Wrangl Data Processing Addendum

Effective: September 2026
Last updated: September 2026

This Data Processing Addendum ("DPA") forms part of the agreement between App-O-Matic Labs, LLC, operator of Wrangl ("Wrangl," "we," "us," or "Processor"), and the customer using Wrangl ("Customer").

This DPA applies whenever Wrangl processes Customer Personal Data on Customer's behalf in connection with the Wrangl services ("Services").

The Wrangl Terms of Service, together with any applicable subscription or order terms, are referred to in this DPA as the "Agreement."

By agreeing to the Wrangl Terms of Service, Customer also agrees to this DPA where it applies.

1. Definitions

"Customer Data"

"Customer Data" has the meaning given in the Agreement and includes information, records, files, messages, projects, tasks, client information, contact information, time entries, rates, costs, invoices, and other content submitted to Wrangl by or on behalf of Customer.

"Customer Personal Data"

"Customer Personal Data" means personal data, personal information, or equivalent information relating to an identified or identifiable individual that is contained in Customer Data and that Wrangl processes on Customer's behalf.

Customer Personal Data does not include personal information for which Wrangl determines the purposes and means of processing independently of Customer, such as certain Wrangl account, billing, security, and business-administration information. Such information is governed by the Wrangl Privacy Policy and applicable law.

"Data Protection Laws"

"Data Protection Laws" means privacy and data-protection laws applicable to the processing of Customer Personal Data under the Agreement, including where applicable:

• Regulation (EU) 2016/679 ("GDPR");
• the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); and
• other applicable U.S. state comprehensive privacy laws.

"Controller," "Processor," "Business," "Service Provider," and "Contractor"

These terms have the meanings given to them under the applicable Data Protection Laws.

"Security Incident"

"Security Incident" means a confirmed breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Customer Personal Data processed by Wrangl.

Security Incident does not include unsuccessful attempts or activities that do not compromise Customer Personal Data, such as unsuccessful login attempts, port scans, denial-of-service attempts, or other unsuccessful attacks.

"Subprocessor"

"Subprocessor" means a third party engaged by Wrangl to process Customer Personal Data on behalf of Customer in connection with the Services.

"EU SCCs"

"EU SCCs" means the Standard Contractual Clauses for transfers of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914.

2. Roles of the Parties

For Customer Personal Data processed by Wrangl on Customer's behalf:

• Customer is the controller or business, as applicable; and
• Wrangl is the processor or service provider, as applicable.

If Customer processes Customer Personal Data on behalf of another controller, Customer acts as a processor and Wrangl acts as Customer's subprocessor.

Customer determines the purposes for which Customer Personal Data is submitted to the Services.

Each party is responsible for complying with the Data Protection Laws applicable to that party's own activities.

Customer represents that:

1. it has the authority and lawful basis necessary to collect and provide Customer Personal Data to Wrangl;
2. its instructions to Wrangl comply with applicable law; and
3. it has provided any notices and obtained any permissions or consents required by applicable law.

3. Customer's Instructions

Wrangl will process Customer Personal Data only:

1. to provide, operate, maintain, secure, and support the Services;
2. according to Customer's documented instructions;
3. as necessary to perform actions initiated by Customer or its authorized users through the Services;
4. to provide support requested by Customer;
5. as described in this DPA and the Agreement; or
6. where processing is required by applicable law.

Customer's documented instructions include the Agreement, this DPA, Customer's configuration and use of Wrangl, and written support instructions provided by an authorized Customer representative.

If Wrangl reasonably believes an instruction violates applicable Data Protection Laws, Wrangl will notify Customer unless prohibited from doing so and may suspend the affected processing until the parties resolve the issue.

If applicable law requires Wrangl to process Customer Personal Data contrary to Customer's instructions, Wrangl will notify Customer before doing so unless the law prohibits such notice.

