Data processing agreement

Last updated: 2026-10-26

Version 1.1

Prepared by: RYSI Labs Pty Ltd | ABN 99 692 790 435

DATA CONTROLLER (Hub Administrator): the business or individual who subscribes to Fanzava and operates a Hub	DATA PROCESSOR (Fanzava / RYSI Labs): RYSI Labs Pty Ltd, trading as Fanzava, ABN 99 692 790 435

Questions? privacy@fanzava.com

Preamble

This Data Processing Agreement (“DPA”) is entered into between the Hub Administrator identified in the Fanzava subscription agreement (the “Controller”) and RYSI Labs Pty Ltd (ABN 99 692 790 435), trading as Fanzava, of 228A St Vincent Street, Port Adelaide SA 5015, Australia (the “Processor”).

This DPA supplements and forms part of the Fanzava Platform Terms of Use (available at fanzava.com/legal/terms) and the Fanzava Privacy Policy (available at fanzava.com/legal/privacy). In the event of any conflict between this DPA and the Platform Terms of Use on matters of data protection, this DPA shall prevail.

This DPA applies where the Processor processes Personal Data on behalf of the Controller in connection with the provision of the Fanzava platform and related services (“Services”).

Governing frameworks: This DPA is designed to satisfy the requirements of (a) the EU General Data Protection Regulation 2016/679 (“GDPR”), (b) the UK General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”), (c) the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APP”), and (d) other applicable data protection legislation in jurisdictions where the Services are offered. Controller acknowledges that compliance with this DPA does not guarantee compliance with all applicable laws, and Controller remains responsible for its own legal obligations.

1. Definitions

In this DPA, the following terms have the meanings set out below. Terms not defined here have the meanings given in the GDPR, UK GDPR, or applicable data protection law.

Term	Definition
Applicable Data Protection Law	Any law or regulation applicable to the processing of Personal Data under this DPA, including without limitation the GDPR, UK GDPR, Australian Privacy Act 1988 (Cth), and any implementing, successor, or supplementary legislation.
Controller	The Hub Administrator who determines the purposes and means of processing Personal Data. In the GDPR context, the Controller is the “data controller”; under the Australian Privacy Act, the Controller is the “APP entity” responsible for the personal information.
Data Breach	A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
Data Subject	An identified or identifiable natural person to whom Personal Data relates, including Hub Participants and other individuals whose Personal Data is processed through the Services.
EEA	The European Economic Area.
Hub	A branded instance of the Fanzava platform operated by a Hub Administrator under a Fanzava subscription.
Hub Administrator	A business or individual who subscribes to Fanzava and creates and manages a Hub, including its participants, competitions, and settings.
Hub Participant / Tipper	An end user who registers with a Hub to participate in tipping competitions or other features of the Fanzava platform.
Personal Data	Any information relating to an identified or identifiable natural person; in the Australian context, “personal information” as defined in the Privacy Act 1988 (Cth).
Processing	Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
Processor	RYSI Labs Pty Ltd, trading as Fanzava, which processes Personal Data on behalf of the Controller.
Restricted Transfer	A transfer of Personal Data to a country or territory that does not provide an adequate level of protection for Personal Data, as determined under Applicable Data Protection Law.
SCCs	Standard Contractual Clauses for the transfer of personal data to third countries issued by the European Commission (Decision 2021/914) or the UK International Data Transfer Agreement or Addendum, as applicable.
Services	The Fanzava multi-tenant sports tipping, bracket, and fantasy platform and all associated features, application programming interfaces (APIs), integrations, and support services provided by the Processor.
Sub-Processor	Any third-party entity engaged by the Processor to process Personal Data on behalf of the Processor in connection with the Services.
Supervisory Authority	The relevant regulatory authority with jurisdiction over data protection matters, including the Office of the Australian Information Commissioner (OAIC), the Irish Data Protection Commission (DPC), the UK Information Commissioner’s Office (ICO), or any other applicable authority.

