The current list of subprocessors (Schedule 3) is also at cuehand.com/subprocessors.

CueHand Data Processing Agreement

Version: 1.4
Effective date: The date on which Customer accepts the Terms of Service that expressly incorporate this DPA during CueHand business-account sign-up, or the date of separate written execution if the parties use that method
Last updated: 1 November 2026

This Data Processing Agreement (“DPA”) is a written agreement between Sealed Innovations LLC, a Wyoming limited liability company (“Sealed”, “we” or “Processor”), and the business or other organisation that creates or uses a CueHand business workspace (“Customer” or “you”). This DPA is incorporated into and forms part of CueHand's Terms of Service. Customer accepts it when an authorised representative completes the sign-up acceptance step for those Terms, which expressly identifies and links to this DPA, or when the parties separately execute it in writing. Customer acts as Controller unless it is itself processing the relevant Personal Data on behalf of another Controller, in which case Customer acts as Processor and Sealed acts as its Subprocessor.

This DPA applies when Sealed processes Personal Data on behalf of Customer in providing CueHand. It is intended to satisfy the written processor-contract requirements that apply to that processing, including where applicable Article 28 GDPR and section 30 of Ghana's Data Protection Act, 2012 (Act 843). It does not apply to processing for which Sealed determines its own purposes and means, such as administering Customer user accounts, managing Sealed’s own subscription relationship, securing its services or complying with Sealed’s legal obligations. For that separate processing, Sealed acts as an independent controller as described in the Privacy Policy.

If Customer is a processor acting for another controller, Customer enters into this DPA as processor and Sealed acts as its subprocessor. In that case, Customer is responsible for ensuring that its agreement with the relevant controller authorises the appointment of Sealed and passes down the required obligations.

If this DPA conflicts with the Terms of Service concerning processing of Personal Data on Customer’s behalf, this DPA controls.

1. Definitions

In this DPA:

• “Applicable Data Protection Law” means data protection and privacy laws applicable to the processing under this DPA, including, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Ghana Data Protection Act, 2012 (Act 843), the Kenya Data Protection Act, 2019, and laws replacing or supplementing them.
• “Controller”, “Processor”, “Personal Data”, “Personal Data Breach”, “Processing”, “Data Subject” and “Supervisory Authority” have the meanings given in Applicable Data Protection Law.
• “Customer Personal Data” means Personal Data processed by Sealed on behalf of Customer through the Service.
• “Subprocessor” means a third party appointed by Sealed to process Customer Personal Data to provide or support the Service.
• “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, as amended or replaced.
• “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office, as amended or replaced.

2. Scope and roles

2.1 Customer determines the purposes and essential means of processing Customer Personal Data and acts as Controller, unless Customer is itself acting as a Processor for another Controller.

2.2 Sealed processes Customer Personal Data only to provide, secure, maintain and support CueHand, in accordance with Customer’s documented instructions, this DPA and Applicable Data Protection Law.

2.3 The subject matter, duration, nature and purpose of processing, types of Personal Data and categories of Data Subjects are described in Schedule 1.

2.4 Customer is responsible for: - ensuring that it has a lawful basis for processing and for instructing Sealed to process Customer Personal Data; - providing required privacy notices and obtaining any required consents or permissions; - ensuring that its instructions and use of CueHand comply with Applicable Data Protection Law; - responding to Data Subject requests, except to the extent Sealed is required to assist under this DPA; and - configuring and using the Service in a way that is appropriate to the sensitivity and risks of the data.

2.5 Sealed will not knowingly use Customer Personal Data for targeted advertising, sell it, or use it for purposes unrelated to providing and securing the Service.

3. Customer instructions

3.1 Customer instructs Sealed to process Customer Personal Data, including with regard to transfers of Customer Personal Data to a third country, only as follows: - to provide the features and functions of CueHand requested or used by Customer; - to host, store, retrieve, transmit, display, organise and otherwise process workspace data; - to provide authentication, team access, enquiry forms, review links, event coordination, document storage, exports and related functionality; - to provide customer support and troubleshoot service issues at Customer’s request; - to maintain the security, integrity and availability of the Service; - to prevent spam, fraud, abuse and unauthorised access; and - as otherwise documented in Customer’s use of the Service or subsequent written instructions accepted by Sealed.

3.2 Customer’s use of the Service, workspace settings, support requests and instructions given through the Service constitute documented instructions.

