Data Processing Agreement

This DPA is between the customer that holds a WarpLink account ("Customer") and Stojanovski Industries Inc., a corporation organized under the laws of the Province of Ontario, Canada, at Suite 603, 130 Spadina Avenue, Toronto, Ontario M5V 2L4, Canada, which operates the WarpLink service ("WarpLink").

This DPA is incorporated into the WarpLink Terms of Service (the "Terms"). It becomes binding when Customer accepts the Terms, and no separate signature is required. Customers that need a signed copy for their records can request a countersigned copy from legal@warplink.app. A countersigned copy has the same content as this page and does not change it.

This DPA applies when WarpLink processes Customer Personal Data in providing the service. It lasts for as long as WarpLink processes Customer Personal Data, including after the Terms end, until the data is deleted under Section 11.

WarpLink's processing of its own account, billing, support, security, and website data, as a controller, is governed by the Privacy Policy and not by this DPA.

Terms not defined here have the meaning given in the Terms or in Applicable Data Protection Law.

• Applicable Data Protection Law: all data protection and privacy laws that apply to the processing of Customer Personal Data under the Terms, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and substantially similar provincial laws, and US state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
• Customer Personal Data: personal data, or personal information as defined by Applicable Data Protection Law, that WarpLink processes on Customer's behalf in providing the service, as described in Annex I.
• Controller, processor, data subject, personal data, processing, and supervisory authority have the meanings given in the GDPR. Under the CCPA, "controller" means "business" and "processor" means "service provider".
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that WarpLink or its sub-processors process. It includes a "breach of security safeguards" under PIPEDA.
• Sub-processor: a third party that WarpLink engages to process Customer Personal Data.
• SCCs: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0, as amended or replaced.

Customer is the controller of Customer Personal Data, and WarpLink is its processor. If Customer acts as a processor for another controller, Customer confirms that it is authorized to give WarpLink instructions and to enter into this DPA on that controller's behalf, and WarpLink acts as Customer's sub-processor.

Customer is responsible for the lawfulness of the collection and use of Customer Personal Data, including its legal basis, the notices it gives its end users, and any consent it must obtain, for example under app store rules or ePrivacy law. Customer must not use the service to process special categories of personal data or data that Customer knows relates to children. Link destinations, URL parameters, referrers, and custom deep link data can contain personal data. Customer controls what it puts in them and should not place sensitive personal data there.

WarpLink processes Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless the law that applies to WarpLink requires otherwise. In that case WarpLink informs Customer of that legal requirement before processing, unless that law prohibits it.

The Terms, this DPA, and Customer's configuration and use of the service are Customer's complete documented instructions. Other instructions require WarpLink's written agreement. WarpLink informs Customer promptly if, in its opinion, an instruction infringes Applicable Data Protection Law.

WarpLink does not use Customer Personal Data for any purpose other than providing, securing, supporting, and maintaining the service for Customer. WarpLink may create aggregated statistics that are anonymized so that they are no longer personal data and do not identify Customer, its end users, or any individual.

WarpLink ensures that every person it authorizes to process Customer Personal Data is under an appropriate obligation of confidentiality, by contract or by law, and processes the data only as needed to provide the service.

WarpLink implements and maintains the technical and organizational measures in Annex II, as required by Article 32 of the GDPR. WarpLink may update those measures if the update does not materially reduce the overall protection of Customer Personal Data.

Customer gives WarpLink general written authorization to engage sub-processors. The current sub-processors are listed in Annex III and on the Sub-processors page.

WarpLink gives Customer at least 30 days' notice before a new or replacement sub-processor begins processing Customer Personal Data. WarpLink sends the notice by email to the organization owner's email address and updates the Sub-processors page at the same time.

Customer may object to the change on reasonable data protection grounds by emailing legal@warplink.app within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it before the change takes effect, Customer may end its use of the service by deleting its organization. If Customer does so, WarpLink refunds any prepaid fees for the period after the deletion. Customer can also use the "refund and end now" option in billing settings before deleting the organization.

WarpLink imposes on each sub-processor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, as Article 28(4) of the GDPR requires. WarpLink remains fully liable to Customer for each sub-processor's performance of those obligations.

Taking into account the nature of the processing, WarpLink assists Customer by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects to exercise their rights of access, rectification, erasure, restriction, portability, and objection.

If WarpLink receives a request directly from a data subject about Customer Personal Data, WarpLink does not answer it, except to confirm that it has forwarded the request. WarpLink forwards the request to Customer without undue delay, unless the law requires otherwise.

