Data Processing Addendum (DPA)

Version: 2026-10-07.1

Prepared / Last Updated: October 7, 2026

Scheduled Effective Date: November 7, 2026

Application Date: The later of November 7, 2026, and valid express customer acceptance under Section 2

Advance notice / scheduled changes

This revision is scheduled to take effect on November 7, 2026, with this document prepared on October 7, 2026. Important changes are announced at least 30 days before they take effect. Matters requiring express customer consent apply from the later of the announced effective date and valid consent.

New Terms acceptance records, DPA and subprocessing consent and evidence management, customer permanent deletion, and automatic deletion three years after initial submission are planned for November 7, 2026. They are not considered implemented or applicable until development, verification, and necessary consent are complete. Changes to the schedule will be announced in advance with the required notice and consent procedures. Acknowledging or closing a notice is not consent to the Terms, DPA, subprocessing, or personal data processing.

Unimplemented or unverified safeguards and access records describe performance standards and planned measures, not confirmation that every measure is already implemented. Provider settings were checked on October 1-2, 2026, as stated in the relevant schedules and annexes; this revision does not constitute a new verification. Existing statutory duties and valid deletion requests remain in effect.

Section 1. Parties and Purpose

This Addendum sets out the rights and obligations regarding entrusted processing of personal data between a customer collecting and managing form submissions containing personal data on its sites (the "Customer" or "Controller") and inblog Inc., operator of Neopress (the "Company" or "Processor"). It supplements the Neopress Terms of Service.

The Customer and accepting representative are identified through online checkbox acceptance records retained with this Addendum. It applies to form submissions on all sites currently operated or subsequently created by the Customer through the account. A person accepting for a company or another customer confirms that they have representative or delegated authority to enter into this Addendum.

Undefined terms follow applicable law, including Korea's Personal Information Protection Act (PIPA), its Enforcement Decree, and the Standards for Ensuring the Safety of Personal Information.

Section 2. Application and Processing Term

1. New customers review this Addendum and the subprocessor list during registration; existing customers review them in a popup when entering the dashboard. They accept by actively selecting a checkbox and pressing the acceptance button. Online acceptance and evidence procedures are planned for November 7, 2026, and will be provided after development and verification. This Addendum applies from the later of November 7, 2026, and confirmed valid express acceptance by the Customer or its authorized representative.
2. Scope is managed at account level under Section 1; separate consent or records for each site are not required. An employee or collaborator invited to another customer's site is subject to the DPA validly entered into by that site's owner. The invited user's personal acceptance is not treated as the owner's acceptance. An agency's acceptance is effective within the authority delegated by the customer; otherwise the customer or an authorized representative must accept.
3. This Addendum also applies to submissions remaining on covered sites when it first becomes applicable, but does not retroactively establish consent or legality for past processing.
4. The processing term covers provision of the form service and the time needed afterward to complete lawful return, destruction, and residual-copy handling. General use of data does not continue after service termination.
5. Reading a notice or popup, closing it, silence, or continued use is not acceptance of this Addendum or required subprocessing consent. Customers who have not signed in or consented remain pending. Permitted use and any necessary termination and return procedures for non-consenting customers are explained in advance under Terms Section 14.
6. The Processor retains the accepting account; represented customer and confirmation of representative or delegated authority, if applicable; Addendum and annex versions and contemporaneous copies; separate consent results; and time and method of acceptance. The Customer can read and save the applicable documents. Grounds and periods for retaining consent records follow Section 6.5.

Section 3. Purpose and Scope of Processing

1. Processing consists of receiving, transmitting, storing, viewing, sending notifications about, returning, and deleting form submissions in Annex 1, and necessary customer support, incident recovery, and security response.
2. The Processor follows the Customer's lawful, recorded instructions. Form settings, notification-recipient settings, deletion requests, and acceptance records under this Addendum form part of those instructions.
3. During and after the agreement, the Processor does not use, disclose, or provide data to third parties outside the entrusted purpose. It does not arbitrarily copy or export submissions beyond what the work requires. Backups and lawful return follow the specified purposes and safeguards. This Addendum alone does not authorize use of submissions for separate advertising, general-purpose AI model training, or other customers.
4. If an unlawful instruction is identified, the Processor informs the Customer and discusses correction, cessation, or other necessary measures. If urgent protection is needed, the Processor may act first and explain the reason afterward.

