Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the agreement between Codexx Nepal Pvt. Ltd., a private limited company incorporated in Nepal (registered office: [Registered address]; company registration number: [Company registration number]; PAN/VAT: [PAN/VAT number]) ("Afterparty", the "Processor") and the operator that has accepted the Terms of Service or signed an Order Form (the "Operator", the "Controller") (together, the "Agreement"). It applies to Afterparty's processing of Player Personal Data on the Operator's behalf and reflects the requirements of Article 28 of the EU and UK General Data Protection Regulation and the service-provider requirements of the California Consumer Privacy Act.

1. Definitions

• "Data Protection Laws" means all laws that apply to the processing of Player Personal Data under the Agreement, including Regulation (EU) 2016/679 ("EU GDPR"), the EU GDPR as retained in UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other U.S. state privacy laws.
• "Player Personal Data" means personal data about the Operator's players and prospective players that Afterparty processes on the Operator's behalf to provide the Service.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Player Personal Data processed by Afterparty or its Sub-processors.
• "Sub-processor" means any third party engaged by Afterparty that processes Player Personal Data.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• Terms such as "controller", "processor", "data subject", "processing", "business", "service provider", "sell" and "share" have the meanings given in the Data Protection Laws. Other capitalised terms have the meanings given in the Terms of Service.

2. Roles and Scope

2.1 The Operator is the controller of Player Personal Data, and Afterparty is its processor. Where the Operator acts as a processor for another controller, such as an affiliated licence holder, Afterparty acts as the Operator's sub-processor, and the Operator warrants that its controller has authorised Afterparty's engagement on these terms.

2.2 For the purposes of the CCPA, Afterparty is the Operator's service provider.

2.3 This DPA does not apply to personal data of the Operator's Authorized Users, which Afterparty processes as a controller under its Privacy Policy.

3. Processing Instructions

3.1 Afterparty will process Player Personal Data only on the documented instructions of the Operator, including with regard to international transfers, unless required to do otherwise by law, in which case Afterparty will inform the Operator before processing unless the law prohibits it. The Agreement, the Operator's configuration of the Service (including segments, journeys, campaigns, retention policies and integrations) and the actions of Authorized Users in the Service constitute the Operator's complete instructions.

3.2 Afterparty will inform the Operator promptly if, in its opinion, an instruction infringes Data Protection Laws. Afterparty is not obliged to perform a comprehensive legal review of instructions.

3.3 The Operator is responsible for the lawfulness of its instructions and of the Player Personal Data it provides, including providing notices to players, obtaining any required consents for profiling and marketing communications, and establishing a lawful basis for each purpose.

4. Details of Processing

The subject matter, duration, nature and purpose of processing, and the categories of data subjects and personal data, are described in Annex 1.

5. Confidentiality of Personnel

Afterparty will ensure that persons authorised to process Player Personal Data are bound by appropriate obligations of confidentiality, receive data-protection and security training, and have access only to the extent necessary for their role.

6. Security

Afterparty will implement and maintain the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. Afterparty may update those measures provided that the update does not materially reduce the overall level of protection.

7. Sub-processors

7.1 The Operator gives Afterparty general authorisation to engage the Sub-processors listed on the Sub-processors page (Annex 3).

7.2 Afterparty will give the Operator at least 30 days' notice before engaging a new Sub-processor, by updating the Sub-processors page and emailing subscribed Operators. The Operator may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if they cannot resolve it, the Operator may terminate the affected part of the Service and receive a refund of prepaid Fees for the remaining term.

7.3 Afterparty will impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains liable to the Operator for each Sub-processor's performance of those obligations.

7.4 Third-party services that the Operator connects to the Service under its own contracts (for example, the Operator's own messaging, wallet or payment provider accounts) are engaged by the Operator and are not Afterparty's Sub-processors.

8. Data Subject Requests

8.1 Afterparty will promptly forward to the Operator any request from a data subject that it receives relating to Player Personal Data, and will not respond to it directly except to direct the data subject to the Operator or as the Operator instructs.

8.2 Taking into account the nature of the processing, Afterparty will assist the Operator with appropriate technical and organisational measures to respond to data subject requests. The Service provides self-service tools for this purpose, including player data export, deletion requests with legal-hold handling, anonymisation, consent records and suppression of marketing.

9. Assistance

Afterparty will provide reasonable assistance to the Operator with data protection impact assessments and prior consultations with supervisory authorities in relation to the Service, taking into account the nature of the processing and the information available to Afterparty. Afterparty may charge reasonable fees for assistance beyond the self-service tools and Documentation.

