Data Processing Agreement

Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms & Conditions between the customer (“Controller”, “you”) and Alan King Group, a trade name of Happy Trading LLC, a Wyoming limited liability company (“Processor”, “we”), and applies where we process Personal Data on your behalf through the AKG Operator platform (the “Services”).

Where there is a conflict between this DPA and the Terms with respect to processing of Personal Data, this DPA controls. To request a counter-signed copy, email alan@akings.com.

1. Definitions

• · “Personal Data”, “Controller”, “Processor”, “Data Subject”, “Processing”, and “Sub-processor” have the meanings given in applicable data-protection law (including the GDPR/UK GDPR and the CCPA/CPRA).
• · “Customer Personal Data” means Personal Data we process on your behalf under the Services (e.g., your customers' order and contact information).
• · “Applicable Data Protection Law” means all privacy and data-protection laws that apply to the processing.

2. Roles and scope

You are the Controller (or a processor acting for another controller) and we are the Processor of Customer Personal Data. We process Customer Personal Data on your documented instructions (including via your configuration and use of the Services), to provide and support the Services, to secure and improve our Services, to develop and train our AI models using de-identified or aggregated data, and as required by law. We will tell you if we believe an instruction violates Applicable Data Protection Law.

Under the CCPA/CPRA, we act as a “service provider” and will not sell or share Customer Personal Data. We retain, use, and disclose it to perform the Services and to build and improve our Services (including, using de-identified or aggregated data, the AI models that power them) as permitted by the CCPA, and not for other purposes.

3. Your responsibilities

You are responsible for the accuracy and lawfulness of Customer Personal Data and for having all necessary rights, notices, and consents (including marketing consents under CAN-SPAM and TCPA) to provide it to us and to instruct our processing.

4. Confidentiality

We ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and process it only as needed to perform their duties.

5. Security

We implement appropriate technical and organizational measures designed to protect Customer Personal Data, including encryption in transit and at rest, access controls and least-privilege access, logging, and a documented incident-response process. We periodically review these measures and may update them provided protection is not materially reduced.

6. Sub-processors

You provide general authorization for us to engage Sub-processors to provide the Services. Our current Sub-processors are listed at alankinggroup.com/subprocessors. We impose data-protection obligations on each Sub-processor substantially similar to those in this DPA and remain responsible for their performance.

We will provide at least 15 days' notice (by updating the list and/or email) before adding or replacing a Sub-processor. You may object on reasonable data-protection grounds within 10 days; if we cannot reasonably address the objection, you may terminate the affected Services.

7. Assistance with data-subject rights

Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to Data Subjects exercising their rights (access, correction, deletion, portability, restriction, and objection). Where Data Subjects contact us directly, we will refer them to you.

8. Personal-data breach

We will notify you without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data, and will provide information reasonably available to help you meet your notification obligations, together with the measures we are taking to mitigate it.

9. Data-protection impact assessments

We will provide reasonable assistance with data-protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to us.

10. International transfers

Where we transfer Customer Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (and the UK Addendum/Swiss amendments, as applicable) are incorporated into this DPA by reference and apply to that transfer.

11. Use of AI and third-party AI providers

We use Customer Personal Data to provide and improve the Services. Where we develop or train our own AI models, we use de-identified or aggregated data only, and the Customer may opt out of model-improvement use by emailing alan@akings.com. We treat Customer Personal Data as confidential. AI features are powered by third-party AI providers, currently including Anthropic, OpenAI, Google (Gemini), Kling, and Higgsfield, which process data under their own terms. You are responsible for reviewing those providers’ terms and policies, to which your use of the Services may be subject. You can choose which providers we use on your data, or disable specific ones, by emailing alan@akings.com. AI outputs are provided for your review, and you remain responsible for content you choose to send or publish.

12. Return and deletion

Upon termination of the Services or your written request, we will return and/or delete Customer Personal Data within 90 days, except where retention is required by law, in which case we will protect it and limit further processing.

13. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits no more than once per year, on reasonable prior notice and subject to confidentiality. Where available, we may satisfy audit requests by providing then-current third-party reports or certifications.

14. Liability and term

Each party's liability under this DPA is subject to the limitations of liability in the Terms. This DPA takes effect when incorporated into the Terms and continues for as long as we process Customer Personal Data; provisions that should survive termination will do so.

15. Contact

• · Email: alan@akings.com
• · Alan King Group (Happy Trading LLC), 30 N Gould St., Suite R, Sheridan, WY 82801, USA