Deleting the data of one end user. Customer can delete a single link, which deletes that link's click records, and can delete an organization, which deletes all of its records. To delete or export the records of one end user, Customer emails privacy@warplink.app from the email address of an organization owner or admin and gives:

• the organization and the app or link concerned, and an approximate time range; and
• at least one identifier the end user can supply, such as the iOS Identifier for Vendor (IDFV) of the device, or the public IP address the device used. WarpLink uses an IP address only to compute the same keyed hash that the service stores, so that it can find matching records, and then discards it.

WarpLink verifies the request, and deletes or exports the matching records within 14 days after it receives enough information to act. WarpLink tells Customer which records it found. WarpLink uses the identifier, app or link, and time range you supply to find the records for deletion or export. Each tap can be matched only within the link's match window, which is 6 hours by default and never more than 24 hours, and pending entries are deleted automatically within 48 hours.

WarpLink notifies Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. WarpLink sends the notice by email to the organization owner's email address.

The notice describes, as far as the information is available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and reduce its effects; and a contact point.

WarpLink takes reasonable steps to contain and investigate the breach and gives Customer the help it reasonably needs to meet its own obligations to notify supervisory authorities and data subjects under Articles 33 and 34 of the GDPR or equivalent law. A notice is not an admission of fault or liability.

Taking into account the nature of the processing and the information available to it, WarpLink assists Customer with its obligations under Articles 32 to 36 of the GDPR: security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities. WarpLink keeps the records of processing activities that Article 30(2) of the GDPR requires of a processor.

During the service, WarpLink deletes Customer Personal Data on the schedule in Annex I.

Customer can export its link configurations from the dashboard, and its click analytics from the dashboard, the API, or the MCP server, at any time while it has access to the service. Export files stay available to download for 7 days after they are created.

At the end of the service, Customer chooses return or deletion as follows. To have data returned, Customer exports it before deleting its organization. To have data deleted, Customer deletes its organization from the dashboard settings. Deleting an organization deletes its database records at once through a cascading deletion and starts removal of its cached link entries. Cancelling a paid plan is not the end of the service: the organization stays open on the Free plan.

If WarpLink ends Customer's access, for example by terminating an account under the Terms, Customer may ask legal@warplink.app for an export of its link configurations and click analytics within 30 days after access ends. WarpLink provides it unless the law prohibits it. WarpLink deletes the organization's Customer Personal Data no later than 60 days after access ends.

WarpLink keeps data after the end of the service only where the law requires, and only for that purpose.

WarpLink makes available to Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA. On written request to legal@warplink.app, no more than once in any 12-month period, WarpLink answers a reasonable written security questionnaire and provides any third-party audit reports it holds.

If that information is not enough to demonstrate compliance, or a supervisory authority requires it, or after a Personal Data Breach, Customer may audit WarpLink's compliance, by itself or through an independent auditor that is not a WarpLink competitor and is bound by confidentiality. Customer gives at least 30 days' written notice, and the parties agree the scope, timing, and duration in advance. The audit takes place during normal business hours in Toronto, does not unreasonably disrupt the service, and does not give access to other customers' data or to security information whose disclosure would put the service at risk. Each party bears its own costs.

This section does not limit any audit right that the SCCs or Applicable Data Protection Law give Customer or a supervisory authority.

Where data is processed. WarpLink is established in Ontario, Canada. Customer Personal Data is stored in a database hosted in the United States (Northern Virginia). Link requests are handled at the edge location nearest to the visitor, which can be anywhere in the world. Each sub-processor's location is listed in Annex III.

Transfers to WarpLink. WarpLink is a commercial organization subject to PIPEDA. Transfers of Customer Personal Data from the European Economic Area to WarpLink rely on the European Commission's adequacy decision for Canada (Decision 2002/2/EC). Transfers from the United Kingdom and Switzerland rely on the corresponding UK and Swiss adequacy findings for Canada. If an adequacy finding does not cover a transfer, or is suspended or withdrawn, the SCCs, the UK Addendum, and the Swiss terms below apply to that transfer automatically.

Onward transfers. WarpLink transfers Customer Personal Data to sub-processors outside Canada, including in the United States, only under a safeguard that Applicable Data Protection Law recognizes, such as the SCCs, the UK Addendum, or the EU-US Data Privacy Framework and its UK and Swiss extensions where the sub-processor is certified.

