Privacy Policy Addendum

International Transfers, Processors and Lawful Basis

Effective: 10 October 2025

1. Scope

This addendum supplements and forms part of the Signsold Ltd Privacy Policy. It explains where your data may be processed, the main third‑party processors we use, the safeguards in place for transfers across jurisdictions (including the UK, the US and New Zealand), and the legal basis for our core processing activities.

2. International transfers and key processors

Signsold Ltd is incorporated in New Zealand and uses third‑party service providers in the United States, the United Kingdom, New Zealand and other jurisdictions. Personal data you provide to us may therefore be processed in New Zealand, the United States, the United Kingdom or other countries where our service providers operate.

Key processors we use:

• Stripe — payment processing (may involve transfers to the United States and other jurisdictions).
• Outseta — billing, authentication, customer support and subscription management (may involve transfers to the United States and other jurisdictions).
• Other third‑party providers we use for service delivery (for example advertising platforms, analytics, hosting) may also process data in these or other jurisdictions.

3. Safeguards and contractual protections

We have entered Data Processing Agreements with our processors (including Stripe and Outseta) that set out the processors’ obligations regarding security, confidentiality, subprocessors, breach notification and assistance with data subject requests.

For transfers to jurisdictions that do not have an adequacy decision, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum where applicable, a Data Transfer Addendum or equivalent contractual safeguards, as provided or required by the processor.

Where applicable we also rely on technical and organisational measures such as tokenisation and encryption in transit and at rest (where supported by the processor), access controls, role‑based access and logging.

4. Lawful basis for core processing activities

Account creation, authentication, billing and subscription management: performance of a contract (necessary to provide the service you signed up for).

Customer support and service delivery: performance of a contract or our legitimate interests in operating the service.

Marketing communications: only with your consent (you will be given the option to opt‑in; you may opt‑out at any time).

Analytics and service improvement: our legitimate interests, where appropriate (we limit data to that necessary for the purpose).

5. Data retention after account cancellation

We retain account and transactional data only for as long as necessary to provide the service, to meet legal and tax obligations, to resolve disputes, and to maintain system integrity. After account cancellation we will retain necessary data for a limited period to allow us to: (a) satisfy legal obligations (for example financial record‑keeping), (b) prevent fraud, and (c) respond to enquiries.

We will retain account and related transactional data for up to 12 months after cancellation unless a longer retention period is required by law or to meet our contractual or regulatory obligations.

If you wish to request deletion of your data sooner, contact us and we will assess and action requests in accordance with applicable law and our contractual and legal obligations.

Note: some processors (for example payment processors) may retain payment‑related records for their own legal, tax or security purposes; please see the processor’s privacy/DPA for details.

6. Your rights

You have rights including access, correction, erasure, restriction, objection, portability and the right to complain to the relevant supervisory authority (for UK users, the Information Commissioner’s Office (ICO); for EU users, the relevant EU supervisory authority; for US users, applicable state regulators). To exercise any right, contact us and we will respond in line with statutory timeframes.

7. How to obtain copies of safeguards and processor details

We maintain Data Processing Agreements and rely on industry standard transfer safeguards with our processors. For published details on our processors’ transfer safeguards and security practices see their public documentation. For specific requests contact us and we will respond within a reasonable timeframe.

8. Contact us

Data protection contact: legal [at] signsold [dot] com