Section 4. Customer Responsibilities

1. The Customer determines data fields, purposes, and retention periods and meets the legal grounds, notice, and consent requirements for collection, use, and any sensitive-data processing or international transfer.
2. The Customer collects only necessary information and manages staff accounts and permissions for viewing submissions and notification-recipient addresses.
3. If earlier deletion is required, including a shorter retention period or fulfillment of the purpose, the Customer acts without delay through available deletion functions or a request to the Processor. The Processor's general retention policy does not give the Customer a statutory basis to retain data.
4. The Customer manages notification emails received in its mailbox and files it downloads or separately copies. Responsibility for Processor-managed backups and subprocessor copies is not transferred to the Customer.
5. This section does not exclude statutory obligations directly applicable to the Processor.

Section 5. Processor Safeguards and Staff Access

1. The Processor implements legally required technical, organizational, and physical safeguards and grants the minimum necessary personnel only necessary access.
2. Access to submissions is limited to permitted purposes, including support, incident recovery, and security response, and to necessary customer sites, submissions, and fields. The purpose and targets are recorded in related support or incident records. For emergencies, minimum necessary steps may be taken first, with reasons and actions recorded by the next business day for retrospective review.
3. Individual accounts identify personnel as a rule. Special operations accounts, direct DB access, and service accounts are also managed. Permissions are changed or revoked when no longer needed, including role changes or departure. Manual operations through service accounts must be traceable to the operator.
4. Infrastructure safeguards include encryption in transit and at rest, authentication, and access controls; their scope follows Annex 2. Encryption at rest does not itself prevent access by authorized operators.
5. The privacy officer approves access and records personnel, scope, and duration in an authorization register. Grants, changes, and revocations are retained for three years from occurrence. Safe authentication, including multifactor authentication, is applied to administrator and DB access.
6. The Processor provides privacy training and confidentiality management for staff. Confidentiality continues after role changes, departure, and termination of this Addendum.

Section 6. Access Records and Processing Evidence

1. The Processor retains and manages personal-data-system access records for two years from creation and protects against unauthorized access, alteration, loss, and similar events.
2. Records include personnel identifier, time, source location, target identifiers, operation, result, and other information necessary for traceability. Submission contents are not copied into separate audit records.
3. Recording covers viewing, downloading, changing, and deleting form submissions through administrator and customer dashboards, APIs, and direct DB access. Automated operations link to job identifiers and staff manual operations to personnel identifiers. Lists and bulk actions must enable tracking of actual targets and meet legally required logging standards.
4. Access records and downloads are reviewed at least monthly, including reasons for downloads and missing records. Anomalies are promptly investigated, access restricted or other necessary steps taken, and reported to the privacy officer. Review results are retained for two years from preparation.
5. Other evidence, including consent and deletion results, is managed by purpose using minimum necessary fields. Access-log retention does not automatically apply to every record type. Deletion results are kept for two years after the operation is closed to verify deletion, address errors, and re-delete after backup restoration, then destroyed. Agreement acceptance evidence is retained during the agreement and for five years after termination on the grounds of contract formation and performance and the Processor's legitimate interests in proving formation and responding to disputes. Only minimum necessary consent evidence is retained separately and destroyed without delay on expiry. These records are distinct from the three-year automatic deletion of form submissions. Records subject to a separate statutory retention duty are segregated and retained only for that period.
6. These standards establish performance duties. Verification of per-submission logging and retention across all paths is ongoing. The Processor manages gaps and improvement plans and accurately informs the Customer about actual coverage. This does not defer statutory duties or exempt liability.

