Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between WeMakeCode (OPC) Private Limited ("showdo", "we") and the organisation or person that uses showdo for a workspace (the "customer", "you"). It applies when showdo processes personal data for the customer under the Terms. It applies from the day the customer starts using showdo.

If you need a signed copy, or the standard clauses signed, write to [email protected].

If this DPA and the Terms disagree about personal data, this DPA wins. If the standard contractual clauses (section "Transfers outside Europe and the UK") and this DPA disagree, the clauses win.

• Customer personal data: personal data in the customer's workspace that showdo processes for the customer: guides, steps, screenshots, narration text, videos, assistant chats, member details and activity records.
• Data protection law: the laws that apply to that personal data, such as the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 (and the Information Technology Act, 2000 and its rules while they apply), and United States state privacy laws such as the California Consumer Privacy Act.
• Controller, processor, sub-processor, personal data breach, data subject: these have the meaning they have in data protection law.
• Sub-processor: a company showdo uses that handles customer personal data.

• For customer personal data, the customer is the controller (or a processor acting for its own controllers) and showdo is a processor.
• showdo is a controller of account and security information that it uses to run showdo, such as sign-in records and the details of who holds an account. The Privacy Policy covers that, not this DPA.
• The customer is responsible for having a lawful reason to put personal data into showdo, for telling the people concerned, and for what its members record. showdo does not check the content for lawfulness.

showdo processes customer personal data only to provide, protect and support showdo for the customer, and as the customer instructs. The customer's instructions are the Terms, this DPA, and what the customer and its members do with showdo's features and settings (for example, turning AI features on or off, setting sharing and retention, and deleting content).

showdo will tell the customer if it believes an instruction breaks data protection law. showdo may stop carrying out that instruction until the customer confirms or changes it.

showdo will:

• keep customer personal data confidential, and make sure the people who can reach it are bound to confidentiality;
• process it only as described here;
• protect it with the measures in "Security measures" below;
• use only the sub-processors listed on the sub-processors page, on the terms below;
• help with people's requests, impact assessments and regulators, as set out below;
• tell the customer about breaches, as set out below; and
• delete or return the data at the end, as set out below.

showdo uses technical and organisational measures that fit the risk. The main ones in place today are listed in Annex B and described on the Security page. showdo may change them over time, as long as the overall protection is not made materially weaker.

The customer agrees that showdo may use the sub-processors on the sub-processors page. showdo will:

• bind each sub-processor to data protection terms that give similar protection to this DPA;
• stay responsible to the customer for the work of its sub-processors; and
• tell the customer when it adds or replaces a sub-processor, by updating that page, and by email if the customer has asked to be told. The notice is given before the new company starts, wherever possible.

The customer may object to a new sub-processor on reasonable data protection grounds by writing to [email protected] within a reasonable time of the notice. The parties will talk in good faith. If they cannot solve it, the customer may stop using the part of showdo that needs the new sub-processor and end that part of its subscription.

If a person asks showdo about customer personal data, such as to see, correct, delete or export it, showdo will not answer the request itself unless the law requires. It will tell the person to ask the customer, and will tell the customer. showdo gives customers tools to find, change, export and delete content. Where those tools are not enough, showdo will give reasonable help.

showdo will tell the customer about a personal data breach affecting customer personal data without undue delay after becoming aware of it. The message will say, as far as showdo knows: what happened, the likely effects, the data and people involved, and what showdo is doing about it. showdo will help the customer meet its duties to tell regulators and people.

showdo will give reasonable help if the customer must carry out a data protection impact assessment or consult a regulator about its use of showdo. The help takes into account what showdo does and what information it has.

• While you use showdo, customers can delete guides, members, chats and the workspace, and can export guides in the app. A deleted guide stays in the Trash for 45 days so it can be restored, and is then removed. "Delete forever" removes it at once.
• At the end, showdo will delete customer personal data, or return it, as the customer asks in writing. If the customer does not ask, showdo deletes it after a reasonable period.
• Stored files. When a guide leaves the Trash (after 45 days, or by Delete forever), and when a workspace is deleted, showdo removes the records and then the stored picture, video, voiceover and logo files. showdo tries again a few times if the file store is busy. If a file is left behind, showdo deletes it on written request and says when it is done.
• Backups. showdo stores its data in the United States. Backups, if any, are overwritten in the normal cycle.
• The law. showdo may keep data that the law requires it to keep, and will keep it protected.

showdo will give the customer the information it reasonably needs to check that showdo follows this DPA. If that is not enough, the customer may carry out an audit, on these conditions: written notice at least 30 days ahead, no more than once a year unless there has been a breach or a regulator requires it, during normal working hours, without harm to other customers' data, under a confidentiality agreement, with a clear scope, and at the customer's cost.