4. Specific Processing Purposes

Wrangl may process Customer Personal Data for the following limited and specified purposes:

1. hosting and storing Customer's clients, projects, tasks, resources, hours, invoices, files, messages, and related records;
2. allowing authorized users to create, retrieve, modify, organize, and manage those records;
3. authenticating users and enforcing Customer-selected access permissions;
4. providing time-tracking, project-management, task-management, messaging, invoicing, file-storage, notification, and related Wrangl functionality;
5. generating reports, calculations, invoices, and other outputs requested by Customer;
6. providing technical and customer support requested by Customer;
7. maintaining backups, service availability, and disaster-recovery capabilities;
8. diagnosing errors and improving the reliability, security, performance, and functionality of the Services;
9. detecting, investigating, and preventing fraud, abuse, unauthorized access, and security threats;
10. carrying out AI-powered functionality expressly initiated by Customer or its authorized users, where enabled;
11. complying with legally binding obligations; and
12. performing other processing expressly documented by Customer and agreed to by Wrangl.

Wrangl will not use Customer Personal Data to train Wrangl's generalized artificial-intelligence models.

Wrangl will not permit an AI provider processing Customer Personal Data on Wrangl's behalf to use that data to train the provider's generalized models where Wrangl has represented that restriction to Customer.

5. California Service-Provider Terms

To the extent the CCPA applies to Customer Personal Data disclosed to Wrangl by a Customer acting as a Business, Wrangl acts as a Service Provider or Contractor, as applicable.

Customer discloses Customer Personal Data to Wrangl only for the limited and specified business purposes set out in Section 4.

Wrangl will:

1. not sell or share Customer Personal Data as those terms are defined by the CCPA;
2. not retain, use, or disclose Customer Personal Data for purposes other than the limited and specified purposes stated in this DPA or as otherwise permitted by the CCPA;
3. not retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and Wrangl except as permitted by the CCPA;
4. not combine Customer Personal Data received from Customer with personal information received from another person or collected from Wrangl's own interaction with an individual except where expressly permitted by the CCPA;
5. comply with applicable provisions of the CCPA and provide Customer Personal Data the level of privacy protection required by the CCPA;
6. implement reasonable security procedures and practices appropriate to the nature of the Customer Personal Data;
7. notify Customer if Wrangl determines it can no longer meet its applicable CCPA obligations;
8. provide Customer with information reasonably necessary for Customer to confirm that Wrangl is using Customer Personal Data consistently with Customer's CCPA obligations;
9. cooperate with Customer as reasonably necessary to respond to consumer requests concerning Customer Personal Data; and
10. cooperate as required by applicable CCPA regulations with Customer's applicable cybersecurity audits, risk assessments, or automated-decisionmaking compliance obligations relating to Customer Personal Data processed by Wrangl.

Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data by Wrangl.

Any Subprocessor processing Customer Personal Data subject to this Section will be contractually required to comply with applicable CCPA service-provider or contractor obligations.

6. Confidentiality

Wrangl will ensure that people authorized by Wrangl to process Customer Personal Data:

• process it only as necessary to perform their authorized responsibilities; and
• are subject to appropriate confidentiality obligations.

Wrangl does not routinely read Customer's business records or private communications.

Wrangl personnel may manually access Customer Personal Data when Customer specifically requests support requiring that access or where access is legally required.

Automated storage, backup, indexing, transmission, security scanning, and normal operation of the Services do not constitute manual review by Wrangl personnel.

7. Security

Wrangl will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

The measures currently applicable to the Services are described in Schedule 2.

Wrangl may update those measures from time to time as technology and the Services change, provided that Wrangl will not materially decrease the overall level of protection provided to Customer Personal Data during the term of the Agreement.

Customer is responsible for configuring and using the Services appropriately, including controlling authorized users, assigning appropriate permissions, protecting credentials, and promptly removing access that is no longer required.

8. Security Incidents

Wrangl will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data.

