Effective July 15, 2026 · Version 1.1

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the Terms of Service between Pixla and the customer ("Customer," "you") for use of the online Services. It applies where and to the extent Pixla processes Personal Data on Customer's behalf as a processor in connection with Pixla Hosting and Pixla Mail. Where there is a conflict, this DPA controls over the Terms with respect to the processing of Customer Personal Data.

1. Definitions

• "Data Protection Laws" means all laws applicable to the processing of Personal Data under this DPA, including the EU GDPR, the UK GDPR, and applicable U.S. state privacy laws (e.g., the CCPA/CPRA).
• "Personal Data," "controller," "processor," "data subject," and "processing" have the meanings given in the applicable Data Protection Laws.
• "Customer Personal Data" means Personal Data contained in User Content that Pixla processes on Customer's behalf under the Terms (e.g., recipient data in Pixla Mail; data within applications deployed on Pixla Hosting).
• "Subprocessor" means a third party engaged by Pixla to process Customer Personal Data.

2. Roles and scope

• Customer is the controller (or a processor acting for a third-party controller) of Customer Personal Data. Pixla is the processor (or subprocessor) acting on Customer's documented instructions.
• For Pixla's own account, billing, website, and security data, Pixla acts as an independent controller under the Privacy Policy; that processing is not governed by this DPA.

3. Details of processing

• Subject matter: provision of the Pixla Hosting and Pixla Mail Services.
• Duration: the term of the Terms, plus any period until deletion of Customer Personal Data in accordance with this DPA.
• Nature and purpose: hosting, storing, transmitting, building, serving, and — for Pixla Mail — sending email on Customer's behalf; and, where the Customer enables them, providing site-visitor analytics, form-submission collection, store/order processing, and email campaign analytics, together with related functionality and support.
• Types of Personal Data: as determined by Customer, which may include names, email addresses, and any Personal Data Customer includes in its User Content, recipient lists, or deployed applications, and — where the relevant features are enabled — additionally:
• *Hosting site analytics:* aggregate visitor statistics for the Customer's site (pages viewed, referring domain, coarse country-level location) and a daily-rotating anonymous visitor hash. Raw IP address and user-agent are used only transiently to derive the hash and are not stored by Pixla.
• *Hosting Forms:* the contents of form submissions made by the Customer's site visitors (which may include name, email address, free-text message, and other fields the Customer's form requests) together with the submitter's IP address.
• *Hosting Store:* order records, including the buyer's email address, order amounts and currency, and purchased items. Payment-card data is handled by Stripe and is not processed or stored by Pixla.
• *Pixla Mail campaign analytics:* per-recipient engagement events, including recipient email address, open/click event type, clicked URL, requesting user-agent, and timestamp.
• Categories of data subjects: as determined by Customer, which may include Customer's end users, contacts, and email recipients, and — where the relevant features are enabled — the Customer's website visitors, the individuals who submit its web forms, and its store customers.

4. Customer instructions

Pixla will process Customer Personal Data only on Customer's documented instructions, including as set out in the Terms and this DPA and as necessary to provide the Services, unless required by law (in which case Pixla will, where legally permitted, inform Customer). Pixla will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

5. Confidentiality

Pixla ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

6. Security

Pixla will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, and purposes of processing. These measures include encryption in transit, access controls, and secured infrastructure, as further described in the Privacy Policy and Pixla's security practices.

7. Subprocessors

• Customer provides general authorization for Pixla to engage Subprocessors to process Customer Personal Data. Pixla's current Subprocessors are listed at https://pixla.app/legal/subprocessors.
• Pixla will impose data-protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for its Subprocessors' performance.
• Pixla will notify Customer of any intended addition or replacement of a Subprocessor at least thirty (30) days before the new Subprocessor begins processing Customer Personal Data, by email to the account's registered address and/or by updating the Subprocessors page. Customer may object in writing within thirty (30) days of that notice on reasonable data-protection grounds, and the parties will work together in good faith to resolve the objection. If the objection cannot be reasonably resolved, Customer may, as its sole remedy, terminate the affected Service by written notice.

8. Data subject requests

Taking into account the nature of the processing, Pixla will provide reasonable assistance to help Customer respond to requests from data subjects to exercise their rights. If Pixla receives such a request directly, it will, where permitted, refer the data subject to Customer.

9. Personal data breach

Pixla will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to Pixla to help Customer meet its notification obligations.

10. International transfers

Where Pixla transfers Customer Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties will rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (the "SCCs"), which are incorporated into this DPA by reference. Module Two (Controller-to-Processor) applies where Customer is a controller of the transferred data, and Module Three (Processor-to-Processor) applies where Customer acts as a processor for a third-party controller. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs applies; for transfers subject to Swiss law, the SCCs apply as adapted for Switzerland. The information required to complete the SCC Annexes is drawn from Section 3 (Details of processing) of this DPA (Annex I) and the current Subprocessors list (Annex III), and the technical and organizational measures in Section 6 (Annex II). *(Counsel to confirm and execute the operative SCC document before reliance.)*

11. Deletion and return

Upon termination or expiry of the Services, Pixla will delete or return Customer Personal Data in accordance with the Terms and the retention periods described in the Privacy Policy, unless retention is required by law.

12. Audits

Pixla will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer. Any such audit will take place no more than once in any twelve (12) month period (except where required by a supervisory authority or following a Personal Data Breach affecting Customer Personal Data), on at least thirty (30) days' prior written notice, during normal business hours, in a manner that does not disrupt Pixla's operations or compromise the confidentiality or security of other customers' data, and at Customer's expense. Where available, Pixla may satisfy an audit request by providing a current third-party audit report, certification, or its written responses to a reasonable security questionnaire.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms.

14. Term

This DPA takes effect when incorporated into the Terms and continues until Pixla has ceased all processing of Customer Personal Data.

15. Contact

Data protection: privacy@pixla.app

Pixla LLC · 5706 Neubert Springs Rd, Knoxville, TN 37920