Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the agreement betweenGo2 ("Processor", "we", "us", or "Go2") and you ("Controller", "Customer", or "you") for the provision of the Go2services as described in our Terms of Service (the "Agreement").

This DPA applies where and only to the extent that Go2 processes Personal Data on behalf of the Customer in the course of providing the Service, and such Personal Data is subject to Data Protection Laws.

The purpose of this DPA is to ensure that the processing of Personal Data byGo2 on behalf of the Customer complies with applicable data protection regulations, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), UK GDPR, and other applicable data protection laws.

1.1 How to Execute This DPA

By using Go2 services, you agree to the terms of this DPA. For enterprise customers requiring a signed copy, please contact legal@go2.gg.

2. Definitions

In this DPA, the following terms shall have the meanings set out below:

3. Scope & Purpose of Processing

3.1 Scope

This DPA applies to the processing of Personal Data that the Customer submits to Go2 or that is collected through the Customer's use of the Service, including:

• Click data from end users who interact with Customer's shortened links
• Analytics data associated with link interactions
• Any Personal Data contained in custom link parameters or metadata

3.2 Categories of Data Subjects

• End users who click on Customer's shortened links
• Customer's employees who use the Service
• Any other individuals whose data the Customer submits to the Service

3.3 Types of Personal Data

3.4 Purpose of Processing

Go2 processes Personal Data solely for the following purposes:

• Providing link redirection services
• Generating analytics and reports for the Customer
• Detecting and preventing abuse and fraud
• Maintaining the security and integrity of the Service

3.5 Duration of Processing

Processing will continue for the duration of the Agreement, plus any retention period required by law or as specified in the data retention schedule.

4. Processing Instructions

4.1 Controller's Instructions

Go2 shall process Personal Data only on documented instructions from the Controller, unless required by law. The Controller's instructions are documented in:

• This DPA
• The Terms of Service
• Customer's configuration of the Service
• Any additional written instructions from the Controller

4.2 Compliance with Instructions

Go2 will immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Laws. Go2 may suspend the relevant processing until the Controller confirms or modifies the instruction.

4.3 Confidentiality

Go2 ensures that persons authorized to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.4 Processing Limitations

Go2 shall not:

• Process Personal Data for any purpose other than as instructed by the Controller
• Sell Personal Data to third parties
• Share Personal Data for cross-context behavioral advertising
• Combine Personal Data from the Controller with data from other sources for Processor's own purposes

5. Security Measures

Go2 implements and maintains appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

5.1 Technical Measures

5.2 Organizational Measures

• Security awareness training for all employees
• Background checks for personnel with access to Personal Data
• Documented security policies and procedures
• Incident response plan
• Regular security assessments and penetration testing
• Vendor security reviews for sub-processors

5.3 Certifications

Our infrastructure providers maintain the following certifications:

• SOC 2 Type II
• ISO 27001
• PCI DSS (for payment processing)

6. Sub-processors

6.1 Authorization

The Controller provides general authorization for Go2 to engage sub-processors to assist in providing the Service. A current list of sub-processors is available in our Privacy Policy.

6.2 Sub-processor Requirements

Before engaging any sub-processor, Go2 shall:

• Conduct due diligence on the sub-processor's security practices
• Enter into a written agreement with data protection obligations equivalent to this DPA
• Remain fully liable for the sub-processor's performance

6.3 Current Sub-processors

6.4 Changes to Sub-processors

Go2 will notify the Controller of any intended changes to sub-processors at least 30 days in advance by:

• Email notification to the account owner
• Updating the sub-processor list in our Privacy Policy

The Controller may object to a new sub-processor within 14 days of notification. If the objection is not resolved, the Controller may terminate the Agreement.

7. Data Subject Rights

7.1 Assistance with Requests

Go2 will assist the Controller in responding to Data Subject requests to exercise their rights under Data Protection Laws, including:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object

7.2 Notification

If Go2 receives a request directly from a Data Subject regarding the Controller's data, Go2 will promptly notify the Controller and will not respond to the request without the Controller's authorization, unless required by law.

7.3 Self-Service Tools

The Controller can use the Go2 dashboard and API to:

• Export analytics data
• Delete specific links and associated data
• Access and modify account information

8. Personal Data Breach

8.1 Notification

Go2 will notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach affecting the Controller's data.

8.2 Breach Notification Contents

The notification will include, to the extent known:

• Nature of the breach, including categories and approximate number of Data Subjects affected
• Name and contact details of the point of contact
• Likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate effects

8.3 Cooperation

Go2 will cooperate with the Controller and take reasonable steps to assist in investigating, mitigating, and remediating the breach.

