CloudBridal Data Processing Agreement (DPA)

Effective Date: November 3, 2026 Last Updated: November 3, 2026

This Data Processing Agreement ("DPA") is incorporated by reference into the CloudBridal Terms and Conditions ("Terms" or "TOS") and the CloudBridal End-User License Agreement ("EULA") available at cloudbridal.com (together, the "Agreement"). It sets out how CloudBridal processes personal data on your behalf when you use CloudBridal. Capitalized terms not defined here have the meanings given in the Agreement.

This DPA is between Cloud Innovations LLC ("CloudBridal," "we," "us," or "our") and the business that holds the CloudBridal account ("Merchant," "you," or "your"). It takes effect when you accept the Agreement, and applies for as long as CloudBridal processes Customer Personal Data. If you need a signed copy of this DPA, email support@cloudbridal.com and CloudBridal will countersign one.

For questions about this DPA, contact us at support@cloudbridal.com.

1. Definitions

1.1. "Data Protection Laws" means the laws on personal data and privacy that apply to the processing of Customer Personal Data under the Agreement, including, where applicable: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"); the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations ("CCPA"), and other U.S. state privacy laws; Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and provincial private-sector privacy laws, including Quebec's Act respecting the protection of personal information in the private sector; and Australia's Privacy Act 1988.

1.2. "Customer Personal Data" means personal data that CloudBridal processes on your behalf in providing the Service, as described in Section 3.

1.3. "Service" means the CloudBridal application and, where you have turned it on, the Website Service described in Section 12 of the EULA.

1.4. "Sub-processor" means a third party engaged by CloudBridal that processes Customer Personal Data on CloudBridal's behalf.

1.5. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

1.6. "Controller," "processor," "data subject," "personal data," "processing," "business," "service provider," "sell," and "share" have the meanings given in the applicable Data Protection Laws. "Personal data" includes "personal information" as defined in those laws.

2. Roles and Instructions

2.1. Roles. For Customer Personal Data, you are the controller (or "business") and CloudBridal is your processor (or "service provider"). You decide why and how Customer Personal Data is processed; CloudBridal processes it only to provide the Service to you.

2.2. Data CloudBridal controls. CloudBridal is an independent controller of the personal data it processes to run its own business: your staff's sign-in details, billing and subscription records, support conversations, and security and usage logs. The CloudBridal Privacy Policy describes that processing, and this DPA does not apply to it.

2.3. Your instructions. CloudBridal processes Customer Personal Data only on your documented instructions. The Agreement, your configuration and use of the Service (including the features, integrations, and website forms you turn on, and any website import you request), and any further written instructions you give that are consistent with the Agreement, are your complete instructions. CloudBridal will tell you if, in its opinion, an instruction infringes Data Protection Laws, and may then decline to follow it.

2.4. Your responsibilities. You are responsible for the lawfulness of the Customer Personal Data you collect and give to CloudBridal, for having a lawful basis and any consents required to process it, and for the notices you give to the people it concerns, including the privacy policy on any website that CloudBridal hosts for you.

3. Details of the Processing

3.1. Subject matter. CloudBridal's provision of the Service to you under the Agreement.

3.2. Duration. The term of the Agreement, plus the period until deletion under Section 9.

3.3. Nature of the processing. Collection (including through forms on your website and from a website you direct CloudBridal to import), recording, organization, storage, adaptation, retrieval, use, transmission (including by email and SMS at your instruction), display (including public display on your website at your instruction), and erasure.

3.4. Purpose. To provide, secure, support, and maintain the Service for you, as the Agreement describes and you instruct.

3.5. Data subjects and categories of personal data.

Data subjects	Categories of personal data
Application: your customers and their wedding parties	Names, contact details, event dates and details, measurements, appointments, orders, payment records (card brand, last four digits, expiry date, and cardholder name only; never full card numbers), messages sent and received through the Service, signed documents and e-signature audit data, notes, and photos you upload
Application: your staff	Names, contact details, and records about their work that you keep in the Service, such as appointments, commissions, and activity history
Application: your vendors and other business contacts	Names, contact details, and order and transaction records
Website Service: visitors to your website	IP address and request metadata processed by the hosting providers to serve the website, the visitor's consent choices and region, and the visit counter's daily visitor codes (the counter stores counts, not IP addresses)
Website Service: people who use your website's forms	Inquiries and appointment requests (name, email address, phone number, event date, message), newsletter signups, and stories with photos ("Visitor Submissions")
Website Service: people shown or named on your website, including in content imported at your direction	Names, photos, testimonials, and stories of customers; names, photos, and biographies of staff; and any other personal data in the website content you publish or import

3.6. Sensitive data. The Service is not intended for special categories of personal data, government identifiers, or other highly sensitive data (see Section 16 of the EULA). You will not instruct CloudBridal to process such data.

