Data Processing Agreement (DPA)

Effective Date: August 31, 2026 | Version 2026.1

1. Roles of the Parties (Art. 28 GDPR)

The parties acknowledge and agree that:

• Merchant as Data Controller: The Merchant is the Controller of the personal data of its end-customers (including order information, delivery addresses, customer names, contact info) processed through the Shoppi platform.
• Shoppi as Data Processor: Shoppi (Shoppi Inc., Shoppi UG, Shoppi Ltd) acts as a Processor (or Sub-processor where applicable) processing personal data solely on behalf of and under the documented instructions of the Merchant.

2. Scope, Subject Matter and Duration of Processing

The Processor shall process personal data solely for the provision of the SaaS platform services, order routing, catalog synchronization, checkout management, POS synchronization, and support as set forth in the Principal Agreement and this DPA.

• Categories of Data Subjects: Merchant’s customers, authorized employees, website visitors.
• Types of Personal Data: Contact details (names, emails, physical addresses, phone numbers), transaction data, order contents, IP addresses, payment tokens.
• Duration: The duration of the Principal Agreement plus any post-termination retention periods required by applicable law or agreed for disaster recovery/backup.

3. Obligations of the Processor (Shoppi)

Shoppi covenants and undertakes that it will:

1. Instruction Compliance: Process personal data only on documented instructions from the Merchant, unless required by mandatory EU/member state law;
2. Confidentiality: Ensure that all personnel authorized to process personal data have committed themselves to confidentiality;
3. Security Measures (Art. 32 GDPR): Implement and maintain appropriate technical and organizational measures (TOMs), including TLS 1.3 encryption in transit, AES-256 encryption at rest, tenant segregation, role-based access control (RBAC), and automated vulnerability assessments;
4. Sub-processing: Only engage sub-processors under a written agreement imposing data protection obligations no less protective than those herein. An up-to-date list of sub-processors (including cloud hosting, email gateways, and payment partners) is maintained and accessible to Merchant;
5. Data Subject Rights Assistance: Provide reasonable technical assistance to Merchant for fulfilling data subject requests (access, rectification, erasure, data portability);
6. Breach Notification: Notify the Merchant without undue delay (and in any event within 48 hours) upon becoming aware of a confirmed Personal Data Breach affecting Merchant's data;
7. Return or Deletion: Upon termination of services, delete or return all personal data to the Merchant, subject to legal retention duties.

4. International Data Transfers & Standard Contractual Clauses (SCC)

Where personal data originating from the EEA, Switzerland, or the UK is transferred or accessed outside these jurisdictions (such as by Shoppi Inc. in the United States or US-based sub-processors), the parties hereby incorporate by reference the Standard Contractual Clauses (SCCs) adopted by European Commission Implementing Decision (EU) 2021/914:

• Module Two (Controller-to-Processor): Applies where Merchant is a Controller in the EEA/UK and Shoppi acts as Processor outside the EEA.
• Module Three (Processor-to-Processor): Applies where Merchant acts as a Processor on behalf of third parties and Shoppi acts as Sub-processor.

The parties agree that for the purposes of the SCCs, the technical and organizational measures specified in Annex II correspond to Shoppi's documented security practices.

5. Audits and Inspections

Shoppi shall make available to Merchant all information reasonably necessary to demonstrate compliance with Article 28 GDPR and allow for audits or third-party independent security certifications (such as SOC2 / ISO 27001 reports).

6. Governing Law

This DPA is governed by the law of the EU member state in which the Merchant is established, or if outside the EU, the laws of the Federal Republic of Germany (Shoppi UG) or the State of Delaware (Shoppi Inc.).