Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement (the “Agreement”) between:

• AMP Catalyst LLC, a Delaware limited liability company (registration No. 7693186), 108 W. 13th Street, Suite 100, Wilmington, New Castle County, Delaware 19801, USA, doing business as “Imba” (“Imba”); and
• the customer that has accepted the Agreement (“Customer”).

The DPA applies automatically when Customer accepts the Agreement. No separate signature is required. Customer may request a countersigned copy at [email protected].

Capitalized terms not defined here have the meanings given in the Agreement. Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject”, and “supervisory authority” have the meanings given in the GDPR and are read as their nearest equivalents under other Data Protection Laws.

1. Definitions

• “Customer Personal Data” means personal data that Imba processes on behalf of Customer as a processor in providing the Service, as described in Annex I.
• “Data Protection Laws” means all data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, including, as applicable, the GDPR, UK GDPR, Swiss FADP, Brazil’s LGPD, India’s DPDP Act, Indonesia’s PDP Law, Turkey’s KVKK, Saudi Arabia’s PDPL, the UAE PDPL, Malaysia’s PDPA, Mexico’s LFPDPPP, Argentina’s Law 25,326, Nigeria’s NDPA, the personal data laws of Kazakhstan, Uzbekistan, and Azerbaijan, and U.S. state privacy laws.
• “Imba Controller Data” means personal data that Imba processes as an independent controller, as described in Section 3.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Imba or its Sub-processors.
• “Sub-processor” means any processor engaged by Imba to process Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

2. Roles: Imba as processor

2.1 Processor. For Customer Personal Data, Customer is the controller (or acts as a processor for its own controllers) and Imba is the processor (or sub-processor).

2.2 Customer’s responsibilities. Customer is responsible for:

• (a) having a lawful basis for the processing of Customer Personal Data, including through its App;
• (b) providing End Users with a privacy policy and all notices required by Data Protection Laws, including the disclosure required by Section 6.2(b) of the Terms of Service;
• (c) obtaining any consents required, including consent to marketing messages and push notifications;
• (d) the accuracy and lawfulness of the Customer Personal Data it provides or collects through its App;
• (e) ensuring its instructions comply with Data Protection Laws.

2.3 Telegram is not a Sub-processor. Telegram operates the platform on which Customer’s bot and App run. Customer owns and operates its bot and has its own relationship with Telegram. Telegram processes data under its own terms as an independent party.

2.4 Customer’s Payment Provider and Third-Party Services are not Sub-processors. Payments from End Users are processed by Customer’s own Payment Provider, and data sent to Third-Party Services that Customer connects (for example, spreadsheets, CRMs, or team chats) is processed by those services under Customer’s agreements with them.

3. Imba as independent controller

3.1 Scope. This DPA does not apply to Imba Controller Data. Imba acts as an independent controller, not as Customer’s processor, only when it processes personal data:

• (a) about Customer, its Authorized Users, and its billing contacts, for account management, billing, support, security, and relationship management (“Customer Relationship Data”);
• (b) for the security of the Service;
• (c) for counting monthly active End Users and calculating Transaction Fees;
• (d) for the notices to End Users and the presentation of Alternative Apps described in Section 8.12 of the Terms of Service;
• (e) to comply with law or to establish, exercise, or defend legal claims.

3.2 No AI training on End User data. Imba does not use Customer Personal Data relating to End Users to train AI models. AI Training Data under Section 12 of the Terms of Service is limited to Customer’s Inputs, Outputs, App configurations, and aggregated, de-identified performance metrics, and Customer must not include personal data in Inputs beyond what is strictly necessary.

3.3 Anonymization. Customer instructs Imba to anonymize and aggregate Customer Personal Data to create Platform Insights. Once anonymized, the data is no longer personal data.

3.4 Customer instruction and notice. Customer instructs and authorizes Imba to use Customer Personal Data for the purposes in Section 3.1(b)–(d). Imba describes its controller processing in its Privacy Statement.

