data transferred under these Clauses: Processing to carry out the email hosting / SMTP relay, email forwarding, URL forwarding and web hosting services, and any other Services through which Data Importer processes personal data on Data Exporter’s behalf, pursuant to the Agreement and Ordering Forms entered into with Exporter.

Role: Processor

B. Details of Processing & Transfer

1. Categories of Data Subjects

The personal data transferred concerns the following categories of data subjects:

• Employees, officers, contractors and agents of the data exporter who hold mailboxes or send/receive email through the Service;
• Customers, prospects, suppliers, partners and other third parties who correspond with the data exporter by email or who are recipients of transactional or marketing email sent through the SMTP relay;
• Any other natural persons whose personal data is, in the data exporter's discretion, included in the body, headers, subject line, attachments or metadata of email messages transmitted through or stored on the Service.
• Senders and recipients of email messages forwarded through the email forwarding service, and any other natural persons whose personal data is contained in the body, headers, subject line, attachments or metadata of such messages;
• Visitors to domains redirected through the URL forwarding service;
• Visitors to and users of websites hosted through the web hosting service, and any other natural persons whose personal data is contained in site files, content, databases, forms or logs uploaded to or generated by the data exporter’s hosted site.
• Any other natural persons whose personal data is processed through the Services on the data exporter’s instructions.

2. Types of Personal Data Transferred

Because the Service transmits and stores arbitrary email content authored or received by the data exporter, the categories of personal data are determined by the data exporter and may include, without limitation:

• Identification and contact data: sender and recipient email addresses, display names, reply-to addresses, organisation names, telephone numbers, postal addresses;
• Message content: free-text body, subject lines, attachments (documents, images, spreadsheets, PDFs, etc.) and any personal data contained therein;
• Email metadata and technical data: message IDs, timestamps, originating and receiving IP addresses, user-agent strings, SMTP envelope data, routing headers (Received, Return-Path), DKIM/SPF/DMARC results, bounce codes, delivery and read receipts, spam scores;
• Authentication and account data: mailbox usernames, hashed passwords, MFA tokens, session identifiers, API keys, login timestamps and source IP addresses.
• URL forwarding traffic data: visitor IP address, requested hostname and path, referrer, user-agent string and timestamp of requests to domains redirected through the URL forwarding service;
• Website content and databases: files, pages, databases, form submissions and access logs of websites hosted through the web hosting service, which may contain any categories of personal data determined by the data exporter.

3. Sensitive Data Transferred

The personal data transferred concern the following special categories of data: None. The Customer should not transfer any special categories of personal data or sensitive data to Processor in relation to providing the Services.

4. Frequency of the Transfer

Continuous.

5. Nature of Processing

The Personal Data transferred will be subject to the following basic processing activities: Processor will Process Controller Data as necessary to perform the Services pursuant to the Agreement, and as further instructed by Customer in its use of the Services. The processing operations are the Services that are used by the Customer.

6. Purpose of Processing

The purpose of the Processing of Controller Data by Processor is to provide Customer with the Services under the Agreement.

7. Duration of the Processing

The Term of the Agreement plus the period from the expiry of such Term until deletion of all Controller Data by the Processor in accordance with the DPA.

Sub-processors authorised under Section 7 of the DPA process the personal data described above for the purposes listed above and only for the duration necessary to perform the sub-processed activity. The current list of sub-processors and a description of their processing is set out in Schedule 1, Part C.

C. Sub-Processors

Customer has authorised the use of the following sub-processors:

SCHEDULE 2 - DESCRIPTION OF TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Technical and Organisational Security Measures

Below is a description of the technical and organizational measures implemented by the data importer (including infrastructure security, application security, operational security, office network security, and various administrative controls) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

• Encryption and pseudonymization. Personal Data is encrypted in transit using TLS (minimum version TLS 1.2) and account passwords are stored using bcrypt hashing.

• Confidentiality, integrity, availability and resilience. Production systems are segmented from office and development environments behind firewalls; DDoS mitigation and reverse-proxy protection are provided via Cloudflare; systems are monitored with alerting for anomalous events. Porkbun maintains a documented incident response procedure.

• Backup and recovery. Data required for service continuity is backed up daily, with backups stored separately from production systems; restoration procedures are documented and restores are performed in the ordinary course of operations.

