Data Processing Addendum

Quick read: When your site collects information about your visitors, leads, buyers or members, that information is yours and you decide how it is used. WebForger stores and processes it only to run your site and store for you, using the vendors listed on our Subprocessors page. We keep it secure, help you answer privacy requests, tell you promptly about breaches, and delete or return it when you leave. This addendum applies automatically to every account; there is nothing to sign.

1. Parties and roles

This Data Processing Addendum ("DPA") is between Always Digital Limited, a New Zealand company trading as HornTech and operating WebForger ("WebForger", "we", "us"), and the customer that holds the WebForger account ("you"). It applies whenever we process Customer Personal Information in providing the service.

"Customer Personal Information" means personal information about your site visitors, lead-form submitters, buyers, subscribers, members, reviewers and other end users that we hold or process on your behalf. It does not include information about you as our account holder, which our Privacy Policy covers.

For Customer Personal Information, you are the controller: you decide why and how it is collected and used. We are your processor: we hold and process it on your behalf and on your instructions. Under the New Zealand Privacy Act 2020, information we hold solely for you as your agent is treated as held by you (section 11), and we do not use or disclose it for our own purposes.

2. What we process and why

Depending on the features you use, Customer Personal Information may include:

• Visitor and analytics data: IP address and request metadata at the edge, page view and session statistics from our first-party analytics, ad click identifiers, and analytics and conversion events from your site.
• Lead and form data: names, contact details and messages submitted through your forms, which are screened for spam by an AI language model provider where spam filtering is enabled for your site.
• Buyer and order data: names, email addresses, phone numbers, billing and shipping addresses, order contents and history, refunds, and payment references (not card numbers).
• Customer account and programme data: buyer logins, subscriptions, gift card and store credit balances, loyalty points, membership tiers, wishlists and download history.
• Buyer content: product reviews, ratings and photos.
• Email data: recipient addresses, delivery and engagement events, and unsubscribe status for messages sent from your site.

We process Customer Personal Information only to provide, secure and support the service for you, including hosting your site, running your store and checkout, sending the emails you set up, producing your reports, and preventing abuse. We do not sell it, do not use it to advertise to your buyers for our own benefit, and do not use it to train AI models. We may use aggregated, de-identified statistics to operate and improve the platform, as described in the Terms.

Your instructions are the Terms, this DPA, and the settings you choose in the dashboard. If we believe an instruction breaches privacy law, we will tell you.

3. Your responsibilities

You are responsible for having a lawful basis to collect Customer Personal Information, for publishing a privacy policy on your site that tells your visitors and buyers what you collect and who processes it (including that it is stored offshore by our vendors), for obtaining any marketing consent the law requires, and for the accuracy of the information you ask us to process.

4. Subprocessors

You authorise us to use the subprocessors listed on our Subprocessors page. We require each subprocessor to protect personal information to a standard comparable to this DPA, and we remain responsible to you for their processing on our behalf. Some subprocessors (for example, AI model providers) are listed by category; we will confirm their identity to an account holder on written request, under confidentiality.

We will give at least 14 days' notice in the dashboard before adding a subprocessor that materially affects how we process Customer Personal Information. If you object on reasonable privacy grounds, tell us during the notice period; if we cannot address your concern, you may close the affected feature or your account before the change takes effect.

Payments are a special case. Stripe processes your buyers' payment details under its own agreement with you as your payment provider (see our Commerce Terms), not as our subprocessor for that processing.

5. Where data is stored

Customer Personal Information is stored on Cloudflare infrastructure, mainly in D1 databases and R2 object storage whose primary location is currently Cloudflare's Oceania region. Cloudflare's network is global and content may be served from or cached at edge locations worldwide. The other subprocessors on our list process it as described there; some of them are located outside New Zealand, including in the United States. We rely on our subprocessors' contractual and security commitments to protect information transferred across borders.

6. Security

We take reasonable security safeguards appropriate to the information, as required by Information Privacy Principle 5 and Australian Privacy Principle 11. These include:

• encryption in transit (HTTPS) for the dashboard, your site and our APIs;
• encryption at rest for stored data, as provided by Cloudflare for its D1, R2 and KV storage services, and additional application-level encryption for payment provider credentials you give us;
• authentication on every administrative interface, and access to production data limited to authorised personnel and systems that need it to operate and support the service;
• card data kept out of our systems entirely by using Stripe's hosted payment elements;
• edge protection against attacks, abuse and automated scraping.

7. Requests from your visitors and buyers

If someone asks us to access, correct or delete personal information that we hold for you, we will refer them to you and will not respond to the substance ourselves unless the law requires it. We will give you reasonable help to respond, for example by exporting or correcting records you cannot reach from the dashboard. Many requests can be handled directly in the dashboard, for example by looking up a buyer's orders and account.

8. Privacy breaches

If we become aware of a privacy breach affecting Customer Personal Information, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it. Our notice will describe what happened, the information and people likely to be affected, the steps we have taken, and a contact person. We will update you as we learn more.

As controller, you decide whether a breach is notifiable and you are responsible for notifying the Office of the Privacy Commissioner (New Zealand), the Office of the Australian Information Commissioner, and affected individuals where required. We will give you the information and reasonable assistance you need to do so. Where a breach is caused by our platform and affects many customers, we may also notify regulators directly in our own right.

9. When your account ends

After your account or a feature is closed, Customer Personal Information remains available for export during the export grace period in section 11 of the Terms. After that period we delete it, or de-identify it so it no longer identifies anyone, in the ordinary course of operations and no later than the end of the retention period for account and content records in section 9 of our Privacy Policy. We may keep information for longer only where the law requires it, and we will continue to protect it under this DPA while we hold it.

10. Information and audits

On reasonable written request, no more than once a year, we will answer a written security and privacy questionnaire and provide information reasonably needed to show that we comply with this DPA. We may also do so in response to a request from a privacy regulator with authority over you. On-site audits and access to our systems or our subprocessors' systems are not included, except where a regulator requires it; in that case we will cooperate on reasonable notice, at your cost, under confidentiality.

11. General

This DPA is governed by the same law, liability limits and dispute terms as the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Information, this DPA prevails. We may update it in the same way as the Terms. Privacy questions and breach reports: privacy@webforger.ai.

Document version: 1.0, 22 October 2026 (first public edition).