4. Processing on instructions

4.1 Documented instructions. Imba will process Customer Personal Data only on Customer’s documented instructions, unless processing is required by law. In that case, Imba will inform Customer before processing, unless the law prohibits this.

4.2 Instructions given. Customer’s documented instructions are the Agreement, including this DPA; Customer’s configuration and use of the Service — for example, building Apps, configuring forms and integrations, and sending push notifications; and any further written instructions agreed by the parties.

4.3 Unlawful instructions. Imba will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or modified.

4.4 Additional instructions. Instructions outside the scope of the Agreement require prior written agreement, and Imba may charge for their implementation.

5. Confidentiality of personnel

Imba will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality, and access it only as needed to provide the Service.

6. Security

6.1 Measures. Imba will implement and maintain the technical and organizational measures described in Annex II.

6.2 Updates. Imba may update the measures from time to time, provided the overall level of security is not materially reduced.

6.3 Bot tokens. Imba treats Customer’s Telegram bot tokens as confidential credentials, stores them encrypted, restricts access to them, and deletes them as set out in the Terms of Service.

6.4 Customer’s security. Customer is responsible for the security of its own accounts, devices, integrations, Custom Code, and any Customer Personal Data it transfers out of the Service, including through integrations.

7. Sub-processors

7.1 General authorization. Customer gives Imba general written authorization to engage Sub-processors. Imba’s current Sub-processors, including its AI model providers, are listed in Annex III.

7.2 Notice of changes. Imba will notify Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to Customer’s account email address.

7.3 Objection. Customer may object to a new Sub-processor on reasonable data protection grounds within 15 days of notice. The parties will discuss the concern in good faith. If they cannot resolve it, Customer’s sole remedy is to terminate the affected Service by written notice before the change takes effect. Fees already paid are not refunded (Terms of Service, Section 8.10).

7.4 Flow-down and liability. Imba will impose on each Sub-processor data protection obligations that are materially no less protective than those in this DPA, and remains liable to Customer for its Sub-processors’ performance, subject to Section 14.

8. International transfers

8.1 Location. Imba hosts Customer Personal Data primarily in Finland (EU), with Hetzner Online GmbH as its hosting Sub-processor. Some Sub-processors, including AI model providers, and Imba’s own personnel may process Customer Personal Data in other countries, including the United States (see Annex III).

8.2 Transfer mechanisms. Where Data Protection Laws restrict a transfer, the parties agree to use, in order of precedence: an adequacy decision or equivalent; the SCCs, incorporated by reference as set out in Annex IV; the UK International Data Transfer Addendum, or the SCCs as adapted for Switzerland; or any other mechanism permitted by the relevant Data Protection Laws.

8.3 Onward transfers. Imba will ensure that transfers to Sub-processors are covered by a valid transfer mechanism.

8.4 Local requirements. Some jurisdictions impose additional conditions on cross-border transfers or require local storage. Unless agreed otherwise in an Order Form, Imba does not offer data localization outside Finland. Customer is responsible for determining whether its use of the Service in a given jurisdiction is permitted and for obtaining any consent required from its End Users.

9. Assistance with data subject requests

9.1 Forwarding. If Imba receives a request from a data subject concerning Customer Personal Data, Imba will forward it to Customer without undue delay and will not respond itself, except to direct the data subject to Customer, unless Customer authorizes otherwise.

9.2 Tools and assistance. The Service allows Customer to access, correct, and delete End User data in its End User Database. Where Customer cannot fulfil a data subject request using the Service — including while an App is withdrawn under Section 8.12 of the Terms of Service — Imba will provide reasonable assistance.

9.3 Imba Controller Data. Requests concerning Imba Controller Data are handled by Imba under its Privacy Statement.

10. Security Incidents

10.1 Notification. Imba determines, in its reasonable discretion, whether a security incident affects Customer Personal Data. Imba will notify Customer without undue delay, and in any event within 48 hours after becoming aware of a Security Incident affecting Customer Personal Data, by email to Customer’s account email address. Customer is responsible for keeping that address current.

