DATA PROCESSING ADDENDUM
Last Updated: August 19, 2026
This Data Processing Addendum ("Addendum") amends and forms a part of the written or electronic agreement(s) (the "Agreement") by and between the legal entity subject to the Agreement ("Customer") and Jika, Inc. (d/b/a Skio) ("Provider"), governing Customer's use of Provider's subscription management platform and related products and services (the "Service"). Capitalized terms not otherwise defined in this Addendum shall have the same definitions as in the Agreement or the meaning ascribed to the corresponding terms in the applicable Data Protection Legislation.
Definitions
“Business," "Controller," "Processor," "Processing/Process/Processed," and "Service Provider" shall be given the meanings given to them by the applicable Data Protection Legislation.
"Data Subject" means the identified or identifiable natural person to whom Personal Information relates.
"Data Subject Request" means the exercise by Data Subjects of their rights in accordance with applicable Data Protection Legislation in respect of Personal Information.
"Data Protection Legislation" means, collectively: (i) the GDPR; (ii) the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020, codified at Cal. Civ. Code §§ 1798.100–1798.199.100, and the California Consumer Privacy Act Regulations issued thereto, as amended (together, the "CCPA"); (iii) the Swiss Federal Act on Data Protection ("FADP"), as amended from time to time; (iv) any other data protection laws, including regulations implementing or made pursuant to those laws, including those which amend, replace, re-enact, or consolidate any data protection laws; (v) applicable data breach notification statutes; and (vi) all other applicable laws relating to Processing of Personal Information and privacy that may exist in any relevant jurisdiction, to the extent applicable to the relevant Personal Information or Processing thereof under the Agreement.
"EEA" means the European Economic Area.
"GDPR" means: (i) the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) ("EU GDPR"); (ii) the EU GDPR as it forms part of United Kingdom ("UK") law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"); and (iii) any applicable implementing or supplementary legislation in any member state of the EEA or the UK (including the UK Data Protection Act 2018).
"Personal Information" means information that constitutes "Personal Data," "Personal Information," "Personally Identifiable Information," or similar information as defined by applicable Data Protection Legislation that Provider Processes pursuant to the Agreement.
"Personal Data Breach" means a breach of Provider's security that has resulted in the accidental or unlawful destruction, acquisition, loss, alteration, unauthorized disclosure of, or access to, Personal Information in Provider's possession, custody, or control. Personal Data Breaches do not include unsuccessful attempts or activities that do not compromise the security of Personal Information, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
"Relevant Body" means: (i) in the context of the UK and UK GDPR, the UK Information Commissioner's Office and/or UK Government (as and where applicable); (ii) in the context of the EEA and EU GDPR, the European Commission; and (iii) in the context of Switzerland and the FADP, the Swiss Federal Data Protection and Information Commissioner.
"Restricted Country" means: (i) in the context of the UK, a country or territory outside the UK; (ii) in the context of the EEA, a country or territory outside the EEA; and (iii) in the context of Switzerland, a country outside of Switzerland; in each case that the relevant Relevant Body has not deemed to provide an adequate level of protection for Personal Information.
"Restricted Data Transfer" means the disclosure, grant of access, or other transfer of Personal Information to: (i) in the context of the EEA, any country or territory outside the EEA that does not benefit from an adequacy decision by the European Commission pursuant to Article 45 of the GDPR; (ii) in the context of the UK, any country or territory outside the UK that does not benefit from an adequacy decision by the UK Information Commissioner's Office pursuant to Article 45 of the GDPR; and (iii) in the context of Switzerland, any country outside Switzerland that does not benefit from an adequacy determination by the Swiss Federal Council pursuant to the FADP.
"Security Measures" means the technical and organizational security measures to be applied by Provider in respect of Personal Information, as set out in Appendix 2.
"Standard Contractual Clauses" or "SCCs" means: (i) where the EU GDPR applies, the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("EU SCCs"); (ii) where the UK GDPR applies, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018 ("UK IDTA"); and (iii) where the FADP applies, the EU SCCs as modified in accordance with Section 3.3 below; in each case as updated, amended, or superseded from time to time.
"Subprocessors" means the third parties engaged by Provider to Process Personal Information, as listed on the Skio Subprocessor list (the “Subprocessor Page”)
"Supervisory Authority" means: (i) in the context of the EU GDPR, any authority within the meaning of Article 4(21) of the EU GDPR; (ii) in the context of the UK GDPR, the UK Information Commissioner's Office; and (iii) in the context of the FADP, the Swiss Federal Data Protection and Information Commissioner.