10. Personal Data Breaches

10.1 Afterparty will notify the Operator without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting the Operator's Player Personal Data.

10.2 The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Afterparty will provide further information as it becomes available and will take reasonable steps to contain and remediate the breach.

10.3 The Operator is responsible for notifying supervisory authorities, gaming regulators and data subjects where required. Afterparty's notification is not an acknowledgement of fault or liability.

11. Audits

11.1 Afterparty will make available to the Operator the information reasonably necessary to demonstrate compliance with this DPA, including its written security documentation describing the measures in Annex 2, completed security questionnaires, and summaries of penetration tests where performed. Afterparty does not currently hold third-party security certifications or audit reports; if it obtains any, such as a SOC 2 or ISO/IEC 27001 report, it will make them available to the Operator on request under confidentiality terms.

11.2 Where that information is not sufficient to demonstrate compliance, or where a supervisory authority or gaming regulator requires it, the Operator may conduct an audit, no more than once in any 12-month period except after a Personal Data Breach, on at least 30 days' written notice, during normal business hours, at its own cost, and subject to reasonable confidentiality and security conditions. Audits must not access data of other customers.

12. International Transfers

12.1 Player Personal Data is stored by Amazon Web Services, Inc. in the AWS US East (N. Virginia) region (us-east-1), United States, together with its backups. Afterparty is established in Nepal, and its authorised personnel may access Player Personal Data remotely from Nepal, over encrypted connections and subject to the access controls in Annex 2, to operate and support the Service. Sub-processors process Player Personal Data in the countries listed on the Sub-processors page.

12.2 To the extent that Afterparty's processing involves a transfer of personal data from the European Economic Area to a country without an adequacy decision, the parties agree that the SCCs apply, incorporated by reference: Module Two (controller to processor) where the Operator is a controller, and Module Three (processor to processor) where the Operator is a processor. For the SCCs: the optional docking clause in Clause 7 applies; Clause 9 Option 2 (general authorisation) applies with the notice period in Section 7.2; the optional language in Clause 11 does not apply; Clause 17 Option 1 applies with the law of Ireland; the courts in Clause 18 are those of Ireland; and Annexes I to III are completed by Annexes 1 to 3 of this DPA, with the transfer details in Annex 4.

12.3 For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies, completed with the information in this DPA. For transfers from Switzerland, the SCCs apply with the amendments required by the Swiss Federal Data Protection and Information Commissioner.

12.4 The SCCs also cover remote access from Nepal, which has no EU or UK adequacy decision, as a transfer to Afterparty as data importer. [Counsel to confirm the transfer analysis for Nepal and to complete the transfer impact assessment.]

13. Return and Deletion

13.1 During the term, the Operator can export and delete Player Personal Data using the Service's export, deletion-request, anonymisation and retention-policy features.

13.2 After the Agreement ends, Afterparty will make Player Personal Data available for export for 30 days, and will then delete it from the active systems within 30 days and from backups as part of normal backup rotation within 35 days, unless retention is required by law. On request, Afterparty will confirm deletion in writing.

13.3 If the Operator instructs Afterparty to keep publicly verifiable raffle draw records available after termination, Afterparty may retain those records only in de-identified form.

14. CCPA Service-Provider Terms

14.1 Afterparty will not: (a) sell or share Player Personal Data; (b) retain, use or disclose Player Personal Data for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Service; (c) retain, use or disclose Player Personal Data outside the direct business relationship between Afterparty and the Operator; or (d) combine Player Personal Data with personal information it receives from or on behalf of another person or collects from its own interactions with consumers, except as permitted by the CCPA.

14.2 Afterparty will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of the Operator, will notify the Operator if it determines that it can no longer meet its obligations, and will allow the Operator to take reasonable and appropriate steps to stop and remediate unauthorised use of Player Personal Data.

14.3 Afterparty certifies that it understands and will comply with the restrictions in this Section 14.

15. Prohibited and Sensitive Data

15.1 The Operator must not send to the Service: payment card numbers or bank account credentials; government identification numbers or images of identity documents; passwords to player accounts; precise geolocation; biometric data; or health data, except as described in Section 15.2.

15.2 The Service is designed to receive responsible-gaming status flags (for example, self-excluded, cool-off or limit-reached) and KYC status flags (for example, verified or pending), not the underlying evidence. Responsible-gaming flags may reveal information that some laws treat as sensitive or as relating to health. The Operator is responsible for determining the legal basis for sending them and for limiting them to what is necessary to suppress marketing and Rewards for restricted players. Afterparty treats such flags as sensitive data within the meaning of Annex 1.