3.3 Sealed will inform Customer if, in Sealed’s reasonable opinion, an instruction infringes Applicable Data Protection Law. Sealed will process Customer Personal Data only on documented instructions, including instructions concerning transfers to a third country or an international organisation, unless Sealed is required to process otherwise by a law to which it is subject. In that case, Sealed will inform Customer of the legal requirement before processing, unless the law prohibits that information on important grounds of public interest. Sealed may suspend the relevant processing while the parties clarify or modify the instruction, where necessary to comply with law.

3.4 Sealed is not required to comply with an instruction that materially changes the Service, creates a security risk, requires processing that Sealed is not equipped to perform, or would require Sealed to violate law. The parties will discuss a reasonable alternative.

4. Confidentiality and personnel

4.1 Sealed will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual, statutory or professional.

4.2 Sealed will limit access to Customer Personal Data to personnel and authorised service providers who need access to provide, secure, maintain or support the Service.

4.3 Sealed will take reasonable steps to ensure that personnel with access to Customer Personal Data receive appropriate data protection and security guidance relevant to their role.

5. Security measures

5.1 Sealed will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data, the risks of processing and the state of the art.

5.2 The measures applicable as at the effective date are described in Schedule 2. Sealed may update or replace measures provided the overall level of protection is not materially reduced.

5.3 Customer is responsible for the security of its own accounts, devices, credentials, workspace membership, user permissions and the information it chooses to upload. Customer must promptly notify Sealed if it suspects unauthorised access to its workspace.

5.4 Customer acknowledges that offline copies may be stored on end-user devices to support event-day functionality. Customer is responsible for securing those devices and managing access to them.

6. Subprocessors

6.1 Customer gives Sealed general authorisation to appoint the Subprocessors listed in Schedule 3 and additional Subprocessors appointed in accordance with this Section.

6.2 Sealed will impose data protection obligations on each Subprocessor that are no less protective, in substance, than the obligations applicable to Sealed under this DPA, to the extent relevant to the service provided.

6.3 Sealed remains responsible to Customer for the performance of its Subprocessors’ data protection obligations, subject to the limitations and exclusions in the Terms of Service and Applicable Data Protection Law.

6.4 Sealed will maintain an up-to-date list of Subprocessors and make it available to Customer through the Service or on request. Sealed will notify Customer of any intended addition or replacement of a Subprocessor at least 14 days before that Subprocessor begins processing Customer Personal Data.

6.5 Customer may object to a new Subprocessor on reasonable data protection grounds by notifying Sealed in writing within 10 business days after notice. The parties will discuss the objection in good faith. If Sealed cannot reasonably avoid the use of the Subprocessor and the parties cannot agree on an alternative, Customer may terminate the affected part of the Service. Sealed will refund the unused prepaid subscription amount for the affected part, as described in the Refund and Cancellation Policy.

7. Assistance with Data Subject rights

7.1 Taking into account the nature of the processing, Sealed will provide reasonable technical and organisational assistance to enable Customer to respond to requests to exercise Data Subject rights, to the extent Customer cannot reasonably fulfil the request using the Service.

7.2 If Sealed receives a request directly from a Data Subject relating to Customer Personal Data, Sealed will, where legally permitted, refer the request to Customer without responding substantively, except to acknowledge receipt or where required by law.

7.3 Sealed may charge reasonable fees for assistance that is manifestly unfounded, excessive or repetitive, or that goes materially beyond the assistance required by Applicable Data Protection Law, provided the charge is lawful and agreed in advance.

8. Personal Data Breaches

8.1 Sealed will notify Customer without undue delay and, in any event, within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. This is a contractual notification target and does not replace any shorter period required by applicable law.

8.2 The notice will, to the extent information is reasonably available at the time, describe: - the nature of the breach, including the categories and approximate number of affected Data Subjects and records; - the likely consequences of the breach; - the measures taken or proposed to address the breach and mitigate possible adverse effects; and - a contact point for follow-up information.

8.3 Sealed may provide information in stages as its investigation progresses. Sealed will take reasonable steps to contain, investigate, mitigate and remediate the breach.

8.4 Customer is responsible for deciding whether a breach must be notified to a Supervisory Authority or Data Subject and for making those notifications within the required legal time limits. Sealed will provide reasonable assistance. This allocation does not prevent or limit any notification that Sealed is independently required to make under Applicable Data Protection Law, including any direct obligation that may apply to a processor or other third party under Ghana’s Data Protection Act, 2012 (Act 843).