The notice will include, to the extent reasonably available:

• the nature of the Security Incident;
• the categories of Customer Personal Data affected;
• the categories of affected individuals, where known;
• known or reasonably anticipated consequences;
• measures taken or planned to contain, investigate, or remediate the Security Incident; and
• information reasonably necessary for Customer to comply with applicable breach-notification obligations.

Information may be provided in stages as it becomes available.

Wrangl's notification of a Security Incident is not an admission of fault or liability.

Wrangl will take reasonable steps to contain and remediate a Security Incident within its control.

9. Data-Subject and Consumer Requests

Taking into account the nature of the processing, Wrangl will provide reasonable assistance to Customer in responding to requests by individuals exercising rights under applicable Data Protection Laws.

If Wrangl receives a request directly from an individual concerning Customer Personal Data processed solely on Customer's behalf, Wrangl will ordinarily direct that person to Customer unless applicable law requires Wrangl to respond directly.

Customer is responsible for determining how to respond to such requests.

Where technically and legally appropriate, Wrangl will assist Customer in carrying out required access, correction, deletion, restriction, portability, or objection actions involving Customer Personal Data.

10. Regulatory Compliance Assistance

Taking into account the nature of Wrangl's processing and the information available to Wrangl, Wrangl will provide reasonable assistance to Customer with obligations relating to:

• data-protection impact assessments;
• transfer impact assessments;
• security of processing;
• regulatory consultations;
• breach notifications; and
• other legally required privacy assessments concerning Wrangl's processing of Customer Personal Data.

Customer remains responsible for determining whether an assessment, consultation, or notification is legally required for Customer.

11. Subprocessors

Customer grants Wrangl general authorization to use the Subprocessors listed in Schedule 3.

Wrangl will enter into a written agreement with each Subprocessor that imposes data-protection obligations appropriate to the Subprocessor's processing and, where required by applicable law, protections no less protective in material respects than Wrangl's applicable obligations under this DPA.

Wrangl remains responsible for its Subprocessors to the extent required by applicable Data Protection Laws.

New or Replacement Subprocessors

Wrangl will provide Customer notice before allowing a new or replacement Subprocessor to process Customer Personal Data.

Schedule 3 of this DPA, as published on the Wrangl website, is the current Subprocessor list. Where practicable, Wrangl will provide at least 15 days' advance notice of an addition or replacement by email to the account owner or administrator, and will update Schedule 3 on that page.

Customer may object to the new Subprocessor within 10 days after receiving notice if Customer has reasonable and documented data-protection grounds for the objection.

The parties will work in good faith to resolve a valid objection.

If the parties cannot reasonably resolve the objection, Wrangl may:

• avoid using the Subprocessor for Customer where commercially and technically feasible;
• make available an alternative configuration where commercially and technically feasible; or
• permit Customer to terminate the affected portion of the Services without a termination penalty.

Urgent changes necessary to protect the security or availability of the Services may be implemented on shorter notice, in which case Wrangl will notify Customer as soon as reasonably practicable.

12. Return and Deletion of Customer Personal Data

Cancellation of a paid Wrangl subscription does not by itself end the Services or trigger deletion where Customer's account continues under the Free plan.

Upon termination or deletion of Customer's Wrangl account, or upon Customer's lawful written instruction where the Services permit, Customer may instruct Wrangl to return or delete Customer Personal Data, unless applicable law requires continued retention.

If Customer requests return of Customer Personal Data before deletion, Wrangl will provide a reasonably available copy or export in a commonly usable format where technically practicable.

After deletion, Customer Personal Data may remain in protected backups for up to 90 days before being overwritten or removed through normal backup lifecycle processes.

Customer Personal Data retained solely in backups will not be restored to active systems except where required for disaster recovery, legal compliance, or security purposes.

Wrangl may retain information that applicable law requires it to retain, but will isolate such information from further processing except as required by law.

13. Audits and Compliance Information

Wrangl will make available to Customer information reasonably necessary to demonstrate compliance with Wrangl's applicable processor, service-provider, and contractor obligations under this DPA.