16. Liability and Precedence

16.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Laws or the SCCs provide otherwise.

16.2 If this DPA conflicts with the Terms of Service or an Order Form, this DPA prevails with respect to the processing of Player Personal Data. If this DPA conflicts with the SCCs, the SCCs prevail.

16.3 This DPA is governed by the laws of the State of Delaware, United States of America, except where the SCCs or Data Protection Laws require otherwise.

Annex 1 — Description of Processing

Subject matter. Provision of the hosted Afterparty retention, gamification and engagement service to the Operator.

Duration. The term of the Agreement plus the export and deletion periods in Section 13.

Nature of processing. Collection through the ingestion API, batch imports, database connectors and widgets; storage; organisation; aggregation into rollups and segments; calculation of scores; evaluation of rules; generation and delivery of messages; fulfilment requests to the Operator's wallet; random draws; display in player widgets and the back office; export; anonymisation and deletion.

Purposes. Running loyalty, missions, tournaments, leaderboards, bonuses, cashback, mini-games, jackpots and raffles; segmentation and personalisation of offers; churn, lifetime-value and engagement scoring; journeys and messaging by email, SMS, push and inbox; responsible-gaming gating and suppression; bonus-abuse and fraud signals; reporting; verifiable draws; and AI-assisted operations where enabled by the Operator.

Categories of data subjects. The Operator's players and prospective players; recipients of the Operator's communications; and, where included in content or notes, the Operator's personnel.

Categories of personal data.

• Identifiers: Operator-issued player identifier, Afterparty player identifier, keyed hashes of the player identifier, email address and phone number used for lookups, and optional nickname.
• Contact data: email address, phone number, push device tokens and messaging preferences.
• Profile attributes supplied by the Operator: display name, country and region, language, currency, registration date, VIP tier and custom attributes.
• Status flags: KYC status, age-verified flag, responsible-gaming status (such as self-exclusion, cool-off or limits), account status and marketing consents.
• Transaction and event data: bets, wins, deposits, withdrawals, bonus events, logins, game and session events, and checkout events, typically as amounts, timestamps, game identifiers and aggregated rollups.
• Engagement data: Reward grants and claims, mission and tournament progress, mini-game plays, raffle tickets and results, message delivery and interaction events, and widget interactions.
• Device and network data: device fingerprints and IP addresses as keyed hashes where used for abuse detection and identity clustering, and IP-derived jurisdiction where used for gating.
• Derived data: segments, RFM classifications, churn, lifetime-value and engagement scores, and bonus-abuse signals.
• AI interaction data: instructions to and outputs from AI agents, which may contain the above data where an Authorized User includes it.

Sensitive data. Responsible-gaming status flags, which may be treated as sensitive data. Restrictions: used only for gating and suppression; access limited by role-based permissions; included in exports and deletions; no use for targeting. No other special categories of data are intended to be processed (see Section 15).

Frequency of transfer. Continuous, as the Operator sends events and players use the widgets.

Retention. As configured by the Operator through retention policies in the Service, subject to Section 13. Raw ingested events are stored in time-partitioned tables and removed when the configured retention period expires.

Annex 2 — Technical and Organisational Measures

Annex 3 — Sub-processors

The current list of Sub-processors, their purposes and locations is published on the Sub-processors page and forms part of this DPA.

Annex 4 — Transfer Details for the SCCs

• Data exporter: the Operator, as identified in the Order Form. Contact: the privacy contact stated in the Order Form or, if none, the Operator's account email address.
• Data importer: Codexx Nepal Pvt. Ltd., a private limited company incorporated in Nepal (registered office: [Registered address]; company registration number: [Company registration number]; PAN/VAT: [PAN/VAT number]). Contact: dpo@afterparty.example.com, privacy@afterparty.example.com.
• Description of transfer: as described in Annex 1.
• Competent supervisory authority: determined under Clause 13 of the SCCs: the supervisory authority of the EU Member State in which the Operator is established; if the Operator is not established in the EU but has appointed a representative under Article 27 GDPR, the authority of the Member State in which that representative is established; and otherwise the authority of the Member State in which the data subjects whose data is transferred are mainly located, as stated in the Order Form.
• Signatures: the Operator's acceptance of the Terms of Service or signature of an Order Form that incorporates this DPA is treated as execution of this DPA, including the SCCs and this Annex 4, by both parties. Either party may request a countersigned copy.