Data Processing Addendum

1. Purpose and Scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Use between Hive Interactive Corporation (“Hive”) and creators who use the Services.

This DPA applies where Hive processes personal data on behalf of a creator in connection with the Services and applicable data protection laws require a data processing agreement.

2. Roles of the Parties

For purposes of applicable data protection laws:

• The creator is the Data Controller.
• Hive is the Data Processor.

Hive processes personal data solely on documented instructions from the creator, as described in this DPA and the Terms of Use.

3. Subject Matter and Duration

Subject Matter: Processing of backer personal data in connection with pledge management, fulfillment support, and related services.

Duration: For the period during which Hive provides Services to the creator and thereafter as required for legal compliance or data retention obligations.

4. Nature and Purpose of Processing

Hive processes personal data for the following purposes:

• Managing pledges and reward selections
• Providing support ticket functionality
• Facilitating communications between creators and backers
• Maintaining platform functionality and security

5. Categories of Data and Data Subjects

Data Subjects:

• Backers supporting a creator’s project

Categories of Personal Data:

• Name
• Email address
• Phone number
• Shipping address
• Pledge details and reward selections
• Communications submitted via the platform

6. Processor Obligations

Hive shall:

• Process personal data only on documented instructions from the creator;
• Ensure persons authorized to process personal data are bound by confidentiality;
• Implement appropriate technical and organizational security measures;
• Assist the creator in responding to data subject requests;
• Notify the creator without undue delay after becoming aware of a personal data breach;
• Delete or return personal data upon termination of Services, subject to legal retention requirements.

7. Security Measures

Hive implements appropriate safeguards including:

• TLS encryption in transit;
• Role-based access controls;
• Restricted access to production systems;
• Monitoring for unauthorized access;
• Subprocessor oversight.

Hive shall implement security measures consistent with industry standards appropriate to the risk presented by the processing.

8. Subprocessors

The creator provides general authorization for Hive to engage subprocessors to provide elements of the Services, including hosting providers, infrastructure providers, analytics providers, and payment processors.

Hive shall ensure that any subprocessor is bound by data protection obligations that are no less protective than those set forth in this DPA.

Hive shall maintain an up-to-date list of subprocessors and shall make such list available upon reasonable request. Hive may update its subprocessors from time to time. Where required by applicable data protection law, Hive will provide notice of material changes.

Hive remains responsible for the performance of its subprocessors to the extent required by applicable law.

9. International Transfers

Where personal data is transferred outside the European Economic Area or United Kingdom, Hive relies on Standard Contractual Clauses or other lawful transfer mechanisms.

10. Liability

Each party’s liability under this DPA shall be subject to the limitations of liability set forth in the Terms of Use.

11. Governing Law

This DPA shall be governed by the laws specified in the Terms of Use, except where applicable data protection law requires otherwise.