Data Processing Agreement (DPA)

Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR)

Version: 2.0 | Date: Sept 10, 2026

Parties

(1) The Organization identified in the Services Agreement, acting as Controller ("Controller", "you").

(2) Simplyk France, SAS, registered at 6 rue des Bateliers, 92110 Clichy, France, SIREN 904889466, acting as Processor ("Zeffy", "we").

Each a "Party" and together the "Parties".

Background

A. The Parties have entered into an agreement under which Zeffy provides its fundraising platform and related services to the Controller (the "Services Agreement"). The nature of the Services is described in Zeffy's Privacy Policy and in Annex I.

B. In providing part of the Services, Zeffy processes personal data on behalf of and on the documented instructions of the Controller. This DPA sets out the terms on which that processing takes place, as required by Article 28(3) GDPR.

C. This DPA forms part of, and is subject to, the Services Agreement. Where this DPA conflicts with the Services Agreement on the subject of data protection, this DPA prevails.

1. Definitions

1.1 Terms defined in the GDPR (including "Personal Data", "Processing", "Data Subject", "Special Categories of Personal Data", "Personal Data Breach", "Supervisory Authority") have the same meaning in this DPA. Where the UK GDPR also applies to a given Data Subject, references to the GDPR are read to include the UK GDPR as applicable.

1.2 "Data Protection Law" means the GDPR, the UK GDPR, the national implementing laws of the EEA states where the Controller or its Data Subjects are located, and the ePrivacy rules as implemented locally. t

1.3 "Controller Personal Data" means the personal data that Zeffy processes as processor on behalf of the Controller, as described in Annex I. It does not include personal data that Zeffy processes as an independent controller (see Section 2).

1.4 "Subprocessor" means any third party engaged by Zeffy to process Controller Personal Data.

1.5 "Standard Contractual Clauses" or "SCCs" means the clauses annexed to Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles of the Parties and scope

Data protection law splits responsibility into two roles. A controller decides why and how personal data is used. A processor handles that data on a controller's behalf and follows its instructions.

Zeffy plays both roles, depending on the activity:

• When you use the platform to run your own fundraising, for example building forms, importing your contacts, emailing your supporters or managing your CRM, you decide why and how, and Zeffy simply carries it out for you. For those activities you are the controller and Zeffy is your processor, and this is the part of our relationship that this DPA governs. Throughout this document, "Controller" means you, the Organization.

• When Zeffy checks your organisation and its transactions for fraud, money laundering and sanctions, takes and reconciles payments, or runs its own security, business and compliance operations, Zeffy decides why and how, on the basis of its own legal obligations rather than your instructions. For those activities Zeffy is an independent controller in its own right, and they are governed by Zeffy's Privacy Policy, not by this DPA.

The same piece of information, such as a donor's name, can fall under both roles at different moments. It sits in your CRM, where we act as your processor, and it may also pass through our fraud and sanctions checks, where we act as our own controller.

2.1 Processor role. With respect to the Controller Personal Data described in Annex I, the Controller is the controller and Zeffy is the processor. Zeffy processes that data only as set out in this DPA and in the Controller's documented instructions.

2.2 Controller role of Zeffy, outside this DPA. The Controller acknowledges that Zeffy also processes personal data as an independent controller for its own purposes, and that those activities are not governed by this DPA. They are governed by Zeffy's Privacy Policy. They include, without limitation:

• (a) payments, payouts, refunds, chargebacks and financial reconciliation;

• (b) verification of the Organization and its representatives;

• (c) fraud prevention, anti money laundering, counter terrorist financing and sanctions screening;

• (d) security, logging and abuse prevention;

• (e) Zeffy's own marketing, advertising, analytics and support; and

• (f) Zeffy's own legal, tax, accounting and regulatory compliance.

For those activities Zeffy acts on its own legal obligations and legitimate interests, not on the Controller's instructions, which is why Zeffy can, for example, hold a payout or suspend an account independently of the Controller.