Where reasonable, compliance review should first be satisfied through:

• this DPA and its schedules;
• written security information;
• questionnaires;
• relevant policies or summaries;
• third-party audit or certification materials, if available; and
• other reasonable documentary evidence.

If that information is insufficient to satisfy a legal obligation applicable to Customer, Customer may request a reasonable audit of Wrangl's relevant processing activities.

Unless a Security Incident, regulator, or applicable law reasonably requires otherwise:

• audits will occur no more than once in any 12-month period;
• Customer will provide reasonable advance written notice;
• audits will occur during normal business hours;
• audits must not compromise the security, confidentiality, or availability of Wrangl or another customer's information; and
• Customer will bear its reasonable audit costs.

Wrangl may require an auditor to enter into appropriate confidentiality obligations.

If an audit identifies material noncompliance by Wrangl, Wrangl will take reasonable corrective action.

Nothing in this Section limits audit or regulatory rights that cannot legally be restricted.

14. Government and Legal Requests

If Wrangl receives a legally binding request from a governmental, regulatory, judicial, or law-enforcement authority seeking Customer Personal Data, Wrangl will, where legally permitted:

1. notify Customer;
2. review the request for legal validity;
3. challenge a request that Wrangl reasonably believes is unlawful or exceeds the requesting authority's lawful powers where a challenge is reasonably available; and
4. disclose only Customer Personal Data that Wrangl is legally required to disclose.

Where notice is legally prohibited, Wrangl will use reasonable efforts to preserve Customer's rights to the extent permitted by law.

15. International Transfers

Customer acknowledges that Wrangl is based in the United States and that Customer Personal Data may be processed in the United States and other countries in which authorized Subprocessors operate.

Wrangl will not transfer Customer Personal Data from the EEA to a country requiring a transfer safeguard unless the transfer is covered by a legally valid mechanism.

15.1 European Economic Area

Where Customer Personal Data subject to the GDPR is transferred to Wrangl in the United States and the transfer requires safeguards under Chapter V of the GDPR, the EU SCCs are incorporated into this DPA as described in Schedule 4.

Where Customer acts as controller and Wrangl acts as processor, Module Two applies.

Where Customer acts as processor and Wrangl acts as subprocessor, Module Three applies.

The parties will cooperate in conducting and documenting transfer assessments required by the EU SCCs or applicable Data Protection Laws and in implementing supplementary safeguards where reasonably necessary.

16. Limitation of Processing

Wrangl does not sell Customer Personal Data.

Wrangl does not share Customer Personal Data for cross-context behavioral advertising.

Wrangl does not use Customer Personal Data to build advertising profiles.

Wrangl does not use Customer Personal Data to train generalized AI models.

Wrangl will not use Customer Personal Data for a purpose materially unrelated to providing, operating, supporting, securing, or improving the Services except where Customer instructs Wrangl to do so or applicable law permits or requires the processing.

17. Liability

Except to the extent prohibited by applicable Data Protection Laws, the liability provisions of the Agreement apply to this DPA.

Nothing in the Agreement or this DPA limits or modifies liability in a manner that would conflict with or undermine the mandatory liability provisions of the EU SCCs or applicable law.

18. Duration

This DPA takes effect when Customer becomes bound by it and remains effective for as long as Wrangl processes Customer Personal Data on Customer's behalf.

Obligations that by their nature continue after termination, including confidentiality, deletion, international-transfer protections, and applicable audit or regulatory obligations, will survive for as long as relevant Customer Personal Data remains in Wrangl's possession or control.

19. Order of Precedence

If there is a conflict concerning the processing of Customer Personal Data:

1. for an EEA Restricted Transfer, the applicable EU SCCs control;
2. this DPA controls over conflicting provisions of the Agreement; and
3. the Agreement otherwise remains in effect.

Nothing in this DPA modifies a mandatory requirement of applicable Data Protection Laws.