10.2 Information. The notification will include, to the extent known, the nature of the incident; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. Imba may provide this information in phases.

10.3 Steps. Imba will take reasonable steps to contain, investigate, and mitigate the Security Incident, and will provide reasonable assistance to Customer in meeting its own notification obligations.

10.4 No admission. Notification of a Security Incident is not an admission of fault or liability.

11. Data protection impact assessments

Imba will provide reasonable information and assistance to help Customer carry out data protection impact assessments and prior consultations with supervisory authorities, where required for Customer’s use of the Service. Imba may charge for assistance beyond providing standard documentation.

12. Deletion and return

12.1 On termination. After the Agreement ends, including when an inactive account is deleted under Section 17.6 of the Terms of Service, Imba will delete Customer Personal Data from its active systems within 60 days, and from backups in the ordinary course of backup rotation. Imba does not return or transfer Customer Personal Data. Customer is responsible for retaining any copies it needs before the Agreement ends.

12.2 Exceptions. Imba may retain Customer Personal Data where required by law, in which case it remains protected by this DPA. Anonymized Platform Insights are not personal data.

12.3 Certification. On written request, Imba will confirm deletion in writing.

13. Audits

13.1 Information. On written request, no more than once in any 12-month period, Imba will provide information reasonably necessary to demonstrate compliance with this DPA, such as responses to a reasonable security questionnaire or any third-party audit reports or certifications Imba holds. Customers on Enterprise plans may also receive a summary of Imba’s security measures under a non-disclosure agreement.

13.2 Audit. If that information is not reasonably sufficient, or where required by a supervisory authority, Customer may audit Imba’s compliance with this DPA, subject to at least 30 days’ written notice; an agreed scope, timing, and duration; an independent auditor bound by confidentiality who is not a competitor of Imba; remote audits wherever possible; Customer bearing the cost, including Imba’s reasonable costs; and no more than one audit in any 12-month period, unless required by a supervisory authority or following a Security Incident.

13.3 Confidentiality. Audit information and results are Imba’s Confidential Information.

14. Liability

14.1 Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits a data subject’s rights under the SCCs or mandatory Data Protection Laws.

14.2 Fines, penalties, and other losses that Imba incurs because of Customer’s failure to comply with Data Protection Laws or this DPA are Customer’s responsibility and are recoverable from Customer under the Agreement.

15. Term, precedence, and changes

15.1 Term. This DPA remains in force for as long as Imba processes Customer Personal Data.

15.2 Precedence. If this DPA conflicts with the Agreement, this DPA prevails as to the processing of Customer Personal Data. If it conflicts with the SCCs, the SCCs prevail.

15.3 Changes. Imba may update this DPA to reflect changes in law, guidance, or the Service by giving at least 30 days’ notice. If an update materially reduces the protection of Customer Personal Data, Customer may terminate the Agreement under Section 17.3 of the Terms of Service.

15.4 Governing law. This DPA is governed by the law that governs the Agreement, except that the SCCs are governed as set out in Annex IV.

Annex I — Description of processing

Data exporter: Customer (controller, or processor for its own controllers). Contact: Customer’s account email.

Data importer: AMP Catalyst LLC (Imba), 108 W. 13th Street, Suite 100, Wilmington, DE 19801, USA (processor). Contact: [email protected].

Subject matter and nature. Providing the Service: hosting, operating, and displaying Customer’s Telegram Mini Apps; the End User Database; Game Mechanics and Coin balances; forms and their integrations; media playback; push notifications sent through Customer’s bot; analytics; AI-assisted App generation; and related support.

Purpose. To provide the Service to Customer in accordance with the Agreement and Customer’s instructions.

Duration. For the term of the Agreement, plus the deletion periods in Section 12.

Frequency. Continuous.

Categories of data subjects. Customer’s End Users; Customer’s Authorized Users, to the extent their data is processed as Customer Personal Data; other individuals whose personal data Customer includes in Customer Content.