2.3 Stripe. Payment processing and the identity verification and financial crime checks that Stripe performs under its own regulatory permissions are carried out by Stripe as an independent controller, not as Zeffy's Subprocessor. Those activities are outside the scope of this DPA and are governed by Stripe's own privacy policy.

2.4 Documented instructions. The Controller's documented instructions comprise (i) the Services Agreement, (ii) this DPA, (iii) the configuration choices the Controller makes when it uses the Platform (including the forms it builds, the custom questions it asks, the records it imports, and the recipients it emails), and (iv) any further written instruction the Parties agree. Zeffy processes Controller Personal Data only on those instructions unless required to do otherwise by law, in which case Zeffy informs the Controller of that legal requirement before processing, unless the law prohibits it.

2.5 Unlawful instructions. Zeffy informs the Controller without undue delay if, in its opinion, an instruction infringes Data Protection Law. Zeffy may suspend the affected processing until the instruction is confirmed, amended or withdrawn.

3. Processor obligations (Article 28(3))

3.1 Confidentiality. Zeffy ensures that persons authorised to process Controller Personal Data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that access is limited to those who need it to provide the Services.

3.2 Security. Zeffy implements the technical and organisational measures described in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by Article 32 GDPR.

3.3 Assistance with Data Subject rights. Taking into account the nature of the processing, Zeffy assists the Controller, by appropriate technical and organisational measures and insofar as possible, to respond to requests from Data Subjects exercising their rights under Chapter III GDPR. Where a Data Subject sends such a request directly to Zeffy in respect of Controller Personal Data, Zeffy does not respond on the merits, forwards it to the Controller without undue delay, and confirms to the Data Subject that it has done so.

3.4 Assistance with Articles 32 to 36. Taking into account the nature of the processing and the information available to it, Zeffy assists the Controller in ensuring compliance with its obligations relating to security, Personal Data Breaches, data protection impact assessments, and prior consultation with a Supervisory Authority.

3.5 Deletion or return. On termination of the Services, Zeffy, at the Controller's choice, deletes or returns the Controller Personal Data and deletes existing copies, within a reasonable period following termination, unless Data Protection Law requires further storage. Where Zeffy retains any data because it is legally required to do so, it does so as an independent controller under Section 2.2 and its Privacy Policy, and it protects that data under this DPA for as long as it is held.

3.6 Demonstrating compliance and audits. Zeffy makes available to the Controller the information reasonably necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, as set out in Section 7.

4. Subprocessors (Article 28(2) and (4))

4.1 General authorisation. The Controller gives Zeffy general written authorisation to engage Subprocessors. The Subprocessors engaged as at the date of this DPA are listed in Annex III.

4.2 Notice and objection. Before adding or replacing a Subprocessor that processes Controller Personal Data, Zeffy updates the subprocessor page and notifies the Controllers that have subscribed to updates, at least 14 days in advance. The Controller may subscribe to these notifications by writing to [email protected], and Zeffy recommends that it does so in order to receive advance notice. The Controller may object on reasonable data protection grounds within that period. The Parties will work in good faith to resolve the objection. If they cannot, the Controller may terminate the part of the Services that cannot be provided without the Subprocessor, as its sole remedy. Zeffy may agree more specific notification arrangements with an individual Controller.

Where a Subprocessor must be added or replaced more quickly, for operational or security reasons, Zeffy may do so on shorter notice and will notify subscribed Controllers as soon as possible, in which case the Controller's right to object applies from the date of notification.

4.3 Flow down. Zeffy imposes on each Subprocessor, by written contract, data protection obligations that are in substance the same as those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Zeffy remains fully liable to the Controller for the performance of each Subprocessor's obligations.

5. Personal Data Breach

5.1 Zeffy notifies the Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data.

5.2 The notification includes, to the extent available, the information set out in Article 33(3): the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information cannot be provided at once, it may be provided in phases without further undue delay.

5.3 Zeffy does not make any breach notification to a Supervisory Authority or to Data Subjects on the Controller's behalf, and does not name the Controller in any of its own notifications, unless the Controller instructs it to or the law requires it.