8.4 Exclusions

Unsuccessful attacks (e.g., blocked intrusion attempts, pings, port scans) that do not result in unauthorized access to Personal Data do not constitute a Personal Data Breach.

9. Audit Rights

9.1 Information

Go2 will make available to the Controller all information necessary to demonstrate compliance with this DPA, including:

• Security certifications and audit reports (SOC 2, etc.)
• Penetration test summaries
• Data protection impact assessments (where relevant)

9.2 Audits

The Controller (or an independent auditor appointed by the Controller) may conduct audits to verify Go2's compliance with this DPA, subject to:

• At least 30 days' prior written notice
• Reasonable scope and timing to minimize disruption
• Confidentiality obligations regarding any information obtained
• The Controller bearing the costs of the audit
• A maximum of one audit per 12-month period (unless required by a supervisory authority)

9.3 Third-Party Audits

Go2 may satisfy audit requests by providing existing third-party audit reports (e.g., SOC 2) that cover the relevant controls.

10. Data Deletion & Return

10.1 Upon Termination

Upon termination of the Agreement or at the Controller's request, Go2will:

• Return all Personal Data to the Controller in a commonly used format (upon request)
• Delete all Personal Data within 30 days of termination
• Provide written certification of deletion upon request

10.2 Exceptions

Go2 may retain Personal Data to the extent required by applicable law, provided that:

• Processing is limited to compliance with legal obligations
• Appropriate confidentiality measures remain in place
• The Controller is informed of the legal requirement

10.3 Sub-processor Deletion

Go2 will ensure that sub-processors delete Personal Data in accordance with the same requirements.

11. International Data Transfers

11.1 Transfer Mechanisms

When transferring Personal Data to countries outside the EEA that do not have an adequacy decision, Go2 implements appropriate safeguards including:

• Standard Contractual Clauses (SCCs) - EU Commission approved clauses
• UK IDTA - International Data Transfer Agreement for UK transfers
• Supplementary measures - Technical measures such as encryption

11.2 Transfer Impact Assessments

Go2 has conducted transfer impact assessments for data transfers to our sub-processors and can provide these assessments to Customers upon request.

11.3 Government Access Requests

If Go2 receives a legally binding request from a government authority for access to Personal Data, Go2 will:

• Challenge the request if there are reasonable grounds
• Notify the Controller before disclosure (unless prohibited by law)
• Limit disclosure to the minimum data required

12. Standard Contractual Clauses

12.1 Incorporation

For transfers of Personal Data from the EEA to countries without an adequacy decision, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference:

• Module Two: Controller to Processor transfers
• Clause 7: Optional docking clause included
• Clause 9: General authorization for sub-processors
• Clause 17: Governed by the laws of Ireland
• Clause 18: Disputes resolved by courts of Ireland

12.2 UK Transfers

For transfers from the UK, the UK International Data Transfer Addendum (IDTA) to the EU SCCs is incorporated as applicable.

12.3 Swiss Transfers

For transfers from Switzerland, the SCCs apply with the modifications specified by the Swiss Federal Data Protection and Information Commissioner.

12.4 Conflict

In case of conflict between this DPA and the SCCs, the SCCs shall prevail to the extent of the conflict.

13. Duration & Termination

13.1 Term

This DPA shall remain in effect for the duration of the Agreement betweenGo2 and the Controller.

13.2 Survival

The following provisions shall survive termination:

• Data deletion and return obligations (Section 10)
• Confidentiality obligations
• Liability provisions

13.3 Updates

Go2 may update this DPA from time to time to reflect changes in legal requirements or our processing activities. Material changes will be notified at least 30 days in advance.

14. Liability

14.1 General

Each party's liability arising out of or related to this DPA shall be subject to the limitations of liability set forth in the Agreement.

14.2 Indemnification

Each party shall indemnify the other for any fines or penalties imposed by a supervisory authority to the extent directly arising from that party's violation of Data Protection Laws.

14.3 Sub-processor Liability

Go2 remains fully liable to the Controller for the performance of sub-processor obligations under this DPA.

15. Contact Information

For questions about this Data Processing Agreement or to exercise any rights under this DPA:

• General DPA inquiries: legal@go2.gg
• Data Protection Officer: dpo@go2.gg
• Security concerns: security@go2.gg
• For a signed copy: legal@go2.gg

Enterprise customers may request customized DPA terms by contacting our legal team.