DATA PROCESSING AGREEMENT

Version 1.0, effective October 23, 2026

This Data Processing Agreement is part of WishKit's Terms of Use for every customer whose processing is subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection. Accepting the Terms of Use counts as signing it. If you need a signed copy, email support@wishkit.io.

1. Parties, scope and precedence

This Data Processing Agreement ("DPA") is between WishKit LLC, a Washington limited liability company doing business as WishKit, 500 Westover Dr #37975, Sanford, NC 27330, United States ("WishKit"), and the customer that accepted WishKit's Terms of Use or signed this DPA ("Customer").

It applies whenever WishKit processes Customer Personal Data while providing the Services under WishKit's Terms of Use (the "Agreement").

If this DPA conflicts with the Agreement, this DPA wins for the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses win.

2. Definitions

Terms not defined here have the meaning given in the Agreement or in Data Protection Law.

• Data Protection Law: the GDPR (Regulation (EU) 2016/679), the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other law on personal data that applies to the processing under this DPA.
• Customer Personal Data: personal data that WishKit processes on Customer's behalf while providing the Services, as described in Annex I.
• End User: a person who uses Customer's app or website, including the boards, forms and chat the Services provide inside it.
• Subprocessor: a third party that WishKit engages to process Customer Personal Data.
• Standard Contractual Clauses (SCCs): the clauses annexed to Commission Implementing Decision (EU) 2021/914.
• Controller, processor, data subject, processing, personal data breach: as defined in the GDPR.

3. Roles and instructions

Customer is the controller of Customer Personal Data and WishKit is its processor. Where Customer acts as a processor for someone else, WishKit is Customer's subprocessor.

1. Documented instructions. WishKit processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's own use and settings of the Services (for example deleting an End User, or connecting an AI app) are those instructions.
2. Unlawful instructions. WishKit tells Customer promptly if, in its opinion, an instruction breaks Data Protection Law.
3. Legal requirements. If a law WishKit is subject to requires other processing, WishKit tells Customer first, unless that law forbids it.
4. Customer's duties. Customer has a lawful basis for the processing and gives End Users the notices it requires. Customer obtains any consent the law requires, including a parent's or guardian's consent. Customer does not use the Services in apps or websites directed at children under 13.
5. No selling or advertising. WishKit does not sell Customer Personal Data and does not use it for advertising.
6. Indemnity. Customer indemnifies WishKit against any third-party claim, including its reasonable costs and attorneys' fees, that arises from Customer's breach of point 4 or from processing WishKit carried out on Customer's instructions.

4. WishKit's obligations

1. Confidentiality. Everyone WishKit authorizes to process Customer Personal Data is bound by confidentiality. Today that is only WishKit's founder.
2. Security. WishKit keeps the technical and organisational measures in Annex II, and may improve them as long as overall protection does not drop.
3. Assistance. Taking into account the nature of the processing and the information available to it, WishKit gives Customer reasonable help with data protection impact assessments and prior consultations (GDPR Articles 35 and 36).
4. Records. WishKit keeps a record of its processing activities as GDPR Article 30(2) requires.

5. Subprocessors

Customer gives WishKit general written authorization to use the Subprocessors listed in Annex III.

1. Same obligations. WishKit binds each Subprocessor by written contract to data protection obligations no less protective than this DPA.
2. Changes. WishKit emails Customer's account address at least 30 days before adding or replacing a Subprocessor.
3. Objection. Customer may object on reasonable data protection grounds within those 30 days. If the parties can't resolve it, Customer may end the affected Services and get a refund of fees prepaid for the period after the change.
4. Liability. WishKit remains liable to Customer for its Subprocessors' performance of their obligations.

6. Data subject requests

Customer handles requests from End Users who exercise their rights, and WishKit helps where Customer can't act alone.

1. Self-service. In the dashboard, Customer can see an End User's requests, votes, comments and chats. Customer can delete single requests, comments and chat messages, or delete the End User, which removes all of them.
2. Help on request. For anything the dashboard doesn't cover, such as a machine-readable copy of one End User's data, WishKit helps within 14 days of Customer's written request.
3. Requests sent to WishKit. If an End User contacts WishKit directly, WishKit points them to Customer and doesn't answer the request itself unless Customer authorizes it.

7. Personal data breaches

WishKit notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

1. Content. The notice describes, as far as known, what happened, the categories and approximate number of End Users and records affected, the likely consequences, and the measures taken or proposed. Information WishKit doesn't have yet follows as soon as it does.
2. Channel. By email to Customer's account address.
3. Containment. WishKit takes reasonable steps to contain the breach and limit its effects, and cooperates with Customer's own notifications to authorities and End Users.
4. No admission. A notice is not an admission of fault or liability.

