Data Processing Addendum

This Data Processing Addendum (“Addendum”) governs the personal data that Pook Audio processes about your customers — the people who buy or activate a plugin you release through the platform. It forms part of the Publisher Terms and is accepted when you accept those terms. No separate signature is required.

“Pook Audio” is a trading name of Ayal Yishay, sole proprietor, registered and operating under the laws of the State of Israel. In this Addendum, “publisher,” “you” and “your” mean the account that releases a plugin, and “customer data” means the personal data described in Section 2.

In respect of customer data, you are the controller and Pook Audio is your processor, within the meaning of Article 28 of the General Data Protection Regulation (GDPR), the UK GDPR, and the Israeli Privacy Protection Law 5741-1981, as each applies. You decide why customer data is collected and for what purpose; Pook Audio processes it only on your behalf.

For everything else — your own account, your publisher account, and the data of people who buy from Pook Audio directly — Pook Audio is the controller, and our Privacy Policy applies instead.

Customer data is limited to what the purposes in Section 3 require:

• The customer’s email address.
• A machine identifier for each machine the customer activates on, together with a name for that machine, the name of its operating system, and when it was last seen.
• The version of each of your plugins that a machine reports when it checks in — one record per machine and product, overwritten on every check-in, so it is the version currently running rather than a history of versions.
• One-time passcode records used to confirm the customer’s email address at activation.
• The session record a redeemed passcode mints — the credential later actions authenticate against, when it expires, and when it was last used. The credential itself is stored only as a hash.
• The license type and its status.
• Activation records — which machines hold an activation, when it was taken and when it was released, and the machine name as it stood at that moment.
• Abuse-prevention counters for requests to send a passcode or to activate, keyed on a normalized email address or an IP address. Each holds nothing but that key, a count and the window it belongs to, and counters are swept within a few days of their window closing.

Pook Audio does not scan a customer's machine and does not collect information about the files, software or other content on it. Payment card and bank details are never received: you sell to your customers yourself, and Pook Audio issues licenses rather than invoices.

Processing is limited to issuing, checking, transferring and revoking licenses for the plugins you release, and to sending the emails those actions require — an activation passcode, a notice that a machine has been activated or released, and a notice that a license has been issued or disabled. It also covers showing you, in the publisher console, which version of each of your plugins your customers are currently running.

Pook Audio acts only on your documented instructions. This Addendum, the Publisher Terms, and the settings and actions available to you in the publisher console together constitute those instructions.

Customer data is not used to train models, to build profiles, or for marketing. It is not sold, and it is not used for any purpose of Pook Audio's own. If Pook Audio is required by law to process customer data beyond your instructions, you will be informed before that processing takes place, unless the law forbids telling you.

Anyone authorised to process customer data is bound by an obligation of confidentiality. Access is limited to what operating the platform actually requires.

Pook Audio maintains appropriate technical and organisational measures to protect customer data, including encryption in transit and encryption at rest, access controls and authentication on the systems that hold it, and regular review of that infrastructure. The Security section of the Privacy Policy describes the same measures in more detail.

If a personal data breach affects your customers' data, Pook Audio will notify you without undue delay and give you the information you need in order to meet your own notification obligations. Pook Audio will also assist you, taking into account the nature of the processing and the information available to it, with your obligations to keep the processing secure and to carry out any assessment or consultation the law requires of you.

You authorise Pook Audio to engage the following subprocessors to process customer data:

• Google — Cloud Run (application hosting), Cloud SQL (database), Cloud Storage (file storage), and Cloud KMS (key management and signing).
• Resend — delivery of the emails that licensing actions require, such as activation passcodes and license notices.
• Cloudflare R2 — storage and delivery of plugin downloads.

Each subprocessor is bound by data protection obligations no less protective than those in this Addendum, and Pook Audio remains responsible to you for their performance.

Pook Audio will give you notice before adding a new subprocessor or replacing an existing one. You may object to the change on reasonable data protection grounds. If an objection cannot be resolved, you remain free to cancel your Publishing Plan as described in the Publisher Terms; Section 10 then applies to your customers' licenses.

Customer data is stored and processed on cloud infrastructure primarily located in the United States, operated by the subprocessors listed in Section 5. It may also be accessed from Israel, where Pook Audio is based, and from other countries in which those subprocessors operate.

Where customer data leaves the European Economic Area or the United Kingdom to a country that has not received an adequacy decision, the transfer is made under the European Commission's standard contractual clauses, the equivalent clauses approved by the UK Information Commissioner's Office, or another legally recognised transfer mechanism.

Your customers exercise their rights against you, as the controller of their data. Pook Audio assists you in responding to those requests, taking into account the nature of the processing and by appropriate technical and organisational measures.

If a customer sends a request directly to Pook Audio, it is forwarded to you rather than answered. Pook Audio does not decide the outcome of a request about customer data.

Pook Audio makes available to you the information necessary to demonstrate compliance with Article 28 of the GDPR and with this Addendum, and permits and contributes to audits and inspections carried out by you or by an auditor you mandate.

An audit takes place on reasonable prior written notice, during normal business hours, and in a manner that does not unreasonably disrupt Pook Audio's operations. Anyone conducting it is bound by confidentiality as to everything they see, and you bear its cost.

An audit is carried out no more than once in any twelve-month period, unless a personal data breach has affected your customers' data or a supervisory authority requires an audit of you.

On termination of the Publisher Terms, customer data is deleted or returned to you, at your choice, once processing on your behalf has ended.

Pook Audio may retain customer data where the law requires it to, and retains the record described in Section 10. Anything retained remains protected by this Addendum for as long as it is held.

There is one exception to the previous section, and it exists so that ending a plan never takes anything away from the people who already bought your plugin:

Customers keep what they bought. When a publisher's plan ends or their account closes, Pook retains the minimum record needed to keep existing licenses working — the customer's email address, the product, and the license status — and from that point acts as an independent controller of that record rather than as the publisher's processor. The basis is the customers' own interest in continuing to use software they paid for. Nothing else is retained, and the record is never used for any other purpose.

This is the data-protection side of what the Publisher Terms describe when a plan ends: your catalog stays alive, each released plugin is rebuilt with an offline license, and every existing customer is emailed a perpetual key for it. The retained record is what makes that possible.

As the controller of your customers' data, you are responsible for the following.

A privacy policy of your own. You must maintain a privacy policy covering your relationship with your customers, and keep it accurate and reachable.

A lawful basis. You must have a lawful basis for the customer data you collect and for instructing Pook Audio to process it.

The notices the law requires. You must give your customers the information their local data protection law entitles them to, including who you are, what is collected and why, and how they exercise their rights.

Customer-facing surfaces — including the plugin's activation screen — link to your privacy policy, never to Pook Audio's.

If you have any questions about this Addendum, please contact us at:

support@pookaudio.com

Pook Audio (a trading name of Ayal Yishay)
Israel