Data Processing Addendum

• Fabrixa B.V. · Markerkant 13 10, 1314 AN Almere, the Netherlands · KvK 74188445 · Version 1.0, effective 22 October 2026

1. Scope and parties

1.1 This Data Processing Addendum (“DPA”) forms part of the Fabrixa Terms of Service (the “Terms”) between Fabrixa B.V. (“Fabrixa”) and the business customer that holds a Fabrixa account (“Customer”). It applies whenever Fabrixa processes personal data on Customer’s behalf in providing the Services.

1.2 For End Customer data (recipient names, delivery addresses, contact details and any personal data in artwork or order notes) Customer is the controller, or a processor acting for its own clients, and Fabrixa is the processor or sub-processor. Where Customer itself acts as a processor, Customer warrants that its controller has authorised Fabrixa’s engagement and the terms of this DPA.

1.3 For Customer’s own account, billing, support and usage data Fabrixa is an independent controller; that processing is described in the Privacy Policy, not in this DPA.

1.4 Acceptance. This DPA is accepted electronically by accepting the Terms. On request, Fabrixa provides a countersigned copy for Customer’s records; the signed copy has the same content and does not change the effective date.

2. Details of processing

2.1 Subject matter, duration, nature, purpose, categories of data and data subjects are set out in Annex 1. Processing lasts as long as Customer uses the Services, plus the deletion period in clause 10.

3. Customer’s instructions

3.1 Fabrixa processes personal data only on Customer’s documented instructions, including with regard to transfers to a third country, unless required to do so by EU or Member State law; in that case Fabrixa informs Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2 Customer’s instructions are: the Terms, this DPA, the orders, settings and API calls Customer submits through the platform, and written instructions sent to Fabrixa’s support channel. Fabrixa may charge for instructions that go beyond the Services.

3.3 Fabrixa informs Customer without delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection law. Fabrixa may suspend the instruction until Customer confirms or amends it.

3.4 Customer is responsible for the lawfulness of the personal data it provides, for the information it gives to End Customers, and for not submitting special categories of data (Article 9 GDPR) or data of children in artwork or order notes.

4. Confidentiality

4.1 Fabrixa ensures that every person it authorises to process personal data — staff, contractors and the engineering partner — is bound by a contractual or statutory duty of confidentiality and processes the data only as needed for their tasks.

5. Security

5.1 Fabrixa implements and maintains the technical and organisational measures in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks for data subjects (Article 32 GDPR). Fabrixa may update Annex 2 provided the overall level of protection does not decrease.

6. Sub-processors

6.1 General authorisation. Customer gives Fabrixa general written authorisation to engage sub-processors for the processing described in Annex 1.

6.2 Current list. The sub-processors engaged at the effective date are listed at https://www.fabrixa.com/sub-processors/ (Annex 3 refers to that list). The list states, for each sub-processor, the service, the location of processing and the transfer mechanism.

6.3 Notice of changes. Fabrixa publishes any intended addition or replacement of a sub-processor on that page and e-mails the account owner at least 30 days before the new sub-processor starts processing Customer data. Changes made to protect the Services against an imminent security risk may take effect immediately, with notice given as soon as possible afterwards.

6.4 Right to object. Customer may object in writing to privacy@fabrixa.com within 30 days of the notice, on reasonable, documented data-protection grounds. The parties discuss the objection in good faith. If Fabrixa cannot offer a reasonable alternative within 30 days, Customer may terminate the affected Services, without penalty, by written notice; prepaid wallet balances are refunded pro rata.

6.5 Flow-down. Fabrixa imposes on each sub-processor, by written contract, data-protection obligations that provide at least the level of protection of this DPA, and remains fully liable to Customer for the sub-processor’s performance.

6.6 Production and logistics partners are engaged per order and listed by category and country. On request, and under a confidentiality undertaking, Fabrixa discloses to Customer the name of the partner that processed a specific order.

7. Assistance to Customer

7.1 Data subject requests. Fabrixa forwards any request it receives from an End Customer to Customer within 5 business days and does not respond to it directly, unless Customer instructs otherwise. Fabrixa assists Customer with appropriate technical and organisational measures to answer requests under Chapter III GDPR.

7.2 Fabrixa assists Customer, taking into account the nature of processing and the information available to Fabrixa, with Customer’s obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).

8. Personal data breach

8.1 Fabrixa notifies Customer without undue delay, and in any event within 48 hours after becoming aware of a personal data breach affecting Customer data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases.

8.2 Fabrixa does not notify End Customers or supervisory authorities on Customer’s behalf unless Customer instructs it to or the law requires it.

9. International transfers

9.1 Fabrixa processes Customer data in the European Economic Area. Transfers to a third country take place only with the safeguards of Chapter V GDPR: an adequacy decision, or the Standard Contractual Clauses (Commission Decision (EU) 2021/914) with supplementary measures where needed. The transfer mechanism per sub-processor is stated in the sub-processor list.

10. Deletion and return

10.1 At the end of the Services, or on Customer’s written request, Fabrixa deletes Customer data within 30 days, unless EU or Member State law requires further storage. Invoices and the order records needed for tax purposes are kept for 7 years under Dutch law; dispute and claim records for the applicable limitation period. Data under a legal retention duty stays blocked for any other use.

10.2 Before deletion, Customer can export order data through the platform and the API. Fabrixa provides reasonable assistance with other export formats at its standard rates.

11. Audits and information

11.1 Fabrixa makes available to Customer all information necessary to demonstrate compliance with Article 28 GDPR: this DPA, the sub-processor list, Annex 2, and on request a completed security questionnaire and the most recent third-party reports or certifications of its hosting providers.

11.2 Where that information is reasonably insufficient, Customer or an independent auditor bound by confidentiality may audit Fabrixa’s relevant processing activities once per 12 months, on 30 days’ written notice, during business hours, without disrupting operations, at Customer’s cost. Audits required by a supervisory authority, or following a personal data breach, are not limited in frequency. Audits do not extend to other customers’ data or to production partners’ premises; for those, Fabrixa relies on contractual assurances and its own supplier checks.

12. General

12.1 Liability under this DPA follows clause 13 of the Terms.

12.2 Where this DPA conflicts with the Terms on a data protection matter, this DPA prevails. Where the Standard Contractual Clauses apply to a transfer, they prevail over this DPA.

12.3 Fabrixa may update this DPA to reflect changes in law or in the Services; material changes are announced in the same way as sub-processor changes (clause 6.3). Continued use of the Services after the effective date constitutes acceptance.

12.4 This DPA is concluded in English. Translations on the website are provided for convenience; the English version prevails. Governing law and courts follow clause 16 of the Terms (the Netherlands; Amsterdam).

12.5 Contact for this DPA, notices and data-protection questions: privacy@fabrixa.com.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

Annex 3 — Sub-processors

The current list is maintained at https://www.fabrixa.com/sub-processors/ and forms part of this DPA as it stands at the effective date; later changes follow clause 6.