Data Processing Addendum

For Customer Data described in Annex A, you are the controller and Cabana is the processor, processing only to provide the Service. For your own account data (your email, billing, usage of Cabana), Cabana is an independent controller as described in the Privacy Policy.

Cabana will:

• (a) Documented instructions. Process Customer Data only on your documented instructions - your use and configuration of the Service constitutes those instructions - including for international transfers, unless required by law (in which case we inform you unless prohibited).
• (b) Confidentiality. Ensure persons authorized to process Customer Data are bound by confidentiality obligations.
• (c) Security. Implement appropriate technical and organizational measures under Art. 32, including encryption in transit and at rest, per-creator row-level access controls, and least-privilege access.
• (d) Subprocessors. Engage subprocessors only per Section 3.
• (e) Data-subject rights. Assist you, insofar as possible, in responding to data-subject requests (access, deletion, portability, objection) - including forwarding any requests we receive about your contacts.
• (f) Breach and impact assessments. Assist you with security, breach-notification, and data-protection-impact-assessment obligations under Arts. 32–36, and notify you without undue delay after becoming aware of a personal-data breach affecting Customer Data.
• (g) Deletion or return. At termination, delete or return Customer Data at your choice (self-service export and deletion are available in Dashboard → Settings), and delete remaining copies within 30 days unless law requires retention.
• (h) Audit. Make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, which we will normally satisfy through documentation and third-party reports from our infrastructure providers.

You give general written authorization for the subprocessors in Annex B. We will notify creators (by email or in-dashboard) at least 14 days before adding or replacing a subprocessor; if you reasonably object on data-protection grounds and we cannot offer an alternative, you may terminate and we will refund prepaid fees for the unused period. Cabana imposes data-protection obligations on subprocessors consistent with this DPA and remains liable for their performance.

Where Customer Data originating in the EEA/UK is transferred to a country without an adequacy decision, the parties rely on appropriate safeguards - the EU Standard Contractual Clauses (module 2, controller→processor), which are incorporated by reference, and/or our subprocessors’ participation in the EU–US Data Privacy Framework.

• Subject matter & duration: provision of the Cabana Studio CRM and related features for the term of your subscription.
• Nature & purpose: hosting, storage, display, organization, and (where enabled) message drafting/sending relating to your brand-deal pipeline, including AI-assisted contract review, content planning, and inbound-message deal extraction.
• Categories of data subjects: your brand contacts and prospects; people who message you or submit your intake form.
• Types of personal data: names, business email addresses and handles, company names, communication content (emails/DMs/inquiries), deal terms and notes, payment status related to deals. No special categories of data are intended to be processed.

Questions or objections: privacy@cabanastudio.io