Data Processing Agreement for Creators

Last Updated: October 30, 2026

Signed copy (PDF)

This Data Processing Agreement (“DPA”) is incorporated into the Fourthwall Creator Terms of Service or other written agreement under which Fourthwall has agreed to provide services (“Agreement”) between the party using such services (“Creator”) and Fourthwall, Inc. (“Fourthwall”), each a “Party” and collectively the “Parties”. This DPA takes precedence over the Agreement to the extent of any conflict concerning its subject matter. Where applicable, the EU SCCs and UK Addendum take precedence over conflicting provisions of this DPA and the Agreement, subject to the hierarchy in the UK Addendum and the Swiss modifications in Section 7(d). Capitalized terms not defined herein are defined as in the Agreement or, if not defined there, as in applicable Data Protection Laws.

Application and execution. This DPA applies to Creator automatically when the Agreement incorporating it becomes binding on Creator, including through the Agreement’s amendment process (the “DPA Effective Date”). No separate request or signature is required. The Parties agree that the Agreement becoming binding on Creator constitutes the Parties’ electronic execution of this DPA and, to the extent legally required, of the EU SCCs, UK Addendum and Swiss terms under Section 7, effective on the DPA Effective Date. A copy signed by Fourthwall is available at fourthwall.com/legal/creator-dpa if Creator wants one for its records; signing or receiving that copy does not change this DPA, the DPA Effective Date or how this DPA is updated. If Creator signed a data processing agreement with Fourthwall before this DPA first became part of the Agreement, that agreement continues to govern the processing it covers unless the Parties agree otherwise in writing, and this DPA governs any other Processing of Personal Data.

Creator and Fourthwall agree as follows:

1. Definitions.

For purposes of this DPA:

a. “Data Protection Laws” means applicable laws, regulations, and other legally binding requirements relating to privacy, data security, or the Processing of Personal Data, including, to the extent applicable, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”); the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”); the GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”) and the United Kingdom Data Protection Act 2018; and the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”). For the avoidance of doubt, unless specified otherwise, references to “Data Protection Laws” herein mean Data Protection Laws that are applicable in a given situation.

b. “Data Subject” means an identified or identifiable natural person to whom Personal Data relates, and is deemed to also refer to “consumer” as defined in Data Protection Laws.

c. “EU SCCs” means the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as set forth herein.

d. “Personal Data” includes “personal data,” “personal information,” “personally identifiable information,” and analogous terms, as defined by applicable Data Protection Laws, that is contained in Creator’s User Content or relates to End Users or other customers of Creator, and that Fourthwall Processes on behalf of Creator under the Agreement to provide the Services to Creator.

e. “Process” and its cognates “Processing,” “Processed,” etc. mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

f. “Security Breach” means any accidental or unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

g. “Services” means the services that Fourthwall performs on behalf of Creator pursuant to the Agreement.

h. “Subprocessor” means any third party that Fourthwall engages to Process Personal Data on Creator’s behalf.

i. “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office, located at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf and completed as set forth herein.

j. The terms “Business,” “Controller,” “Processor,” and “Service Provider” are defined as in Data Protection Laws. “Controller” is deemed to also refer to “Business,” and “Processor” is deemed to also refer to “Service Provider.”

2. Roles of the Parties; Scope and Purposes of Processing.

a. This DPA applies to Personal Data that Fourthwall Processes on behalf of Creator under the Agreement. This DPA does not apply to Personal Data that Fourthwall Processes as an independent Controller, including in its activities as merchant of record for Product Orders, Memberships, and Donations (for example, to process payments, calculate and remit taxes, fulfill and ship orders, prevent fraud, and provide customer support to End Users); operation, improvement, and development of the Services; platform security and integrity; and complying with legal obligations, which Fourthwall Processes in accordance with its privacy policy. Where Fourthwall makes Personal Data about End Users that it Processes as an independent Controller available to Creator (for example, order or customer details shown in Creator’s account), Creator Processes that Personal Data as an independent Controller and is responsible for its own compliance with Data Protection Laws.

b. To the extent that Creator is the Controller of Personal Data, Fourthwall is its Processor. To the extent that Creator is a Processor of Personal Data, Fourthwall is its Subprocessor.