Section 7. Subprocessing and International Transfers

1. When accepting this Addendum, the Customer reviews the providers, work, data, and countries in Annex 3 and consents to subprocessing within that scope. The version and content of the annex at acceptance are retained with the acceptance record.
2. Before adding a subprocessor or changing work, data, or countries beyond the consented scope, the Processor provides details in advance and obtains any customer consent required by law. The procedure uses a dashboard-entry popup and checkbox acceptance and preserves the accepted content and records. The changed scope does not apply to that Customer until required consent is confirmed.
3. The Processor contractually imposes necessary protection duties on subprocessors and performs legally required management and supervision. Subprocessing does not exempt its responsibility.
4. International transfers meet the purpose-specific legal grounds and disclosure, notice, and consent requirements in Privacy Policy Section 5. For entrusted form reception and storage necessary to form or perform a contract between the Customer and submitter, the Customer discloses statutory transfer details in its privacy policy and applies PIPA Article 28-8(1)(3)(a). Transfers for purposes not meeting those criteria require a lawful ground, such as the submitter's separate consent under Article 28-8(1)(1). Form-notification emails use that disclosure approach only where necessary for contract formation or performance; internal convenience alone does not establish necessity. If requirements are not met, separate international-transfer consent must be obtained or email notifications must not be used. Customer DPA or subprocessing acceptance does not replace data-subject transfer consent.
5. The Processor supplies accurate processing details and changes so the Customer can reflect them in its privacy policy and forms. Annex 3 specifies subprocessor names, information and purposes, operational DB location, request-processing locations, mail storage and sending countries, and retention and deletion criteria.
6. Refusal or suspension of international transfers, or withdrawal of transfer consent, may be requested at contact@email.neopress.ai; submitters may also contact the site operator's privacy contact. Refusal of transfers needed for form reception and storage restricts online reception through that form. The Customer explains whether phone, in-person, or other alternatives are available. If notification-email transfers are refused, the Customer can disable notifications and view submissions in the dashboard, although that still relies on Supabase and Vercel. Unrelated functions are not restricted indiscriminately. Previously transferred data follows applicable retention and deletion criteria.

Section 8. Retention, Deletion, and Return

1. The Processor retains information only as necessary for the entrusted purpose and lawful Customer instructions. Data is destroyed without delay as required by law upon a deletion request, fulfillment of purpose, termination, or when otherwise unnecessary. If prompt handling is difficult, the Processor explains the reason, measures, and expected completion time.
2. Before customer permanent deletion is available, requests are accepted at contact@email.neopress.ai and processed after authority and target verification. Hiding a record or merely marking it deleted is not described as permanent destruction.
3. Customer permanent deletion and automatic deletion three years after initial submission are planned for November 7, 2026. After development and verification and before each feature takes effect, service notices and dashboard-entry popups explain the date, scope, method, irreversibility, and backup treatment. Following necessary consent, they apply from the announced date under Annex 2. Before then, deletion follows paragraph 2; feature rollout is not a reason to defer valid destruction requests.
4. At service termination or a lawful Customer request, data is returned in a commonly available electronic format or deleted, at the Customer's choice. If return is needed, the parties arrange timing and a secure delivery method before deletion; return does not automatically create a grace period delaying statutory destruction. Remaining copies after return follow the deletion criteria.
5. Where law requires separate retention, the Processor identifies the ground, scope, and period to the Customer, segregates necessary data, and uses it only for that purpose.
6. Deletion management distinguishes operational DB submissions, Processor-managed replicas, and subprocessor copies. Deleting operational data does not immediately delete individual records in existing backups. Access and use of residual copies are restricted and provider retention and deletion procedures apply. Provider-specific periods and backup handling follow Annex 3. On restoration, previously deleted submissions are removed before service exposure. Identifiers needed for re-deletion are retained separately from the backup being restored.
7. The Processor records requester or automated job, target identifiers and count, request and processing times, success, failure, and retries. Customers can check the outcome of direct deletion on the processing screen. Results of separately requested or end-of-processing return or destruction are reported without delay. Automatic deletion results are supplied to the necessary extent on request. If backup handling remains, operational deletion completion and destruction of all copies are distinguished.

