Data Processing Addendum

Last Updated: July 28, 2026

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the Client Engagement Acknowledgement, Terms of Service, or other written or electronic agreement between Distinkt Talent Agency LLC ("Distinkt") and the entity that has entered into such agreement ("Client") governing Client's use of Distinkt's talent representation platform and related services (the "Agreement"). This DPA applies to the extent Distinkt Processes Personal Data on behalf of Client in connection with the Services and such Processing is subject to Data Protection Laws.

This DPA is effective on the date the Agreement is executed or accepted, or the date both parties execute this DPA, whichever is earlier (the "Effective Date"). In the event of a conflict between this DPA and the Agreement with respect to the Processing of Client Personal Data, this DPA controls. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.

1. Definitions

1.1 "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including, as applicable: (a) Regulation (EU) 2016/679 ("GDPR"); (b) the GDPR as incorporated into United Kingdom law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018 ("UK GDPR"); (c) the Swiss Federal Act on Data Protection ("FADP"); (d) the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"); and (e) other applicable US state privacy laws.

1.2 "Client Personal Data" means Personal Data that Client (or its authorized users) provides to Distinkt, or that Distinkt otherwise Processes on Client's behalf, in connection with the Services, as described in Annex I. Client Personal Data excludes Talent Data and Distinkt Account Data (each as defined in Section 2.3).

1.3 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", and "Processing" (and derivatives) have the meanings given in the GDPR. For Personal Data subject to the CCPA, "Controller" includes "Business" and "Processor" includes "Service Provider".

1.4 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

1.5 "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022).

1.6 "Subprocessor" means any Processor engaged by Distinkt to Process Client Personal Data on Client's behalf.

1.7 "Services" means the services provided by Distinkt to Client under the Agreement, including the Distinkt platform, talent matching and shortlisting, booking facilitation, availability checks, contracting support, and related communications.

2. Scope and Roles of the Parties

2.1 Roles. As between the parties, Client is the Controller (or, where Client acts on behalf of a third-party Controller, a Processor) of Client Personal Data, and Distinkt is a Processor (or Subprocessor, as applicable) of Client Personal Data. Each party will comply with its obligations under Data Protection Laws in respect of its role.

2.2 Client Instructions. Distinkt will Process Client Personal Data only on Client's documented instructions, including with regard to transfers to third countries, unless required to do otherwise by law to which Distinkt is subject. In that case, Distinkt will inform Client of that legal requirement before Processing unless the law prohibits such disclosure on important grounds of public interest. The Agreement, this DPA, and Client's configuration of and use of the Services constitute Client's complete documented instructions. Additional instructions require prior written agreement of the parties. Distinkt will promptly inform Client if, in Distinkt's opinion, an instruction infringes Data Protection Laws.

2.3 Distinkt as Independent Controller. This DPA does not apply to Personal Data for which Distinkt is an independent Controller, including: (a) "Talent Data" — Personal Data of talent represented on or registered with the Distinkt platform, which talent provide to Distinkt directly under Distinkt's own agreements and Privacy Policy; and (b) "Distinkt Account Data" — Personal Data relating to Client's account, billing, and relationship with Distinkt, such as business contact details of Client personnel used for account administration, which Distinkt Processes as a Controller in accordance with its Privacy Policy.

Where Distinkt shares Talent Data with Client for the purpose of an engagement, each party acts as an independent Controller of that data and will Process it only for the purposes of evaluating, negotiating, and performing the relevant engagement, in compliance with Data Protection Laws.

2.4 Lawfulness. Client warrants that: (a) it has complied and will comply with Data Protection Laws in respect of Client Personal Data, including establishing a lawful basis for the Processing contemplated by the Agreement; (b) it has provided all notices and obtained all consents and rights necessary for Distinkt to Process Client Personal Data as permitted by the Agreement and this DPA; (c) its instructions will not cause Distinkt to violate Data Protection Laws; and (d) where Client acts as a Processor, the relevant Controller has authorized Client to appoint Distinkt as a Subprocessor and to give the instructions and authorizations in this DPA.

3. Confidentiality

3.1 Distinkt will ensure that persons authorized to Process Client Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and Process Client Personal Data only as necessary to provide the Services.

4. Security

4.1 Distinkt will implement and maintain appropriate technical and organizational measures to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Distinkt's current measures are described in Annex II. Distinkt may update Annex II from time to time, provided the updates do not materially reduce the overall level of protection.

5. Subprocessing

5.1 General Authorization. Client provides general written authorization for Distinkt to engage the Subprocessors listed in Annex III, and to engage additional or replacement Subprocessors subject to this Section 5.