8.5 A notice under this Section is not an admission of fault or liability.

9. Data Protection Impact Assessments and consultation

Taking into account the nature of processing and information available to Sealed, Sealed will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities where required by Applicable Data Protection Law. Customer remains responsible for the assessment, decision and any consultation or filing.

10. International transfers and incorporated transfer instruments

10.1 Sealed may process Customer Personal Data in the countries in which Sealed and its Subprocessors operate, as described in the Privacy Policy and Schedules 1 and 3. Customer acknowledges that authorised Sealed personnel may remotely access Customer Personal Data from Ghana, and that hosting in Ireland does not eliminate a restricted transfer arising from access from another country.

10.2 Acceptance and evidence. This DPA is incorporated into CueHand's Terms of Service and is accepted by Customer when an individual authorised to bind Customer completes CueHand's sign-up acceptance step for those Terms. The acceptance screen must clearly state that acceptance includes this DPA and provide a working link to the DPA before the user accepts. Sealed accepts this DPA by making CueHand available on those contractual terms. The electronic record must identify the accepted Terms and DPA versions, the Customer business/workspace, the accepting account and the date and time of acceptance. A general website visit, account use without the required sign-up acceptance record, or a link to the DPA standing alone does not establish acceptance. The parties may also execute a separate written copy or customer-specific transfer appendix where appropriate; separate execution is not required where the incorporated electronic acceptance process has been completed.

10.3 EU Standard Contractual Clauses. Where Customer Personal Data is transferred from the EEA to Sealed or a Subprocessor in a country that does not benefit from an applicable adequacy decision, and the EU GDPR requires Article 46 safeguards, the parties incorporate the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 (“EU SCCs”) as if set out in full, subject to the following selections and completion rules:

• Module Two (Controller to Processor) applies where Customer is the Controller and Sealed is the Processor.
• Module Three (Processor to Processor) applies where Customer is itself a Processor and Sealed is its Subprocessor.
• Clause 7 (docking clause) applies.
• Clause 9(a), Option 2 (general written authorisation) applies. Sealed will give at least 14 days’ notice of an intended addition or replacement of a Subprocessor, as provided in Section 6.
• The optional language in Clause 11(a) does not apply.
• For Clause 13, the competent supervisory authority is the supervisory authority of the EU Member State in which the data exporter is established. Where the data exporter is not established in the EU but is subject to the EU GDPR under Article 3(2) and has appointed an Article 27 representative, the competent supervisory authority is the authority of the Member State in which that representative is established. If the SCCs or the exporter’s circumstances require a different authority, the applicable SCC rule controls.
• Clause 17, Option 1 applies, with the law of Ireland governing the EU SCCs.
• Clause 18(b) applies, with the courts of Ireland resolving disputes under the EU SCCs.
• Annex I, Annex II and Annex III are completed using Schedules 1, 2 and 3 of this DPA and the additional party/contact information provided by Customer at sign-up or in the workspace. If any required information is not available in those schedules or the Customer’s account record, the transfer must not be treated as covered until the information is supplied and the relevant annex is complete.

The EU SCCs apply only to transfers and party roles for which the selected module is legally valid. They do not apply to processing for which Sealed is itself a Controller. They must not be relied on where the SCCs are unavailable or inappropriate, including where the importer is directly subject to the EU GDPR for the relevant processing. The parties must assess the applicable legal position, complete the required annexes and implement any supplementary measures before relying on the SCCs.

10.4 United Kingdom restricted transfers. Where a restricted transfer from the United Kingdom requires an appropriate safeguard, the parties incorporate the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office (the “UK Addendum”), including its mandatory clauses, by reference. The UK Addendum is completed using the information in this DPA and its Schedules, with the relevant EU SCC module selected under Section 10.3. Table 4 (ending the Addendum when the approved Addendum changes) is completed by selecting neither party as the party entitled to end the Addendum solely because the approved Addendum changes, unless the law or a revised official template requires a different selection. The mandatory wording of the UK Addendum is not modified. Where the mandatory clauses are incorporated by reference rather than reproduced in full, the parties also incorporate the ICO-prescribed alternative wording: “Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.” If the UK Addendum cannot lawfully be used for a particular transfer, the parties will use the then-current UK International Data Transfer Agreement or another lawful safeguard, completed before the transfer.

