Data processing addendum

Data processing addendum

Last updated: October 6, 2026

This addendum applies when an organization uses Wavemaker and Adwave Digital Inc. processes personal data on that organization’s behalf. It supplements the Terms of Service and Privacy Policy. It is readable without an account. It is not a signed order form and does not enroll an organization by itself.

When you use Wavemaker as an individual, Adwave is the controller of that account as described in the Privacy Policy. This addendum does not change that.

Roles

• The organization customer is the controller (or equivalent “business”) of personal data it submits about its members and the content it directs Wavemaker to process.
• Adwave is the processor (or “service provider”) for that customer data.
• Adwave remains controller of its own account, billing, security, abuse-prevention and service-operation records.

Members of an organization should send data-subject requests to that organization first. Adwave will reasonably assist the organization.

Processing

Adwave processes customer personal data only to provide, secure and maintain the Service, to prevent abuse and fraud, and to comply with law, as described in the Privacy Policy and the organization’s instructions in the product.

Adwave does not sell customer personal data and does not use it to train foundation AI models.

Subprocessors

The organization authorizes Adwave to use the service providers listed at Service providers and subprocessors. Adwave remains responsible to the organization for those providers’ processing of customer personal data in connection with the Service.

Security and incidents

Adwave maintains the technical and organizational measures described in Security and recovery and the Privacy Policy. If Adwave confirms a personal-data breach affecting customer personal data, it will notify the organization without undue delay and as required by applicable law.

International transfers

Customer personal data may be processed in the United States and other countries where Adwave or its providers operate. Where a transfer from the EEA, UK or Switzerland requires a safeguard, Adwave relies on Standard Contractual Clauses, the UK Addendum, or an adequacy decision, as described in the Privacy Policy.

Assistance, deletion and return

The organization can access, export and delete customer data through the product controls described at Export and privacy rights. After the organization closes the relevant workspace or account, Adwave deletes or returns customer personal data from active systems except records it must retain as controller (for example security, payment, moderation and agreement records) or as required by law. Encrypted recovery copies are independent of the active database and are handled as described in the Privacy Policy.

Term

This addendum lasts for as long as Adwave processes customer personal data for the organization. The Terms govern liability, indemnity, governing law and dispute resolution. If this addendum conflicts with the Privacy Policy on processor topics, this addendum controls for organization-customer processing.

Contact

[email protected] [email protected] Adwave Digital Inc., 8 The Green, Ste A, Dover, DE 19901, United States