c. Fourthwall will Process Personal Data: (i) on Creator’s behalf; (ii) to fulfill its obligations to Creator under the Agreement, including this DPA; and (iii) in compliance with Data Protection Laws. For the avoidance of doubt, Fourthwall will Process Personal Data to provide the Services to Creator under the Agreement for the following express business purposes: (a) maintaining and servicing Creator’s account; (b) serving and rendering Creator Sites to End Users; (c) enabling communications between Creator and its End Users that Creator directs through the Services; (d) providing analytics, auditing, or verifying impressions related to Creator’s end user visits to Creator Sites; (e) debugging and ensuring the security and integrity of the Services in connection with Processing on Creator's behalf; (f) improving and enhancing the Services; (g) fulfilling orders for Products that Creator sells through a third-party marketplace it connects to the Services, such as TikTok Shop or Etsy (“Marketplace Orders”); and (h) as otherwise set forth in the Agreement.

d. Creator retains the right to take reasonable and appropriate steps to (i) ensure that Fourthwall Processes Personal Data in a manner consistent with Data Protection Laws, and (ii) upon written notice, stop and remediate unauthorized Processing of Personal Data that is not permitted by this DPA.

e. Creator will ensure that (i) it has provided all notices, obtained all consents, and has a lawful basis required under Data Protection Laws for Fourthwall to Process Personal Data under this DPA, and (ii) its instructions to Fourthwall comply with Data Protection Laws. Creator is solely responsible for its User Content, its own communications with End Users, and its collection, receipt, and use of personal data, including order and customer details that Fourthwall makes available to it, mailing lists, email tools, giveaways, and any apps, embeds, pixels, scripts, or integrations it adds to its Creator Site or account.

3. Personal Data Processing Requirements.

Fourthwall will, except as expressly authorized under Data Protection Laws:

a. Not retain, use, or disclose Personal Data outside of the direct business relationship between Creator and Fourthwall, or for any purpose (including any commercial purpose) not set forth in this DPA.

b. Not “sell” or “share” any Personal Data, or use Personal Data for purposes of “cross-context behavioral advertising,” as such terms are defined in Data Protection Laws in the United States.

c. Comply with any applicable restrictions under Data Protection Laws on combining Personal Data with personal data that Fourthwall receives from, or on behalf of, another person or persons, or that Fourthwall collects from any interaction between it and any individual.

d. Not attempt to link, identify, or otherwise create a relationship between Personal Data and any other data, without Creator’s express permission.

e. Ensure that the persons it authorizes to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

f. To the extent required by Data Protection Laws, provide Creator with reasonable assistance and cooperation for the fulfilment of Creator’s obligations under Data Protection Laws, including Creator’s obligation to (i) respond to requests by Data Subjects (or their lawful representatives) to exercise their rights under Data Protection Laws with regard to their Personal Data; (ii) perform any required data protection impact assessment for Processing of Personal Data; and (iii) consult with regulatory authorities in relation to the Processing of Personal Data. Except where prohibited by applicable law, Fourthwall will notify Creator of any Data Subject or government requests regarding Fourthwall’s Processing of Personal Data on Creator’s behalf, and except as prohibited by applicable law will await written instructions from Creator on how, if at all, to assist in responding. Creator will pay Fourthwall’s costs in providing assistance and carrying out any request under this Section.

g. Notify Creator if Fourthwall determines that (i) it can no longer meet its obligations under this DPA or Data Protection Laws; or (ii) in Fourthwall’s opinion, an instruction from Creator infringes Data Protection Laws.

4. Data Security.

Fourthwall will implement appropriate administrative, technical, physical, and organizational measures to protect Personal Data, including the measures described in Exhibit B, which Fourthwall may update from time to time provided that updates do not materially reduce the overall level of protection. Fourthwall will provide the same level of protection for Personal Data as is required under Data Protection Laws applicable to Creator.

5. Security Breach.

Fourthwall will notify Creator of any known Security Breach without undue delay after becoming aware of such Security Breach and to the extent required by Data Protection Laws. Fourthwall will comply with the Security Breach-related obligations directly applicable to it under Data Protection Laws and will reasonably assist Creator in its compliance with its Security Breach-related obligations, including by providing Creator with such information about the Security Breach as Fourthwall is reasonably able to disclose to Creator, taking into account the nature of the Services, the information available to Fourthwall, and any confidentiality or other restrictions on disclosing information. Fourthwall’s report or response to a Security Breach pursuant to this Section will not be construed as an acknowledgement by Fourthwall of any fault or liability of Fourthwall with respect to the Security Breach. Except to the extent required by Data Protection Laws or the transfer terms in Section 7, Fourthwall’s obligations under this Section do not apply to incidents that are caused by Creator, any activity on Creator’s accounts, or third-party services that Creator elects to use.