"UK" means the United Kingdom of Great Britain and Northern Ireland.
Data Protection
In the course of Provider providing the Service under the Agreement, Customer may from time to time provide or make available Personal Information to Provider for the limited and specific purposes of providing the Service under the Agreement. The Parties acknowledge and agree that in relation to any such Personal Information, the Customer will be the Controller and Provider will be the Processor for the purposes of the GDPR and the FADP, and the Customer will be the Business and Provider will be the Service Provider for purposes of the CCPA.
When Provider Processes Personal Information in the course of providing the Service, Provider will:
Process the Personal Information as a Processor, for the purpose of providing the Service in accordance with documented instructions from the Customer (provided that such instructions are commensurate with the functionalities of the Service), to perform Provider's obligations and exercise Provider's rights under the Agreement, and as may subsequently be agreed to by the Customer. Provider is prohibited from retaining, using, or disclosing Personal Information provided by the Customer for any purpose other than for the specific purpose of performing the Services specified in the Agreement, unless otherwise expressly permitted by applicable Data Protection Legislation. If Provider is required by applicable laws to Process the Personal Information for any other purpose, Provider will provide the Customer with prior notice of this requirement, unless Provider is prohibited by such laws from providing such notice;
not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Customer Personal Information to any third party for monetary or other valuable consideration, and shall not share any Customer Personal Information for purposes of cross-context behavioral advertising;
not combine any Personal Information that Provider receives from, or on behalf of, Customer with information that it receives from, or on behalf of, another source, provided that Provider may combine Personal Information as authorized by Data Protection Legislation;
to the extent that Customer discloses or otherwise makes available deidentified data to Provider, take reasonable measures to ensure that such deidentified data cannot be associated with an individual or household;
notify the Customer if it cannot follow the Customer's instruction for the Processing of Personal Information because, in Provider's opinion, the instruction infringes applicable Data Protection Legislation;
notify the Customer promptly, to the extent permitted by law, upon receiving an inquiry or complaint from a Supervisory Authority relating to Provider's Processing of the Personal Information;
.upon Customer's written request, provide Customer with such assistance as may be reasonably necessary and technically feasible in fulfilling its legal obligations under Data Protection Legislation, including data protection impact assessments and prior consultations with Supervisory Authorities, in each case solely in relation to Processing of Personal Information by, and taking into account the nature of the Processing by, and information available to, Provider;
upon the Customer's written request, provide the Customer with such reasonable assistance as may be necessary and technically feasible, taking into account the nature and circumstances of the processing and Provider's role as a processor, to allow the Customer to fulfill its obligation to respond to Data Subject Requests;
upon receipt of any Data Subject Request relating to Personal Information that Provider Processes for the Customer, advise the Data Subject to submit the request to Customer, as Customer is solely responsible for responding to any such requests. Provider's notification of or response to a Data Subject Request under this section is not an acknowledgment by Provider of any fault or liability with respect to the Data Subject Request;
implement and maintain appropriate technical and organizational measures designed to protect Personal Information and ensure a level of security appropriate to the risk, comprising those documented in the Security Measures listed in Appendix 2;
provide the Customer, upon reasonable written request, with up-to-date attestations, reports, or extracts thereof, where available, from a source charged with auditing Provider's data protection practices (e.g., external auditors, internal audit, data protection auditors), or suitable certifications, to enable the Customer to assess compliance with the terms of this Addendum;
comply with applicable obligations under Data Protection Legislation and reasonably ensure its employees, agents, and service providers comply with the obligations and restrictions applicable to Provider under applicable Data Protection Legislation. Provider shall reasonably notify Customer if it decides it can no longer meet its obligations. Upon such notification, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information;
notify the Customer without undue delay upon becoming aware of and confirming any Personal Data Breach impacting Customer's Personal Information. The Customer is solely responsible for complying with data breach notification laws applicable to the Customer and fulfilling any third-party notification obligations related to any Personal Data Breach. Provider's notification of, or response to, a Personal Data Breach under this section is not an acknowledgment by Provider of any fault or liability with respect to the Personal Data Breach;
ensure that its personnel who access Personal Information have committed themselves to confidentiality or are under appropriate statutory obligations of confidentiality; and
upon termination of the Agreement or expiry of the Service, cease data processing and return or delete all Personal Information in Provider's possession, custody, or control in accordance with Customer's instructions, except to the extent Provider is required to retain such Personal Information by applicable law, in which case Provider shall maintain the confidentiality of such Personal Information and Process it only as necessary for the purpose and duration required by law.