showdo and its sub-processors may handle customer personal data in countries outside the customer's own, including the United States. Where data protection law requires a legal tool for such a transfer, the parties use these:

• From the European Economic Area: the European Commission's Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor), which are part of this DPA by this reference. Option 2 of clause 9 applies (general permission for sub-processors, with the notice described above). The governing law and courts for the clauses are those of the EU member state where the customer is established, if that law allows third parties to rely on the clauses, and otherwise those of an EU member state that does. Annexes A, B and the sub-processors page give the details the clauses ask for.
• From the United Kingdom: the UK International Data Transfer Addendum to those clauses, which is part of this DPA by this reference.
• From Switzerland: the same clauses, with references to the GDPR read as references to the Swiss Federal Act on Data Protection.
• Other tools that the law accepts, such as an adequacy decision or a data privacy framework certification by the receiving company, where one applies.

showdo will give a copy of the clauses on request, and will sign them if the customer needs a signed copy.

Where the Digital Personal Data Protection Act, 2023 applies to customer personal data:

• Roles. The customer is the Data Fiduciary and showdo is its Data Processor. This DPA, with the Terms, is the valid contract the Act asks for.
• Instructions only. showdo processes customer personal data only to provide showdo to the customer, as the Terms, this DPA and the customer's instructions say.
• Safeguards. showdo keeps the reasonable security safeguards described on the Security page, including role-based access checked on the server for every change, secure sign-in, and an activity log of important changes.
• Breaches. showdo tells the customer about a personal data breach as set out above, with the details the customer needs to tell the Data Protection Board of India and the people affected as the Digital Personal Data Protection Rules, 2025 require.
• People's requests. showdo passes on requests from Data Principals (the people the data is about) and helps the customer answer requests to see a summary, correct, complete, update or erase their information, from nominees, and grievances.
• Erasure. When the customer asks, when its purpose is served, or when the agreement ends, showdo erases customer personal data as described above, unless a law says it must keep it, and makes its sub-processors do the same.
• Transfers. showdo and its sub-processors may handle customer personal data outside India. showdo will not transfer it to any country the Government of India restricts under the Act.
• Children. showdo is not for children (under 18 in India). The customer must not use showdo to handle children's personal data unless it has obtained the verifiable consent of a parent or lawful guardian that the Act requires.

To the extent laws such as the California Consumer Privacy Act apply, showdo is the customer's service provider and processes personal information only for the business purposes in the Terms and this DPA. showdo will not sell it, share it for advertising across other companies' sites, keep, use or share it outside its direct business relationship with the customer, or combine it with other data, except as the law allows. showdo will tell the customer if it can no longer meet these obligations, and the customer may take reasonable steps to stop and fix unauthorised use.

Each party's liability under this DPA is subject to the limits in the Terms, except where the law or the standard contractual clauses say otherwise. This DPA lasts as long as showdo processes customer personal data. The law that governs the Terms also governs this DPA, except where the standard contractual clauses require otherwise.

• What and why: hosting and processing the customer's guides, assistant, videos and workspace so the customer's members can create, share and use them.
• How long: for as long as the customer uses showdo, and then as set out in "Deleting and returning data".
• How: storing, organising, showing, searching, exporting and deleting content; sending parts of it to the AI companies the customer's members choose to use, as described on the AI page.
• Kinds of personal data: names, email addresses and roles of members; anything that appears in screenshots, step text, narration text and chats, such as business contact details, names, page addresses and work information. showdo blurs or replaces many sensitive details before upload. showdo does not ask for sensitive categories of data and the customer should not put them in.
• People concerned: the customer's members and invitees, and people who appear in or are named in guides.
• How often: all the time while the customer uses showdo.

These are in place today. They are described in more detail on the Security page.

• Roles (owner, admin, editor, viewer) checked on the server for each change.
• Blurring of personal details in screenshots on the user's device before upload, cleaning of text, and a second check on the server and by an AI review.
• Sharing controls: workspace-only by default, link and public sharing that admins can switch off, and share links that can be reset.
• Links to pictures and videos that are signed and that expire.
• Passwords stored as one-way scrambled values, limits on sign-in and reset attempts, session lists with sign-out, and secure cookies when showdo is served over https.
• Access keys stored as one-way scrambled values, shown once, limited by role and turned off on request.
• An activity log of important changes.
• Confirmations for deleting an account or a workspace.

showdo does not claim any security certificate in this DPA.

The current list is below, and on the sub-processors page.