Brand Terms

Version 2026-09-23

Previous versions: 2026-09-08

These are the terms on which Crowdable SIA, a private limited company registered in Latvia at Ventspils nov., Tārgales pag., Tārgale, "Zelmeņi" - 4, LV-3621, registration number 40203708984 ("we", "us"), lets a brand ("you") run an ambassador programme on Crowdable. They are written to be read by the person who runs your programme as well as by the lawyer who reviews them, so where a clause limits what you may do, we have tried to say why.

Three documents make up what is between us: these terms; our Privacy Policy, which says what we do with personal data and forms part of these terms; and any agreement we have signed with you. Where a signed agreement conflicts with these terms on price, term, service levels or liability, the signed agreement wins. Where the Privacy Policy and Schedule 1 describe the same thing, they are meant to agree, and if they ever appear not to, tell us and we will fix the drafting rather than argue about which prevails.

The people in your programme have their own contract with us, the Ambassador Terms. You are not a party to it and it is not a party to this. Section 2 explains what that means in practice, and it is the most important section here.

1. What Crowdable is, and what you are

Crowdable is a platform. A person joins Crowdable once, with one account, and can be an ambassador for many brands with it. We decide who may have an account, we set the rules every ambassador follows, we run the community surfaces, we moderate and enforce, and we hold and protect the data. That makes us the controller of every piece of personal data in the product: the account, the profile, and everything that happens inside your programme. The Privacy Policy is the notice every ambassador reads, and it names us.

You run a programme inside that. You decide what your programme is called and looks like, who you accept into it, what your campaigns ask for, what a submission is worth, and what rewards you offer. Those are your decisions and we carry them out as the platform. To make them you receive some of the personal data we hold, and for what you receive you are an independent recipient: a controller in your own right of the copy in your hands, for the purposes Schedule 1 allows and no others. You are not our processor and we are not yours. There is no data processing agreement between us because the law does not require one for this relationship; what it requires is that we tell people plainly who receives their data and why, and that you use what you receive only for that. Schedule 1 is where both of those live.

You have no contract with your ambassadors. They accepted the Ambassador Terms with us. Your programme rules (section 3) are conditions of being in your programme, and an ambassador who breaks them can be removed from it, but they are not a contract between you and that person, and you may not present them as one. We do not employ ambassadors and neither do you by running a programme here; section 12 says more.

If you are also an ambassador in someone else's programme, both roles apply to you, each in its own place.

2. What you get, and what you do not

You get a workspace: the brand-side surface where you set up your programme, review applications, run campaigns, award points, fulfil rewards, answer support in your lane, and see who is in your programme and what they have done. Everything in it is described in the product itself and in the Privacy Policy's account of what a brand receives.

What you do not get, stated so nobody assumes it:

• You do not get the ambassador. Their account, profile, social handles and history across other programmes are ours to hold and theirs to control. You see what Schedule 1 says you see. When they leave your programme, or you remove them, you lose access to them and keep only what Schedule 1 lets you keep.
• You do not get a contract with them. See section 1.
• You do not get verification. We have no connection to Instagram, TikTok, YouTube or any other network: no login, no API, no scraping. Every follower count and reach figure in your workspace was typed in by a person, and proof of a post is a link and a screenshot. Treat those numbers as claims.
• You do not get exclusivity. An ambassador may be in other programmes, including a competitor's. If you need exclusivity, that is a term to negotiate with us in a signed agreement, and we will tell you honestly whether the product can enforce it.

3. Programme rules and admission

Programme rules. You may set rules for your programme: what you expect of ambassadors, how often, in what tone, what is off limits. We show them to every person when they join and record which version they saw, and we notify members when you change them. They are conditions of membership under the Ambassador Terms: an ambassador who breaks them can be removed by you, and a serious breach can be reported to us for action under our own rules. They are not a contract, they cannot impose obligations beyond those the Ambassador Terms allow, and you may not use them to take rights in content, to require exclusivity, or to impose money obligations on anyone. We will remove rules that try.