2. Subject Matter, Duration, and Termination

2.1 Subject Matter. The Processor shall process Personal Data on behalf of the Controller for the purpose of providing the Services as described in Schedule 1 (Processing Activities).

2.2 Duration. This DPA commences on the date the Controller accepts the Platform Terms of Use and remains in force for the duration of the Services subscription. This DPA will automatically renew upon each renewal of the Services subscription.

2.3 Termination. This DPA terminates upon the earlier of (a) termination or expiry of the Services subscription, or (b) written agreement of the parties. Termination of this DPA does not affect any obligations that have already accrued.

2.4 Effect of Termination. Upon termination of this DPA, the Processor shall, at the Controller’s choice and subject to Section 14 (Data Return and Deletion), either return or securely delete all Personal Data processed on the Controller’s behalf, subject to any retention obligations imposed by applicable law.

3. Roles and Responsibilities

3.1 Controller’s Role. The Controller is the data controller in respect of Personal Data collected from Hub Participants and other individuals in connection with the Controller’s use of the Services. The Controller is responsible for:

Ensuring it has a lawful basis for processing Personal Data and for instructing the Processor to process Personal Data on its behalf;
Providing all required notices to Data Subjects and obtaining all necessary consents;
Ensuring the accuracy, adequacy, and relevance of Personal Data submitted to the Services;
Configuring the Services appropriately for the Controller’s particular use case and legal obligations;
Exercising any rights granted to Data Subjects under Applicable Data Protection Law and fulfilling any associated obligations;
Ensuring that any transfer of Personal Data to the Processor complies with Applicable Data Protection Law.

3.2 Processor’s Role. The Processor is a data processor in respect of Personal Data processed on behalf of the Controller. The Processor shall process Personal Data only on documented instructions from the Controller, except where required to do so by applicable law. Where the Processor is required by law to process Personal Data for a purpose other than as instructed by the Controller, the Processor shall notify the Controller before that processing, unless prohibited by law.

3.3 Independent Controller Processing. Notwithstanding the above, the Processor may process certain Personal Data as an independent data controller for its own purposes, including: (a) managing the subscription relationship with Hub Administrators; (b) billing and management of Hub Administrator accounts; (c) platform security and fraud prevention; (d) product analytics and service improvement; (e) compliance with applicable law; and (f) on Free Hubs, all participant data, as described in section 1.3 of the Fanzava Privacy Policy. Such processing is governed by the Fanzava Privacy Policy and not this DPA. On Free Hubs the Processor processes no participant Personal Data on the Hub Administrator’s behalf. On paid Hubs, participant accounts and competition data are Personal Data processed on the Controller’s behalf under this DPA.

4. Controller’s Instructions

4.1 Compliance with Instructions. The Processor shall process Personal Data only in accordance with the Controller’s documented instructions. This DPA and the Platform Terms of Use together constitute the Controller’s documented instructions as of the effective date.

4.2 Additional Instructions. The Controller may provide additional instructions via the platform settings and administrative tools made available by the Processor, or by written notice to privacy@fanzava.com. The Processor shall acknowledge and act on such instructions within a reasonable time.

4.3 Instructions Outside Scope. If the Processor considers that an instruction from the Controller would infringe Applicable Data Protection Law, the Processor shall promptly notify the Controller. In such circumstances, the Processor is entitled to refuse to carry out the instruction without being in breach of this DPA.

4.4 Processor’s Compliance Obligations. The Processor shall inform the Controller if, in its reasonable opinion, an instruction would result in processing that violates Applicable Data Protection Law, and shall not implement such an instruction pending clarification.

5. Lawfulness of Processing

The Controller warrants that it has, and will continue to have throughout the term of this DPA, appropriate and sufficient legal bases for all processing of Personal Data instructed to the Processor. The Processor processes Personal Data solely on the Controller’s behalf and in reliance on the Controller’s warranty that such processing is lawful. The Processor shall not be liable for any processing carried out in accordance with the Controller’s instructions that is subsequently determined to have lacked an appropriate legal basis.