5.2 Notice and Objection. Distinkt will maintain a current list of Subprocessors and will provide Client with at least thirty (30) days' prior notice of the addition or replacement of any Subprocessor by email or other direct notice to Client's designated contact. Client may object on reasonable data-protection grounds within that notice period. The parties will work in good faith to resolve the objection; if no resolution is reached, Client may terminate the affected Services without penalty as its sole remedy.

5.3 Subprocessor Obligations. Distinkt will impose on each Subprocessor data protection obligations that are materially no less protective than those in this DPA, by way of a written contract, and will remain liable to Client for the performance of each Subprocessor's obligations.

6. Data Subject Requests

6.1 Taking into account the nature of the Processing, Distinkt will assist Client, by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Client's obligations to respond to Data Subject requests to exercise rights under Data Protection Laws, including access, rectification, erasure, restriction, portability, and objection. If Distinkt receives such a request directly and can identify the requester as relating to Client Personal Data, Distinkt will promptly forward the request to Client and will not respond to it except to direct the Data Subject to Client, unless required by law.

7. Personal Data Breach

7.1 Distinkt will notify Client without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Client Personal Data. The notification will, to the extent known, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects, and will be supplemented as further information becomes available. Distinkt will take reasonable steps to contain and remediate the breach and will provide reasonable cooperation with Client's notification obligations. Distinkt's notification of or response to a Personal Data Breach is not an acknowledgment of fault or liability.

8. Impact Assessments and Consultation

8.1 Taking into account the nature of the Processing and the information available to Distinkt, Distinkt will provide reasonable assistance to Client with data protection impact assessments and prior consultations with supervisory authorities that Client is required to carry out under Data Protection Laws, in each case solely in relation to Processing of Client Personal Data by Distinkt.

8.2 Government and Legal Requests. If Distinkt receives a legally binding request from a public authority for Client Personal Data, Distinkt will, where legally permitted: (a) notify Client; (b) direct the requesting authority to Client where appropriate; (c) review the request for legal validity; and (d) disclose only the minimum Client Personal Data legally required.

9. Deletion and Return

9.1 Upon termination or expiration of the Agreement, or earlier upon Client's written request, Distinkt will, at Client's election, delete or return Client Personal Data and delete existing copies within thirty (30) days, unless retention is required by law to which Distinkt is subject. In that case, Distinkt will isolate and protect the retained data from further Processing and delete it once the legal requirement lapses. Data held in routine backups will be deleted in accordance with Distinkt's backup rotation schedule and remains protected by this DPA until deletion.

10. Audits and Information

10.1 Distinkt will make available to Client information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by Client or an independent auditor mandated by Client. Audits are subject to the following: (a) Client will first exercise its rights by reviewing documentation, certifications, and audit reports made available by Distinkt and by written questionnaire; (b) any on-site audit requires at least thirty (30) days' written notice, is limited to once per twelve-month period except following a Personal Data Breach or where required by a supervisory authority, occurs during normal business hours, and must not unreasonably disrupt Distinkt's operations; (c) the auditor must not be a competitor of Distinkt and must execute reasonable confidentiality terms; and (d) each party bears its own costs.

11. International Transfers

11.1 Transfer Mechanism. To the extent the Processing of Client Personal Data involves a transfer from the European Economic Area, the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of protection, the parties agree that such transfer is governed by the Standard Contractual Clauses, which are incorporated into this DPA by reference as follows:

(a) Module Two (Controller to Processor) applies where Client is a Controller; Module Three (Processor to Processor) applies where Client is a Processor;

(b) Clause 7 (docking clause) does not apply;

(c) in Clause 9, Option 2 (general written authorization) applies with the notice period in Section 5.2 of this DPA;

(d) in Clause 11, the optional independent-resolution language does not apply;

(e) in Clauses 17 and 18, the governing law and forum are those of Ireland;

(f) Annex I of the SCCs is completed with the information in Annex I of this DPA; Annex II of the SCCs is completed with Annex II of this DPA; and Annex III of the SCCs is completed with Annex III of this DPA.

11.2 UK Transfers. For transfers subject to the UK GDPR, the SCCs apply as modified by the UK Addendum. The parties agree to be bound by Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses. Table 1 is completed with the party details in Annex I; Tables 2 and 3 are completed by reference to the SCCs as incorporated above and the Annexes to this DPA; and for Table 4, either party may end the UK Addendum as set out in Section 19 of the UK Addendum.