6. Subprocessors.

a. Creator acknowledges and agrees that Fourthwall may use Subprocessors to Process Personal Data in accordance with this DPA and Data Protection Laws. Fourthwall will enter into a written agreement with Subprocessors who process Personal Data on Fourthwall’s behalf, requiring them to comply with similar obligations to those imposed on Fourthwall under this DPA, to the extent applicable based on the nature of the Services provided by the Subprocessor.

b. Fourthwall will maintain a current list of its Subprocessors (the “Subprocessor List”), and Creator consents to Fourthwall’s use of the Subprocessors on the Subprocessor List. Fourthwall will give Creator the Subprocessor List, identifying each Subprocessor’s name, purpose and location, within a reasonable time after Creator requests it by email to legal@fourthwall.com. Subprocessors that manage, make, store or ship Marketplace Orders (“Fulfillment Subprocessors”) Process Personal Data on a Creator’s behalf only for Marketplace Orders, so they are Subprocessors of, and are included in the Subprocessor List and notices given under this Section 6(b) to, only Creators that sell through a third-party marketplace connected to the Services. Creator will keep the Subprocessor List confidential except as needed to comply with Data Protection Laws or as otherwise required by law. Fourthwall will give notice of any intended addition or replacement of a Subprocessor at least fourteen (14) days before the change takes effect, by updating the Subprocessor List and notifying directly each Creator that has requested it. Each notice will identify the intended addition or replacement. These notices are how Fourthwall informs Creator of intended changes, including under the transfer terms in Section 7. If Creator has not requested the Subprocessor List, it may request the current Subprocessor List at any time. Notwithstanding the foregoing, where Fourthwall reasonably determines that a change is urgently needed for security reasons or to keep the Services running, Fourthwall may make the change with shorter notice and will give notice as soon as practicable. If Creator reasonably objects to a new or replacement Subprocessor on data protection grounds within fourteen (14) days after notice, including notice of an urgent change, the Parties will cooperate in good faith to resolve the objection and, if they cannot, Creator may terminate the Services affected by the change as its sole and exclusive remedy.

c. Third-party services that Creator adds to or connects with its Creator Site or account, such as email marketing, analytics, advertising, or shipping tools, are not Subprocessors. Fourthwall makes Personal Data available to them at Creator’s direction, and their Processing is governed by Creator’s own terms with their providers.

7. Data Transfers.

a. Creator authorizes Fourthwall and its Subprocessors to make international transfers of Personal Data in accordance with this DPA so long as the Data Protection Laws applicable to such transfers are respected.

b. To the extent legally required, by entering into this DPA, Creator and Fourthwall are deemed to have signed the EU SCCs, which form part of this DPA and (except as described in Section 7(c) below) are deemed completed as follows:

i. Module 2 of the EU SCCs applies to transfers of Personal Data from Creator (as a Controller) to Fourthwall (as a Processor), and Module 3 of the EU SCCs applies to transfers of Personal Data from Creator (as a Processor) to Fourthwall (as a Subprocessor);

ii. Clause 7 (the optional docking clause) is not included;

iii. Clause 9 (Use of sub-processors): The Parties select Option 2 (General written authorization). The initial list of Subprocessors is the Subprocessor List, and the time period for prior notice of changes is fourteen (14) days;

iv. Clause 11 (Redress): The optional language requiring that data subjects be permitted to lodge a complaint with an independent dispute resolution body is not included;

v. Clause 17 (Governing law): The Parties choose Option 1 (the law of an EU Member State that allows for third-party beneficiary rights) and select the law of Ireland;

vi. Clause 18 (Choice of forum and jurisdiction): The Parties select the courts of Ireland;

vii. Annexes I (List of Parties) and II (Technical and organizational measures) are completed as set forth in Exhibit A and Exhibit B, respectively; and

viii. Annex III (List of subprocessors) is not applicable because the Parties have chosen General Authorization under Clause 9.

