Data Processing
Addendum

This Data Processing Addendum ("DPA") forms part of the Gumroad Terms of Service (the "Agreement") between Gumroad, Inc. ("Gumroad") and the seller using the Services (the "Seller"), and applies to the extent Gumroad processes personal data on behalf of the Seller and that processing is subject to the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the GDPR as incorporated into United Kingdom law (the "UK GDPR"), or other applicable data protection laws that require these terms ("Data Protection Laws").

This DPA is incorporated into the Agreement by reference and takes effect automatically for Sellers within its scope. No signature is required. If you require a countersigned copy for your records, contact us at support@gumroad.com.

1. Roles of the Parties

Gumroad acts as a processor on behalf of the Seller when it hosts, stores, and delivers the Seller's products and content to buyers and stores buyer information (such as names, email addresses, and shipping details) that the Seller collects through the Services for the Seller's own purposes, such as audience management, email updates, and workflows. In respect of that processing, the Seller is the controller and Gumroad processes the personal data described in Section 3 ("Seller Data") only in accordance with this DPA.

Gumroad acts as an independent controller when it processes personal data for its own purposes, including processing payments and payouts as merchant of record, fraud prevention and risk management, tax collection and reporting, compliance with its own legal obligations, and operating, securing, and improving the Services. Processing carried out by Gumroad as a controller is described in the Privacy Policy and is not subject to this DPA.

2. Instructions

Gumroad will process Seller Data only on the Seller's documented instructions, including with regard to transfers of personal data to a third country, unless required to do so by applicable law; in that case Gumroad will inform the Seller of the legal requirement before processing unless the law prohibits it. The Seller's instructions are: (a) the Agreement and this DPA; and (b) the Seller's configuration and use of the features of the Services. Gumroad will inform the Seller if, in its opinion, an instruction infringes Data Protection Laws.

3. Details of Processing

• Subject matter and duration - The provision of the Services to the Seller under the Agreement, for the term of the Agreement plus the deletion period in Section 9.
• Nature and purpose - Hosting, storage, and delivery of the Seller's products; collection and storage of buyer information on the Seller's behalf; sending the Seller's emails, updates, and workflows to the Seller's audience; and related support and analytics features of the Services.
• Categories of data subjects - Buyers, subscribers, followers, and other end users who interact with the Seller through the Services.
• Categories of personal data - Name, email address, shipping and billing address, country, purchase and subscription history, and any other personal data the Seller chooses to collect from its buyers through the Services. The Services are not intended for the processing of special categories of personal data on the Seller's behalf, and the Seller agrees not to submit such data.

4. Confidentiality

Gumroad ensures that persons authorized to process Seller Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of natural persons, Gumroad implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. These measures include encryption of data in transit, access controls and authentication requirements for personnel, logging and monitoring, and vendor security review. Information about how we protect accounts is available in the Privacy Policy.

6. Subprocessors

The Seller provides a general authorization for Gumroad to engage subprocessors to process Seller Data in connection with the Services. Gumroad maintains a current list of its subprocessors, including their purpose and processing location, in the Gumroad's subprocessors help center article.

Gumroad will update that list at least 30 days before adding or replacing a subprocessor. The Seller may object to a new subprocessor on reasonable, documented data protection grounds by contacting support@gumroad.com before the new subprocessor begins processing Seller Data; if the objection cannot be resolved, the Seller may terminate its account. Gumroad imposes data protection obligations on its subprocessors that are materially equivalent to those in this DPA and remains liable for their performance.

7. Assistance

Taking into account the nature of the processing, Gumroad will assist the Seller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Seller's obligation to respond to requests from data subjects exercising their rights under Data Protection Laws. The Services include features that allow the Seller to access, export, correct, and delete buyer information. If a data subject contacts Gumroad directly about processing carried out on the Seller's behalf, Gumroad will direct the data subject to the Seller.

Gumroad will also assist the Seller, taking into account the nature of the processing and the information available to Gumroad, in ensuring compliance with the Seller's obligations regarding security of processing, notification of personal data breaches, data protection impact assessments, and prior consultation under Articles 32 to 36 GDPR.

8. Personal Data Breach

Gumroad will notify the Seller without undue delay after becoming aware of a personal data breach affecting Seller Data, and will provide information reasonably available to Gumroad to assist the Seller in meeting its breach notification obligations under Data Protection Laws.

9. Deletion and Return

Upon termination of the Agreement, or earlier at the Seller's choice through the export and deletion features of the Services, Gumroad will delete or return Seller Data, and delete existing copies, unless applicable law requires storage of the personal data. Gumroad retains data it processes as an independent controller (such as transaction records required for tax, accounting, and fraud prevention purposes) in accordance with the Privacy Policy.

10. Audits

Gumroad will make available to the Seller information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by the Seller or an auditor mandated by the Seller. Gumroad may satisfy audit requests by providing documentation, summaries of third-party assessments, or written responses to reasonable information requests, and any on-site inspection requires reasonable prior notice, must not disrupt the Services, and is at the Seller's expense.

11. International Transfers

Gumroad is headquartered in the United States and processes Seller Data in the United States and in the locations listed for each subprocessor. For transfers of Seller Data from the European Economic Area, the United Kingdom, or Switzerland to countries not covered by an adequacy decision applicable to the recipient, the parties enter into the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914 (the "SCCs"), which are incorporated into this DPA by reference as follows:

• Module Two (controller to processor) applies, with the Seller as data exporter and Gumroad as data importer
• Clause 7 (docking clause) is included; Clause 9 option 2 (general authorization) applies with the notice period in Section 6; Clause 11 optional language is not included; Clause 17 option 1 applies with Irish law governing; Clause 18 designates the courts of Ireland
• Annex I is completed with the details in Sections 1 and 3 of this DPA, and the competent supervisory authority under Annex I.C is the supervisory authority of the EEA member state in which the Seller (as data exporter) is established; Annex II is completed with the measures described in Section 5; Annex III is the subprocessor list referenced in Section 6
• For transfers subject to the UK GDPR, the SCCs apply as amended by the UK International Data Transfer Addendum issued by the UK Information Commissioner, and for transfers subject to Swiss law, the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner.

12. General

In the event of a conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict with respect to the processing of Seller Data. In the event of a conflict between this DPA and the SCCs, the SCCs prevail. Any claims under this DPA are subject to the limitations of liability in the Agreement. Gumroad may update this DPA from time to time to reflect changes in Data Protection Laws or the Services; material changes will be reflected in the "last revised" date above.