11.3 Swiss Transfers. For transfers subject to the FADP, the SCCs apply with the following adaptations: references to the GDPR are understood as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; the governing law and forum under Clauses 17 and 18 are those of Switzerland or Ireland at the data exporter's election; and Data Subjects habitually resident in Switzerland may enforce their rights in Switzerland.

11.4 Alternative Mechanisms. If Distinkt adopts an alternative lawful transfer mechanism recognized under Data Protection Laws, that mechanism will apply in place of the SCCs to the extent it lawfully covers the relevant transfer.

11.5 Onward Transfers. Distinkt will not make an onward transfer of Client Personal Data subject to a transfer restriction under Data Protection Laws unless the transfer is permitted by those laws and protected by an applicable transfer mechanism or other legally recognized safeguard.

12. CCPA and US State Privacy Laws

12.1 To the extent Client Personal Data includes Personal Data subject to the CCPA or other US state privacy laws, Distinkt acts as a Service Provider or Processor and will: (a) Process Client Personal Data solely for the business purposes described in the Agreement and Annex I; (b) not sell or share Client Personal Data as those terms are defined in the CCPA; (c) not use Client Personal Data for Distinkt's own marketing or advertising; (d) not retain, use, or disclose Client Personal Data outside the direct business relationship between the parties or for any purpose other than the business purposes specified, except as permitted by law; (e) not combine Client Personal Data with Personal Data received from other sources except as permitted by the CCPA; (f) notify Client if it determines it can no longer meet its obligations under applicable US state privacy laws, in which case Client may take reasonable steps to stop and remediate unauthorized use; and (g) provide the same level of privacy protection as required of businesses by the CCPA. Distinkt certifies that it understands and will comply with the restrictions in this Section.

13. Data Protection Contacts

13.1 Privacy inquiries should be directed to privacy@distinkt.com.

13.2 Distinkt has appointed DataRep as its representative in the European Union and the United Kingdom for the purposes of Article 27 GDPR and Article 27 UK GDPR. In the European Union, DataRep may be contacted through its online request form. In the United Kingdom, DataRep may be contacted at datarequest@datarep.uk or through its UK request form. When contacting DataRep, identify Distinkt Talent Agency LLC as the organization to which the request relates.

14. Liability, Term, and General

14.1 Liability. Each party's liability arising out of or related to this DPA, including the SCCs, is subject to the exclusions and limitations of liability set out in the Agreement, except to the extent such limitation is prohibited by Data Protection Laws or the SCCs. Nothing in this Section affects the rights of Data Subjects under the SCCs.

14.2 Term. This DPA remains in effect for as long as Distinkt Processes Client Personal Data under the Agreement.

14.3 Governing Law. This DPA is governed by the law governing the Agreement, except that the SCCs and UK Addendum are governed as set out in Section 11.

14.4 Severability. If any provision of this DPA is held invalid or unenforceable, the remainder remains in full force, and the parties will substitute a valid provision that most closely reflects the original intent.

14.5 Updates. Distinkt may update this DPA from time to time as required to reflect changes in Data Protection Laws or the Services, provided that updates do not materially reduce the protection of Client Personal Data. Material changes will be notified to Client in accordance with the Agreement.

Execution

Where this DPA is incorporated into the Agreement by reference, no separate signature is required. Where the parties execute this DPA separately:

DISTINKT: Distinkt Talent Agency LLC

By: ______________________________

Name: ____________________________

Title: _____________________________

Date: _____________________________

CLIENT: ______________________________

By: ______________________________

Name: ____________________________

Title: _____________________________

Date: _____________________________

Annex I — Description of Processing

A. List of Parties

Data exporter: Client, with contact details as set out in the Agreement or Client's account. Role: Controller, or Processor where applicable. Activities: use of the Distinkt platform and Services to identify, evaluate, and engage talent for commercial, advertising, editorial, and related productions.

Data importer: Distinkt Talent Agency LLC, Los Angeles, California, USA. Contact: privacy@distinkt.com. Role: Processor. Activities: provision of the Services described in the Agreement.

B. Description of Transfer and Processing

Categories of Data Subjects: Client personnel and authorized users, including employees, contractors, and agents of Client who access the Distinkt platform; individuals whose Personal Data appears in project briefs, creative materials, feedback, or communications submitted by Client through the platform.

Categories of Personal Data: Identification and business contact data, including name, email address, phone number, job title, and company name; account credentials and usage data; project and engagement information, including creative briefs, casting specifications, and production details, to the extent they contain Personal Data; communications content, including messages, feedback, availability responses, notes, and review records; billing and transaction records associated with identifiable individuals where they constitute Personal Data.