Schedule 1

Details of Processing

A. Subject Matter

Processing of Customer Personal Data as necessary to provide the Wrangl project, time-tracking, task-management, messaging, file-storage, invoicing, reporting, notification, and related business-management Services.

B. Duration

For the duration of Customer's use of the Services and any additional period during which Customer Personal Data remains in Wrangl's systems in accordance with Customer instructions, the Agreement, this DPA, backup lifecycles, or applicable law.

C. Nature of Processing

Processing may include:

• collection;
• receipt;
• recording;
• organization;
• structuring;
• storage;
• retrieval;
• consultation;
• display;
• transmission;
• calculation;
• modification;
• generation of reports and invoices;
• messaging;
• file handling;
• backup;
• security monitoring;
• deletion; and
• AI inference when an authorized user expressly uses an AI-enabled feature.

D. Purposes of Processing

The purposes are those specifically described in Section 4 of this DPA.

E. Categories of Data Subjects

Customer Personal Data may relate to:

• Customer's employees;
• Customer's owners and administrators;
• Customer's team members and authorized users;
• contractors and subcontractors;
• resources whose time or work Customer tracks;
• clients;
• client employees and representatives;
• client contacts;
• vendors and business contacts;
• individuals identified in tasks, messages, files, invoices, or project records; and
• other individuals whose information Customer chooses to enter into Wrangl.

F. Categories of Customer Personal Data

Depending on Customer's use of Wrangl, Customer Personal Data may include:

• names;
• business email addresses;
• telephone numbers;
• company names;
• job titles and business roles;
• client and resource identifiers;
• project assignments;
• tasks and task information;
• time entries;
• work comments and notes;
• project codes;
• billing rates;
• costs associated with resources;
• budgets;
• invoice information and invoice-line information;
• messages and reactions;
• documents, images, and other uploaded files;
• information contained inside uploaded files;
• notification-related information;
• other business information entered by Customer into free-text fields or files.

G. Special Categories and Highly Regulated Data

Wrangl is not designed for Customer to submit:

• Social Security numbers;
• complete payment-card information;
• financial-account access credentials;
• protected health information subject to HIPAA;
• government identification numbers; or
• other information requiring specialized regulatory safeguards not expressly agreed to by Wrangl.

Wrangl is not intended for systematic processing of special-category personal data under GDPR Article 9.

Customer must not intentionally submit such information unless Customer has a lawful basis to do so and Wrangl has expressly agreed in writing to the applicable processing and safeguards.

H. Frequency of Transfer

Continuous or intermittent, depending on Customer's use of the Services.

I. Retention

Customer Personal Data is retained while Customer's Wrangl account remains active, subject to Customer instructions and the Agreement.

Cancellation of a paid subscription may result in Customer Data above Free-plan limits becoming read-only rather than being deleted.

Upon account deletion, active Customer Personal Data is deleted subject to legal retention obligations and backup lifecycle processes. Deleted information may remain in backups for up to 90 days.

Schedule 2

Technical and Organizational Measures

Wrangl currently uses the following measures for the protection of Customer Personal Data.

1. Data Isolation

Customer accounts are logically separated at the database level.

Database row-level security is used to restrict records so that one Customer account cannot ordinarily retrieve another Customer's records through the application.

2. Role-Based Access

Wrangl uses role-based permissions.

Account administrators control authorized users and applicable roles.

Permissions restrict access to information such as billing rates, costs, and margins according to assigned roles.

Removal of user access takes effect through Wrangl's account-permission controls.

3. Authentication

Email addresses must be verified before an account may sign in.

Authentication credentials are handled through Wrangl's authentication provider.

Wrangl does not have access to users' passwords in readable form.

4. Encryption in Transit

Traffic between users' browsers and Wrangl is transmitted over encrypted connections using industry-standard transport encryption.

5. File Protection

Files stored through Wrangl are not intentionally made available through permanent public URLs.

Authorized file access uses restricted or expiring access mechanisms.

6. Data Minimization

Service providers receive only the information reasonably necessary to perform the services Wrangl uses them for.