Section 9. Assistance with Data-Subject Rights

The Processor assists with searches, provision, deletion, and related materials so the Customer can respond to access, correction, deletion, suspension, and consent-withdrawal requests. If contacted directly, it takes necessary steps, including identity and authority verification and secure referral to the Customer, and cooperates without delay considering statutory deadlines. Unless law requires otherwise, it does not arbitrarily replace the Customer's substantive decisions.

Section 10. Personal Data Incident Response

1. Upon learning of an incident, including disclosure of entrusted personal data, the Processor promptly informs the Customer's designated contact and takes containment, investigation, and recovery measures. Initial notice is not deferred until the whole investigation is complete.
2. Notice includes known occurrence and detection times, data fields, scale and impact, current measures, recommendations, and a contact person. Unconfirmed facts are supplemented later.
3. The Processor assists with data-subject notification and regulator reporting and fulfills directly applicable statutory duties. Incident evidence is protected against damage and lawfully preserved.

Section 11. Supervision and Review

1. The Processor supplies materials necessary to review safeguards, access permissions, records, subprocessing, and deletion, and cooperates with training and supervision.
2. Reviews prioritize documents while protecting other customers' information and security. Methods and schedules may be agreed where needed; that coordination must not unduly restrict statutory supervision or incident response.
3. Identified gaps are managed with improvement actions, owners, deadlines, and results.

Section 12. Responsibility

Each party bears liability under applicable law for loss caused by its violation of law or this Addendum. The Processor also bears legally attributable responsibility for loss caused by its personnel or subprocessors. Where the Customer compensates a data subject or third party for loss attributable to the Processor's side, it may seek recourse to the extent recognized by law. Use of subprocessors does not exempt statutory responsibility. This Addendum does not restrict data subjects' damages rights or duties that cannot be excluded by agreement. Disclaimers, liability limitations, and indemnification in the Terms do not apply to the extent they conflict with mandatory law or this Addendum.

Section 13. Document Priority and Changes

This Addendum prevails over the Terms in a conflict about entrusted processing of form submissions. The Privacy Policy's statutory effect and legal standards, including contract terms favorable to data subjects, remain applicable. Important changes are announced with their content, reasons, and application date through service notices and dashboard-entry popups from at least 30 days before application through that date. Changes requiring consent by law or contract apply after checkbox consent by an authorized Customer representative. Silence or continued use is not consent. Terms Section 14 also governs advance-notice periods and treatment of non-consenting customers. Any separate statutory notice method or procedure must also be followed.

Section 14. Contact

Processor privacy and DPA inquiries: contact@email.neopress.ai / +82-503-7150-2997

Customer representative and incident contact: the contact registered in the customer account or otherwise designated by the Customer

Annex 1. Entrusted Information and Processing

Annex 2. Protection and Deletion Standards

Safeguards and Processing Evidence

This table specifies the performance standards in Sections 5 and 6. Actual implementation and gaps are described according to verification results. Unimplemented or unverified measures are not marked complete.

Direct and Automatic Deletion

Records requiring longer statutory retention by the Customer must be moved to a lawful separate retention system before deletion. The form service does not replace a statutory medical-record system.

Annex 3. Subprocessors and International Transfers

Annex Version: 2026-10-07.1

These details define the scope of Customer subprocessing consent. International transfers follow the legal grounds and disclosure, notice, and consent requirements in Section 7. The text and annexes accepted by each Customer are preserved together.

The following reflects operational settings and official provider materials checked on October 1-2, 2026. Deleting operational DB submissions is distinct from final destruction of existing backups or email copies. Unless stated otherwise, the retention periods below are not deadlines measured from a Customer's deletion request.

Supabase

Resend

Vercel