Special categories of data: Special categories of Personal Data are not intended as a routine part of Client Personal Data. Client must not submit data subject to Article 9 or Article 10 GDPR unless the data is necessary for a lawful project purpose, the Processing is permitted by applicable law, and Distinkt has agreed to the Processing in writing. Where such Processing is accepted, Client remains responsible for establishing the appropriate lawful basis and providing required notices, and Distinkt will apply the safeguards described in Annex II.

Frequency of the transfer: Continuous, for the duration of the Agreement.

Nature and purpose of the Processing: Hosting and storage; AI-assisted talent matching, shortlisting, and curation; availability checks and booking facilitation; contract preparation and electronic signature; notifications and communications; payment and commission recordkeeping; customer support; and security, backup, and service integrity.

Duration of Processing and retention: The term of the Agreement, plus the deletion period in Section 9 of this DPA.

Transfers to Subprocessors: As set out in Annex III. The subject matter, nature, and duration of Subprocessor Processing correspond to the functions described in Annex III for the duration above.

C. Competent Supervisory Authority

The supervisory authority determined in accordance with Clause 13 of the SCCs; where the data exporter is not established in the EEA, the Irish Data Protection Commission, unless another authority is mandated by Data Protection Laws. For UK transfers, the Information Commissioner's Office.

Annex II — Technical and Organizational Measures

Distinkt implements and maintains, at minimum, the following measures:

  • Encryption: Personal Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest at the storage layer using AES-256 or equivalent. Data stores, including the primary PostgreSQL database, the vault database, and Cloudflare R2 object storage, are encrypted at rest.

  • Access control: Role-based access control with least-privilege permissions; access to production systems restricted to authorized personnel; authentication via managed identity providers with multi-factor authentication enforced for administrative access; per-user data scoping so platform users can access only records they are authorized to view.

  • Network and application security: Web application firewall and DDoS protection at the network edge; server-side input validation and injection protections, including safeguards applied to AI-assisted features; webhook signature validation and secrets management for third-party integrations.

  • Identity verification: Where enabled or required, platform participants undergo identity verification through a dedicated verification provider before gaining full platform access.

  • Infrastructure: Production workloads run on managed cloud infrastructure with logical tenant separation. Databases are access-restricted, credentialed, and not publicly exposed. Backend microservices operate in a private network. Media files are stored in Cloudflare R2 and served via Cloudflare Stream.

  • Availability and resilience: Automated backups with defined rotation; monitoring and alerting on service health; documented incident-response procedures.

  • Logging and monitoring: System and application logging of security-relevant events via centralized error monitoring; review of anomalous activity.

  • Data minimization and retention: Data collection limited to what the Services require; retention and deletion in accordance with Section 9 of this DPA and Distinkt's retention schedule.

  • Personnel: Confidentiality obligations for personnel with access to Personal Data; security awareness appropriate to role.

  • Vendor management: Subprocessors are assessed for security and data protection practices prior to engagement and bound by written data protection terms.

  • Secure development: Separation of development and production environments; code review for changes affecting Personal Data handling; testing of security-relevant functionality prior to release.

  • Assistance measures: Tooling and processes to support Data Subject rights requests, breach-notification timelines, and deletion or return of Client Personal Data.

Annex III — Authorized Subprocessors

Subprocessor Function Location Transfer Mechanism
OpenAI, LLC AI-assisted talent-to-brief matching, text embeddings, and analysis support; processes creative briefs and derived matching data United States SCCs
Anthropic, PBC AI agents supporting platform workflows, onboarding, matching fallback, and customer support; processes project context and support communications United States SCCs
Cloudflare, Inc. Content delivery network, object storage, video hosting, and application-layer security United States / global edge SCCs
Google LLC Transactional email delivery, message processing, and OAuth-based authentication for platform users United States SCCs
OneSignal, Inc. Transactional and operational email and push-notification delivery to platform users United States SCCs
Twilio Inc. SMS and telephony messaging to platform users United States SCCs
BoldSign (Syncfusion, Inc.) Electronic signature and agreement execution for engagement contracts United States SCCs
Persona Identities, Inc. Identity verification of platform users where enabled or required United States SCCs
Zoom Video Communications, Inc. Video and audio sessions facilitated through the platform United States SCCs
Replit, Inc. Primary application hosting and managed PostgreSQL database infrastructure United States SCCs
Fly.io (Fly Machines, Inc.) Backend microservice and database hosting United States SCCs
Sentry (Functional Software, Inc.) Application error monitoring and diagnostics; may receive request context, user identifiers, and Personal Data present in error payloads United States SCCs

The current Subprocessor list is maintained online. Changes are notified in accordance with Section 5.2 of this DPA.