SCCs. Where the SCCs apply, they are incorporated into this DPA by reference and completed as follows:

• Module Two (controller to processor) applies where Customer is a controller. Module Three (processor to processor) applies where Customer is a processor.
• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorization) applies, and the time period for notice of changes is 30 days, as set out in Section 7.
• Clause 11: the optional language does not apply.
• Clause 13: the competent supervisory authority is set out in Annex I, part C.
• Clause 17: Option 1 applies, and the governing law is the law of Ireland.
• Clause 18: the courts of Ireland have jurisdiction.
• Annexes I, II, and III of this DPA complete Annexes I, II, and III of the SCCs.

UK. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference. Table 1 is completed with the parties' details in Annex I. Table 2 is completed with the SCC modules and options selected above. Table 3 is completed with Annexes I, II, and III of this DPA. For Table 4, neither party may end the UK Addendum under its Section 19.

Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR mean the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; references to "Member State" in Clause 18(c) include Switzerland, so data subjects habitually resident in Switzerland can bring claims there; and Swiss law governs the SCCs for those transfers where the FADP requires it.

Order. If the SCCs, the UK Addendum, or the Swiss terms conflict with this DPA, they prevail for the transfers they govern.

Customers and data subjects can contact WarpLink directly at privacy@warplink.app about any matter covered by this DPA.

Where the CCPA or a similar US state privacy law applies to Customer Personal Data, WarpLink acts as Customer's service provider or processor, and processes Customer Personal Data for the limited and specified business purposes described in Annex I. WarpLink:

• does not sell or share Customer Personal Data, as those terms are defined in the CCPA;
• does not retain, use, or disclose Customer Personal Data for any purpose other than those business purposes, including any commercial purpose other than providing the service, or outside the direct business relationship with Customer;
• does not combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with a consumer, except as the CCPA permits;
• complies with the obligations that apply to it under the CCPA and provides the same level of privacy protection the CCPA requires;
• notifies Customer if it determines it can no longer meet its obligations under the CCPA; and
• allows Customer, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

WarpLink certifies that it understands these restrictions and will comply with them.

Where PIPEDA or a substantially similar provincial law applies, WarpLink processes Customer Personal Data only for the purposes for which Customer transferred it, protects it with security safeguards appropriate to its sensitivity as described in Annex II, and helps Customer meet its accountability obligations, including its obligation to report and record breaches of security safeguards.

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms. Nothing in this DPA or the Terms limits:

• either party's liability to data subjects under Clause 12 of the SCCs or under Applicable Data Protection Law; or
• any liability that cannot be limited or excluded under applicable law.

If documents conflict on the processing of Customer Personal Data, they apply in this order: the SCCs, the UK Addendum, and the Swiss terms, for the transfers they govern; then this DPA; then the Terms.

WarpLink may update this DPA in the same way and with the same notice as the Terms. An update will not materially reduce the protection of Customer Personal Data, unless the law requires the change.

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, and the parties submit to the courts of the Province of Ontario, except where the SCCs or Applicable Data Protection Law require another law or forum. Questions about this DPA go to legal@warplink.app.

A. List of parties

• Data exporter: Customer, as identified by its WarpLink account and its acceptance of the Terms. Address and contact: the organization owner's details in the account. Activities: use of the WarpLink service. Role: controller, or processor on behalf of another controller. Signature and date: given by acceptance of the Terms.
• Data importer: Stojanovski Industries Inc., operating WarpLink, Suite 603, 130 Spadina Avenue, Toronto, Ontario M5V 2L4, Canada. Contact: privacy@warplink.app. Activities: provision of the WarpLink service. Role: processor, or sub-processor. Signature and date: given by Customer's acceptance of the Terms.

B. Description of the processing

Categories of data subjects. People who open Customer's WarpLink links; people who use Customer's mobile apps that include a WarpLink SDK.

Categories of personal data.

• For each link click: link and organization identifiers; time; a keyed HMAC-SHA256 hash of the visitor's IP address; country, region, and city derived from the network; device type, operating system and version, and browser, derived from the user agent (the full user agent is not stored); the referring URL; UTM parameters on the link URL; whether the click counts as unique.
• For deferred deep linking and install attribution: a device match key, which is a keyed HMAC-SHA256 hash of the IP address and preferred language and, where the SDK sends it, the time zone; on iOS only, the Identifier for Vendor (IDFV); on Android, the click identifier returned by the Google Play Install Referrer; the app's bundle ID or package name; SDK version; platform; whether the app was reinstalled; the class of the IP address (IPv4, IPv6, or carrier-grade NAT), not the address; the match method, result, confidence, and diagnostic reason codes; and the link data returned to the app.
• Any personal data that Customer or a third party places in link destinations, URL parameters, referrers, or custom deep link data.