4. CloudBridal's Obligations

CloudBridal will:

(a) process Customer Personal Data only on your documented instructions under Section 2.3, including with regard to international transfers, unless the law to which CloudBridal is subject requires otherwise, in which case CloudBridal will tell you of that legal requirement before processing unless the law prohibits it;

(b) ensure that the people it authorizes to process Customer Personal Data are bound by confidentiality obligations;

(d) engage Sub-processors only as described in Section 5;

(e) taking into account the nature of the processing, assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects to exercise their rights, as described in Section 8;

(f) assist you, taking into account the nature of the processing and the information available to CloudBridal, with your obligations on security, Personal Data Breach notification, data protection impact assessments, and prior consultation with supervisory authorities;

(g) delete or return Customer Personal Data at the end of the Service as described in Section 9; and

(h) make available the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, as described in Section 10.

5. Sub-processors

5.1. Authorization. You give CloudBridal general written authorization to engage the Sub-processors listed in Sections A and B of the CloudBridal Subprocessor Register at cloudbridal.com/subprocessors. The parties listed in Section C of the Register are independent controllers, not Sub-processors.

5.2. Changes. CloudBridal will give at least 30 days' notice before adding or replacing a Sub-processor, by updating the Register and notifying the merchants on its notification list. To join the list, email support@cloudbridal.com.

5.3. Objections. You may object to a new Sub-processor on reasonable data protection grounds by emailing support@cloudbridal.com within the notice period. CloudBridal will discuss the objection with you in good faith. If it cannot be resolved, you may stop using the affected part of the Service, or end your subscription, before the change takes effect. If you end your subscription for this reason, CloudBridal will refund the unused part of any fees you prepaid.

5.4. Sub-processor terms. CloudBridal imposes on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remains responsible to you for each Sub-processor's performance of those obligations.

5.5. Third parties you choose. Integrations you connect yourself under your own agreement with the provider, and analytics, advertising, or other third-party scripts you add to your website, are your own choices under Section 11 of the EULA. Those providers are not CloudBridal's Sub-processors.

6. Security

6.1. CloudBridal implements appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing. The measures are described at cloudbridal.com/security and include:

(a) encryption of data in transit between your devices and CloudBridal, and encryption of the data stored by CloudBridal's hosting provider;

(b) separation of each merchant's data from every other merchant's, built into how the Service reads data and checked automatically whenever the code changes;

(d) automatic database backups that can be restored to an earlier point in time;

(e) access to Customer Personal Data limited to CloudBridal personnel who need it to provide and support the Service; and

(f) monitoring of availability and errors.

6.2. CloudBridal may update its security measures, provided that an update does not materially lower the overall level of protection.

7. Personal Data Breaches

7.1. CloudBridal will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting your Customer Personal Data.

7.2. The notice will describe, as far as the information is then available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact for more information. Where the information is not all available at once, CloudBridal will provide it in phases without further undue delay.

7.3. CloudBridal will take reasonable steps to contain and remedy the breach, and will assist you with your own notifications to supervisory authorities and affected individuals. CloudBridal's notice of a breach is not an admission of fault or liability.

8. Data Subject Requests

8.1. The Service lets you find, export, correct, and delete Customer Personal Data, which you can use to respond to requests from the people it concerns.

8.2. If CloudBridal receives a request from a data subject about Customer Personal Data, including from a visitor to your website, it will pass the request to you and will not respond to it directly, except to tell the person that it has done so, unless Data Protection Laws require otherwise.

8.3. Where you cannot respond to a request using the Service, CloudBridal will provide reasonable assistance on your written request.

9. Deletion and Return

9.1. During the Agreement. You can export Customer Personal Data with the Service's export features, as Section 7 of the EULA describes, and delete it at any time. Turning the Website Service off does not delete your website content or Visitor Submissions (Section 12.11 of the EULA).

9.2. At the end of the Agreement. When your subscription ends, you may export Customer Personal Data during the Grace Period described in Section 8 of the EULA. After the Grace Period, CloudBridal will delete Customer Personal Data within 30 days of your written request, except where law requires CloudBridal to keep it, and will confirm the deletion in writing.

9.3. Backups. Customer Personal Data in backups is deleted as the backups expire, within six months (point-in-time database backups are kept for 35 days, monthly database backups for six months, and deleted files for 30 days), and is kept secure and out of active use until then.

10. Audits

10.1. On your written request, no more than once in any 12-month period, CloudBridal will provide the information reasonably necessary to demonstrate its compliance with this DPA, such as answers to a reasonable security questionnaire and, where they allow it, its Sub-processors' audit reports or certifications.

10.2. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, you may audit CloudBridal's compliance with this DPA, yourself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, during normal business hours, in a way that does not disrupt CloudBridal's business or compromise other merchants' data, and at your cost.