Admission. We decide who may have a Crowdable account. You decide who may join your programme, from the people who apply or whom you invite. Rejecting an applicant needs no reason and we will not ask you for one; treating applicants differently on a protected ground is unlawful in every country we operate in, and it is your responsibility not to.

Application questions. Your application form is built from questions in our question bank, which we wrote and own the purpose of, each shown to the applicant with the reason it is asked, plus one optional open question whose purpose is matching the applicant to your programme. You can also add questions of your own, each shown with the purpose you give for it, at any time and without asking us first. For every question you write, you warrant that it asks for nothing in Article 9 GDPR (health, beliefs, sexuality, ethnicity, politics, union membership, biometrics, genetics), nothing about anyone other than the applicant, and nothing beyond what running your programme needs, and that the purpose you give for it is the true one. We do not read your questions before they go live. We read them afterwards, and we may switch your own questions off, in whole or in part, if we believe one breaks this warranty or the law; switching them off hides them from applicants at once and deletes nothing. Under these terms we remain the controller of every answer, including the answers to your own questions.

Age. Nobody under 18 may hold an account. We ask for a date of birth and refuse below that; we do not verify it. If your programme is aimed at younger people, it does not belong on Crowdable in its standard form and you should talk to us before building it.

4. Content and the rights in it

An ambassador's posts, images and files stay theirs. Under the Ambassador Terms they give us a licence to host and display their content and to sub-license it to the brand whose campaign it was made for. We pass that licence to you: for content submitted to your campaigns you may reshare it on channels you own and use it internally, for the life of the ambassador's membership and 12 months after it ends. Paid advertising, packaging, retail and any use beyond that need the ambassador's separate agreement, which you may seek directly, outside these terms, on terms of your own. We do not broker that and we take no part in it.

Sponsored content has to be disclosed as such by the person posting it, under the advertising and consumer law of wherever the audience is. That duty is on the ambassador and it is on you, and it is the one thing in this document neither of us can contract out of. Our default programme rules say so, our Ambassador Terms say so, and a brand that instructs an ambassador to hide the relationship is in material breach of these terms.

5. Points, rewards and fulfilment

Points are our mechanic. We define how they work in the Ambassador Terms; you set what earns them and what they buy. They have no cash value, cannot be transferred, exist per programme, and are not money, e-money, a voucher or a stake. When an ambassador redeems, you fulfil: you ship the product or deliver the benefit, at your cost, within a reasonable time, and you tell us when you have so the record is right. We do not fulfil, we do not hold stock, and there is no fund behind unspent points. If your programme ends with balances outstanding, section 10 says what you owe.

For a reward that has to be shipped, you receive the ambassador's delivery details under Schedule 1, for that purpose and no other. Do not add them to a marketing list. Do not keep them after the parcel has been delivered and any dispute about it is over.

A reward may be income in the hands of the person who receives it. We say so to ambassadors in their terms. Whether you must report or withhold anything is a question for you and your tax adviser, and a programme that gives substantial rewards should have asked it.

6. Confidentiality

Neither of us will disclose the other's non-public business information, and each of us will protect it as carefully as our own. On your side the obvious examples are campaign briefs, unreleased product information, pricing, and your roster. On ours, our roadmap and anything we show you before it is public. This does not cover information already public, information the receiving party already had, or a disclosure a court or regulator requires, and where a disclosure is compelled we will tell you first unless the law forbids it. Personal data is not "business information" for this section; Schedule 1 governs it.

7. Security, our providers, and what we owe the people in your programme

We take the measures set out in Schedule 2, and it is written in two halves: what is in place, and what is not. A document that lists only the controls it has is a sales document; you are entitled to price the risk, and so is every ambassador, which is why the same statement appears in the Privacy Policy.

We run on providers: hosting, the database, file storage and backups, email delivery, error monitoring, the job that runs the nightly backup, and aggregate analytics, which is not switched on at present. They are our processors, bound to us by agreements that carry the Standard Contractual Clauses where anything leaves the EEA, and they are named with region and transfer basis in the Privacy Policy. We may change them; when we do, the Privacy Policy changes and ambassadors are told under our own obligations. You are not a controller of our processing and need no notice of our processors, but the list is public and you may ask us about any of them.