10.5 Switzerland and other jurisdictions. For restricted transfers subject to Swiss law, the EU SCCs apply with the modifications required by the Swiss Federal Act on Data Protection and its implementing ordinance, including references to the Swiss Federal Data Protection and Information Commissioner and Swiss data subjects where required. For transfers subject to another jurisdiction’s transfer rules, the parties will apply the relevant approved transfer mechanism or other lawful safeguard required by that jurisdiction. Nothing in this DPA represents that the EU SCCs or UK Addendum automatically satisfy every country’s transfer requirements.

10.6 Transfer assessments and supplementary measures. The parties will assess the laws and practices of relevant destination countries and implement supplementary technical, contractual or organisational measures where required. Sealed will provide reasonable information within its control to support Customer’s transfer impact assessment or transfer risk assessment. The parties will review the assessment if material changes occur in the transfer, processing, law or access environment.

10.7 Invalidity or change. If a transfer mechanism is invalidated, suspended or no longer available, the parties will work together in good faith to implement another lawful transfer mechanism. Sealed may suspend the affected transfer where required to comply with law. No provision of this DPA authorises a transfer that is prohibited by Applicable Data Protection Law.

11. Return and deletion of Customer Personal Data

11.1 During the subscription and any applicable read-only period, Customer may export workspace data using CueHand's Download everything feature. The export includes structured CSV spreadsheets, JSON records and copies of uploaded workspace files available for export. Large exports may be split into parts.

11.2 Export is available to the workspace owner, including while the workspace is read-only. Generated download links expire after 10 minutes and temporary export archives are deleted after 24 hours. Customer may request a fresh export while the workspace remains eligible for export.

11.3 On termination or expiry, Customer may retrieve its data during the applicable read-only period described in the Terms. Unless the parties agree otherwise or applicable law requires a different period, a read-only workspace is retained for 12 months from the date it becomes read-only, with reminders sent to the workspace owner 60, 30 and 7 days before scheduled deletion.

11.4 After the applicable retrieval/read-only period, Sealed will delete or render inaccessible Customer Personal Data from active systems, subject to legal retention requirements and the technical operation of encrypted backups. Data may remain in encrypted backups until the relevant backup is rotated out under the policy retaining the newest 30 complete backup runs. Backups are not used for ordinary access to deleted workspace data and are retained for recovery purposes.

11.5 If Customer requests earlier deletion, Sealed will initiate deletion in accordance with the Service's account and workspace deletion process, subject to workspace ownership rules, legal obligations, security requirements and the backup-retention process described above.

11.6 On termination, Sealed will, at Customer's choice and subject to applicable law, return or delete Customer Personal Data. Customer is responsible for downloading the export before deletion. This Section does not require Sealed to provide authentication secrets, passwords, login sessions, private access tokens, platform security data, internal service telemetry or information that Sealed is legally required to retain.

11.7 If Sealed is required by law to retain Customer Personal Data after termination, it will inform Customer of the legal requirement where legally permitted and will continue to protect the retained information.

12. Audit and compliance information

12.1 Sealed will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, taking into account the nature of processing and the information available to Sealed.

12.2 Customer may request a written security and data protection questionnaire or other reasonable information. Sealed may satisfy requests by providing existing policies, summaries, certifications, audit reports or other documentation, where available.

12.3 If the information provided is insufficient to demonstrate compliance with this DPA, Customer may request an audit, subject to: - at least 30 days’ prior written notice, except where a competent authority requires otherwise or there has been a substantiated Personal Data Breach; - the audit being conducted during normal business hours and in a manner that does not unreasonably disrupt Sealed’s operations or compromise other customers’ security or confidentiality; - the auditor being independent, suitably qualified and bound by confidentiality obligations; - the audit being limited to systems and records relevant to Customer Personal Data; and - Customer bearing its own audit costs, unless the audit identifies a material breach of this DPA by Sealed.

12.4 The parties will cooperate with a competent Supervisory Authority as required by Applicable Data Protection Law.

13. Customer warranties and obligations

Customer represents and warrants that: - it has provided all required notices and obtained all required rights, permissions and lawful bases for the processing it instructs Sealed to perform; - its instructions to Sealed comply with Applicable Data Protection Law; - it will not use CueHand to process special category, sensitive or criminal-offence data unless the processing is lawful, necessary and supported by appropriate safeguards; and - it will use appropriate access controls and promptly remove access for people who no longer need it.

Customer will not upload payment-card data, bank-account credentials, government identification data, broader medical histories or diagnoses to CueHand. Limited event-related dietary, allergy and accessibility notes are permitted only as described in Schedule 1, Section D, subject to Customer’s legal obligations and access restrictions.