The Customer shall ensure that it is entitled to give access to the relevant Personal Information to Provider so that Provider may lawfully Process Personal Information in accordance with the Agreement on the Customer's behalf. The Customer shall:
comply with its obligations under Data Protection Legislation which arise in relation to this Addendum, the Agreement, and the receipt of the Service;
not do or omit to do anything which causes Provider (or any Subprocessor) to breach any of its obligations under Data Protection Legislation; and
reasonably inform Provider of any inquiry or request and any necessary information regarding Provider's compliance with Data Protection Legislation, should the Customer receive an inquiry or request.
Customer agrees that Provider may use Subprocessors to Process Personal Information in the course of providing the Service. Provider's use of any Subprocessor must comply with Data Protection Legislation and be governed by a contract between Provider and the Subprocessor. Provider will notify the Customer of any changes to the Subprocessor Page concerning the addition or replacement of Subprocessors. Customer acknowledges its obligation to review the Subprocessor Page after being notified. Customer may object to such changes in writing within 14 days of notification, setting out its reasonable concerns in detail. If the Customer does not object, Provider shall have the right to continue to Process Personal Information using the relevant Subprocessors. If the Customer objects, Provider shall consult with the Customer and consider the Customer's concerns in good faith. If the Customer upholds its objection and the parties are unable to reach a mutually acceptable resolution, Customer may, as its sole and exclusive remedy, terminate the Agreement upon written notice to Provider, subject to payment of all amounts due and owing as of the date of termination.
As part of providing the Service, Personal Information may be Processed and stored in the United States. Such Processing will be completed in compliance with relevant Data Protection Legislation.
Customer acknowledges and agrees that Provider may transfer, access, and Process Personal Information in a Restricted Country as necessary to provide the Service in accordance with the Agreement. Provider will make any such Restricted Data Transfers in compliance with applicable Data Protection Legislation. If Provider's compliance with Data Protection Legislation applicable to Restricted Data Transfers is affected by circumstances outside of Provider's control, including if a legal instrument for Restricted Data Transfers is invalidated, amended, or replaced, then Customer and Provider will work together in good faith to reasonably resolve such non-compliance.
International Transfers
EU Restricted Transfers. Solely to the extent required to ensure the legality of Restricted Data Transfers of Personal Information subject to the EU GDPR, the EU SCCs are hereby incorporated by reference and form an integral part of this Addendum, with Customer as "data exporter" and Provider as "data importer." For the purposes of the EU SCCs: (i) Module Two (Controller to Processor) terms shall apply; (ii) Clause 7 (Docking Clause) shall not apply; (iii) in Clause 9, Option 2 shall apply and the notice period shall be 14 days; (iv) in Clause 11, the optional language shall not apply; (v) in Clause 17 (Option 1), the EU SCCs shall be governed by Irish law; (vi) in Clause 18(b), disputes shall be resolved before the courts of Ireland; (vii) Annex I of the EU SCCs shall be populated with the information set out in Appendix 1; and (viii) Annex II of the EU SCCs shall be deemed populated with the information set out in Appendix 2.
UK Restricted Transfers. Solely to the extent required to ensure the legality of Restricted Data Transfers of Personal Information subject to the UK GDPR, the UK IDTA is hereby incorporated by reference and forms an integral part of this Addendum. The Appendices of the UK IDTA shall be populated with the relevant information set out in this Addendum, and the UK IDTA shall be governed by the laws of, and disputes shall be resolved before the courts of, England and Wales.
Swiss Restricted Transfers. Solely to the extent required to ensure the legality of Restricted Data Transfers of Personal Information subject to the FADP, the EU SCCs are hereby incorporated by reference and form an integral part of this Addendum as modified by this Section 3.3. For Swiss Restricted Transfers: (i) in Clause 13, the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner; (ii) in Clause 17 (Option 1), the SCCs shall be governed by the laws of Switzerland; (iii) in Clause 18(b), disputes shall be resolved before the courts of Switzerland; (iv) the term "Member State" shall not be interpreted to exclude Data Subjects in Switzerland from enforcing their rights in their place of habitual residence; and (v) all references to the EU GDPR shall also be deemed to refer to the FADP.
Data Privacy Framework. A transfer of Personal Information from the EU, UK, or Switzerland to Provider in the United States shall not constitute a Restricted Data Transfer so long as Provider maintains an active certification to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and/or the Swiss-U.S. Data Privacy Framework, as applicable (collectively, the "DPF"), and such certification remains a valid legal basis for transfer of Personal Information to the United States under the GDPR or FADP, as applicable. With respect to the Swiss-U.S. Data Privacy Framework, transfers may only be made in reliance on such certification on or after September 15, 2024, the date on which Switzerland's recognition of adequacy for the Swiss-U.S. Data Privacy Framework entered into force.