• Testing and evaluation. Porkbun regularly tests, assesses and evaluates the effectiveness of its technical and organizational measures, taking into account the state of the art, implementation cost, and the nature, scope, context and purposes of processing (Art. 32(1) GDPR), including regular vulnerability scanning and patching of identified issues.

• Access control and authentication. Access to systems processing Controller Data is limited to personnel who require it for their role; administrative access requires multi-factor authentication; access is revoked promptly on role change or departure.

• Protection in transmission. Customer-facing services carrying Controller Data are encrypted in transit using TLS.

• Protection in storage and physical security. Controller Data is processed exclusively in third-party cloud infrastructure (AWS; Cloudflare; WP Cloud/Automattic; Articulation; Extendify). Porkbun operates no data centers of its own and relies on its infrastructure providers’ physical, environmental and redundancy controls as described in their published security documentation.

• Logging. System and access logs for the hosting and email services are maintained for security-relevant events and retained for 14 days.

• System configuration and patching. Systems are maintained at supported software versions with security patches applied on a prioritized basis.

• Governance. Responsibility for security and privacy is assigned to identified members of the operations and engineering leadership; Porkbun operates with a small team under direct management oversight and engages external privacy counsel for legal matters.

• Data minimization and instructions. Controller Data is handled only as needed to provide the Services and in accordance with the Customer’s instructions under the DPA; personnel access is limited to what their duties require.

• Data quality. Access to Controller Data occurs through authenticated, authorized sessions; customer-initiated changes are validated through the account login and authorization mechanisms.

• Retention. Controller Data is retained only as long as needed to provide the Services or as required by law, and is deleted or returned in accordance with the Retention and Deletion section of this DPA.

• Accountability. Privacy and security practices are coordinated across operations, engineering and support, with material issues escalated to executive management.

• Portability and erasure. Customers can access, export and delete Controller Data through account functionality where available, supplemented by support-assisted processes for export or deletion requests.

SCHEDULE 3 – CROSS BORDER TRANSFER MECHANISMS

1. Definitions

• a. “EC” means the European Commission.

• b. “EEA” means the European Economic Area.

• c. “EEA Personal Data” is Controller Data collected from data subjects when they are located in the EEA.

• d. “Standard Contractual Clauses” means (i) where the EU GDPR applies, the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for transferring personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU SCC”); (ii) where the UK GDPR applies, the International Data Transfer Agreement: Controller to Processor under Section 119A of the Data Protection Act 2018 (“UK SCC”); and (iii) where the Swiss DPA applies, the applicable standard data protection clauses issued, approved or recognised by the Swiss Federal Data Protection and Information Commissioner (“Swiss SCC”).

• e. “Swiss Personal Data” means Controller Data collected from data subjects when they are located in Switzerland.

• f. “UK Personal Data” means Controller Data collected from data subjects when they are located in the United Kingdom.

2. Cross Border Data Transfer Mechanisms

2.1. EEA Personal Data. The Parties agree that the Standard Contractual Clauses will apply to Controller Data that is transferred via the Services from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is: (a) not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for Personal Data. To the extent applicable, the Standard Contractual Clauses will be deemed entered into (and incorporated into this Addendum by this reference) and are deemed executed by each of the Parties acting on their own behalf and on behalf of their Affiliates (where applicable) without the need for any further signature from either party and completed as follows:

(a) Module Two (Controller to Processor) of the EU SCC will apply where Customer is a Controller of Controller Data, and Module Three (Processor to Processor) of the EU SCC will apply where Customer is a Processor of Controller Data, in each case where Porkbun is Processing Controller Data on Customer’s behalf, which can be found at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en.

(b) For the Module, where applicable:

• (i) in Clause 7 of EU SCC, the optional docking clause will not apply;

• (ii) the audits described in Clause 8.9(c) and (d) of the EU SCC shall be carried out in accordance with Section 6 of the DPA

• (iii) in Clause 9 (a) of the EU SCC, Option 2 will apply and the time period for prior notice of sub-processor changes will be as set forth in Section 7 of the DPA;

• (iv) in Clause 11 of the EU SCC, the optional language will not apply;

• (v) the liability described in Clause 12 shall in no event exceed the limitations set forth in the DPA, and that under no circumstances and under no legal theory (whether in contract, tort, negligence or otherwise) will either party to this DPA, or their Affiliates, officers, directors, employees, agents, service providers, suppliers, or licensors be liable to the other party or any third party for any lost profits, lost sales of business, lost data (being data lost in the course of transmission via Customer’s systems or over the Internet through no fault of Supplier), business interruption, loss of goodwill, or for any type of indirect, incidental, special, exemplary, consequential or punitive loss or damages, regardless of whether such party has been advised of the possibility of or could have foreseen such damages. For the avoidance of doubt, this section shall not be construed as limiting the liability of either party with respect to claims brought by data subjects;

• (vi) the certification of deletion of Controller Data that is described in Clause 16(d) of the EU SCC shall be provided by Processor to Customer only upon Customer’s request.