c. To the extent legally required, by entering into this DPA, the Parties are deemed to be signing the UK Addendum, which forms part of this DPA and takes precedence over the rest of this DPA as set forth in the UK Addendum. The Tables within the UK Addendum are deemed completed as follows:

i. Table 1: The Parties’ details and Key Contacts are those set out in Exhibit A below, and the Start Date is the DPA Effective Date.

ii. Table 2: The Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties and completed in Section 7(b) of this DPA.

iii. Table 3: Annexes I and II are set forth in Exhibit A and Exhibit B, respectively. Annex III is inapplicable.

iv. Table 4: Creator, as exporter, may end the UK Addendum as set out in Section 19 of the UK Addendum.

d. To the extent legally required, the EU SCCs, completed as set forth in Section 7(b), also apply to transfers of Personal Data subject to the FADP, with the following modifications to the extent required by the FADP: (i) references to Regulation (EU) 2016/679 are interpreted as references to the FADP; (ii) the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner; and (iii) the term “Member State” is not interpreted in a way that excludes data subjects in Switzerland from bringing legal proceedings in their place of habitual residence in Switzerland in accordance with Clause 18(c).

8. Additional Safeguards.

To the extent permitted by applicable law, Fourthwall will notify Creator of any request by any government or law enforcement entity regarding Personal Data, and will make commercially reasonable objections and challenges to any such request, including to any prohibition on notifying Creator of any such request. Unless otherwise required by applicable law, Fourthwall will await written instructions from Creator on how, if at all, to assist in responding to any such request, and will render Creator reasonable assistance and cooperation in relation to any such request.

9. Audits.

To the extent permitted by Data Protection Laws, Creator agrees to exercise any rights to conduct an audit to verify the adequacy of Fourthwall’s security measures by instructing Fourthwall to carry out such audit using its own external or internal auditors. Creator agrees that it may be required to agree to a non-disclosure agreement before Fourthwall shares any report from such audit with Creator, and that Fourthwall may redact any such report as it considers appropriate. Where Creator is legally required by Data Protection Laws to demonstrate compliance with means other than such a report, the Parties will cooperate in good faith to agree on a plan for complying with the applicable requirements. The Parties agree to use the least intrusive means for Fourthwall to address Creator’s request, taking into account legal requirements, the sensitivity of the Personal Data involved, information otherwise available to Creator, and the need for Fourthwall to maintain its business operations, confidentiality, and security of its facilities. Any audit or inspection conducted by Creator or another auditor under this Section shall occur not more than once every twelve (12) calendar months, upon thirty (30) days’ prior written notice, and to the extent Fourthwall’s personnel are required to cooperate therewith, during Fourthwall’s normal business hours. Creator will pay Fourthwall’s costs in carrying out any audit or addressing any request under this Section.

10. Return or Destruction of Personal Data.

Except to the extent required by Data Protection Laws, Fourthwall will, at Creator’s election, return to Creator and/or delete Personal Data within thirty (30) days after (a) Creator’s written request, to the extent the Personal Data is no longer needed to provide the Services, or (b) termination of the Agreement, except that Fourthwall may retain Personal Data to the extent required by applicable law or in backup or archival systems until it is deleted in the ordinary course, and any retained Personal Data will remain subject to this DPA. Except to the extent prohibited by Data Protection Laws, Fourthwall will inform Creator if it is not able to return or delete Personal Data.

11. Indemnification and Limitation of Liability.

To the extent permitted by Data Protection Laws, the provisions on indemnification and limitation of liability in the Agreement apply to this DPA.

12. Updates.

Fourthwall may update this DPA through the Agreement’s amendment process. Before an update takes effect, Fourthwall will notify Creator of it and its effective date directly, by email or through the Services, and the update takes effect after the period stated in that notice. Changes to the Subprocessor List and to the measures in Exhibit B are made under Sections 6(b) and 4, not this Section.