6. International transfers

6.1 Controller to Zeffy. Where the Controller is established in the European Economic Area, as is the contracting Zeffy entity, Simplyk France, the transfer of Controller Personal Data from the Controller to Zeffy takes place within the EEA and does not itself involve a restricted transfer. Where the Controller is established outside the EEA, the Parties will put in place any transfer mechanism required for that transfer.

6.2 Onward transfers by Zeffy. Controller Personal Data is hosted on Amazon Web Services infrastructure located in the United States, and certain other Subprocessors operate from the United States and Canada. These onward transfers are covered as follows:

• (a) transfers to Canada rely on the European Commission's adequacy decision for Canadian commercial organisations;

• (b) transfers to the United States rely on the Standard Contractual Clauses (Module Three, processor to processor), together with a transfer impact assessment and supplementary measures, in particular encryption in transit and at rest and access controls as described in Annex II;

• (c) where a United States Subprocessor is also certified under the EU-US Data Privacy Framework, that certification applies as an additional safeguard. Zeffy does not rely on the Framework as its sole transfer mechanism.

6.3 UK. Where the UK GDPR applies to any Controller Personal Data, transfers are additionally covered by the UK Addendum.

6.4 Intragroup. Where Controller Personal Data is shared between Zeffy group entities, that sharing takes place only where the destination country benefits from an adequacy decision, or the transfer is covered by an appropriate safeguard under Chapter V of the GDPR.

6.5 The Controller may request a copy of the safeguards relied on, with commercial terms redacted, by writing to [email protected].

7. Audit

7.1 Zeffy makes available, on request and no more than once in any twelve month period (unless a Supervisory Authority requires otherwise or following a Personal Data Breach), the information reasonably necessary to demonstrate compliance with Article 28, including the technical and organisational measures described in Annex II.

7.2 Where Zeffy holds a current third-party audit report or certification (such as ISO/IEC 27001 or SOC 2), providing the relevant report or certificate to the Controller satisfies Zeffy's obligation under Section 7.1.

7.3 Where the information made available under Sections 7.1 and 7.2 is not sufficient to demonstrate compliance, the Controller may conduct an audit or inspection on 30 days' written notice, during business hours, subject to reasonable confidentiality undertakings and in a manner that does not disrupt Zeffy's operations or the security or confidentiality of other customers' data. The Controller bears its own costs, and Zeffy's reasonable costs where an inspection is on site.

8. Liability, term and general

8.1 Liability. The liability of each Party under this DPA is subject to the limitations and exclusions of liability in the Services Agreement.

8.2 Term. This DPA takes effect on the date above and continues for as long as Zeffy processes Controller Personal Data. Sections that by their nature should survive termination do so.

8.3 Order of precedence. In the event of conflict, the order of precedence is: (i) the Standard Contractual Clauses and UK Addendum, where they apply; (ii) this DPA; (iii) the Services Agreement.

8.4 Governing law and jurisdiction. This DPA is governed by the law and subject to the jurisdiction stated in the Services Agreement.

8.5 Changes. Zeffy may update this DPA where required to reflect a change in Data Protection Law, a decision of a Supervisory Authority, or a change to the Services, on reasonable notice and provided the update does not materially reduce the protection of Controller Personal Data.

Annex I. Description of the processing

A. List of parties

Data exporter (Controller): the Organization identified in the Services Agreement.
Data importer (Processor): Simplyk France, 6 rue des Bateliers, 92110 Clichy, France. Contact: [email protected].

B. Description of the processing

Categories of Data Subjects. The Controller's contributors and donors, event registrants, ticket buyers, members, peer to peer campaign participants, newsletter and communication recipients, supporters and other contacts held in the Controller's account, and the Controller's own authorised users (its staff or volunteers).

Categories of Personal Data. Determined by the Controller through its use of the Platform, and typically including: name, email, postal address, telephone number; the fact and content of a contribution as visible to the Controller (amount, frequency, campaign, form); the answers to any custom questions the Controller chooses to ask; peer to peer fundraising page content and any photograph the Data Subject adds; the content of communications the Controller sends through the Platform; and contact and supporter records the Controller imports from another platform.