We are the party that answers to the people in your programme and to the supervisory authority. If we suffer a personal data breach we notify the Latvian Data State Inspectorate within 72 hours where the law requires it, and the people affected where it requires that. Schedule 1 also commits us to tell you, as a courtesy and so you can act, within 48 hours of becoming aware of a breach that affects data you received, with what we know at the time and an update when we know more. We have a written procedure for detecting, containing, assessing and notifying an incident, and a register in which every incident is recorded whether or not it is notified; we do not have an on-call rota or automated alerting, and Schedule 2 says so. The 48 hours is the number that procedure can keep with the people we have; it is not a substitute for our statutory duties and it does not make you responsible for them.

8. What we charge

Crowdable is sold to brands under an agreement made with us directly; scope, term and price are set there or on an order we both sign. These terms sit underneath it. Where the signed agreement and these terms conflict on price, term, service levels or liability, the signed agreement wins.

One plan is built but not live yet: priority onboarding, $4,999 USD, once. No subscription, no seat count, no usage tiers. It buys four things, worded as the checkout page words them: we set your brand up ourselves, with you, this week; your first campaign live rather than queued; your first three months of Crowdable included; and a direct line to us while you get going.

Nothing is on sale today. The offer is switched off unless we deliberately enable it, no payment processor is connected, and nobody has bought it. The rest of this section describes how it will work when we turn it on, so that a brand we approach can read the deal before agreeing to it - not because there is a checkout waiting. If we are talking to you about price at all, it is a conversation with a person, and what we agree in writing is what binds us.

Two honest limits. "This week" means the working week following payment, assuming you are available to us for setup; if you are not reachable, the clock is on you, not on us. "First three months included" means we will not invoice you for the platform during that period - afterwards, continued use is on whatever ongoing terms we agree in writing. That period belongs to this plan and to nothing else: an account opened any other way is not running a three-month clock, and there is no free tier hiding behind this sentence. The plan is also capacity-capped, and we will not sell it to an applicant we have already declined. Paying opens your account and skips the queue; it does not buy a decision we would otherwise have refused. Read those three months against section 10: where nothing is signed, either of us can end the arrangement on 30 days' notice, which is shorter than the term you paid for, and nothing in the product records when such a term starts or ends. Section 9 carries the open question and this section does not sell around it.

Payment is not automated. There is no payment processor connected to Crowdable - the checkout screen has a stand-in where the card form will go, and confirming it settles the invoice without taking money. So if we offer you priority onboarding we will tell you how to pay and settle it with you directly, and we are not going to describe a checkout in a contract when the product does not have one. What does exist is the invoice document:

• A numbered invoice with a date, a due date, and line items frozen at issue. If we change the offer afterwards, an invoice already sent does not re-price or re-word. It is the record of what you actually bought.
• It is open for 7 days. Not a payment term in the credit sense - it is when an unpaid link goes stale and we assume you have changed your mind.
• Anyone holding the link can pay it, so you can forward it to your finance team. Treat it as confidential; we cannot tell an unauthorised payer from an authorised one. Cancelling is different: only the account holder can withdraw an invoice, and only while it is unpaid, which voids it and leaves you where you were in the queue.
• Your account opens when payment clears. Where a payment is reconciled by hand, opening the account is a second, separate decision made by a person who has looked at the bank, so it can lag by a day.
• We cannot void an invoice you have already paid. Money has moved, and cancelling the document afterwards would be a lie about what happened. If a paid invoice was wrong, we correct it with a credit note or a refund, not by deleting it.
• If we take your money and then decline to open your account, we refund it in full. That case is not negotiable.

Tax. We are not registered for VAT, so we do not charge it and an invoice from us will not show a VAT line. That is a statement about our position today, not a promise about yours: if VAT is due at your end under your own member state's rules, it is yours to account for, and if our position changes we will invoice VAT from that point without it being a price rise. If a withholding tax applies at your end, the amount you pay us is grossed up so we receive the invoiced sum - a deduction at your end is your cost, not a reduction in our fee.

