Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Rebel Audio Terms of Service (the "Terms") between Rebel Audio, Inc. and the account holder who accepts it ("you"). It applies only where you are a controller (or a processor for someone else) of personal data that Rebel processes for you, as Privacy Policy section 8 describes: the voices and images in your recordings, the guests and crew you credit, and the mail your show receives.

1. Parties, scope and roles

1.1 Parties. Rebel Audio, Inc., 1103 Tulloss Road, Franklin, TN 37067, United States ("Rebel", contact engineering@rebelaudio.ai), and you.

1.2 Definitions. "Data Protection Law" means every law on personal data that applies to the processing: the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the California Consumer Privacy Act as amended (CCPA) and other US state privacy laws. "Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings in the GDPR, and the matching terms in other Data Protection Law ("business", "service provider") are read the same way. "Customer Personal Data" means personal data in Your Content (as the Terms define it) that Rebel processes for you.

1.3 Roles. For Customer Personal Data you are the controller (or a processor acting for your own client) and Rebel is your processor (or subprocessor).

1.4 Rebel as a controller. Rebel is an independent controller, outside this DPA, of the data it processes for its own purposes: your account, billing, security and abuse prevention, product analytics, listener download counting, and compliance with law. The Privacy Policy governs that data.

1.5 Platforms you publish to. When you tell Rebel to publish to Spotify, Apple Podcasts, YouTube or another destination, the recipient receives the data as an independent company under its own terms. Rebel's role in that transfer is to carry out your instruction.

2. Annex I: details of the processing

3. Rebel's obligations (GDPR Art. 28(3))

3.1 Instructions. Rebel processes Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA and what you do in the Service (for example, uploading, publishing, dubbing or deleting). Rebel tells you if it thinks an instruction breaks Data Protection Law, unless the law forbids telling you. If the law requires Rebel to process the data otherwise, Rebel tells you first where the law allows.

3.2 Your responsibilities. You confirm you have a lawful basis and have given the notices needed for the processing, including consent from people you record, credit or dub (Privacy §8, Terms §6).

3.3 Confidentiality. Everyone at Rebel authorised to process Customer Personal Data is bound by confidentiality.

3.4 Security. Rebel applies the measures in Annex II (section 8) and keeps them at least as protective while this DPA applies.

3.5 Data subject requests. If a data subject contacts Rebel about Customer Personal Data, Rebel refers them to you and does not answer for you, unless the law requires it to act directly. The Service lets you find, correct, export and delete the data yourself. Rebel helps further on request where you cannot do so in the Service.

3.6 Personal data breaches. Rebel notifies you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice is sent to your account email and says what is known: the nature of the breach, the categories and approximate number of people and records, likely consequences, and what Rebel has done. Rebel updates you as it learns more. A notice is not an admission of fault.

3.7 Assistance. Rebel gives you the information you reasonably need for data protection impact assessments and prior consultations, taking into account what Rebel knows.

3.8 Deletion at the end. When you delete content or your account, Rebel deletes the Customer Personal Data as Privacy §10 describes: from active systems promptly, after the 7-day account-deletion grace period, and from encrypted backups within 35 days. Before you delete, you can download your content. Rebel keeps a copy only where the law requires it.

3.9 Information and audits. Rebel makes available the information needed to show it meets Art. 28, starting with this DPA, the Subprocessors page and written answers to reasonable security questionnaires (at most once a year, unless a breach or a regulator requires more). If that is not enough, you may audit through an independent auditor bound by confidentiality, at your cost, on 30 days' notice, during business hours, and without access to other customers' data.

4. Subprocessors (Annex III)

4.1 General authorisation. You authorise Rebel to use the subprocessors listed at rebelaudio.app/subprocessors (Annex III). Rebel binds each one by a written contract that imposes data protection obligations no less protective than this DPA, and remains liable to you for their performance.

4.2 Changes. Rebel gives at least 14 days' notice before adding or replacing a subprocessor, by updating the Subprocessors page and emailing account holders. In an emergency (for example, to keep the Service running or secure), Rebel may make the change first and give notice as soon as it can.

4.3 Objection. You may object on reasonable data protection grounds within the notice period by writing to engineering@rebelaudio.ai. Rebel will try to address the objection. If it cannot, you may end the Terms and Rebel refunds the unused part of any prepaid fees.

4.4 Annex III as of 19 October 2026 (Customer Personal Data reaches only the ones marked):

The current Annex III is the live Subprocessors page.

5. International transfers

5.1 Where. Rebel processes Customer Personal Data in the United States, and its subprocessors where Annex III says.

5.2 EU. Where you are in the EEA (or subject to the GDPR) and a transfer to Rebel is a restricted transfer, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference: Module 2 where you are a controller, Module 3 where you are a processor. For them:

• Clause 7 (docking) applies.
• Clause 9(a): Option 2, general authorisation, with the notice period in section 4.2.
• Clause 11: the optional redress language does not apply.
• Clause 13: the supervisory authority of the EU member state where you are established, or where your representative is.
• Clauses 17 and 18: the law and courts of Ireland.
• Annex I is section 2 of this DPA; Annex II is section 8; Annex III is section 4.4.

5.3 UK. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum (version B1.0, issued by the ICO under s.119A DPA 2018) applies on top of the SCCs, with the Table 1–4 details taken from this DPA. Neither party may end the Addendum under its Section 19.

5.4 Switzerland. For transfers subject to the Swiss FADP, the SCCs apply with the FDPIC as the competent authority and Swiss law references read in.

5.5 Conflict and alternatives. If the SCCs conflict with this DPA, the SCCs win. If Rebel later certifies to the EU-US Data Privacy Framework (and its UK and Swiss extensions), Rebel may rely on that certification instead, and tells you.

6. US state privacy laws

6.1 Where you are a "business" under the CCPA, or a controller under another US state privacy law, Rebel is your service provider or processor, and Rebel:

• processes Customer Personal Data only for the business purposes in section 2 and the Terms;
• does not sell or share it (as the CCPA defines those words), and does not use it for cross-context behavioural advertising;
• does not retain, use or disclose it outside the direct business relationship with you, and does not combine it with personal data from other sources except as the law allows a service provider to;
• complies with the law that applies and gives the same level of privacy protection it requires;
• tells you if it can no longer meet these obligations;
• lets you take reasonable steps to stop and remedy unauthorised use, as section 3.9 describes.

6.2 Rebel certifies that it understands and will comply with the restrictions in section 6.1.

7. Liability, term and precedence

7.1 Liability. Each party's liability under this DPA is subject to the limits in Terms §17, except where Data Protection Law or the SCCs do not allow them to apply (for example, a data subject's own rights against either party).

7.2 Term. This DPA applies for as long as Rebel processes Customer Personal Data for you, and survives the end of the Terms until the data is deleted.

7.3 Order of precedence. If documents conflict: first the SCCs (where they apply), then this DPA, then the Terms, then the Privacy Policy.

7.4 Changes. Rebel may update this DPA with notice, like the Terms (§21). An update never lowers the protection for Customer Personal Data unless the law requires it.

7.5 Governing law. The Terms' governing law (New York) applies, except where the SCCs or Data Protection Law require another law.

8. Annex II: technical and organisational measures

Each measure below is what Rebel runs today (Privacy §11 and the code). Nothing here claims a certification or a penetration test Rebel does not have.