Data Processing Addendum (DPA)

Version 1.0 — April 15, 2026

Version 1.0 — Effective [date]

This Data Processing Addendum (the “DPA”) forms part of the agreement between PXA LLC, a New York limited liability company doing business as Hammock (“Hammock”) and the client identified in Annex I (“Client”) under which Hammock provides services (the “Agreement” — a Master Services Agreement, an Engagement Letter, or the Terms of Service at gethammock.com/legal/terms). It applies to Personal Data that Hammock Processes on Client’s behalf in providing the Services where that Processing is subject to the GDPR, the UK GDPR, the Swiss FADP, or another non-U.S. Data Protection Law, and whenever Client has asked for it to apply. Where this DPA applies, it prevails over Section 9.6 of the Master Services Agreement (or Section 7.7 of the Terms of Service) to the extent of any conflict, and otherwise supplements the Agreement.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement. “Data Protection Law” means all laws that apply to the Processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and the U.S. state privacy laws addressed in the Agreement. “Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” “Personal Data Breach,” and “Supervisory Authority” have the meanings given in the GDPR (and their equivalents under other Data Protection Law). “Client Personal Data” means Personal Data contained in Client Data that Hammock Processes on Client’s behalf. “Sub-processor” means a third party engaged by Hammock to Process Client Personal Data. “SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.

2. Roles and scope

2.1 Roles. For Client Personal Data, Client is the Controller (or a Processor acting for another Controller, in which case Hammock is a sub-processor and Client warrants that it has the Controller’s authority to give the instructions in this DPA) and Hammock is the Processor. confirm the Processor characterization for the managed-services model, where Hammock works inside Client’s systems under named accounts — we treat that access as Processing on Client’s behalf (MSA §9.2).

2.2 Not covered. This DPA does not cover Personal Data for which Hammock is itself the Controller — account, billing, support, and website data, and the business contact details of Client’s personnel — which Hammock handles under its Privacy Policy. Nor does it cover De-identified Data, which the Agreement governs.

2.3 Details of Processing. The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex I, as supplemented by the applicable Statement of Work and Service Schedule.

3. Hammock’s obligations as Processor

3.1 Instructions. Hammock Processes Client Personal Data only on Client’s documented instructions, which are the Agreement, the applicable SOW and Service Schedule, this DPA, and Client’s further written instructions consistent with them (including instructions given through Client’s systems and by Client’s Authorized Representatives), unless Hammock is required to Process it by law, in which case Hammock will tell Client before Processing unless the law prohibits that. Hammock will inform Client promptly if, in its opinion, an instruction infringes Data Protection Law; Hammock is not obliged to perform a legal analysis on Client’s behalf.

3.2 Confidentiality. Hammock ensures that every person authorized to Process Client Personal Data is bound by a written duty of confidentiality (Agreement §4.1 and §9.1).

3.3 Security. Hammock implements and maintains the technical and organizational measures in Annex II, which are appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing, and will not materially reduce the overall level of protection during the term. Hammock may update Annex II as its program develops; the current description is published on the Security page at gethammock.com/security.

3.4 Sub-processors. Client gives Hammock general written authorization to engage Sub-processors. Hammock (a) maintains the current list of Sub-processors, with the location and purpose of each, at gethammock.com/legal/subprocessors (Annex III); (b) gives at least thirty (30) days’ notice before a new or replacement Sub-processor begins Processing Client Personal Data, by updating that page and emailing Client’s designated contact; (c) considers in good faith any objection Client raises within that period on reasonable data-protection grounds and, if the objection cannot be resolved, Client may terminate the affected Services on written notice without penalty; (d) imposes on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA; and (e) remains fully liable to Client for the performance of each Sub-processor’s obligations.

3.5 Data Subject requests. Taking into account the nature of the Processing, Hammock assists Client with appropriate technical and organizational measures, insofar as possible, in fulfilling Client’s obligation to respond to requests to exercise Data Subject rights. If Hammock receives such a request directly, it will refer the Data Subject to Client and will not respond on Client’s behalf unless Client instructs it to. Hammock may charge for assistance that goes beyond routine support at its then-current hourly rates.

