Data Processing Addendum

1. Scope and Parties

This Data Processing Addendum (“DPA”) forms part of the services agreement (“Agreement”) between SYNNETRA Corp, operating under the brand name Hooklift (“Hooklift,” “we,” or “Processor”) and the client entity that has engaged Hooklift to provide creative production services (the “Client” or “Controller”).

This DPA applies whenever Hooklift processes personal data on behalf of the Client in connection with the Agreement. Where the Client's use of Hooklift services does not involve the processing of personal data, this DPA does not impose obligations beyond those already reflected in the Agreement.

2. Definitions

Capitalized terms not otherwise defined in this DPA have the meaning given in the EU General Data Protection Regulation 2016/679 (“GDPR”). For clarity:

• Personal Data means any information relating to an identified or identifiable natural person processed by Hooklift on behalf of the Client.
• Sub-processor means any third party engaged by Hooklift to process Personal Data on Hooklift's behalf.
• Data Subject means the identified or identifiable natural person to whom Personal Data relates.

3. Roles

The Client is the Controller in respect of Personal Data made available to Hooklift under the Agreement. Hooklift is the Processor. Where Hooklift collects Personal Data directly from end users of the Hooklift website (e.g. audit-form submissions), Hooklift acts as Controller and the Hooklift Privacy Policy applies.

4. Subject Matter and Duration

The subject matter of processing is the production and delivery of Meta video advertising creative. The duration of processing corresponds to the term of the Agreement plus any retention period required by applicable law or set out in this DPA.

Categories of Data Subjects may include the Client's end customers, prospective customers, and personnel insofar as their Personal Data appears in materials supplied by the Client (e.g., customer testimonials, internal screenshots, analytics exports). Categories of Personal Data are limited to what the Client provides and what Hooklift necessarily collects to deliver the services.

5. Hooklift Obligations

• Processing on instructions: Hooklift will process Personal Data only on documented instructions from the Client, including with respect to transfers to third countries, unless required to do so by applicable law.
• Confidentiality: Hooklift ensures that personnel authorized to process Personal Data are bound by a contractual or statutory duty of confidentiality.
• Security: Hooklift implements appropriate technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest, role-based access controls, and infrastructure hosted on SOC 2-compliant providers (Vercel, Supabase).
• Assistance to Controller: Taking into account the nature of the processing, Hooklift assists the Client by appropriate technical and organizational measures in fulfilling the Client's obligation to respond to Data Subject requests under GDPR Articles 12-22.
• Notification of breaches: Hooklift will notify the Client without undue delay (and in any event within 72 hours of becoming aware) of any Personal Data breach, providing the information necessary for the Client to comply with its own notification obligations.

6. Sub-processors

The Client provides general authorization for Hooklift to engage sub-processors. Hooklift currently uses the following sub-processors in connection with the services:

• Vercel Inc. — web hosting and edge delivery for the Hooklift Site and APIs.
• Supabase Inc. — database storage for audit-form submissions and lead-magnet email captures.
• OpenAI L.L.C. — language-model API used for the Hook Generator tool. Inputs to this tool are processed under OpenAI's zero-retention API terms.
• Arcads — AI avatar video synthesis used in the production pipeline. Used only with Client-provided or Hooklift-generated scripts; no end-user Personal Data is sent.
• ElevenLabs — voice synthesis for voiceover production.
• Google (Analytics 4), Meta Platforms (Pixel), PostHog — analytics and attribution providers, used only on the Hooklift Site, not on Client deliverables.

Hooklift will inform the Client of any intended changes to this list with at least 30 days' notice, and the Client may object to such changes on reasonable data-protection grounds.

7. International Transfers

Where processing involves the transfer of Personal Data outside the European Economic Area, the United Kingdom, or Switzerland, Hooklift relies on the EU-U.S. Data Privacy Framework where applicable, the Standard Contractual Clauses (Module Two: Controller-to-Processor) where the DPF does not apply, or, in respect of Canada-based operations, the European Commission's adequacy decision under GDPR Article 45.

8. Audits

Hooklift will make available to the Client all information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client, subject to reasonable confidentiality obligations and not more than once per calendar year, except where required following a Personal Data breach.

9. Return or Deletion of Data

On termination of the Agreement, Hooklift will at the Client's choice delete or return all Personal Data processed on the Client's behalf, unless retention is required by applicable law. Production assets and final deliverables remain the property of the Client and are returned in their delivered form.

10. Liability and Order of Precedence

The liability provisions of the Agreement apply to this DPA. In the event of conflict between this DPA and the Agreement, this DPA prevails with respect to data-processing matters.

11. Contact

For DPA-related inquiries, including Data Subject requests forwarded by the Client, use our DPO contact form.