Where we have signed an agreement with you, its price and term govern. Where we have not, we will tell you in writing what we charge before you owe anything, and nothing here obliges you to pay for a period we have not agreed.

9. Availability and support

We will run Crowdable with reasonable skill and care, and tell you honestly when something is broken.

There is no service-level commitment in these terms: no uptime percentage, no support response time. We would rather say that plainly than publish a number we have not built the monitoring to stand behind. Where a signed agreement contains a service-level schedule with credits, that schedule replaces this section.

Support runs through the in-product support desk. Questions from your ambassadors about your programme come to you; questions about the platform come to us. Priority is set by whoever answers.

10. Term, and ending

Priority onboarding is a one-time purchase, but it is not termless: section 8 puts three months of platform use inside it, so a brand that pays will have bought a period, not only a setup. Nobody has yet, because the plan is not live - which is the reason the next paragraph is a warning rather than a dispute. For ongoing service beyond that the term is what your signed agreement says. Where nothing is signed, either of us may end the arrangement on 30 days' written notice, for any reason or none, and either of us may end it immediately if the other commits a material breach and does not fix it within 30 days of being told, or becomes insolvent.

Those two things pull against each other and we are not going to pretend otherwise: 30 days' notice for any reason is shorter than three months paid for, the refund position for the difference is open in section 8, and nothing in the product records a term start, an expiry or a renewal, so neither of us could measure the period being cut short. That is cheap to fix now and expensive to fix after the first sale, which is the whole argument for settling it before the plan goes live.

When your programme ends, whether you closed it, we ended these terms, or Crowdable itself stops:

• We keep your workspace readable for at least 30 days so you can get out what Schedule 1 lets you keep. Ask early; getting a workspace out is a job we do for you, not a button.
• Your ambassadors keep their accounts and their memberships of every other programme. They lose access to yours. Their unspent points in your programme are the open question in the Ambassador Terms, and a programme that closes with balances outstanding must tell its members what, if anything, it will honour, before the end date.
• Their submissions to your campaigns remain what Schedule 1 says they are: a record of work you may keep in anonymised form for three years, and content you may use under the licence in section 4 for its tail.
• After the window we delete your workspace. You delete your copies of anything you received under Schedule 1 that its purpose no longer covers, and you confirm in writing that you have when we ask.

If we stop. If Crowdable winds down we will give you at least 60 days' notice, keep the export window open through it, and say plainly what happens to the data.

11. What you are responsible for

• Your programme rules and your custom questions meet section 3.
• What you receive is used as Schedule 1 allows, protected, and deleted when its purpose ends.
• Your own notice. Where you use data you received for anything beyond running your programme on Crowdable (a CRM, an agency, a report to your parent company), you are the controller of that use, you need your own lawful basis and your own notice to the person, and Schedule 1 says what you must tell us first.
• Fulfilment under section 5.
• Disclosure under section 4.
• Your team. Every admin you add to your workspace can see everything in it. Add people who need it, remove people who leave, and tell us at once if an admin's credentials are compromised.
• The law where you are. These terms are written to the GDPR and Latvian law. If your own law adds obligations on a company receiving personal data (a US state privacy law, for instance), those are yours to meet, and Schedule 1 gives you what you need to meet them.

12. What we do and do not promise

Beyond running the service with reasonable skill and care and keeping it materially as described, we give no further guarantee, so far as the law allows us not to.

We make no promise about results. Figures on our marketing pages are illustrative, not a commitment about your programme, and we make no promise that a figure an ambassador reports is accurate; section 2 explains why we cannot.

Nobody here is anybody's employee. Ambassadors are not our employees and running a programme does not make them yours. We do not pay them, supervise their work or direct how they post; nor do you, beyond the rules section 3 allows. If the law where an ambassador lives treats a creator arrangement as employment or agency, that is between you, the creator and their authority, and it is a reason to talk to us before designing a programme that looks like a job.

Things outside anyone's control. Neither of us is liable for a failure or delay caused by something genuinely beyond our reasonable control: an outage at a hosting, database, storage or email provider, a network failure, a state act, a natural event. While it lasts the affected obligations are suspended rather than breached. If it lasts more than 30 days, either of us may end these terms without penalty.