6. Confidentiality

6.1 Personnel Obligations. The Processor shall ensure that all personnel authorised to process Personal Data: (a) are subject to a binding obligation of confidentiality with respect to such Personal Data; (b) process Personal Data only as necessary for their role; and (c) have received appropriate training on data protection obligations.

6.2 Processor’s Confidentiality Obligation. The Processor shall treat all Personal Data it processes on behalf of the Controller as strictly confidential and shall not disclose it to any third party except as permitted under this DPA, with the Controller’s prior written consent, or as required by applicable law.

7. Security Measures

7.1 Technical and Organisational Measures. The Processor shall implement and maintain appropriate technical and organisational measures (“TOMs”) to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction, or damage, having regard to: (a) the state of the art; (b) the costs of implementation; (c) the nature, scope, context, and purposes of processing; and (d) the risks to the rights and freedoms of Data Subjects.

7.2 Measures in Schedule 2. The current security measures implemented by the Processor are set out in Schedule 2. The Processor may update these measures over time provided that the overall level of protection is not materially reduced.

7.3 Controller’s Access Controls. The Controller is responsible for the security of any credentials used to access the Processor’s administrative interfaces, and for configuring access permissions for its Hub Participants and administrators.

8. Sub-Processors

8.1 General Authorisation. The Controller grants the Processor general written authorisation to engage the Sub-Processors listed in Schedule 3 (Approved Sub-Processors).

8.2 New or Replacement Sub-Processors. The Processor shall notify the Controller at least 30 days in advance of any intended changes to its Sub-Processor list (whether additions or replacements) by updating the sub-processor list in section 4 of the Fanzava Privacy Policy and providing notice via the platform dashboard or email to the Hub Administrator’s registered address. The Controller may object to the proposed change in writing within 30 days of the notice. If the Controller objects and the Processor cannot reasonably accommodate the objection, either party may terminate the affected Services on 30 days’ written notice without liability.

8.3 Sub-Processor Obligations. The Processor shall impose data protection obligations on each Sub-Processor that are no less protective than those set out in this DPA. The Processor remains liable to the Controller for the performance of each Sub-Processor’s obligations under this DPA.

9. Data Subject Rights

9.1 Assistance. The Processor shall assist the Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, and objection. Such assistance shall be provided to the extent technically feasible and at the Controller’s cost for requests requiring substantial manual effort.

9.2 Forwarding Requests. If the Processor receives a request directly from a Data Subject exercising a right under Applicable Data Protection Law in relation to Personal Data processed on behalf of the Controller, the Processor shall promptly forward the request to the Controller and shall not respond to the Data Subject directly (except to acknowledge receipt or to inform the Data Subject that the Controller is responsible).

9.3 Platform Tools. The Processor shall make available appropriate technical tools within the platform to enable the Controller to fulfil common Data Subject requests, including participant data export, account deletion, and data correction.

10. Data Breach Notification

10.1 Notification Obligation. The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a confirmed Data Breach affecting Personal Data processed on the Controller’s behalf.

10.2 Content of Notification. Notification shall, to the extent available at the time of notification, include:

A description of the nature of the Data Breach, including where possible the categories and approximate number of Data Subjects concerned and the categories and approximate number of records concerned;
The name and contact details of the data protection contact or other relevant contact point where more information can be obtained;
A description of the likely consequences of the Data Breach;
A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its possible adverse effects.

10.3 Phased Notification. Where information is not available at the time of initial notification, the Processor may provide information in phases without undue further delay.

10.4 Controller’s Reporting Obligations. The Controller is solely responsible for determining whether a Data Breach must be reported to a Supervisory Authority or notified to affected Data Subjects under Applicable Data Protection Law. The Processor shall assist the Controller in making such determinations and in preparing any required notifications.

