Data Processing Agreement (DPA)

# **Data Processing Agreement (DPA)** **Effective Date:** 09 August 2025 **Company:** HAPPYGLOBAL, LLC **Address:** 1908 Thomes Ave STE 12154, Cheyenne, WY 82001, USA **Contact:** [hello@ftmvai.com](mailto:hello@ftmvai.com) --- ## **1. Introduction** This Data Processing Agreement (“DPA”) forms part of the Terms of Service between HAPPYGLOBAL, LLC (“Company”, “we”, “our”, “us”) and the customer (“Controller”, “you”) and applies where we process Personal Data on your behalf. This DPA ensures compliance with the **General Data Protection Regulation (GDPR)**, the **UK GDPR**, the **California Consumer Privacy Act (CCPA)**, and other applicable data protection laws. --- ## **2. Definitions** * **“Personal Data”** – any information relating to an identified or identifiable natural person. * **“Processing”** – any operation performed on Personal Data (collection, storage, use, disclosure, deletion, etc.). * **“Controller”** – the entity determining the purposes and means of Processing. * **“Processor”** – the entity processing Personal Data on behalf of a Controller. * **“Sub-processor”** – any third party engaged by us to process Personal Data. * **“Biometric Data”** – facial geometry, measurements, and other identifiers used in try-on generation. --- ## **3. Roles** * We act as a **Controller** for: * User account information * Service usage analytics * Marketing communications (with consent) * AI model training using non-enterprise user data (unless opted out) * We act as a **Processor** for: * Data processed on behalf of enterprise customers via API or integrations * End-user images and related metadata in enterprise scenarios --- ## **4. Processing Details** * **Categories of Data Subjects:** Registered users, enterprise customer end-users, website visitors. * **Categories of Personal Data:** Identity data, contact details, uploaded images, biometric data (with consent), payment data, technical logs. * **Special Category Data:** Biometric data processed only with explicit consent. * **Purpose of Processing:** Providing try-on services, support, analytics, AI model improvement (if consented). * **Retention:** As described in our Privacy Policy and Biometric Privacy Notice. --- ## **5. Controller Obligations** * Provide Personal Data in compliance with applicable laws. * Obtain all necessary consents (including parental consent where applicable). * Ensure data provided to us is accurate and up to date. --- ## **6. Processor Obligations (Our Commitments)** * Process Personal Data only on documented instructions from you. * Ensure confidentiality of personnel with access to Personal Data. * Implement appropriate technical and organizational measures for data protection. * Assist you in responding to Data Subject rights requests. * Notify you without undue delay of any Personal Data breach. * Maintain records of all Processing activities. --- ## **7. Sub-processors** We use the following categories of Sub-processors: * **Cloud Providers:** Google Cloud, AWS. * **AI Model Providers:** OpenAI, Anthropic. * **Payment Processors:** Stripe, PayPal. * **Communication Services:** Twilio. * **Analytics Tools:** Google Analytics, Meta Pixel. You will be notified of any intended changes to our Sub-processor list at least **30 days** in advance and may object in writing. --- ## **8. International Transfers** * Transfers outside the EEA, UK, or Switzerland are subject to **Standard Contractual Clauses (SCCs)** or equivalent safeguards. * We conduct Transfer Impact Assessments for high-risk transfers. --- ## **9. Data Subject Rights** We will assist you, where possible, in fulfilling obligations to respond to: * Access, rectification, and erasure requests. * Restriction or objection to processing. * Data portability requests. --- ## **10. Security Measures** We implement, at a minimum: * **Encryption:** AES-256 at rest, TLS 1.3 in transit. * **Access Control:** Role-based access, MFA, least-privilege principle. * **Monitoring:** Intrusion detection, security logging, and regular audits. * **Incident Response:** Documented breach notification procedures. --- ## **11. Audit Rights** * Enterprise customers may conduct audits with at least **30 days’ notice**. * Audits must not disrupt our operations and are limited to once per year unless required by law. --- ## **12. Data Deletion & Return** Upon termination of the Services: * We will delete or return Personal Data as instructed, unless retention is required by law. * Biometric Data will be deleted per the Biometric Privacy Notice timelines. --- ## **13. Governing Law** This DPA is governed by the laws of the **State of Delaware, USA**, unless superseded by mandatory data protection law. --- ## **14. Contact** For all data protection matters: **Email:** [hello@ftmvai.com](mailto:hello@ftmvai.com) **Mail:** Data Protection Officer – HAPPYGLOBAL, LLC, 1908 Thomes Ave STE 12154, Cheyenne, WY 82001, USA