Data Processing Agreement (DPA)

Document Status: June 2026

This agreement ("Data Processing Agreement" or "DPA") is entered into between the Customer ("Controller") and Spotix ("Processor"), and forms an integral part of the main service agreement (Terms of Service). This agreement is concluded in accordance with GDPR Article 28(3) and Israel's Privacy Protection Law (Amendment 13).

To arrange signature of this agreement: [email protected]

Section 1: Scope, Duration, and Description of Processing

This agreement applies to the processing of player data only. With regard to creator account data, Spotix acts as an independent Controller.

Duration: For as long as the engagement between the parties is in effect.

Section 2: Responsibilities and Roles

• The Customer (organization, museum, creator) is the "Controller" under GDPR Article 4(7).
• Spotix is the "Processor."
• The Controller is responsible for the lawfulness of processing, including the legal basis for collecting data from players.
• Initial processing instructions are as specified in this agreement. The Controller may modify instructions in writing.

Section 3: Processor Obligations (Spotix)

1. Processing on instructions only: Processing solely in accordance with the Controller's instructions (Article 28(3)(a)). If an instruction conflicts with law, Spotix will notify immediately.
2. Security measures: Implementation of technical and organizational security measures (Article 32) as detailed in Annex 1.
3. Assistance with data subject rights: Assistance in handling data subject requests (Articles 15-21). Response within 30 days.
4. Confidentiality: Any person authorized to process data is bound by confidentiality.
5. Notification of security incidents: Notice without undue delay, and in any case within 72 hours (Articles 33-34). Immediate measures to mitigate harm.
6. Impact assessment (DPIA): Assistance with impact assessments and prior consultation (Articles 35-36) upon request.
7. Correction and deletion: Correction or deletion of data per the Controller's instruction.
8. Termination of engagement: Upon termination: deletion of all data within 30 days, or return in a structured format, at the Controller's choice.
9. Defense against claims: Assistance in defense against claims (Article 82).
10. Periodic review: Periodic review of the effectiveness of security measures (Article 32(1)(d)).

Section 4: Controller Obligations (Customer)

1. Immediate notification of any defect or irregularity discovered.
2. Designating a point of contact for data protection matters.

Section 5: Data Subject Requests

• If a data subject contacts Spotix directly, the request will be forwarded to the Controller.
• Spotix provides assistance according to instructions and capability.
• Spotix is not responsible if the Controller fails to respond to a request.

Section 6: Documentation and Audit

1. Spotix documents and demonstrates compliance through Annex 1 (Technical and Organizational Measures).
2. Right of audit: The Controller is entitled to conduct an audit (or appoint an auditor), with prior coordination, during business hours, without interfering with operations. Spotix may require a confidentiality agreement and reject auditors who are competitors.
3. Supervisory authority audit: Same terms, without requiring a confidentiality agreement.

Section 7: Sub-processors

The Customer hereby approves the use of the sub-processors listed in Annex 2.

• Modification or addition: 30-day prior notice.
• Right to object: The Controller may object on substantive grounds. If no agreement is reached, the Controller has a right of termination.
• Spotix undertakes that data protection obligations also apply to sub-processors (Articles 28(2)-(4)).

Section 8: General Provisions

1. Immediate notification if data is subject to seizure, attachment, or bankruptcy proceedings.
2. Changes to this agreement: in writing only.
3. This agreement prevails over the main agreement on data protection matters.
4. Governing law: Laws of the State of Israel, interpreted in accordance with GDPR where relevant.

Section 9: Liability and Damages

• Liability to data subjects under GDPR Article 82.
• The liability provisions in the main agreement (Terms of Service) also apply to this processing.