WarpLink does not collect the Apple Identifier for Advertisers (IDFA), the Google Advertising ID, or the Android ID. The raw IP address is used in memory to compute hashes, location, and the IP class, and is not stored in click, install, or attribution records. It is also used for a few minutes as a rate-limit key by the rate-limiting sub-processor.

Sensitive data. None. Customer must not send special categories of personal data.

Frequency of transfer. Continuous, for as long as Customer uses the service.

Nature and purpose of processing. Redirecting links; recording, deduplicating, and aggregating clicks; matching app installs and app opens to earlier link clicks; returning deferred deep link data to the app; showing analytics in the dashboard, API, and MCP server; producing exports; securing the service and preventing abuse; and deleting data when it expires.

Retention.

The Free plan shows only the last 30 days of analytics in the dashboard, API, and MCP server, although it keeps 90 days.

Sub-processor transfers. As listed in Annex III, for the purposes and duration stated there.

C. Competent supervisory authority

Under Clause 13 of the SCCs: if Customer is established in an EU Member State, the supervisory authority of that Member State. If Customer is not established in the EU but is subject to the GDPR under Article 3(2) and has appointed a representative, the supervisory authority of the Member State where its representative is established. If Customer is not established in the EU and has no representative, the supervisory authority of the Member State where the data subjects concerned are located. For the UK Addendum, the UK Information Commissioner. For the FADP, the Swiss Federal Data Protection and Information Commissioner.

WarpLink maintains the following measures.

Pseudonymization and minimization

• IP addresses of link visitors are converted to a keyed HMAC-SHA256 hash, using a secret key, before click data enters the event queue or the database. The raw IP address is not stored in click, install, or attribution records.
• Device match keys are keyed HMAC-SHA256 hashes. Their inputs are not stored.
• The user agent is reduced to device type, operating system and version, and browser. The full user agent is not stored.
• The SDKs do not collect advertising identifiers. The Android SDK sends no device identifier.
• Keyed hashes are pseudonymous data, not anonymous data. WarpLink treats them as personal data.

Encryption

• The dashboard, the API, the MCP server, and the SDK endpoints are served over HTTPS (TLS). Connections from WarpLink to its database and sub-processors use TLS.
• WarpLink's database and edge key-value storage are encrypted at rest by the providers.

Access control

• Dashboard users sign in with email and password, GitHub, or Google. Passwords are stored as salted hashes by the authentication library.
• Two-factor authentication with an authenticator app (TOTP) and backup codes. Organization owners can require two-factor authentication for every member and set a session lifetime and an idle timeout.
• Role-based access in each organization: owner, admin, and member. Members can edit and delete only their own links.
• API keys and SDK keys are stored only as SHA-256 hashes and shown once at creation. API keys carry scopes and can expire. SDK keys work only on the three SDK endpoints, which resolve links, validate the key, and record attribution. An SDK key can be tied to one app, which restricts which app it acts as.
• An organization audit log records sign-ins, two-factor changes, key creation and revocation, link, app, and domain changes, member and invitation changes, security policy changes, billing events, and data exports.
• Rate limits apply to the API, the MCP server, sign-in, two-factor verification, and OAuth endpoints.

Tenant isolation

• Every customer record carries its organization identifier. Every request is checked against the organization of its session or key, and every database query is scoped by organization ID.

Secrets and operations

• Production secrets are stored encrypted with asymmetric keys and decrypted only by the deployment process and authorized personnel.
• Error monitoring is configured without its default collection of personal data.
• Click events are retried automatically.

Retention and deletion

• A daily automated process deletes click, summary, install, and attribution records older than the plan's retention period.
• Organization deletion removes all organization records through a cascading database deletion and removes cached link entries.

People and suppliers

• Everyone authorized to access Customer Personal Data is bound by confidentiality.
• Sub-processors are bound by written data protection terms, as described in Section 7.

Incidents

• WarpLink investigates security reports and incidents, and notifies Customers of a Personal Data Breach as described in Section 9.

These sub-processors may process Customer Personal Data. The Sub-processors page holds the same list and is updated as described in Section 7.