3.6 Assistance with compliance. Taking into account the nature of the Processing and the information available to it, Hammock assists Client in ensuring compliance with Client’s obligations concerning security of Processing, Personal Data Breach notification, data protection impact assessments, and prior consultation with Supervisory Authorities (GDPR Articles 32–36), at Client’s reasonable request and, where the assistance is substantial, at Hammock’s then-current hourly rates.

3.7 Personal Data Breach. Hammock will notify Client without undue delay, and in any event within seventy-two (72) hours, after confirming a Personal Data Breach affecting Client Personal Data in Hammock’s or a Sub-processor’s possession or control, will give Client the information it reasonably needs to meet its own notification obligations as that information becomes available, and will cooperate in the investigation and response (Agreement §9.3). Hammock will not notify Data Subjects, Supervisory Authorities, or the public on Client’s behalf unless Client instructs it to or the law requires it. the 72-hour window runs from confirmation; GDPR Article 33(2) requires notice to the Controller “without undue delay” — confirm the formulation.

3.8 Deletion and return. On termination of the Services, or on Client’s written request, Hammock will transfer Client Personal Data in its systems to Client in a commonly used format and delete its copies within thirty (30) days, and will confirm deletion in writing on request, except that Hammock may retain Client Personal Data (a) to the extent required by applicable law, and (b) within Hammock’s Engagement Record as described in Section 9.4 of the Master Services Agreement, which remains subject to this DPA and is Processed for no other purpose. Sensitive HR Data is never retained (Service Schedule D). Deletion from backups follows Hammock’s normal backup cycle and is complete within twenty-eight (28) days.

3.9 Records and demonstration of compliance. Hammock makes available to Client the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, through written responses to reasonable inquiries, copies of relevant policies, and summaries of any third-party assessments it holds, and allows for and contributes to audits as Section 4 provides. Hammock maintains a record of its Processing activities on Client’s behalf as Article 30(2) GDPR requires.

4. Audits

Client may audit Hammock’s compliance with this DPA no more than once in any twelve (12) months (or more often where required by a Supervisory Authority or following a Personal Data Breach), on at least thirty (30) days’ written notice, during business hours, at Client’s expense, through Client or an independent auditor bound by confidentiality and reasonably acceptable to Hammock, in a manner that does not disrupt Hammock’s operations or compromise the confidentiality of other clients’ data. Hammock will first satisfy audit requests by written response and documentation; an on-site or remote-access audit is conducted only where that is insufficient. Client will share the audit findings with Hammock, and the Parties will agree a remediation plan for any material finding.

5. International transfers

5.1 Location. Hammock Processes Client Personal Data in the United States (Annex I). Client acknowledges that Hammock and its Sub-processors are located in, and transfer Client Personal Data to, the United States.

5.2 EEA transfers. To the extent Client Personal Data subject to the GDPR is transferred from the European Economic Area to Hammock, the Parties enter into the SCCs, Module Two (controller to processor) (or Module Three where Client is itself a Processor), which are incorporated into this DPA by reference and completed as follows: Clause 7 (docking clause) does not apply; Clause 9(a) Option 2 (general written authorization) applies with the thirty (30)-day notice period in Section 3.4; the optional language in Clause 11(a) does not apply; Clause 13 applies as determined by Annex I.C; under Clause 17, the SCCs are governed by the law of Ireland; under Clause 18, disputes are resolved by the courts of Ireland; Annexes I and II of the SCCs are completed by Annexes I and II of this DPA; and Annex III of the SCCs is completed by Annex III of this DPA. Where the SCCs conflict with this DPA, the SCCs prevail. confirm Ireland as the governing-law choice for the SCCs and whether a transfer impact assessment summary should be attached.

5.3 UK transfers. To the extent Client Personal Data subject to the UK GDPR is transferred from the United Kingdom to Hammock, the SCCs as completed above apply as amended by the UK Addendum, which is incorporated by reference and completed as set out in Annex IV. Either Party may end the UK Addendum as its Section 19 provides.

5.4 Swiss transfers. To the extent Client Personal Data subject to the FADP is transferred from Switzerland to Hammock, the SCCs apply with these adaptations: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority under Clause 13; the term “member state” is read to include Switzerland so that Swiss Data Subjects may enforce their rights in Switzerland; and the SCCs also protect the data of legal entities until the FADP no longer does so.