13. Limits on liability

Some things cannot be limited and we do not try to: death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, and anything else the law says cannot be excluded.

Otherwise, and to the extent the law allows:

• Neither of us is liable to the other for indirect or consequential loss, lost profit, lost revenue, lost business, lost goodwill, or the cost of substitute services.
• We are not liable for anything an ambassador does or fails to do: a post not made, a post a network removes, a disclosure not given, a reward not collected, a dispute between you and them.
• We are not liable for content an ambassador uploaded, beyond our obligations under the Digital Services Act as stated in the Ambassador Terms.
• Our total liability to you, in aggregate for everything arising out of these terms across the whole life of the contract, is capped at the greater of the fees you paid us in the 12 months before the claim, or EUR 1,000. One cap, not one per claim, not one per year.
• The cap does not limit fees you owe us, or a breach by either of us of section 6 or of Schedule 1.

Nothing in this section limits either party's liability towards a data subject under Article 82 GDPR, or the apportionment between us that Article 82(5) provides for, or a supervisory authority's power to fine either of us directly. That carve-out is real rather than boilerplate: for the data you receive, you are answerable for what you do with it.

14. Changes

If we change these terms in a way that affects your rights or obligations, we will email your workspace's admins and post the new version with a new date, and the change takes effect no less than 15 days later, longer if you need time to adjust. You may end these terms before the change takes effect, and telling us so is enough. Corrections that are purely legal or factual, that only remove a restriction, or that are required by law may take effect sooner. Nothing we change applies retroactively to something you already bought.

Because these terms incorporate the Privacy Policy, we do not publish a version of either while the other is inaccurate. Where a change here would make the policy wrong, both move together.

15. If we disagree

Talk to us first. Write to crowdable@crowdable.co and we will reply; we would appreciate the chance to put it right before it becomes a dispute.

These terms are governed by the law of the Republic of Latvia and the courts of the Republic of Latvia have jurisdiction. If a dispute between us cannot be settled directly, we are willing to mediate in good faith before either of us litigates, and we will agree a mediator with you at the time. Mediation is voluntary for both of us: proposing it costs you nothing and refusing it costs you no right to go to court.

16. The rest

• Survival. Sections 4 (the licence tail), 6, 10 (your deletion obligation), 11, 13, 15, Schedule 1, and any fees you owe continue after these terms end.
• Severability. If a clause fails the rest stands, and the failed clause is read down to what the law allows rather than struck out.
• No waiver by inaction. If we do not enforce something straight away, we have not given it up.
• Transfer. You may not transfer your rights without asking us. We may transfer ours to a company that acquires our business, and we will tell you if it happens.
• Nobody else. Nobody other than you and us can enforce these terms. Ambassadors have their own terms with us and their own rights under the law; neither runs through this document.
• Whole agreement. These terms, the Privacy Policy, Schedules 1 to 3, and any written agreement we have signed with you are the whole of what is between us, and they replace anything said earlier.
• Language. These terms are written in English, and the English version is the authoritative one.

17. Accepting these terms

You accept these terms in the product, when the person creating your workspace ticks the box that names this version, or by signing a copy of them. Either way we record the version accepted, the date and time, who accepted and in what capacity, the legal entity they accepted for and its registered address and country, the text of the representation they made about their authority to bind it, and a fingerprint of the exact document they saw. That record is the answer, years later, to "what did we agree and when", and it is why the person accepting must be entitled to bind the entity.

Where you accept in the product and later sign a negotiated version, the later one is in force. Where your entity is outside the EEA and not in a country the European Commission has found adequate, accepting these terms also accepts Schedule 3, and you tell us whether your entity is certified under the EU-US Data Privacy Framework.

Nothing in your workspace can receive an ambassador's personal data until this acceptance is recorded. That is not a formality we could waive for you: the record is what makes what you receive lawful.