14. Liability

The liability provisions in the Terms of Service apply to this DPA except to the extent they are inconsistent with mandatory liability rules under Applicable Data Protection Law. Nothing in this DPA limits a Data Subject’s rights or a party’s liability to a Data Subject or Supervisory Authority where that liability cannot lawfully be limited.

As between the parties, each party is responsible for the losses caused by its own breach of this DPA and Applicable Data Protection Law, subject to the limitations permitted by law and the Terms of Service.

15. Term and termination

15.1 This DPA takes effect on the date Customer accepts the Terms of Service incorporating it through the process described in Section 10.2, or on the date of separate written execution if that method is used. It continues for as long as Sealed processes Customer Personal Data on Customer’s behalf.

15.2 Termination of the Terms of Service automatically terminates this DPA, except for provisions that by their nature must continue, including confidentiality, deletion, audit rights relating to prior processing, liability and dispute resolution.

15.3 Sections concerning deletion, confidentiality, international transfers, liability and any accrued rights survive termination to the extent necessary to give them effect.

16. Governing law and order of precedence

This DPA is governed by the laws of the State of Wyoming, except that the EU SCCs and UK Addendum are governed by the laws and courts specified in those instruments.

If this DPA conflicts with the Terms of Service concerning processing of Customer Personal Data, this DPA controls. If a provision of this DPA conflicts with a mandatory provision of Applicable Data Protection Law, the mandatory provision applies.

17. Changes to this DPA

17.1 Sealed may update this DPA to reflect changes in the Service, subprocessors, security measures or Applicable Data Protection Law. Sealed will give Customer at least 14 days’ notice of a material change, where reasonably practicable, through the Service or by email.

17.2 If a change is required immediately by law, a Supervisory Authority or a security risk, Sealed may make it effective sooner and will notify Customer as soon as reasonably practicable.

17.3 If Customer reasonably objects to a material change on data protection grounds and the parties cannot resolve the objection, Customer may terminate the affected Service before the change takes effect and receive any refund due under the Refund and Cancellation Policy.

18. Contact

For DPA, privacy and data protection matters:

Sealed Innovations LLC
Email: privacy@cuehand.com
Registered agent address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA (not an operating office)

Schedule 1 — Details of processing

A. Subject matter and duration

Subject matter: provision of the CueHand business software service to Customer, including workspace administration, enquiry and lead management, quotes, event planning and coordination, staff and supplier management, invoices, payment records, client reviews, document and image storage, notifications, data export, support and security.

Duration: for the term of Customer’s use of CueHand and any applicable post-termination read-only, export, retention and deletion period described in the Terms, Refund and Cancellation Policy and Privacy Policy.

B. Nature and purpose of processing

Processing operations may include collection, recording, organisation, structuring, storage, retrieval, consultation, use, disclosure by transmission or display, alignment, restriction, export, deletion and destruction, as required to provide and secure the Service.

C. Categories of Data Subjects

Depending on Customer’s use of CueHand: - Customer’s account holders, owners and team members; - Customer’s prospective and existing clients; - people submitting Customer’s public enquiry forms; - people providing reviews through Customer’s review links; - Customer’s staff, contractors and event crew; - Customer’s suppliers and vendors; and - other individuals whose information Customer chooses to enter into the workspace.

D. Types of Personal Data

Depending on Customer’s use of CueHand: - names and contact details, including email addresses, telephone numbers and business addresses; - account identifiers, workspace membership, role and profile information; - business and client relationship information; - enquiry details, event dates, event requirements and preferences; - quotes, invoices, receipts and payment records, excluding full payment-card numbers and bank-account credentials; - staff, contractor and supplier details and assigned event responsibilities; - review ratings, comments, selected highlights and permission to quote; - documents, images and other content uploaded by Customer; - notification tokens and device/browser information; and - technical metadata associated with use of the Service.

Customer may submit limited event-related dietary, allergy or accessibility notes only where reasonably necessary to plan or deliver an event, the processing is lawful and Customer has provided required notices and obtained required permissions. Such notes may reveal health information or religious beliefs. Customer must not submit broader medical histories, diagnoses, government identification numbers, payment-card data or bank-account credentials unless Sealed has expressly agreed in writing that the relevant feature and safeguards support that processing.

E. Frequency and locations

Processing occurs on a continuous or event-driven basis as Customer and its users use the Service. The database and file storage are hosted in Ireland. Authorised Sealed personnel may remotely access Customer Personal Data from Ghana to operate, secure and support the Service. Service providers may process or access data in the United States and other countries as described in Schedule 3 and the Privacy Policy. This describes data access and processing locations; it does not change Sealed’s legal identity or place of incorporation.