10.5 Incident Log. The Processor shall maintain a log of all confirmed Data Breaches affecting Personal Data processed on behalf of Controllers, including those that do not require notification, and shall make this log available to the Controller on request.

11. Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller in conducting data protection impact assessments (“DPIAs”) and prior consultations with Supervisory Authorities where required by Applicable Data Protection Law. Such assistance shall be provided within a reasonable time and at the Controller’s cost for requests requiring substantial manual effort. The Processor shall maintain sufficient documentation to enable it to provide such assistance, including records of the TOMs described in Schedule 2.

12. Records of Processing Activities

The Processor shall maintain records of processing activities carried out on behalf of the Controller as required by Article 30(2) GDPR and equivalent provisions of Applicable Data Protection Law. Such records shall be made available to the Controller on reasonable request.

13. Audit Rights

13.1 Documentation. The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. The Processor shall promptly notify the Controller if, in its opinion, any instruction or request would violate Applicable Data Protection Law.

13.2 Audit. The Controller may conduct audits of the Processor’s processing activities and security measures at most once per calendar year, subject to: (a) providing at least 30 days’ written notice; (b) conducting any audit during normal business hours; (c) taking all reasonable steps to avoid disruption to the Processor’s business; and (d) bearing the costs of such audit. Alternatively, the Controller may request that the Processor provide an audit report prepared by an independent third party, and the Processor shall use reasonable endeavours to comply.

13.3 Certifications and Reports. In lieu of an audit, the Processor may provide relevant third-party audit reports or certifications as evidence of compliance, including the SOC 2 Type II reports and ISO 27001 certifications held by its infrastructure sub-processors. The Processor operates its own information security controls consistent with SOC 2 and ISO 27001, with formal certification of the Processor on its compliance roadmap; the Processor does not represent that it currently holds SOC 2 Type II or ISO 27001 certification in its own name. The Controller acknowledges that the certifications and reports made available under this Section may satisfy its audit obligations under this Section.

14. Data Return and Deletion

14.1 Controller’s choice at the end of the subscription. When the Services subscription ends, the Controller may choose to: (a) export Personal Data in a machine-readable format using the platform’s data export tools; (b) have all Personal Data processed on its behalf deleted, with written confirmation; or (c) move the Hub to the Free plan.

14.2 Default and deletion timeline. If the Controller makes no choice within 30 days, the Hub moves to the Free plan. From that point the Processor holds participant data as an independent controller under the Fanzava Privacy Policy (section 1.3), and this DPA no longer applies to it. If the Controller chooses deletion, the Processor shall securely delete the Personal Data processed on the Controller’s behalf within 90 days, except where retention is required by applicable law. For Enterprise subscriptions, the default is deletion unless the Order Form states otherwise.

14.3 Residual Copies. The Processor may retain residual copies of Personal Data in its point-in-time-recovery backups for a period not exceeding 14 days following deletion, after which they age out. Such copies shall not be used for any purpose other than restoration in the event of system failure, and shall be subject to the security measures and confidentiality obligations in this DPA.

14.4 Anonymised Data. The Processor may retain anonymised or aggregated data derived from Personal Data where such data cannot reasonably be used to identify any individual, and may use such data for platform analytics, product improvement, and statistical purposes.

15. International Data Transfers

15.1 Transfer Restrictions. The Processor shall not transfer Personal Data to a third country or international organisation outside the EEA, UK, or Australia unless: (a) the transfer is to a country with an adequacy decision; (b) the transfer is subject to appropriate safeguards as set out in Applicable Data Protection Law (including SCCs or the UK IDTA); or (c) a derogation under Article 49 GDPR or equivalent provision applies.

15.2 SCCs and Transfer Mechanisms. Where Personal Data originating in the EEA or UK is transferred to a country without an adequacy decision, the parties shall rely on the relevant SCCs or equivalent transfer mechanism as set out in Schedule 4. The Controller authorises the Processor to enter into SCCs with Sub-Processors on the Controller’s behalf where necessary to facilitate the provision of the Services.