11. International Transfers

11.1. Where data is processed. CloudBridal processes Customer Personal Data in the United States, and its Sub-processors process it in the regions shown in the Subprocessor Register.

11.2. EU Standard Contractual Clauses. Where a transfer of Customer Personal Data from you to CloudBridal is a transfer of personal data subject to the GDPR to a country that has no adequacy decision, the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) ("SCCs"), are incorporated into this DPA, with you as data exporter and CloudBridal as data importer, and completed as follows:

(a) Clause 7 (docking clause) does not apply;

(b) Clause 9: Option 2 (general written authorization) applies, with the notice period in Section 5.2;

(d) Clause 13: the competent supervisory authority is the one determined under Clause 13(a) by your establishment or, if you are not established in the EU, by your EU representative;

(e) Clauses 17 and 18: the SCCs are governed by the law of, and disputes are resolved by the courts of, Ireland; and

(f) Annex I is completed by Section 3 of this DPA and the parties' details in the Agreement, Annex II by Section 6, and Annex III by the Subprocessor Register.

11.3. United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner ("UK Addendum") applies to the SCCs. Tables 1 to 3 of the UK Addendum are completed with the information in Section 11.2 and this DPA, and either party may end the UK Addendum as its Table 4 allows.

11.4. Onward transfers. CloudBridal transfers Customer Personal Data to Sub-processors outside the EEA and the UK only under the EU Standard Contractual Clauses (with the UK Addendum where applicable), or a valid adequacy mechanism such as the Sub-processor's certification under the EU-U.S. Data Privacy Framework, as the Subprocessor Register describes.

11.6. Order of precedence. If the SCCs or the UK Addendum conflict with this DPA, the SCCs or the UK Addendum prevail.

12. California and Other U.S. State Privacy Laws

12.1. Where the CCPA applies to Customer Personal Data, CloudBridal acts as your service provider, and the business purposes for which it processes Customer Personal Data are those set out in Section 3.4. CloudBridal will not:

(a) sell or share Customer Personal Data;

(b) retain, use, or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in this DPA, or as otherwise permitted by the CCPA;

(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between you and CloudBridal; or

(d) combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA permits a service provider to do.

12.2. CloudBridal will comply with the obligations that the CCPA places on service providers, provide the level of privacy protection the CCPA requires, and notify you if it determines that it can no longer meet its obligations under the CCPA. You may take reasonable and appropriate steps to ensure that CloudBridal uses Customer Personal Data consistently with your obligations under the CCPA and, on notice, to stop and remediate any unauthorized use.

12.3. Where CloudBridal uses deidentified data derived from Customer Personal Data under Section 6.3 of the EULA, it will take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintain and use it only in deidentified form, not attempt to reidentify it, and require any recipient to do the same.

12.4. Where another U.S. state privacy law applies, CloudBridal acts as your processor under that law, and this DPA's terms apply to the extent that law requires.

13. Canada

13.1. Under PIPEDA, you remain accountable for Customer Personal Data that you transfer to CloudBridal for processing. CloudBridal will use it only for the purposes for which you transferred it, protect it with the safeguards in Section 6, and notify you under Section 7 of any breach of security safeguards so that you can assess, record, and report it as Canadian law requires.

13.2. Customer Personal Data is stored and processed in the United States and may be accessible to courts and authorities there. You are responsible for telling your customers so where Canadian law requires it, and, in Quebec, for any privacy impact assessment required before communicating personal information outside Quebec. CloudBridal will provide the information you reasonably need for that assessment.

14. Australia

14.1. Where the Australian Privacy Act 1988 applies to you, CloudBridal will handle Customer Personal Data only to provide the Service, protect it with the safeguards in Section 6 in a manner consistent with Australian Privacy Principle 11, and notify you under Section 7 of a suspected or actual data breach so that you can assess it and meet your obligations under the Notifiable Data Breaches scheme.

14.2. Customer Personal Data is stored and processed in the United States. You are responsible for any disclosure you must make about overseas recipients under Australian Privacy Principles 1 and 8.

15. Liability

15.1. Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Laws or the SCCs do not permit such a limitation.

16. General

16.1. Precedence. If this DPA conflicts with the Terms or the EULA on the processing of Customer Personal Data, this DPA prevails, subject to Section 11.6.

16.2. Governing law. Except as Section 11 provides for the SCCs and the UK Addendum, this DPA is governed by the law that governs the Terms.

16.3. Changes. CloudBridal may modify this DPA by posting an updated version at the URL where it is hosted. CloudBridal will give at least 30 days' notice of a change that materially reduces the protection of Customer Personal Data, unless the change is required by law.

17. Contact

For questions about this DPA or to exercise your rights under it, contact Cloud Innovations LLC at support@cloudbridal.com.

CloudBridal's representative in the European Union and the United Kingdom is Prighter Group, reachable at https://app.prighter.com/portal/16500849503.