Signing is optional; this DPA applies without a signature. SIGNED by the Parties or their duly authorized representatives:

Exhibit A

ANNEX I TO THE EU SCCS

A. LIST OF PARTIES

Data exporter(s):

• Name: Creator’s legal name, as recorded in its Fourthwall account or otherwise provided to Fourthwall in writing (including in a signed copy of this DPA).
• Address: Creator’s address, as recorded in its Fourthwall account or otherwise provided to Fourthwall in writing (including in a signed copy of this DPA).
• Contact person’s name, position, and contact details: Creator’s contact details, as recorded in its Fourthwall account or otherwise provided to Fourthwall in writing (including in a signed copy of this DPA).
• Activities relevant to the data transferred under these Clauses: The data exporter receives the data importer’s Services pursuant to their underlying Agreement.
• Signature and date: The Parties agree that execution of the DPA, including when the Agreement incorporating it becomes binding on Creator on the DPA Effective Date, shall constitute execution of these EU SCCs by both parties.
• Role: Controller (Module 2) or Processor (Module 3)

Data importer(s):

• Name: Fourthwall, Inc.
• Address: 2041 East St. Suite 1090, Concord, CA 94520, United States
• Contact person’s name, position, and contact details: Privacy team, privacy@fourthwall.com
• Activities relevant to the data transferred under these Clauses: The data importer provides Services to the data exporter pursuant to their underlying Agreement.
• Signature and date: The Parties agree that execution of the DPA, including when the Agreement incorporating it becomes binding on Creator on the DPA Effective Date, shall constitute execution of these EU SCCs by both parties.
• Role: Processor

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred: The Personal Data transferred concerns individuals whose Personal Data is contained in Creator’s User Content or is otherwise Processed by Fourthwall on Creator’s behalf under the DPA, which may include End Users of Creator Sites and buyers and recipients of Marketplace Orders.

Categories of personal data transferred: The Personal Data transferred concern the following categories of data: names and other identifiers, contact details, social media profiles, communications, images, audio, and video, usage data relating to visits to Creator Sites, and order and shipping details for Marketplace Orders, in each case to the extent contained in Creator’s User Content or otherwise Processed by Fourthwall on Creator’s behalf under the DPA. This does not include Personal Data that Fourthwall Processes as an independent Controller, such as payment, order, and fulfillment data for Product Orders and Donations, to the extent Fourthwall Processes such data for its own purposes as an independent Controller.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuous for the duration of the Agreement.

Nature of the processing: Fourthwall’s Processing activities shall be limited to those discussed in the Agreement and the DPA.

Purpose(s) of the data transfer and further processing: The purpose of the transfer to and further Processing of Personal Data by Fourthwall is for Fourthwall to provide the Services to Creator as set forth in the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Personal Data will be retained for the period of time necessary for Fourthwall to provide the Services to Creator under the Agreement and/or in accordance with applicable legal requirements.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Same as above to the extent that Personal Data is provided to Subprocessors for purposes of providing the Services.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority is determined in accordance with Clause 13 of the EU SCCs and will generally be the supervisory authority of the EU Member State in which the data exporter is established. For transfers subject to the UK GDPR, it is the UK Information Commissioner’s Office, and for transfers subject to the FADP, it is the Swiss Federal Data Protection and Information Commissioner.

Exhibit B

ANNEX II TO THE EU SCCS – TECHNICAL AND ORGANIZATIONAL MEASURES

Fourthwall maintains the following technical and organizational measures to protect Personal Data.

• Security program: A written information security program with policies approved by management and reviewed at least annually.
• Access control: Role-based access controls designed to limit access to personnel with a business need, with access rights reviewed at least quarterly; multi-factor authentication for administrative and production access; and removal of access upon termination.
• Encryption: Personal Data encrypted in transit over public networks using TLS and at rest using industry-standard encryption provided by Fourthwall’s cloud infrastructure.
• Infrastructure and physical security: Systems hosted with established cloud providers whose data centers maintain physical access controls, monitoring, and environmental protections.
• Logging and monitoring: Logging of access to production systems and monitoring for security events and errors.
• Vulnerability management: Automated vulnerability and dependency scanning, patching of systems and dependencies with remediation prioritized by severity, and periodic third-party penetration testing.
• Backups and continuity: Daily backups with point-in-time recovery, and restoration procedures that have been tested.
• Personnel: Confidentiality obligations for personnel with access to Personal Data, and security awareness training at onboarding and periodically thereafter.
• Subprocessor management: Review of the security practices of new Subprocessors before engagement.
• Incident response: A documented process for detecting, containing, investigating, and notifying Security Breaches in accordance with Section 5.