15.3 Data Residency. The Processor operates the Platform in regional cells in Australia (Sydney), the European Union (Frankfurt), and the United States. Each Hub is placed in one cell, and that Hub’s participant accounts, competition data, and related records are stored in that cell’s database. The Processor places each Hub in the nearest cell when the Hub is created; Enterprise customers can choose their cell. The Platform is delivered through Cloudflare’s global network, and some Sub-Processors listed in Schedule 3 process Personal Data outside the Hub’s cell, as shown in that Schedule. Some operational data, such as cached content, short-lived files, and participant list exports, is held in Cloudflare’s key-value storage, which is replicated across Cloudflare’s global network rather than kept in the Hub’s cell. Data residency is described further in the Processor’s security documentation.

15.4 Australian Transfers. Where Personal Data of Australian residents is transferred outside Australia, the Processor shall take reasonable steps to ensure that the overseas recipient handles the Personal Data in accordance with the Australian Privacy Principles or a similar standard, as required by Australian Privacy Principle 8.

16. Cooperation with Supervisory Authorities

The Processor shall cooperate, at the Controller’s reasonable request and cost, with any Supervisory Authority in connection with the Controller’s processing activities. The Processor shall promptly inform the Controller if it receives any inquiry, request, or order from a Supervisory Authority relating to the processing of Personal Data on the Controller’s behalf.

17. Liability

17.1 Allocation. Each party is liable to the other for any damage suffered by the other party as a result of that party’s failure to comply with its obligations under this DPA and Applicable Data Protection Law.

17.2 Processor’s Liability. The Processor shall only be liable for damage caused by processing to the extent that it has not complied with its obligations under this DPA, or where it has acted outside or contrary to the Controller’s lawful instructions.

17.3 Exclusion of Liability. The Processor shall not be liable for damage caused by processing where it can demonstrate that it is not in any way responsible for the event giving rise to the damage.

17.4 Cap on Liability. The Processor’s aggregate liability to the Controller under or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed two times (2x) the total fees paid by the Controller to the Processor in the 12 months preceding the event giving rise to the claim. This limitation does not apply to liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be limited by applicable law.

18. Indemnity

The Controller shall indemnify and hold harmless the Processor and its affiliates, officers, employees, and agents from and against any claims, losses, damages, costs (including legal costs on a solicitor-client basis), fines, penalties, and expenses arising from: (a) the Controller’s failure to comply with its obligations as a data controller under Applicable Data Protection Law; (b) the Controller’s instructions that caused the Processor to violate Applicable Data Protection Law; or (c) any inaccurate, misleading, or unlawfully obtained Personal Data provided to the Processor by the Controller.

19. General Provisions

19.1 Governing Law and Jurisdiction. This DPA is governed by the laws of South Australia, Australia. Each party irrevocably submits to the exclusive jurisdiction of the courts of South Australia for the resolution of disputes arising under this DPA, without prejudice to the right of either party to seek injunctive or other urgent relief in any court of competent jurisdiction.

19.2 Entire Agreement. This DPA (including its Schedules), together with the Platform Terms of Use, constitutes the entire agreement between the parties with respect to the processing of Personal Data in connection with the Services, and supersedes all prior agreements, representations, and understandings on that subject.

19.3 Precedence. In the event of any inconsistency between this DPA and the Platform Terms of Use on matters of data protection, this DPA shall prevail.

19.4 Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

19.5 Amendments. The Processor may amend this DPA to reflect changes in Applicable Data Protection Law, Sub-Processors, or platform features by providing 30 days’ notice to the Controller. If an amendment materially reduces the Controller’s rights, the Controller may terminate the subscription on 30 days’ written notice without penalty. Continued use of the Services after the effective date of an amendment constitutes acceptance.

19.6 No Waiver. Failure to exercise or delay in exercising any right under this DPA shall not constitute a waiver of that right.