Schedule 2 — Technical and organisational security measures

The measures below describe the controls represented for the Service at the date of this DPA. They are not a guarantee that every control is suitable for every Customer’s risk profile. Sealed may update the measures where the overall level of protection is not materially reduced. Any item expressly identified as requiring implementation or verification is a publication blocker and must not be treated as an implemented control.

1. Encryption in transit: connections to the Service use HTTPS/TLS.
2. Authentication: account authentication is provided through an authentication service; passwords are handled in hashed form rather than stored in plain text by Sealed.
3. Access control: access to workspace data is controlled through authenticated accounts, workspace membership and role-based permissions.
4. Workspace separation: the database has row-level security enabled, with no RLS policies currently relied on for tenant separation. Client-side direct database access is denied by default. Workspace access is enforced in server-side application code using authenticated workspace membership and role-based authorisation. Automated integration tests create separate business workspaces and attempt cross-workspace reads and changes using identifiers belonging to another workspace; the tests expect the other workspace’s records to remain inaccessible and changes not to be saved. These tests run against a local test database as part of pull-request checks. They are not an external penetration test or a production-environment certification.
5. File access: event and lead documents are intended to be stored privately and made available through time-limited signed links. Certain logos and profile images may be publicly addressable to support display in the Service and on documents; Customer should not upload images that it does not want publicly accessible.
6. Production access: access to production systems is restricted to authorised personnel and service accounts that need it for operation and support.
7. Logging and monitoring: relevant technical and application events are recorded to support security, troubleshooting and service operation. Usage analytics events are designed not to include names, email addresses or phone numbers in event properties.
8. Data minimisation: the Service is designed around business operations and does not require full payment-card numbers or bank-account credentials for the payment-recording feature.
9. Deletion: account and workspace deletion processes are provided through the Service, subject to workspace ownership rules and applicable retention requirements.
10. Device-side data: offline event information may be stored on a user’s device to support event-day use. Users are responsible for device security and signing out of shared devices.
11. Subprocessor controls: Sealed uses service providers to host, operate and support the Service and requires appropriate contractual protections from providers acting as subprocessors.
12. Incident response: Sealed will investigate suspected Personal Data Breaches, take reasonable steps to contain and remediate them, and notify affected Customers as required by this DPA and law.
13. Multi-factor authentication: multi-factor authentication is enabled for infrastructure and administrative accounts.
14. Backups and restoration: scheduled backups cover the production database and stored files included in the backup workflow. GitHub Actions runs the workflow on a GitHub-hosted runner. The runner temporarily handles database and file data before the workflow encrypts the backup archives using age and uploads the encrypted objects to a private Cloudflare R2 bucket. The workflow retains the newest 30 complete backup runs; this is a run-count limit, not a fixed 30-day period. Healthchecks.io receives a heartbeat/status ping about the scheduled job; the ping is not intended to contain workspace records or backup contents. Sealed has successfully completed a restore-verification check using the backup verification procedure. That check validated the downloaded archive, checksums, database dumps and stored files and reported the run as restorable; it did not perform a live restoration into a separate production environment. The workflow is not described as end-to-end encrypted throughout the runner stage, and no specific recovery time objective or recovery point objective is promised by this DPA.
15. Encryption at rest: Supabase’s published documentation states that data it stores is encrypted at rest using AES-256 by default. This is a provider-managed control; Sealed does not independently configure that encryption setting or represent that it has independently audited the provider’s implementation. Encryption in transit is described in item 1.

Schedule 3 — Authorised Subprocessors and other service recipients

This Schedule distinguishes (A) providers appointed by Sealed to process Customer Personal Data for CueHand, (B) onward providers used by those providers or by CueHand for delivery, and (C) services that act in their own controller capacity or receive only operational metadata. It is not a representation that every provider listed below receives every category of Customer Personal Data.

Provider legal terms and subprocessor lists can change. Sealed will maintain links to the current provider terms and lists and will update this Schedule when a material change affects the processing described here. The exact contracting entity and account-level agreement must be retained in Sealed’s vendor records.

A. Direct subprocessors used to process Customer Personal Data

B. Onward delivery providers and variable browser infrastructure

These providers may receive data as part of delivery by a provider in Section A or as a result of a user’s choice of browser. They are not all separately appointed by Sealed under a direct processor agreement.

