Data Processing Addendum (DPA)

Effective Date: October 1, 2026

This Data Processing Addendum ("DPA") forms part of the Master Services Agreement, Terms of Service, or other written or electronic agreement ("Agreement") between Woven Women’s Network ("Processor") and the Customer ("Controller") to reflect the parties' agreement with regard to the Processing of Personal Data.

By signing the Agreement, Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws and Regulations, in the name and on behalf of its Authorized Affiliates, if and to the extent Woven Women’s Network processes Personal Data for which such Authorized Affiliates qualify as the Controller.

1. Definitions

  • Controller Means the entity which determines the purposes and means of the Processing of Personal Data.

  • Processor Means the entity which Processes Personal Data on behalf of the Controller.

  • Data Subject Means the identified or identifiable natural person to whom the Personal Data relates.

  • Personal Data Means any information relating to an identified or identifiable natural person that is processed by Woven Women’s Network on behalf of the Customer in connection with the Agreement.

  • Processing Means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

  • Subprocessor Means any third party appointed by or on behalf of Woven Women’s Network to process Personal Data on behalf of the Customer.

  • Applicable Data Protection Law Refers to all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, Switzerland, the United Kingdom and the United States and its states, applicable to the Processing of Personal Data under the Agreement.

  • Security Incident Means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed by Woven Women’s Network.

2. Scope and Applicability

This DPA applies where and only to the extent that Woven Women’s Network processes Personal Data on behalf of the Customer in the course of providing the Services pursuant to the Agreement.

The parties agree that this DPA shall replace any existing DPA or privacy addendum the parties may have previously entered into in connection with the Services.

3. Roles and Responsibilities

The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller, Woven Women’s Network is the Processor and that Woven Women’s Network will engage Subprocessors pursuant to the requirements set forth in Section 6 "Subprocessing" below.

4. Customer Obligations

Customer shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations. For the avoidance of doubt, Customer's instructions for the Processing of Personal Data shall comply with Data Protection Laws and Regulations.

Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data.

5. Woven Women’s Network Media Obligations

Woven Women’s Network a shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of and in accordance with Customer's documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Customer.

6. Subprocessing

Customer acknowledges and agrees that Woven Women’s Network may engage third-party Subprocessors in connection with the provision of the Services. Woven Women’s Network has entered into a written agreement with each Subprocessor containing data protection obligations not less protective than those in this Agreement.

Woven Women’s Network shall provide notification of a new Subprocessor(s) before authorizing any new Subprocessor(s) to Process Personal Data in connection with the provision of the applicable Services.

7. Security Measures

Woven Women’s Network shall implement and maintain appropriate technical and organizational security measures designed to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data, in accordance with Woven Women’s Network security standards described in Appendix B.

8. Security Incidents

Upon becoming aware of a Security Incident, Woven Women’s Network shall notify Customer without undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Customer.

9. Data Subject Rights

Woven Women’s Network shall, to the extent legally permitted, promptly notify Customer if Woven Women’s Network receives a request from a Data Subject to exercise the Data Subject's right of access, right to rectification, restriction of Processing, erasure, data portability, object to the Processing, or its right not to be subject to an automated individual decision making.

10. Data Transfers

Woven Women’s Network may transfer and process Personal Data to and in the United States and anywhere else in the world where Woven Women’s Network, its Affiliates or its Subprocessors maintain data processing operations. Woven Women’s Network shall at all times provide an adequate level of protection for the Personal Data processed, in accordance with the requirements of Data Protection Laws.

11. Return or Deletion of Data

Upon termination or expiration of the Agreement, Woven Women’s Network shall (at Customer's election) delete or return to Customer all Personal Data (including copies) in its possession or control, save that this requirement shall not apply to the extent Woven Women’s Network is required by applicable law to retain some or all of the Personal Data.

12. Audits and Inspections

Woven Women’s Network shall allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, provided that such audits are conducted no more than once per year, during regular business hours, and with reasonable prior notice.

13. Limitation of Liability

Each party's and all of its Affiliates' liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Authorized Affiliates and Woven Women’s Network, whether in contract, tort or under any other theory of liability, is subject to the 'Limitation of Liability' section of the Agreement.

14. Term and Termination

This DPA shall remain in effect until, and automatically expire upon, deletion of all Personal Data by Woven Women’s Network as described in this DPA.

15. Governing Law and Jurisdiction

Without prejudice to clauses of the SCCs, this DPA and any dispute or claim arising out of or in connection with it or its subject matter or formation shall be governed by, and construed in accordance with, the laws and jurisdiction stipulated in the Agreement.

16. Changes to this DPA

Woven Women’s Network may modify this DPA from time to time as required by applicable law or to reflect changes in its processing activities. Woven Women’s Network will provide reasonable notice of any material changes to this DPA.

17. General Provisions

In the event of any conflict or inconsistency between this DPA and the Agreement, this DPA shall prevail. If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

Appendix A: Details of Processing

Nature and Purpose of Processing

Woven Women’s Network will Process Personal Data as necessary to perform the Services pursuant to the Agreement, and as further instructed by Customer in its use of the Services.

Duration of Processing

Subject to Section 11 of the DPA, Woven Women’s Network will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

Categories of Data Subjects

Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects:

  • Prospects, customers, business partners and vendors of Customer (who are natural persons)

  • Employees or contact persons of Customer's prospects, customers, business partners and vendors

  • Employees, agents, advisors, freelancers of Customer (who are natural persons)

  • Customer's Users authorized by Customer to use the Services

Type of Personal Data

Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to the following categories of Personal Data:

  • First and last name

  • Title

  • Position

  • Employer

  • Contact information (company, email, phone, physical business address)

  • ID data

  • Professional life data

  • Personal life data

  • Connection data

  • Localization data

Appendix B: Security Measures

Woven Women’s Network will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the Services, as described in the Security Documentation applicable to the specific Services purchased by Customer.

Woven Women’s Network will not materially decrease the overall security of the Services during a subscription term.

  • Access Control: Preventing unauthorized persons from gaining access to data processing systems.

  • Data Media Control: Preventing unauthorized reading, copying, alteration or removal of data media.

  • Data Memory Control: Preventing unauthorized data input as well as unauthorized reading, alteration or deletion of stored personal data.

  • User Control: Preventing data processing systems from being used by unauthorized persons by means of data transmission facilities.

  • Access to Data: Ensuring that persons entitled to use a data processing system gain access only to such personal data in accordance with their access rights.

Appendix C: Standard Contractual Clauses (SCCs)

For data transfers from the European Economic Area, Switzerland, or the United Kingdom to countries which do not ensure an adequate level of data protection, the Standard Contractual Clauses (Module Two: Transfer controller to processor) shall apply.

The parties agree that the SCCs are incorporated by reference into this DPA and shall be deemed completed as follows:

  • Clause 7 (Docking clause) shall apply.

  • Clause 9 (Use of sub-processors): Option 2 (General written authorization) shall apply.

  • Clause 11 (Data subject rights): The optional language shall not apply.

  • Clause 17 (Governing law): Option 1 shall apply, and the governing law shall be the law of the Republic of Ireland.

  • Clause 18 (Choice of forum and jurisdiction): The courts of the Republic of Ireland shall have jurisdiction.