Data Processing Addendum (DPA)

Version 2026-08-21 — effective as of September 1, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Use or the specific agreement entered into between Blob Animação Gráfica Interativa Ltda., CNPJ (Brazilian corporate taxpayer ID) 05.196.991/0001-43 ("Trakto" or "Processor") and the customer that subscribes to the Platform ("Customer" or "Controller") (together, the "Agreement"), and governs the processing of personal data carried out by Trakto on behalf of the Customer.

This DPA is self-serve: it applies automatically to every Customer that uses the Platform on behalf of an organization or that enters personal data of third parties into its content, without the need for signature. Customers who need a signed version, or additional terms (for example, for on-site audits or sector-specific requirements), may request it at Avenida Álvaro Otacílio, 3731, Bloco Espanha – Edf. JTR, Sala 602, Jatiúca, Maceió/AL, 57036-850, Brazil.

1. Definitions

1.1. The terms "personal data", "data subject", "processing", "controller", "processor", "sub-processor", "security incident" / "personal data breach" and "supervisory authority" have the meaning given to them by the applicable Data Protection Law.

1.2. "Data Protection Law" means all law applicable to the processing of personal data under this DPA, including Law 13,709/2018 (LGPD, the Brazilian General Data Protection Law) and the regulations of the ANPD (Brazilian National Data Protection Authority); Regulation (EU) 2016/679 (GDPR) and the national laws supplementing it; the UK GDPR and the Data Protection Act 2018; the California Consumer Privacy Act as amended by the CPRA (CCPA) and other US state laws; and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws.

1.3. "Customer Data" means the personal data contained in User Content (as defined in the Terms of Use) or otherwise provided by the Customer or its authorized users for processing by Trakto on behalf of the Customer. It does not include the account data of the Customer's authorized users, for which Trakto is the controller under the Privacy Policy.

1.4. "Standard Contractual Clauses" or "SCCs" means (a) for transfers subject to the GDPR, the clauses approved by European Commission Implementing Decision (EU) 2021/914; (b) for transfers subject to the UK GDPR, the ICO's International Data Transfer Addendum to the EU SCCs; (c) for transfers subject to the LGPD, the standard contractual clauses approved by ANPD Resolution CD/ANPD No. 19/2024; in all cases as updated or replaced.

1.5. "Sub-processor" means any third party engaged by Trakto to process Customer Data on behalf of the Customer.

2. Roles and subject matter

2.1. For the purposes of this DPA, the Customer is the Controller (or a processor acting on behalf of a third-party controller, in which case it represents that it is authorized to engage Trakto as a sub-processor) and Trakto is the Processor of the Customer Data.

2.2. The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are described in Annex I.

2.3. This DPA prevails over the Terms of Use in case of conflict regarding the processing of Customer Data. In case of conflict between this DPA and the SCCs, the SCCs prevail.

3. Customer instructions

3.1. Trakto will process Customer Data only on the Customer's documented instructions, which consist of: (a) the Agreement and this DPA; (b) the use of the Platform by the Customer and its authorized users, including settings, commands, prompts and API calls; and (c) other reasonable written instructions compatible with the Platform, agreed between the parties.

3.2. Trakto will inform the Customer if, in its opinion, an instruction violates Data Protection Law, without this implying an obligation to conduct an exhaustive legal analysis.

3.3. Trakto may process Customer Data outside the instructions only where required by law to which it is subject; in that case, it will inform the Customer before processing, unless the law prohibits this on important grounds of public interest.

3.4. No-training commitment. Trakto and its Sub-processors are expressly prohibited from using Customer Data, prompts or outputs to train, fine-tune, evaluate or improve artificial intelligence or machine learning models. Trakto engages AI providers exclusively under commercial arrangements that prohibit training and limit retention, and passes this prohibition on contractually.

4. Confidentiality

4.1. Trakto ensures that persons authorized to process Customer Data (employees, contractors) are bound by contractual or statutory confidentiality obligations, receive appropriate data protection training and access Customer Data only to the extent necessary to provide the Service, to deliver support requested by the Customer, for safety moderation or to comply with a legal obligation.

4.2. Access by Trakto personnel to Customer content is restricted by role-based controls, recorded in logs and subject to periodic review.

5. Security

5.1. Trakto implements and maintains appropriate technical and organizational measures to protect Customer Data against security incidents, taking into account the state of the art, the costs, the nature, scope, context and purposes of the processing and the risks to data subjects. The measures are described in Annex II and include, at a minimum: encryption in transit (TLS 1.2+) and at rest; role-based access control with least privilege; strong authentication; logical segregation of data per Customer; access logging and monitoring; backups and business continuity plan; vulnerability management.

