Data Processing Agreement

Version 2.0 · Last updated 14 October 2026 · Effective from the date of publication on aikaya.net

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions, Part C, between the Creator ("Controller") and Tenchi DWC-LLC, Business Centre, Floor 3, Building A3, Business Park, Dubai South, Dubai, United Arab Emirates, registration number 12600 ("Aikaya", "Processor"). It applies from the moment a Creator accepts the Terms and replaces any need for a separately signed agreement.

1. Scope and roles

1.1 This DPA covers Creator Personal Data: personal data Aikaya processes on the Creator's behalf to provide the creator features — the Creator's audience list and consent records, invitations and team seats, the Creator's customer view of her own Buyers, and delivery of her Products to them.

1.2 Aikaya is an independent controller, not a processor, for: user accounts and sign-in; the Terms acceptance record; the hosting commitment; security, fraud and abuse prevention; Content screening and notice-and-action; Aikaya's own billing; and legal obligations. The Privacy Policy covers that processing.

1.3 The Creator is an independent controller for personal data she exports from Aikaya or receives through her Stripe account.

2. Instructions

2.1 Aikaya processes Creator Personal Data only on the Creator's documented instructions, which are the Terms, this DPA and the Creator's use of the Platform's features, unless the law applicable to Aikaya requires otherwise; in that case Aikaya informs the Creator first unless the law prohibits it.

2.2 Aikaya informs the Creator if, in its opinion, an instruction infringes data-protection law.

3. Confidentiality

3.1 Everyone Aikaya authorises to process Creator Personal Data is bound by confidentiality.

4. Security

4.1 Aikaya implements the technical and organisational measures in Annex 2, appropriate to the risk under GDPR Art. 32, and may update them provided the overall level of protection does not fall.

5. Sub-processors

5.1 The Creator gives general authorisation for the sub-processors in Annex 3.

5.2 Aikaya notifies Creators of an intended addition or replacement by e-mail and on the sub-processor page at least 30 days in advance (or as soon as possible where an urgent change is needed for security or continuity). A Creator may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Creator may terminate her Plan and receive a refund of prepaid unused fees.

5.3 Aikaya imposes on each sub-processor data-protection obligations that are no less protective than this DPA and remains responsible to the Creator for its performance.

6. Assistance

6.1 Aikaya provides self-service tools for export and deletion and, taking into account the nature of the processing, assists the Creator in answering data-subject requests and in meeting her obligations under GDPR Arts. 32–36.

6.2 If a data subject contacts Aikaya about Creator Personal Data, Aikaya forwards the request to the Creator without undue delay, unless it concerns data for which Aikaya is controller.

7. Personal data breaches

7.1 Aikaya notifies the Creator without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Creator Personal Data, with the information available at the time and updates as it becomes available.

8. Location and international transfers

8.1 Creator Personal Data is stored in the EU (Frankfurt, Germany). Aikaya is established in the United Arab Emirates and accesses the data from there to operate the Platform.

8.2 Standard Contractual Clauses. Where the Creator is subject to the GDPR, the transfer of Creator Personal Data to Aikaya as a processor established outside the EEA is governed by the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this DPA by reference, with the Creator as data exporter and Aikaya as data importer. For those clauses: the optional docking clause (Clause 7) does not apply; Clause 9 option 2 (general written authorisation, with the notice period in 5.2) applies; the optional redress wording in Clause 11 does not apply; the competent supervisory authority is the one determined under Clause 13 of the clauses; the clauses are governed by the law of Ireland (Clause 17) and disputes go to the courts of Ireland (Clause 18). Annexes 1, 2 and 3 of this DPA serve as Annexes I.B, II and III to the clauses; Annex I.A consists of the parties' details above and on the Creator's account. If this DPA and the clauses conflict, the clauses prevail.

8.3 Where a sub-processor processes Creator Personal Data outside the EEA, Aikaya ensures that an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or standard contractual clauses apply.

9. End of processing

9.1 When the Creator's contract ends, the Creator may export her audience list and records for 30 days. Aikaya then deletes Creator Personal Data within 90 days, except where the law requires storage, or where it is needed to honour Buyers' access under the Terms (Part B §B7). Back-ups are overwritten in their normal cycle.

10. Demonstrating compliance and audits

10.1 Aikaya makes available the information necessary to demonstrate compliance with GDPR Art. 28, primarily this DPA, its records of processing and security documentation. Where that is not sufficient, or where a supervisory authority requires it, the Creator may carry out an audit on 30 days' written notice, at her cost, once per 12 months, subject to confidentiality and without access to other customers' data.

11. Liability and precedence

11.1 Liability under this DPA follows the Terms, Part A §11, without limiting either party's liability to data subjects under GDPR Art. 82.

11.2 In case of conflict about personal data, this DPA prevails over the Terms, subject to 8.2.

Annex 1 — Description of processing

Annex 2 — Technical and organisational measures

• Encryption in transit (TLS; HSTS) and provider-managed encryption at rest.
• Passwordless sign-in with single-use, expiring links; __Host- session cookies; administrator access with TOTP two-factor authentication, re-verified every 30 minutes.
• Signed, expiring playback URLs; rate limiting on authentication and playback.
• Least-privilege access: one operator; production credentials held in the hosting provider's secret store.
• Logging with personal data redacted; append-only audit log of administrator actions; webhook payloads stripped of personal data.
• Data minimisation: watch data deleted after 6 months; aggregate statistics carry no viewer identifier; IP addresses scrubbed on account deletion.
• Documented erasure procedure with an automated test that an erased e-mail address appears in no table.
• Dependency and supply-chain scanning; security review before release.
• Back-ups and point-in-time recovery provided by the database host.
• Incident response: a written breach procedure and breach register; notification to controllers under §7 and to supervisory authorities within 72 hours where required.

Annex 3 — Sub-processors

Not sub-processors: Stripe for Creators' own sales (the Creator's own provider under her Stripe agreement); AWS Route 53 (DNS only); GitHub (source code, no customer data). Any new sub-processor is added here under §5.2 before it processes Creator Personal Data.