8. Audits

WishKit demonstrates compliance by answering Customer's written security and privacy questionnaire, once a year and after a personal data breach.

1. Questionnaire. WishKit answers within 30 days and provides the information reasonably needed to show it meets GDPR Article 28.
2. Inspection. If a supervisory authority requires it, or the answers are reasonably insufficient, Customer may have an independent auditor inspect WishKit's processing. This needs 30 days' notice, happens at most once a year during business hours, is at Customer's cost, and is under a confidentiality agreement.
3. Confidentiality. Everything WishKit shares under this section is WishKit's confidential information.

9. Transfers to the United States

WishKit stores and processes Customer Personal Data in the United States. Its database and application run in Heroku's US region, on AWS in Northern Virginia.

1. EEA. For transfers from the European Economic Area, the parties enter into the SCCs, Module 2 (controller to processor), or Module 3 (processor to processor) where Customer is a processor. They are incorporated by reference, with Customer as data exporter and WishKit as data importer.
2. Options chosen. Clause 7 (docking) applies. Clause 9(a) Option 2 applies, with the notice period in section 5. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the law and courts of Ireland apply.
3. Annexes. Annexes I, II and III of this DPA are the SCCs' Annexes I, II and III.
4. UK. For transfers from the United Kingdom, the UK International Data Transfer Addendum (version B1.0) applies to those SCCs. Under the Addendum, those transfers fall under the law and courts of England and Wales.
5. Switzerland. For transfers from Switzerland, the SCCs apply with references to the GDPR read as the Swiss Federal Act on Data Protection, and the Swiss FDPIC is the competent authority. "Member State" in Clause 18(c) does not prevent data subjects in Switzerland from suing where they habitually reside.

10. Return and deletion

When the Services end, WishKit deletes Customer Personal Data within 30 days, unless a law WishKit is subject to requires keeping it.

1. During the Services. Customer can delete End Users and whole projects in the dashboard at any time. Deleting the account happens on request to support@wishkit.io.
2. Copy first. On written request before deletion, WishKit gives Customer a copy of Customer Personal Data in a common machine-readable format (CSV or JSON).
3. Backups. WishKit's database backups are taken daily and kept for at most 14 days (7 daily and 1 weekly). Manual backups, for example before a database change, are deleted within 14 days. The hosting provider also keeps physical backups for disaster recovery, on its own schedule. Backups are only restored to recover the Services.
4. Confirmation. On request, WishKit confirms the deletion in writing.

11. Aggregated and anonymized statistics

Customer instructs WishKit to create aggregated, anonymized statistics from Customer Personal Data, as the Agreement's "Aggregated Data" clause describes.

1. Thresholds. WishKit publishes only results that combine data from at least ten customers' projects. It never publishes content, quotes, or figures about a single customer, app or End User.
2. Not personal data. Once anonymized, the statistics are not personal data and are not Customer Personal Data under this DPA.
3. AI classification. Before WishKit sends request titles to an AI provider to group them into topics, it adds that provider to Annex III under section 5. It sends titles only, without names, emails, identifiers or the app they came from, to a provider that does not train on them.

12. Liability

WishKit's total liability under this DPA and the Agreement together is limited to the greater of USD 50 or the fees Customer paid WishKit in the 12 months before the event giving rise to the claim.

1. One cap. This DPA does not add a second cap on top of the Agreement's. Claims under both count toward the same limit.
2. SCCs. The cap, the Agreement's exclusions of damages, its release and its one-year claim deadline do not apply to liability under the SCCs where applying them would contradict the SCCs, including each party's liability to the other under Clause 12.
3. Data subjects and the law. Nothing here limits either party's liability to data subjects, or any liability that the law does not allow to be limited.

13. Term, law and signatures

This DPA runs for as long as WishKit processes Customer Personal Data.

1. How it is entered into. This DPA forms part of the Agreement for every Customer whose processing is subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection, from the moment Customer accepts the Agreement. Accepting the Agreement counts as signing this DPA, including Annex I of the SCCs. On request to support@wishkit.io, WishKit signs a copy of this same text using the table below.
2. Governing law. This DPA is governed by the laws of the State of Washington, and disputes under it follow the Agreement's dispute resolution.
3. SCCs. The SCCs are governed by the law, and their disputes resolved by the courts, that section 9 sets out. Disputes under the SCCs are not subject to the Agreement's arbitration.

Annex I: Details of the processing

Annex II: Technical and organisational measures

Annex III: Subprocessors

The public web board also loads its stylesheet and scripts (Bootstrap) from the jsDelivr and unpkg content delivery networks. They receive board visitors' IP addresses and browser details when the files load, but no other Customer Personal Data.

Contact Information

Email: support@wishkit.io

Mail: WishKit LLC, 500 Westover Dr #37975, Sanford, NC 27330, United States