• (vii) in Clause 17 (Option 1), the EU SCC will be governed by Irish law;

• (viii) in Clause 18(b) of the Standard Contractual Clauses, disputes will be resolved before the courts of Ireland;

• (ix) in Annex I, Part A of the EU SCC shall be deemed completed with the information set out in Schedule 1, Part A of this DPA;

• (x) in Annex I, Part B of the EU SCC shall be deemed completed with the information set out in Schedule 1, Part B of this DPA

• (xi) in Annex I, Part C of the EU SCC: the competent supervisory authority will be determined in accordance with Clause 13 of the EU SCC; where the data exporter is established in an EU Member State, the supervisory authority of that Member State will be the competent supervisory authority;

• (xii) subject to Section 4.6 of the DPA, Schedule 2 (Description of Technical and Organizational Security Measures) of this DPA serves as Annex II of the EU SCC; and

• (xiii) subject to Section 7 of this DPA, Annex III of the EU SCC shall be deemed completed with the information set out in Schedule 1, Part C of this DPA.

2.2 Swiss Personal Data. In accordance with guidance issued by the Swiss Federal Data Protection and Information Commissioner (FDPIC) titled “The transfer of personal data to a country with an inadequate level of data protection based on recognised standard contractual clauses and model contracts,” dated 27 August 2021, the parties hereby agree to adopt the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council annexed to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021(the “EU SCC”) as adapted herein in order to comply with Swiss legislation and thus be suitable for ensuring an adequate level of protection for data transfers from Switzerland to a third country in accordance with Article 6 paragraph 2 letter a of the Federal Act on Data Protection (“FADP”). To the extent there is any conflict between the DPA and this Section 2.2, the terms of this section will prevail in relation to Swiss Personal Data. The parties agree that in relation to Restricted Transfer of Swiss Personal Data, the applicable Module of the EU SCC (as determined under Section 2.1(a)) applies with the following amendments:

• (i) For purposes of Annex I, Part C under Clause 13 of Standard Contractual Clauses insofar as the data transfer is governed by the Switzerland Federal Act on Data Protection of 19 June 1992 (SR 235.1; FADP) or the FADP’s revised 25 September 2020 version, the Supervisory Authority shall be Switzerland’s Federal Data Protection and Information Commissioner (FDPIC);

• (ii) The term “member state” must not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in Switzerland in accordance with Clause 18(c) of the Standard Contractual Clauses. The Standard Contractual Clauses shall also protect the data of Switzerland legal entities until the entry into force of the 25 September 2020 revised version of the Federal Act on Data Protection (revised FADP). Any references in the Standard Contractual Clauses to “Directive 95/46/EC” or “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA.

2.3 UK Personal Data. The parties agree that the Information Commissioner’s Office’s International Data Transfer Agreement, referred to hereafter as Standard Contractual Clauses, will apply to UK Personal Data that is transferred via the Services from the United Kingdom, either directly or via onward transfer, to any country or recipient outside the United Kingdom that is not recognized by the ICO as providing an adequate level of protection for Personal Data. To the extent applicable, the Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows:

PART 1: TABLES

Table 1: Parties and Signatures. See Schedule 1 of the DPA.

Table 2: Transfer Details

Table 3: Transferred Data. See Schedule 1, which will be updated automatically if the data transferred changes.

Table 4: Security Requirements. See Schedule 2, which will update automatically if the information is updated in the Agreement or this DPA.

PART 2: EXTRA PROTECTION CLAUSES: N/A

PART 3: COMMERCIAL CLAUSES

PART 4: MANDATORY CLAUSES

The template IDTA A1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 5.4. By entering into the DPA, the parties are deemed to have signed the IDTA, incorporated herein by reference, as of the Effective Date of the Agreement.