5.2. Trakto may update the security measures, provided this does not result in a material reduction of the level of protection.

6. Sub-processors

6.1. General authorization. The Customer authorizes Trakto to engage the Sub-processors listed in Annex III, which includes the providers of infrastructure, database, AI, e-mail, analytics, monitoring and real-time collaboration.

6.2. 15 days' prior notice. Trakto will notify the Customer, by e-mail to the workspace administrator or by notice on the Platform, at least 15 days in advance, of the addition or replacement of Sub-processors. The updated list will be available at https://beta.trakto.studio/legal/data-processing-addendum, with an option to subscribe to notifications.

6.3. Right to object. The Customer may object, in writing and on reasonable grounds related to data protection, within the notice period. The parties will seek a solution in good faith (for example, disabling the feature that depends on the new Sub-processor). If no solution is found, the Customer may terminate the Agreement as to the affected part, with a pro-rated refund of prepaid amounts.

6.4. Equivalent obligations. Trakto will enter into a written contract with each Sub-processor imposing data protection obligations substantially equivalent to those in this DPA, including the prohibition on training AI models, and will remain liable to the Customer for the performance of those obligations by the Sub-processors.

7. Assistance to the Customer

7.1. Data subject rights. Taking into account the nature of the processing, Trakto will assist the Customer, through appropriate technical and organizational measures, in responding to data subject requests (access, rectification, erasure, portability, objection, etc.). The Platform offers search, export and content deletion tools that allow the Customer to handle most requests directly. If Trakto receives a data subject request concerning Customer Data, it will forward it to the Customer within 5 business days and will not respond directly, unless instructed by the Customer or required by law.

7.2. Impact assessments and prior consultations. Trakto will provide information reasonably necessary for the Customer to carry out data protection impact assessments and prior consultations with authorities, to the extent the information is not available in Trakto's public documentation.

7.3. Costs. Assistance is provided at no additional cost where it involves reasonable effort. Requests that require significant and recurring effort may be charged at a reasonable price, agreed in advance.

8. Security incidents

8.1. Trakto will notify the Customer without undue delay and, in any event, within 48 hours 48 hours after becoming aware of a security incident affecting Customer Data.

8.2. The notification will contain, to the extent known at the time, and will be supplemented progressively: (a) the nature of the incident, the categories and approximate number of data subjects and records affected; (b) the likely consequences; (c) the measures taken or proposed to remedy the incident and mitigate its effects; (d) a point of contact.

8.3. Trakto will reasonably cooperate with the Customer in the investigation, mitigation and in communications to data subjects and authorities that are the Customer's responsibility. Notification of an incident does not constitute an admission of fault or liability.

9. Audit

9.1. Trakto will make available to the Customer, upon request and under confidentiality, the information necessary to demonstrate compliance with this DPA, including: a description of the security measures; summaries of penetration tests and vulnerability assessments; third-party reports and certifications (such as SOC 2 or ISO 27001) of Trakto or its Sub-processors, where available no formal certification at this time (SOC 2/ISO 27001 planned); and responses to reasonable security questionnaires, up to once per year.

9.2. Where the reports are not sufficient to meet a legal requirement or a requirement of a supervisory authority, the Customer may conduct (or engage an independent auditor bound by confidentiality to conduct) an audit of Trakto's relevant facilities and systems, upon 30 days' prior notice, at most once every 12 months (except following a security incident or at the requirement of an authority), during business hours, without disproportionate interference with Trakto's operations, and at the Customer's expense. Audits of the facilities of cloud Sub-processors take place by means of those providers' reports and certifications.

10. International transfers

10.1. The Customer acknowledges that Trakto is headquartered in Brazil and that the Sub-processors are located mainly in the United States in the USA only, as set out in Annex III.

10.2. Transfers subject to the LGPD. Trakto ensures that international transfers of Customer Data take place on the basis of the ANPD standard contractual clauses (Resolution CD/ANPD No. 19/2024) or another mechanism provided for in art. 33 of the LGPD, and that the recipients offer an adequate level of protection.