19.7 Assignment. The Controller may not assign its rights or obligations under this DPA without the Processor’s prior written consent. The Processor may assign this DPA in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided it gives the Controller reasonable prior notice and the assignee assumes all obligations under this DPA.

19.8 Contact Details. All notices and communications under this DPA shall be addressed to:

Controller (Hub Administrator): as specified in the Fanzava account registration details	Processor (Fanzava): RYSI Labs Pty Ltd, 228A St Vincent Street, Port Adelaide SA 5015. Email: privacy@fanzava.com

Schedule 1: Processing Activities

This Schedule sets out the details of the processing activities carried out by the Processor on behalf of the Controller.

Element	Details
Subject matter of processing	Provision of the Fanzava multi-tenant sports tipping, bracket, and fantasy competition platform and associated features including leaderboards, group management, white-label branding, email engagement, and analytics.
Duration of processing	For the duration of the Controller’s subscription to the Services and for such period thereafter as is necessary to fulfil data retention or deletion obligations under this DPA.
Nature of processing	Collection, storage, organisation, retrieval, use, disclosure to authorised personnel, and deletion of Personal Data as necessary to operate and improve the Services.
Purpose of processing	To enable the Controller to operate branded tipping competitions for its Hub Participants; to deliver email communications on the Controller’s behalf; to provide leaderboards, group features, and analytics; and to administer the subscription relationship.
Categories of Personal Data	Identity data (name, username, display name); contact data (email address); account data (password hash, authentication tokens, profile settings, notification preferences); behavioural data (tips submitted, competition results, streak data, login history); device and technical data (IP address and user agent, held in identified form for the periods stated in the Privacy Policy and then shredded or anonymised; device identifiers); communications data (email engagement metrics); financial data relating to Hub Administrators (billing name, address, Stripe customer identifier, and not full payment card numbers).
Special categories of Personal Data	None intended. The Controller must not submit or instruct the Processor to process special categories of Personal Data (Article 9 GDPR) through the Services without prior written agreement.
Categories of Data Subjects	Hub Participants (tippers) who register with a Hub; Hub Administrators and their nominated account users; any other individuals whose Personal Data is submitted to the Services by the Controller.
Recipients of Personal Data	Authorised Fanzava personnel; Sub-Processors listed in Schedule 3; Supervisory Authorities and law enforcement where required by law.

Schedule 2: Technical and Organisational Security Measures

The Processor maintains the following technical and organisational measures. These measures are reviewed and updated regularly; the Processor will notify the Controller of any material changes that reduce the overall level of protection.

A. Infrastructure and Hosting

The Services run on Cloudflare’s global edge network (Cloudflare Workers for compute, R2 for object storage, KV, Durable Objects, and Queues for edge state, and Analytics Engine for analytics and monitoring), with Neon PostgreSQL as the primary transactional database accessed via Cloudflare Hyperdrive.
The Processor’s infrastructure sub-processors maintain recognised certifications, including SOC 2 Type II and ISO 27001, as set out in Schedule 3.
All data at rest is encrypted using AES-256.
All data in transit is encrypted using Transport Layer Security (TLS) 1.3. TLS 1.0 and 1.1 are not accepted, and HTTP Strict Transport Security (HSTS) is preloaded.
Passwords are hashed using Argon2id and are never stored, transmitted, or logged in plaintext.
Session tokens are signed using RS256, with signing keys rotated every 90 days.
Backups are encrypted with keys separate from production data and held within a distinct security boundary.
Data residency: the Processor operates regional cells in Australia (Sydney), the European Union (Frankfurt), and the United States. Each Hub’s participant accounts, competition data, and related records are stored in its cell’s database; Enterprise customers choose their cell and other Hubs are placed by the Processor. Delivery is through Cloudflare’s global network, and Sub-Processors that process data outside the cell are identified in Schedule 3. Query-result caching between the Platform and its databases (Cloudflare Hyperdrive) is disabled in every cell. Some operational data is held in Cloudflare’s key-value storage, which is replicated globally and is not pinned to the cell.