Categories of personal data.

• Telegram data made available to Apps: Telegram user ID, first and last name, username, language, profile photo, and Telegram Premium status. Phone numbers are not collected.
• Interaction data: App opens, screens viewed, actions, time in App, referral relationships, quiz answers, prediction and game participation, Coin balances and history, leaderboard positions.
• End User Database: records created automatically when an End User opens an App, with statistics of their visits.
• Form responses: data End Users submit in forms configured by Customer, such as name, phone, email, and answers.
• Transaction metadata: amounts, dates, products, and status of purchases and subscriptions made with Customer’s Payment Provider (no full payment card data).
• Communications: messages and push notifications sent through Customer’s bot.
• Technical data: device and platform information, IP address, and logs.

Special categories of data. Not permitted unless agreed in an Order Form (Terms of Service, Section 10.4).

Competent supervisory authority (for the SCCs). Determined under Clause 13 of the SCCs.

Annex II — Technical and organizational measures

Imba implements and maintains technical and organizational measures appropriate to the risk, as required by Article 32 of the GDPR, designed to ensure:

• the confidentiality, integrity, availability, and resilience of the systems and services used to process Customer Personal Data;
• protection of Customer Personal Data and of credentials, including Telegram bot tokens, against unauthorized access, disclosure, alteration, and loss;
• the ability to restore the availability of and access to Customer Personal Data in a timely manner after an incident;
• access to Customer Personal Data only by authorized persons bound by confidentiality, to the extent needed for their tasks;
• detection of, response to, and recovery from security incidents;
• regular review of the effectiveness of these measures.

Imba does not publish a detailed description of its security measures. A summary is available to Customers on Enterprise plans on written request under a non-disclosure agreement, as described in Section 13.1.

Annex III — Sub-processors

AI model providers are reached through OpenRouter. Imba has configured its OpenRouter account so that AI model providers may not use Customer Personal Data to train their models and do not retain it.

Imba’s payment processor for Subscription Fees and Credits, Stripe, processes Imba Controller Data (Customer billing), not Customer Personal Data, and is listed in the Privacy Statement.

Annex IV — Jurisdiction-specific terms and SCCs

United States (CCPA and similar state laws). To the extent Imba processes Customer Personal Data as a “service provider” or “processor”, Imba will not sell or share it, or retain, use, or disclose it outside the direct business relationship with Customer, except as permitted by law; will provide the level of privacy protection required by applicable law and notify Customer if it can no longer meet its obligations; and Customer may take reasonable steps to stop and remediate unauthorized use.

Brazil (LGPD). Customer is the “controlador” and Imba the “operador” for Customer Personal Data. International transfers use the ANPD standard contractual clauses where required.

Other jurisdictions. Where a Data Protection Law requires specific terms in a contract between a controller and a processor, those terms are deemed incorporated to the extent required, and the parties will cooperate in good faith to document them on request.

Standard Contractual Clauses.

1. Where the SCCs apply to a transfer of Customer Personal Data from Customer to Imba, Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor. Module One (controller to controller) applies to Imba Controller Data.
2. Clause 7 (docking clause) does not apply.
3. Clause 9: Option 2 (general written authorization) applies, with the notice and objection periods in Section 7.
4. Clause 11: the optional language does not apply.
5. Clause 13: as set out in Annex I.
6. Clauses 17 and 18: the SCCs are governed by the law of Ireland, and disputes are resolved before the courts of Ireland.
7. Annexes I, II, and III of the SCCs are completed by Annexes I, II, and III of this DPA.
8. UK. For transfers subject to UK data protection law, the International Data Transfer Addendum (version B1.0) issued by the UK Information Commissioner applies, with Tables 1–3 completed by the corresponding information in this DPA.
9. Switzerland. For transfers subject to the Swiss FADP, the SCCs apply with the necessary adaptations. The competent authority is the Swiss Federal Data Protection and Information Commissioner, and references to the GDPR include the FADP.