Special categories of Personal Data. Zeffy does not require special category data for the processor role. Where the Controller chooses to collect it through its forms (for example a health condition, a religious affiliation implied by a donation, or a political opinion), the Controller acts as the controller for that data and is responsible for having a valid legal basis and a valid Article 9 condition.

Nature and purpose of the processing. Hosting, storing, organising, retrieving, transmitting and deleting the Controller Personal Data so as to provide the Platform functions the Controller uses: contact and supporter management (CRM), forms and their responses, sending of emails and postal mail on the Controller's behalf, and the Controller's own reporting and exports.

Duration. For the duration of the Services Agreement, then deletion or return as set out in Section 3.5, subject to any storage that Zeffy is legally required to carry out as an independent controller.

Frequency. Continuous, for the duration of the Services.

C. Competent Supervisory Authority

The competent Supervisory Authority is the national or, where applicable, regional data protection authority of the Controller's establishment. Where the Standard Contractual Clauses apply to an onward transfer, the competent Supervisory Authority is determined in accordance with Clause 13 of the SCCs.

Annex II. Technical and organisational measures (Article 32)

Zeffy applies the following measures, kept under review and updated as the Services evolve.

Encryption. Encryption of personal data in transit using TLS, and encryption at rest.

Access control. Access on a need to know basis, with multi factor authentication for staff, role based permissions, and logging of access to production systems.

Confidentiality, integrity, availability and resilience. Separation of environments; measures to maintain the ongoing availability and resilience of processing systems.

Vendor management. Vendor due diligence and data protection terms before a provider handles personal data.

Payment cards. Full payment card numbers and card security codes are captured directly by Stripe in a Stripe hosted field and do not pass through Zeffy's systems. Zeffy holds only limited data such as card brand, last four digits, expiry, cardholder name and billing address, and only as an independent controller under Section 2.2.

Annex III. List of Subprocessors

This list is current as at the date of this DPA. Only providers that process Controller Personal Data (Annex I) in the processor role appear here. Providers used solely for Zeffy's own independent controller activities (Section 2.2) are not Subprocessors under this DPA and are listed separately below for transparency.

A. Hosting, storage and delivery

B. Data pipeline and warehouse

Listed because these systems store or move copies of the Controller's records. If, on review, the Controller's own reporting and exports are served only from production and never from the warehouse, these belong under Section C instead as Zeffy controller-role providers.

C. AI and automation

Engaged under agreements that limit them to Zeffy's instructions and prohibit use of the data to train their models. They are authorised for processor-role use to the extent a workflow processes the Controller's form or campaign content or records. Their heaviest current use is in Zeffy's own controller-role activities (fraud, support), which is outside this DPA.

Providers that are NOT Subprocessors under this DPA

These are listed so the boundary is explicit. They are either independent controllers, or providers Zeffy uses only for its own controller-role purposes (Section 2.2), so they do not process Controller Personal Data on the Controller's behalf.

• Stripe is an independent controller for payments, payouts, identity verification and financial crime obligations (Section 2.3). It is not a Subprocessor.

• HubSpot is Zeffy's own CRM for managing its relationship with Organizations, running its support channels and its own marketing. Controller-role.

• Google Analytics, Amplitude, Hotjar measure Zeffy's own Website and product usage. Controller-role, consent-based.

• Metabase is Zeffy's internal business intelligence tool used by Zeffy staff over the warehouse. Controller-role.

• Datadog provides observability and logging for security and abuse prevention. Controller-role (Section 2.2(d)).

• Google reCAPTCHA provides bot detection and form security. Controller-role (fraud and security).

• Stytch provides authentication, two factor authentication and device fingerprinting to secure access to the Platform and prevent fraud. Controller-role (Section 2.2(c) and (d)).

• Zoom hosts Zeffy's demo sessions. Controller-role.

• Internal corporate tools used by Zeffy staff and never to process the Controller's donor data on the Controller's behalf, including its productivity, engineering, product research, recruiting and advertising tools, are likewise not Subprocessors under this DPA.