B. Tenant Isolation

Every request carries a hub identifier context that is validated by Cloudflare Worker middleware before any database query executes.
Database queries are filtered by hub identifier at the object-relational mapping layer, so that a query in one hub cannot return data belonging to another hub.
Groups within a hub are further isolated by hub ownership and membership checks.
Participant accounts are scoped to a single Hub. A person who joins two Hubs holds two separate accounts, with separate credentials, settings, and multi-factor authentication, and no account record is shared or linked between Hubs. Administrative actions in one Hub, such as a multi-factor authentication reset, affect only the account in that Hub.

C. Access Controls

Access to production systems is restricted to authorised personnel on a need-to-know basis, with least-privilege role-based access control (RBAC) enforced across the platform and infrastructure.
Multi-factor authentication is mandatory for all Processor personnel with any production access.
Staff access to customer data is limited to authorised personnel and used only for support, incident response, or to meet legal obligations.

D. Application and Edge Security

A single Cloudflare Worker acts as the enforcement point for authentication, authorisation, input validation, rate limiting, and response hardening on every request.
A strict Content Security Policy (CSP) with per-request nonces is enforced on all web interfaces, together with a full set of security headers.
Cloudflare’s Web Application Firewall (WAF), running the OWASP Core Rule Set, executes ahead of the Worker to block common attack patterns.
API request bodies and path parameters are validated against Zod schemas.
Rate limiting is enforced on authentication, password reset, and write endpoints.
Authentication is handled by Better Auth for default methods (email and password, magic link, and Google OAuth) and by the Processor’s own single sign-on service for Enterprise customers (SAML 2.0, OpenID Connect, and OAuth 2.0 with PKCE). Time-based one-time password (TOTP) multi-factor authentication is available on all methods.
Dependency vulnerability scanning is conducted on every deployment, and every change passes automated code review and a mandatory lint, type-check and test gate before release.
Accessibility: the Processor targets Web Content Accessibility Guidelines (WCAG) 2.1 AA conformance across customer-facing interfaces.

E. Monitoring and Incident Response

Security-relevant events are monitored continuously via Cloudflare Analytics Engine, and application errors and performance are monitored via Sentry.
The Processor maintains an incident response process, with notification timelines consistent with Section 10 of this DPA.
Independent third-party penetration testing is on the Processor’s compliance roadmap.

F. Organisational Measures

Personnel with access to Personal Data are made aware of their data protection obligations.
Data protection policies and procedures are reviewed regularly and updated as required.
A designated privacy contact is responsible for data protection compliance (privacy@fanzava.com).
Sub-Processors are subject to due diligence assessments prior to onboarding and periodic reviews thereafter.
Vulnerability reports can be made to security@fanzava.com and are acknowledged promptly.

G. Business Continuity

Backups are continuous through Neon write-ahead-log point-in-time recovery (PITR), retained for 14 days; there is no separate staged backup-scrub process.
Disaster recovery procedures are documented. Specific recovery-time and recovery-point figures are not published.
Redundant infrastructure is maintained to minimise service downtime.

Schedule 3: Approved Sub-Processors

The following Sub-Processors are approved as at the effective date of this DPA. The Processor will update this Schedule, and the sub-processor list in section 4 of the Fanzava Privacy Policy, in accordance with Section 8.2 when Sub-Processors are added or replaced.

This list is derived from the platform’s live service bindings (verified against the codebase, August 2026). Countries reflect where each provider processes data.