Conflicts. If and to the extent the applicable SCCs conflict with any provision of this Addendum regarding the transfer of Personal Information from Customer to Provider, the SCCs shall prevail to the extent of such conflict.
Miscellaneous
In the event of any conflict or inconsistency between the provisions of the Agreement and this Addendum, the provisions of this Addendum shall prevail. For avoidance of doubt, and to the extent allowed by applicable law, any and all liability under this Addendum, including limitations thereof, will be governed by the relevant provisions of the Agreement.
Save as specifically modified and amended in this Addendum, all terms, provisions, and requirements contained in the Agreement shall remain in full force and effect. If any provision of this Addendum is held illegal or unenforceable in a judicial proceeding, such provision shall be severed and inoperative, and the remainder of this Addendum shall remain operative and binding on the parties.
The terms of this Addendum shall be governed by and interpreted in accordance with the laws of the State of California and the laws of the United States applicable therein, without regard to principles of conflicts of laws. The parties irrevocably and unconditionally submit to the exclusive jurisdiction of the courts of the State of California with respect to any dispute or claim arising out of or in connection with this Addendum.
The undersigned have executed this Addendum by their duly authorized representatives with the intention to be legally bound.
PROVIDER
Jika, Inc. (d/b/a Skio)
By: ___________________________________
Name: _________________________________
Title: __________________________________
Date: __________________________________
CUSTOMER
Customer name: ________________________
By: ___________________________________
Name: _________________________________
Title: __________________________________
Date: __________________________________
Appendix 1 – Data Processing Details
This Appendix includes certain details of the Processing of Personal Information: (i) as required by Article 28(3) of the GDPR; and (ii) where applicable, to populate Annex I to the Standard Contractual Clauses.
Roles
Data exporter: Customer (as described in the Agreement).
Data importer: Jika, Inc. (d/b/a Skio) — Provider of a subscription management platform for online retailers.
Contact details for data protection: 2261 Market St #4096, San Francisco, CA 94114; help@skio.com
Subject Matter and Duration
The Processing of Personal Information in connection with Provider's provision of the Service under the Agreement. Processing begins on the date Personal Information is first Processed by Provider and ends on the date of termination or expiry of the Agreement, subject to Section 2.2.15.
Nature and Purpose of Processing
Processing of Personal Information by Provider on behalf of Customer in connection with allowing access of Customer's subscribers to Provider's subscription management platform, as more particularly described in the Agreement.
Categories of Data Subjects
Customer's subscribers and end users of the Service.
Categories of Personal Information
Personal Information that Provider receives as described in Provider's privacy policy, including: first and last name, shipping address, email address, phone number order history, and subscription status.
Sensitive Categories of Data
Not applicable.
Frequency of Transfer
Continuous and ongoing during the term of the Agreement.
Transfers to Subprocessors
As described in the Subprocessor Page for the purposes described therein.
Appendix 2 – Security Measures
Provider will implement and maintain the following security measures:
1.Physical Access Control. Provider shall take reasonable measures to prevent physical access by unauthorized persons to facilities where Personal Information is Processed. Safeguards at data processing facilities are controlled by third-party vendors and may include security personnel, alarm systems, access control systems, and video/CCTV surveillance.
2.System Access Control. Provider shall take reasonable measures to prevent unauthorized access to systems processing Personal Information, including multi-factor authentication, change management processes, and system-level logging.
3.Data Access Control. Provider shall take reasonable measures to allow Personal Information to be accessed and managed by authorized personnel only, and to protect against Personal Information being read, modified, or removed without authorization.
4.Transmission Control. Provider shall take reasonable measures to prevent the disclosure of Personal Information during transmission, including encryption over public networks.
5.Data Availability Control. Provider shall take reasonable measures to protect against accidental destruction or loss of Personal Information, including regular backups, restoration testing, replication across multiple sites, and disaster recovery plans.
6.Data Segregation Control. Provider shall take reasonable measures to segregate Personal Information on a per-customer basis, including application-level controls for logical separation of Personal Information.
7.Organizational Controls. Provider shall maintain an organizational information security program with dedicated staff responsible for its development, implementation, and maintenance, including audit and risk assessment procedures, incident management procedures, vulnerability assessment and threat protection technologies, and change management procedures.
Provider may update or modify the Security Measures from time to time, provided that such updates and modifications do not materially decrease the overall security of the Service.