10.3. Transfers subject to the GDPR/UK GDPR. Where the Customer is subject to the GDPR or the UK GDPR and Trakto processes Customer Data outside the EEA/UK, the parties enter into, by means of this DPA, the SCCs (Module 2 — controller to processor; or Module 3 — processor to processor, where the Customer is a processor), incorporated by reference, with the following options: Clause 7 (docking) included; Clause 9(a) — option 2 (general authorization with 15 days' notice); Clause 11 — optional mechanism not applicable; Clause 13 — supervisory authority as set out in Annex I.C; Clause 17 — law of Ireland Ireland; Clause 18 — courts of Ireland. For the UK, the UK Addendum applies, with the Tables completed in accordance with the Annexes to this DPA. Annexes I, II and III to this DPA constitute Annexes I, II and III to the SCCs.

10.4. Onward transfers. Trakto ensures that onward transfers to Sub-processors are covered by SCCs or an equivalent mechanism, including, where applicable, certifications under the EU-U.S. Data Privacy Framework.

10.5. Government requests. If Trakto receives a request from a public authority for access to Customer Data, it will challenge legally inadequate requests, provide only the minimum necessary and notify the Customer, unless legally prohibited.

11. Return and deletion

11.1. During the term of the Agreement, the Customer may export and delete Customer Data at any time through the Platform.

11.2. Upon termination of the Agreement, Trakto will keep Customer Data available for export in read-only mode for at least 90 days (in accordance with the Refund and Cancellation Policy). After that period, or earlier upon the Customer's request, Trakto will delete Customer Data from production systems within 30 days and from backups in the normal rotation cycle, within an additional 30 days, except where the law requires retention, in which case the data will remain isolated and protected, processed only for the legal purpose.

11.3. Upon request, Trakto will certify deletion in writing.

12. Regime-specific provisions

12.1. CCPA/CPRA. To the extent Customer Data includes personal information of California residents, Trakto acts as a "service provider", and: (a) will not sell or share the information; (b) will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than those specified in this DPA; (c) will not combine it with information received from other sources, except as permitted by the CCPA; (d) will comply with the applicable obligations and provide the same level of protection; (e) will notify the Customer if it can no longer meet its obligations; and (f) will allow the Customer to take reasonable steps to stop and remediate unauthorized use. Trakto certifies that it understands these restrictions.

12.2. PIPEDA. Trakto will process personal information of residents of Canada with a level of protection comparable to that which the Customer must provide, and the Customer is responsible for informing data subjects that the data may be processed outside Canada.

12.3. LGPD. Under art. 39 of the LGPD, Trakto will carry out the processing in accordance with the Customer's instructions, and the Customer will verify compliance with the instructions and the applicable rules. Trakto will be jointly and severally liable in the cases set out in art. 42, § 1, I, of the LGPD.

13. Liability

Each party's liability under this DPA is subject to the exclusions and limitations set out in the Agreement, except where Data Protection Law or the SCCs provide otherwise in a manner that cannot be waived.

14. Term and amendments

14.1. This DPA remains in force for as long as Trakto processes Customer Data.

14.2. Trakto may update this DPA to reflect changes in Data Protection Law, in transfer mechanisms or in the Platform, with 15 days' prior notice, except where the change is required by law within a shorter period. Changes that materially reduce the Customer's protections entitle the Customer to terminate the Agreement, with a pro-rated refund.

Annex I — Details of the processing

A. Parties

• Data exporter / Controller: the Customer, identified by its account and workspace on the Platform; contact: workspace administrator.
• Data importer / Processor: Blob Animação Gráfica Interativa Ltda., Avenida Álvaro Otacílio, 3731, Bloco Espanha – Edf. JTR, Sala 602, Jatiúca, Maceió/AL, 57036-850, Brazil, Brazil; contact: Avenida Álvaro Otacílio, 3731, Bloco Espanha – Edf. JTR, Sala 602, Jatiúca, Maceió/AL, 57036-850, Brazil; activity: SaaS platform for design and motion with generative AI.

B. Description of the processing

C. Competent supervisory authority (for SCCs)

The authority of the EEA Member State in which the Customer is established or, if the Customer is not established in the EEA, the authority of the Member State in which the Customer's representative or the data subjects are located, in accordance with Clause 13 of the SCCs. For the UK, the ICO. not appointed at this time

Annex II — Technical and organizational measures

Annex III — Authorized Sub-processors

List in effect as of 2026-08-21. Changes will be communicated 15 days in advance (clause 6). USA unless stated otherwise; each provider's standard DPA accepted at signup

A. Platform infrastructure and operations

B. AI Providers (used via API under a no-retention / no-training regime)

C. Analytics (enabled only with consent, where required; they process usage data of authorized users, not content)

D. Support

Version history