5.5 Alternative mechanisms. If a transfer mechanism in this Section 5 is invalidated or replaced, the Parties will cooperate in good faith to put an alternative lawful mechanism in place promptly, and Hammock may do so by notice adopting a successor mechanism approved by the European Commission or the UK Information Commissioner.

6. Other jurisdictions

6.1 United States. The service-provider, processor, and contractor terms required by U.S. state privacy laws are in Section 9.6 of the Master Services Agreement (Section 7.7 of the Terms of Service) and apply alongside this DPA.

6.2 Canada and Kenya. [Reserved. Country-specific terms (PIPEDA / Quebec Law 25; Kenya Data Protection Act 2019, including any registration and cross-border transfer conditions) will be added before Hammock processes Personal Data of residents of those countries. — deferred under Decision D-038.]

7. Liability, term, and general

7.1 Liability. Each Party’s liability under this DPA, including under the SCCs as between the Parties, is subject to the limitations and exclusions in the Agreement (Master Services Agreement Section 11, including the super-cap for data and confidentiality claims), except that nothing in this DPA limits a Party’s liability to Data Subjects or Supervisory Authorities where Data Protection Law prohibits that limitation.

7.2 Term. This DPA takes effect on the date the Agreement takes effect (or, if later, the date it is executed or Client requests it) and continues for as long as Hammock Processes Client Personal Data.

7.3 Precedence. Section 1.4 of the Master Services Agreement governs precedence; this DPA controls as to the Processing of Personal Data, and the SCCs control over this DPA.

7.4 Changes. Hammock may update this DPA to reflect changes in Data Protection Law or approved transfer mechanisms by giving Client at least thirty (30) days’ notice; a change that materially reduces Client’s protections takes effect only with Client’s written agreement. Self-serve users of the Platform accept this DPA by reference through the Terms of Service; MSA clients execute it by signature below.

7.5 Contact. Hammock’s data-protection contact is privacy@gethammock.com. Hammock has not appointed a representative in the EU or UK under Article 27 GDPR because its Services are directed to businesses in the United States. confirm no Article 27 representative or DPO appointment is required.

8. Execution

This page is the published text of the DPA. Self-serve users accept it by reference through the Terms of Service; clients on a Master Services Agreement execute it by signature on the copy Hammock provides, with Annex I completed for the engagement.

A. List of Parties

B. Description of the Processing

C. Competent Supervisory Authority

The Supervisory Authority of the EU member state in which the data exporter is established or, where the exporter is not established in the EU, the authority identified in accordance with Clause 13 of the SCCs: [authority]. For UK transfers, the Information Commissioner’s Office.

Hammock’s program is described on the Security page (gethammock.com/security) and in its Information Security & Incident Response Plan. Current measures:

The current list, with each Sub-processor’s purpose, the data it Processes, and its location, is published at gethammock.com/legal/subprocessors and is incorporated here. Hammock gives thirty (30) days’ notice of changes as Section 3.4 provides. At the date of this DPA the list comprises infrastructure and platform providers (Google Cloud / Firebase; Cloudflare), AI and document-processing providers (Google Cloud Document AI and Vertex AI; Anthropic; OpenAI, approved but inactive; Recall.ai), payments and financial-data providers (Stripe; Plaid, planned; PayPal; Bill.com), and communications and operations providers (Google Workspace; Slack; Zoom; Resend; Expo; Sentry; HubSpot), all located in the United States.

Table 1: Parties. As in Annex I.A. Key contact for the exporter: [name, email]; for the importer: Puneet Agrawal, privacy@gethammock.com.

Table 2: Selected SCCs, Modules and selected clauses. The Approved EU SCCs, Module Two (or Three, where applicable), as completed in Section 5.2 of this DPA: Clause 7 not included; Clause 11 option not included; Clause 9(a) Option 2 with a thirty (30)-day notice period; Clause 13 as determined by Annex I.C.

Table 3: Appendix information. Annex 1A (parties): Annex I.A of this DPA. Annex 1B (description of transfer): Annex I.B. Annex II (technical and organizational measures): Annex II. Annex III (sub-processors): Annex III.

Table 4: Ending the Addendum when the Approved Addendum changes. Either Party may end the UK Addendum as set out in its Section 19.

The Mandatory Clauses of the UK Addendum (Part 2) are incorporated by reference.