Schedule 1 - Data sharing

Who is who. Crowdable SIA is the controller of all personal data in the product. A brand is a recipient: an independent controller of the copy of personal data it receives under this Schedule, for the purposes it states, and nothing else. This Schedule is Article 13 and 14 information as far as the ambassador is concerned, so the Privacy Policy describes it in the same words, and Article 26 does not apply because we do not determine purposes jointly: we decide what the platform does and you decide what your programme does with what it receives.

What you receive, and what for. Version 1.1, 23 September 2026.

You do not receive: the person's memberships of other programmes, their activity in them, their community activity outside your programme, their account security records, or their date of birth.

Your obligations as recipient.

1. Purpose limit. Use what you receive only for the purpose in the table. Using it for anything else, including adding a person to a marketing list, sharing it with an agency or another company, or building a profile of them outside Crowdable, makes you the controller of a new processing for which you need your own lawful basis, your own notice to the person, and our written agreement first. We will not agree to marketing use of delivery details or to any use of application data for a rejected applicant.
2. No re-identification. Where we give you anonymised data, you do not try to identify the person.
3. Security. Protect what you receive at least as carefully as Schedule 2 says we protect it, and in any event with access limited to people who need it, on accounts with multi-factor authentication where the tool allows it.
4. Deletion. When the purpose ends, when a membership ends, when a person is erased, or when these terms end, delete your copies, and confirm in writing that you have when we ask. We will tell you when a person in your programme has been erased so you can act.
5. Rights requests. An ambassador's rights are against us, and we answer them within one month. If a person contacts you, forward the request to crowdable@crowdable.co within two working days and tell them you have. Do not answer for us. We will tell you what we need from you to answer, which is usually nothing, and where an erasure reaches data you hold, item 4 applies.
6. Breach. If you become aware of a breach affecting data you received, tell us within 24 hours, since it is our notification to make. We tell you within 48 hours of becoming aware of one on our side that affects data you received, with what we know at the time.
7. Onward transfer. You do not transfer what you receive outside the EEA, or to anyone outside your own organisation, except a processor bound to you by an Article 28 agreement and named to us on request.
8. Your law. Where a law where you are established imposes obligations on a company receiving personal data, you meet them. On request we will provide what a "service provider" or "processor" clause under a US state law expects to see, but you remain the party those laws address.

Transfers. If your entity is in the EEA, or in a country the European Commission has found adequate (including the United Kingdom and Switzerland), nothing further applies. If it is elsewhere, what you receive is a transfer from us, a controller in the EEA, to you, a controller in a third country, and it needs an instrument: either your certification under the EU-US Data Privacy Framework, which you tell us about at acceptance and keep current, or the Standard Contractual Clauses in Schedule 3, Module 1, which you accept with these terms. Where you are subject to the GDPR yourself under Article 3(2), the Clauses apply nonetheless, because that is what the European Data Protection Board says the law requires until the Commission says otherwise.

Definitions. References to the GDPR include the UK GDPR for a brand established in the United Kingdom and the Swiss Federal Act on Data Protection for a brand established in Switzerland, and references to a supervisory authority include theirs.

Schedule 2 - Security statement

Written in two halves on purpose. Every "In place" line was checked against the code or a provider console on the date given, and the check is recorded in our repository. The same statement, in the same words, is in the Privacy Policy, because the ambassador is entitled to it as much as you are.

In place

• Encryption in transit. All traffic uses TLS.
• Encryption at rest, AES-256, on the hosting platform, the database and the file store, each verified against the provider's published statement or the live configuration on 28 August 2026. Our email provider does not state its position and is not included in this claim.
• No passwords anywhere. Sign-in is a single-use link, valid once, expiring after 30 minutes. There is no password to leak, to reuse across sites, or for us to store badly.
• Programme isolation enforced on the server. Whether one brand can reach another programme's data is decided in server-side authorisation, not in what the interface renders, and it is covered by tests.
• Rate limiting on the authentication surfaces. Sign-in and sign-up are limited per email address and per IP, and the auth API separately. Refusals are logged.
• Session records. Each session stores the IP address and browser user-agent, so a person can recognise and end a session they do not recognise. A scheduled sweep removes the record seven days after the session expires.
• Uploads are pinned to their declared content type and stored as delivered; the application does not execute them.
• A record of what our staff do in the admin screens. Who, what, whose record and when, append-only, kept 400 days. We can produce an extract for one person or one programme on request. It covers the application only; see the residual risk below.
• The database can be restored to any point in the previous six hours.
• A nightly backup of the whole database, kept 30 days in our file store and restored into an empty database every night to prove it can be. In place since 21 September 2026.
• Prior versions of uploaded files are kept 30 days, so a deletion or an overwrite can be undone. Erasing a person and taking down a file delete every version at once. In place since 21 September 2026.
• A written incident procedure and a breach register. How an incident is detected, contained, assessed and notified is written down, with the notice templates it uses, and every incident is recorded in a register whether or not it is notified. The register is kept since 23 September 2026. It names which failures we would not notice; see the next half.