Sub-Processor	Country	Purpose	Privacy Policy
Cloudflare, Inc.	USA / Global	Edge compute (Workers), object and edge storage, CDN, DDoS protection, TLS termination, WAF, bot protection (Turnstile), in-app analytics, and AI Round Recap generation (Workers AI, with no external AI provider)	cloudflare.com/privacypolicy
Databricks, Inc. (Neon)	The Hub’s cell: Australia (Sydney), European Union (Frankfurt), or United States	Primary transactional database (PostgreSQL)	databricks.com/legal/privacynotice
Stripe, Inc.	USA / Global	Payment processing and billing for Hub Administrator subscriptions	stripe.com/privacy
Amazon Web Services, Inc. (Simple Email Service)	The Hub’s email zone: Australia, United States, European Union, United Kingdom, or France	Transactional and engagement email delivery	aws.amazon.com/privacy
Expo (Expo Push Service) (from mobile app launch)	USA / Global	Mobile push notification delivery; Apple APNs and Google FCM operate behind Expo as Expo’s sub-processors	expo.dev/privacy
PostHog, Inc.	USA	Product analytics and session replay (typed inputs masked)	posthog.com/privacy
Sentry (Functional Software, Inc.)	USA	Application error and performance monitoring	sentry.io/privacy
Twilio Inc.	USA / Global	Messaging (SMS notifications and verification, where a number is provided)	twilio.com/legal/privacy
Google Chat (Google LLC)	USA / Global	Hub chat and notification integration; carries participant display names	policies.google.com/privacy
Klipy (Kikliko, Inc.)	USA	GIF search within the Banter Board	klipy.com/support/privacy-policy
Sign-in providers: Google, Microsoft	USA / Global	Social sign-in where a Data Subject chooses to use it	respective provider policies

Corporate and marketing business tools that process Hub Administrator and prospect business-contact data (not participant Personal Data) are handled outside this Schedule.

Note: The Processor will update this Schedule when Sub-Processors are added, replaced, or removed. Expo switches on at the launch of the mobile application.

Schedule 4: International Data Transfer Mechanisms

This Schedule sets out the transfer mechanisms relied upon by the Processor where Personal Data is transferred outside the EEA, UK, or Australia.

A. EEA Transfers. For transfers of Personal Data from the EEA to countries without an EU adequacy decision (including the USA), the Processor relies on: the EU Standard Contractual Clauses (SCCs) adopted by European Commission Decision 2021/914 (Module 2: Controller to Processor, and Module 3: Processor to Sub-Processor as applicable); and the adequacy decisions adopted by the European Commission in respect of relevant countries, as updated from time to time.

B. UK Transfers. For transfers of Personal Data from the UK to countries without a UK adequacy decision, the Processor relies on: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs issued by the ICO; and UK adequacy decisions, as updated from time to time.

C. Australian Transfers. For cross-border disclosures of personal information of Australian residents, the Processor takes reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information, as required by Australian Privacy Principle 8.2. Where Sub-Processors have implemented binding corporate rules, signed SCCs, or are located in countries with equivalent privacy frameworks, this standard is considered to be met.

D. Transfer Impact Assessments. On written request, the Processor will provide reasonable information about the safeguards applied to transfers, to help the Controller assess them.

E. Incorporation of SCCs. Where SCCs or the UK IDTA or Addendum are relied upon, those instruments are hereby incorporated into this DPA by reference. In the event of any conflict between the terms of the SCCs or IDTA and this DPA, the SCCs or IDTA shall prevail to the extent required to meet their mandatory requirements.

Schedule 5: Execution

This DPA is accepted by the Controller upon the Controller’s acceptance of the Fanzava Platform Terms of Use. No separate signature is required. However, if the parties wish to execute this DPA by hand, the following execution block may be used.

SIGNED for and on behalf of THE CONTROLLER (Hub Administrator). Signature: __________ Name: __________ Title: __________ Company: __________ Date: __________	SIGNED for and on behalf of RYSI LABS PTY LTD (Fanzava). Signature: __________ Name: __________ Title: __________ Date: __________

By accepting the Platform Terms of Use electronically, the Controller confirms that it has read, understood, and agrees to be bound by this Data Processing Agreement.

Questions: privacy@fanzava.com | fanzava.com/legal/dpa