C. Operational services and independent controllers

No Firebase SDK / no third-party analytics: CueHand does not use Firebase Authentication, Analytics, Crashlytics, Firestore or Remote Config. The Android Firebase configuration file is present to enable Expo’s Android push-token integration; CueHand does not directly call FCM. CueHand’s product analytics are first-party records in its own database. No third-party analytics or error-monitoring SDK was identified in the code review.

EU Standard Contractual Clauses — Appendix information

The parties incorporate by reference the official Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914, without rewriting or varying their mandatory text. Official text: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

The SCCs are incorporated into this wider DPA only for transfers and party roles for which they are legally available. They do not automatically apply to Sealed’s processing as an independent Controller, or to an importer whose relevant processing is directly subject to the EU GDPR in a way that makes the 2021 SCCs unavailable.

Annex I.A — List of Parties

Data exporter (Customer)

• Legal name: ______________________________________________
• Trading name, if different: ______________________________________________
• Registered or principal business address: ______________________________________________
• Registration number, if applicable: ______________________________________________
• Business/privacy contact name and email: ______________________________________________
• Role for this processing: Controller (Module Two) or Processor (Module Three) — select one.
• Date and method of acceptance: ______________________________________________

Data importer (Sealed)

• Legal name: Sealed Innovations LLC
• Trading name: CueHand
• Legal form: Wyoming limited liability company
• Registration identifier: Wyoming filing ID 2026-002102812
• Registered agent address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA (not an operating office)
• Privacy/DPA contact: privacy@cuehand.com
• Role: Processor for Module Two; Subprocessor for Module Three.
• Date and method of acceptance by Sealed: ______________________________________________

The Customer's legal name, address, contact and role must be completed before the relevant SCC Appendix is treated as complete. A display name or trading name alone may not identify the correct legal exporter.

Annex I.B — Description of Transfer

Data subjects: Customer’s account owners and team members; prospective and existing clients; people submitting public enquiries or reviews; event staff, crew, contractors and suppliers; and other individuals whose information Customer enters into CueHand.

Categories of personal data: names; email addresses; telephone numbers; business and contact details; account identifiers; workspace membership and role information; enquiries and client relationship records; event dates, requirements and running orders; task and supplier details; quotes, invoices, receipts and recorded payment information (excluding full card numbers and bank-account credentials); review content; uploaded documents and images; device/browser identifiers; push tokens; technical and usage metadata; and notification content. Limited dietary, allergy or accessibility notes may be entered for event planning and may reveal health information or religious beliefs.

Special categories: limited dietary, allergy or accessibility information may reveal health data or religious beliefs. Customer is responsible for ensuring lawful processing, providing required notices and obtaining any required explicit consent or other condition. CueHand is not designed for broader medical histories, diagnoses or unrelated special-category records.

Frequency: continuous and event-driven, as Customer and its authorised users use CueHand.

Nature and purpose: collection, recording, organisation, storage, hosting, retrieval, consultation, use, transmission, display, notification delivery, backup, restoration, support, security, export and deletion, to provide and secure CueHand and carry out Customer’s documented instructions.

Processing duration: for the Customer’s use of CueHand and any applicable read-only, export, retention, backup and deletion period described in the Terms, Privacy Policy and this DPA. Backup objects are subject to the configured retention policy of the newest 30 complete backup runs; provider logs and transient operational records are subject to the relevant provider’s retention settings.

Transfer and access locations: primary database and file storage in AWS eu-west-1 (Ireland); Vercel application functions in Dublin (Ireland); authorised Sealed personnel accessing/administering the service from Ghana; and provider processing/access in the United States, Singapore, Germany, Latvia and other locations disclosed in Schedule 3 and the applicable provider subprocessor lists. The precise onward locations depend on the provider, service and end-user browser.

Annex I.C — Competent Supervisory Authority

For Module Two or Module Three, the competent supervisory authority is determined under Clause 13 of the EU SCCs by reference to the data exporter and its establishment or, where applicable, its EU GDPR Article 27 representative. The relevant authority must be identified for each Customer based on its legal establishment and circumstances and recorded in the Customer’s DPA/transfer record. It is not appropriate to name one EU authority for every worldwide Customer.

