Data Processing Addendum (DPA)

Between: WISHGATE LTD, a company incorporated in Bulgaria (UIC 208871609), registered office ul. Stefan Peshev 76, fl. 1, 5400 Sevlievo, Gabrovo Province, Bulgaria ("Processor")
And: Organization using the Wishgate platform ("Controller")
Effective date: July 1, 2026
Contact: legal@wishgate.io

Purpose

This Data Processing Addendum ("DPA") applies when Wishgate processes personal data on behalf of organizations (Studios and Creators) registered on the platform. It supplements the Terms of Service and governs the data protection obligations between the parties.

1. Roles and Responsibilities

Controller

Each organization registered on Wishgate acts as a Data Controller for personal data it collects from its own partners, team members, and the personal data it inputs about its business activities on the platform.

Processor

Wishgate acts as a Data Processor when it stores and processes personal data on behalf of organization accounts, including:

• Partnership chat messages between organizations
• Audit log records for partnership events
• Team member data for organization members

Wishgate also acts as an independent Data Controller for account registration data, platform analytics, payment data, and platform security purposes.

2. Scope of Processing

Wishgate processes personal data on behalf of Controllers only to:

• Provide the platform service as described in the Terms of Service
• Enable communication between partner organizations (chat, announcements)
• Maintain partnership audit trails and submission records
• Fulfill technical support requests

Processing outside this scope requires additional written agreement.

3. Sub-processors

Wishgate uses the following sub-processors when processing Controller data:

We will notify Controllers of material changes to sub-processors with 14 days' notice.

4. Data Subject Rights

Where Wishgate receives a data subject request (access, erasure, portability) relating to data processed on behalf of an organization:

• We will forward the request to the relevant organization within 5 business days
• Organizations are responsible for responding to their own data subjects
• Wishgate will provide reasonable technical assistance to help organizations respond

5. Security

Wishgate implements technical and organizational measures proportionate to the risk, including:

• Encryption of data in transit (TLS 1.2+)
• Encryption of sensitive data at rest (Steam keys)
• Role-based access controls
• Periodic security reviews

6. Audit Rights

Controllers may request, no more than once per year, a summary report of Wishgate's data protection practices. More detailed audits may be arranged with reasonable notice at the Controller's cost.

7. Breach Notification

Wishgate will notify affected Controllers of any personal data breach without undue delay and within 72 hours of becoming aware, where the breach is likely to result in risk to natural persons.

8. Data Return and Deletion

Upon termination of an organization account:

• Chat messages and audit records may be retained for up to 3 years in accordance with our retention schedule (to preserve the rights of other parties in a partnership)
• Organization-specific data will be anonymized within 30 days of an account deletion request
• On written request, we will provide a data export in JSON format before deletion

9. Governing Law

This DPA is governed by the same jurisdiction as the Terms of Service. Where GDPR applies, this DPA is interpreted in accordance with GDPR requirements.