WIRK Data Processing Addendum

Last updated: 2 October 2026

This Data Processing Addendum ("DPA") forms part of the WIRK Terms of Service, or the Order Form, between Pebble Inc, a Delaware corporation ("WIRK"), and the Customer. It applies when WIRK processes Customer Personal Data for the Customer under Data Protection Laws. Terms not defined here have the meaning given in the Terms of Service.

1. Definitions

• Customer Personal Data: personal data in Customer Content, and other personal data WIRK processes for the Customer to provide the Service.
• Data Protection Laws: the laws that apply to that processing, including the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and the California Consumer Privacy Act as amended by the CPRA.
• Subprocessor: a third party WIRK engages to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

2. Roles and instructions

2.1 The Customer is the controller and WIRK is the processor of Customer Personal Data, except as section 2.5 describes. Under the CCPA, WIRK is the Customer's service provider.

2.2 WIRK processes Customer Personal Data only on the Customer's documented instructions, except as section 2.5 describes. Those instructions are the Terms of Service, any Order Form, this DPA, and the Customer's use of the Service, including the actions its Users and Agents take with tokens issued to its Account. WIRK will tell the Customer if it believes an instruction breaks Data Protection Laws.

2.3 The Customer is responsible for the lawfulness of the Customer Personal Data it and its Agents put into the Service, and for giving any notices and obtaining any consents required.

2.4 WIRK will not sell or share Customer Personal Data as those terms are defined in the CCPA, and will not retain, use or disclose it outside the direct business relationship with the Customer, or combine it with other personal data, except as section 2.5 describes and the CCPA permits.

2.5 WIRK's own purpose. As section 4.3 of the Terms of Service describes, WIRK may use Customer Content, including Customer Personal Data, to maintain and improve the Service, including to train and evaluate models that power WIRK's own features. WIRK decides how it does this, so Data Protection Laws may treat WIRK as a controller for this purpose. WIRK never sells Customer Personal Data, never discloses it to other customers, and never releases a model or dataset that reproduces identifiable Customer Content. Customers on the Team or Pro plan may opt out of model training by writing to support@wirk.life; the opt-out applies to training that starts after WIRK confirms it. An Order Form may exclude model training.

3. WIRK's personnel

WIRK makes sure that everyone authorized to process Customer Personal Data is bound by confidentiality.

4. Security

WIRK maintains the technical and organizational measures in Annex 2. WIRK may update them as long as the update does not lower the overall protection of Customer Personal Data.

5. Subprocessors

5.1 The Customer authorizes WIRK to use the Subprocessors in Annex 3.

5.2 WIRK uses each Subprocessor under written terms that protect Customer Personal Data. Where those terms are not yet a data processing agreement at least as protective as this DPA, WIRK is putting one in place. WIRK remains responsible for its Subprocessors' performance.

5.3 WIRK will give at least 30 days' notice before adding or replacing a Subprocessor, by email to the Account owner. The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If it is not resolved, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.

6. Requests from data subjects

If WIRK receives a request from a data subject about Customer Personal Data, it will pass the request to the Customer and will not answer it except on the Customer's instructions. WIRK will give the Customer reasonable help to respond, taking into account the nature of the processing.

7. Security Incidents

WIRK will notify the Customer without undue delay, and in any case within 72 hours after becoming aware of a Security Incident. The notice will describe what is known of the incident, the data and data subjects affected, the likely consequences, and the steps taken or proposed. WIRK will update the Customer as it learns more and take reasonable steps to contain the incident.

8. Further assistance

WIRK will give the Customer reasonable help with data protection impact assessments and consultations with supervisory authorities that relate to the Service.

9. Return and deletion

When the Customer's subscription ends, the Customer may ask for an export of Customer Personal Data by writing to support@wirk.life within 30 days (the "export window"). WIRK will send the export within 14 days of the request. WIRK will delete Customer Personal Data within 30 days after the export window ends, including earlier versions kept by file-storage versioning, unless the law requires WIRK to keep it. The Customer may also ask WIRK at support@wirk.life to delete Customer Personal Data during the subscription.

10. Audits

WIRK will make available the information needed to show compliance with this DPA. This includes its security page, answers to one reasonable security questionnaire a year, and its SOC 2 report once one exists. WIRK does not have a SOC 2 report today. If that information is not enough to show compliance, or Data Protection Laws or a supervisory authority require it, the Customer may audit WIRK's compliance with this DPA no more than once a year, on at least 30 days' written notice, during business hours, at its own cost, under confidentiality, and through an independent auditor who is not a WIRK competitor.

11. International transfers

WIRK stores Customer Personal Data with AWS in the United States. For transfers from the European Economic Area, the United Kingdom or Switzerland, the parties agree to the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914, Module 2 (controller to processor), or Module 3 (processor to processor) where the Customer is itself a processor, incorporated by reference. Clause 7 applies. Clause 9(a) Option 2 applies, with the notice period in section 5.3. The optional wording in Clause 11 does not apply. Clauses 17 and 18 choose the law and courts of Ireland. Annexes 1, 2 and 3 of this DPA complete Annexes I, II and III of the Clauses. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies; for transfers from Switzerland, the Clauses apply with the amendments the Swiss Federal Data Protection and Information Commissioner requires.

12. Liability and precedence

12.1 Each party's liability under this DPA is subject to the limitations in the Terms of Service.

12.2 On data protection matters, this DPA prevails over the Terms of Service. Any Standard Contractual Clauses prevail over this DPA.

12.3 If WIRK assigns the Terms of Service under their section 17.5, this DPA is assigned with them. Customer Personal Data may then transfer to the affiliate or successor, which is bound by this DPA.

Annex 1: Details of processing

Annex 2: Security measures

These are the measures in place on 2 October 2026. Work still in progress is listed on WIRK's security page and is not promised here.

• The Service runs on AWS in the United States, on EC2, with files in S3.
• Data in transit is encrypted with TLS.
• Files in S3 are encrypted at rest with an AWS KMS key dedicated to each Customer account.
• Users who sign in with email and password must use multi-factor authentication, through WorkOS AuthKit. Enterprise customers can use single sign-on through WorkOS instead.
• Agents can propose changes, but only Users decide proposals, and nobody decides their own proposal.
• AWS CloudTrail records operations on WIRK's AWS infrastructure.
• Everyone authorized to process Customer Personal Data is bound by confidentiality (section 3).

Annex 3: Subprocessors