Annex II — Technical and Organisational Measures

The technical and organisational measures are set out in Schedule 2 of this DPA, which is incorporated into this Annex II. Schedule 2 must be verified against production before publication and updated when material controls change. In particular: - RLS is enabled but no RLS policies are relied upon for workspace separation; application-side authorisation is enforced in server code. - Cross-tenant tests run against a local test database in pull-request checks and are not a production penetration test. - MFA is enabled for infrastructure and administrative accounts. - Supabase’s published encryption-at-rest statement is a provider-managed control, not a control independently configured or audited by Sealed. - Backup source data is temporarily handled by the GitHub Actions runner before age encryption; only encrypted backup objects are uploaded to R2. Do not describe the entire workflow as encrypted end-to-end.

Annex III — List of Subprocessors (Modules Two and Three, where applicable)

For the applicable module, the direct subprocessors processing Customer Personal Data on Sealed's behalf are those identified in Schedule 3, Section A. The relevant SCC Annex III must be completed for the selected module. The onward delivery providers in Section B must be disclosed to the extent they receive or can access Customer Personal Data in the relevant transfer. Section C providers are not represented as subprocessors of Customer workspace content. The live provider terms and subprocessor lists linked in Schedule 3 form part of Sealed’s vendor due-diligence record but do not replace Sealed’s duty to keep this Schedule accurate.

UK International Data Transfer Addendum — Table completion

The parties incorporate the ICO’s International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0 (in force 21 March 2022), including its mandatory clauses, where a UK restricted transfer requires this safeguard. Official template: https://ico.org.uk/media/for-organisations/documents/4019483/international-data-transfer-addendum.pdf.

The Addendum is incorporated into this DPA. It is entered into only for a particular restricted transfer when the applicable Addendum tables and required party details have been completed and the completed transfer documentation is accepted in writing or through an electronic process that presents or links to the completed documentation and records the accepted versions.

Table 1 — Parties: Data exporter is the Customer identified in Annex I.A; data importer is Sealed Innovations LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA; contact privacy@cuehand.com. The Customer's legal name, address, registration details (if applicable), contact and role must be completed in the signed DPA/transfer appendix.

Table 2 — Selected SCCs, modules and clauses: Commission Implementing Decision (EU) 2021/914; Module Two where Customer is Controller and Sealed is Processor; Module Three where Customer is Processor and Sealed is Subprocessor. Clause selections are those set out in Section 10.3 of this DPA.

Table 3 — Appendix Information: Annex I.A, Annex I.B and Annex I.C above; Annex II/Schedule 2; and, where applicable, Annex III/Schedule 3 for the selected module.

Table 4 — Ending the Addendum when the approved Addendum changes: Neither party may end the Addendum solely because the ICO-approved Addendum changes, unless the then-current official template or applicable law requires a different selection.

The ICO-prescribed alternative wording for incorporation by reference is included in Section 10.4 of this DPA. The UK Addendum’s mandatory clauses must not be modified. If the Addendum cannot lawfully be used for a particular transfer, the parties must complete the then-current UK IDTA or another valid safeguard before the transfer.

Customer-specific transfer information and completion

This DPA is accepted through the sign-up process described in Section 10.2 or by separate written execution. Before relying on an EU SCC or UK Addendum for a particular transfer, the parties must complete the Customer-specific party details, select the correct role/module, identify the competent supervisory authority, complete the relevant tables and carry out any transfer impact/risk assessment and supplementary measures required by applicable law.

Customer completion fields

• Customer legal entity name: ______________________________
• Trading name (if different): ______________________________
• Registered or principal business address: ______________________________
• Company/registration number (if applicable): ______________________________
• Customer privacy/business contact and email: ______________________________
• Customer role for this processing: ☐ Controller (Module Two) ☐ Processor (Module Three)
• Competent supervisory authority (where applicable): ______________________________
• Date of Customer acceptance: ______________________________

Sealed Innovations LLC

• Legal name: Sealed Innovations LLC
• Legal form: Wyoming limited liability company
• Registered agent address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA (not an operating office)
• Privacy/DPA contact: privacy@cuehand.com
• Date of Sealed acceptance: ______________________________

The EU SCCs and UK Addendum do not automatically make a transfer lawful merely because this DPA is signed. The parties must confirm that the selected instrument is legally available for the transfer and that all required information and safeguards are in place.

Before relying on the EU SCCs or UK Addendum, the parties must complete the Customer-specific fields, identify the competent supervisory authority, select the correct module, complete the relevant appendices and carry out any transfer impact or risk assessment and supplementary measures required by law. The parties should obtain qualified advice on the application of Article 3(2) GDPR, remote access from Ghana, onward transfers and any required UK or Swiss adaptations. This DPA does not represent that a transfer instrument is complete merely because this standard form has been published.