Not in place

Listed so you can price the risk rather than assume it away.

• No record of provider console access. Our database, hosting and file storage consoles sit outside the application's own record, and someone with console access can read data without appearing in any record we hold. MFA on those accounts, below, is the control that reduces it. Not planned: no application-side work can close it.
• No multi-factor authentication yet on the accounts that open our provider consoles: hosting, database, file storage, email, error monitoring, code hosting and analytics. Each is a single-operator account, so account-level MFA is the whole of the control. Being enabled now; when it is, this line moves up with the date it was verified.
• No self-serve export and no bulk deletion. Both are commands we run on request. Not planned for this version.
• No certification and no third-party audit or penetration test report. None planned. At our size the cost would be spent on the certificate rather than the controls, and we would rather you assessed the controls. Our providers hold theirs: SOC 2 Type 2 and ISO 27001 at the hosting provider, annual SOC 2 and ISO 27001/27701 audits at the database provider, and AWS for files. None of that speaks to our own code.
• No rehearsed restore of the database provider's six-hour window. The window exists and has not been exercised into a non-production target; the nightly backup above is restored every night instead. Planned.
• No on-call rota and no automated alerting. The incident procedure above says what happens once someone notices; nothing pages anyone, and application log lines at our hosting provider are kept for about an hour. Out of hours, the first signal is usually a person telling us. The 72-hour statutory notice is met by the procedure; the 48-hour courtesy notice is 48 and not 24 for this reason. Alerting is planned; a rota is not, at two people.
• No formal access review or joiner-mover-leaver process. At the current headcount the list of people with access is the list of founders. Not planned until that changes.

Schedule 3 - Standard Contractual Clauses, Module 1

For a brand whose entity is outside the EEA and not in an adequate country, the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914, Module One (controller to controller), are incorporated into these terms unmodified and are accepted by accepting these terms. The optional docking clause (Clause 7) is included. For Clause 11 the optional independent dispute resolution language is not included. For Clause 13 the competent supervisory authority is the Latvian Data State Inspectorate. For Clause 17 the governing law is the law of the Republic of Latvia and for Clause 18 the courts of the Republic of Latvia.

Annex I.A, parties. Data exporter: Crowdable SIA, Ventspils nov., Tārgales pag., Tārgale, "Zelmeņi" - 4, LV-3621, Latvia, contact crowdable@crowdable.co, role: controller. Data importer: the brand, as identified in its acceptance record, role: controller.

Annex I.B, description of the transfer. Data subjects: the importer's applicants and programme members. Categories of data, purposes and retention: as in the Schedule 1 table. No special categories. Frequency: continuous while the programme runs. Onward transfers: only as Schedule 1 item 7 allows.

Annex I.C, competent supervisory authority. The Latvian Data State Inspectorate (Datu valsts inspekcija).

Annex II, technical and organisational measures. Schedule 2, for the exporter; for the importer, Schedule 1 item 3.

Where the importer is certified under the EU-US Data Privacy Framework and has told us so, that certification is the transfer instrument relied on and these Clauses are the fallback should the Framework cease to be available.

Crowdable SIA. Questions, complaints and notices: crowdable@crowdable.co, +371 26126798. Postal address for service of legal process: Ventspils nov., Tārgales pag., Tārgale, "Zelmeņi" - 4, LV-3621. Registration number 40203708984. Not registered for VAT.