Where an authorized user invokes an AI feature, Wrangl sends the AI provider only the request and records reasonably necessary to produce the requested response.

7. Infrastructure and Security Logs

Wrangl's infrastructure and hosting providers maintain operational request logs, which may include information such as IP address, browser information, request time, and related technical information used to operate and secure the Services.

8. Payment-Card Segregation

Payment-card details used to purchase Wrangl subscriptions are collected directly by the payment processor and are not stored by Wrangl.

9. Backups and Recovery

Wrangl's infrastructure providers maintain backup and recovery mechanisms used to support service continuity.

Deleted Customer Personal Data may persist in protected backups for up to 90 days before normal backup lifecycle processes remove or overwrite it.

10. Confidentiality

Personnel or contractors authorized by Wrangl to access Customer Personal Data are limited to access reasonably necessary for their responsibilities and are subject to appropriate confidentiality obligations.

11. Incident Response

Wrangl maintains procedures for investigating confirmed security incidents and will notify affected Customers as described in this DPA and applicable law.

Schedule 3

Authorized Subprocessors

Customer authorizes the following Subprocessors where they process Customer Personal Data as part of providing Wrangl.

The AI subprocessors above process Customer Personal Data only where an authorized user invokes an AI feature. No AI feature is enabled in Wrangl at the date of this DPA.

Providers used for Wrangl's own account administration, payment processing, bot protection, operational email, or encrypted browser-push delivery may also be identified in Wrangl's Privacy Policy but are not necessarily Subprocessors of Customer Personal Data for every Customer.

Schedule 4

International Transfer Terms — European Economic Area

Where the EU SCCs apply, the parties agree as follows.

1. Parties

Data Exporter:
Customer identified in the Agreement or Wrangl account records.

Customer's address and contact information are the business details associated with Customer's Wrangl account, order, or other written agreement with Wrangl.

Data Importer:
App-O-Matic Labs, LLC
Wrangl
Huntersville, North Carolina, United States
contact@appomaticlabs.com

The activities relevant to the transfer are the processing activities described in Schedule 1.

2. Applicable Module

If Customer is the controller and Wrangl is the processor:

Module Two — Controller to Processor applies.

If Customer is a processor acting for another controller and Wrangl is Customer's subprocessor:

Module Three — Processor to Processor applies.

3. Clause 7 — Docking Clause

Clause 7 is included.

4. Clause 9 — Subprocessor Authorization

For Modules Two and Three, general written authorization applies.

The agreed notice period for intended additions or replacements of Subprocessors is 15 days, subject to the emergency-security exception described in Section 11 of this DPA.

5. Clause 11

The optional independent dispute-resolution language in Clause 11 is not used.

6. Clause 13 — Supervisory Authority

The competent supervisory authority will be determined in accordance with Clause 13 of the EU SCCs based on Customer's establishment, representative, or other circumstances applicable to the transfer.

7. Clause 17 — Governing Law

Where Customer is established in the EEA, the SCCs will be governed by the law of the EEA country in which Customer is established, provided that law permits third-party beneficiary rights under the SCCs.

If that law does not permit such rights, or Customer is not established in the EEA and another qualifying law is not identified, the SCCs will be governed by the laws of Ireland.

8. Clause 18 — Courts

The courts corresponding to the governing law selected under Clause 17 will have jurisdiction as provided by the SCCs.

Where Irish law is the fallback governing law, the courts of Ireland will be the designated courts.

9. Annex I.B — Description of Transfer

Schedule 1 to this DPA completes Annex I.B.

10. Annex II — Security Measures

Schedule 2 to this DPA completes Annex II.

11. Annex III — Subprocessors

Schedule 3 to this DPA completes Annex III.

Contact

Questions relating to this DPA or Wrangl's processing of Customer Personal Data may be sent to:

App-O-Matic Labs, LLC
Wrangl
Huntersville, North Carolina
contact@appomaticlabs.com