Data Processing Addendum & Subprocessors

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Shopinzip Inc, a New Jersey corporation ("Shopinzip"), and the Member. It applies when Shopinzip processes personal data on the Member's behalf ("Customer Personal Data"). It takes effect when the Member accepts the Terms. Capitalized terms not defined here have the meanings in the Terms.

1. Roles and scope

• The Member is the controller (or "business" under California law, or "data fiduciary" under Indian law). Shopinzip is its processor (or "service provider" or "data processor").
• If the Member is an agency acting as processor for its Clients, Shopinzip is the Member's subprocessor, and the Member is responsible for passing on its Clients' instructions.
• Annex 1 describes the processing.

2. Shopinzip's obligations

2.1 General. Shopinzip will:

1. process Customer Personal Data only on the Member's documented instructions, which are the Terms, the Member's configuration and its use of the Service, and tell the Member if an instruction appears to break the law;
2. ensure everyone authorized to process it is bound by confidentiality;
3. implement the security measures in Annex 2;
4. use subprocessors only under Section 4;
5. help the Member, considering the nature of the processing, with data-subject requests, security, breach notification, data protection assessments and consultations with regulators, at the Member's reasonable cost where help goes beyond self-service tools;
6. delete or return Customer Personal Data when the Service ends, under Section 11;
7. make available the information reasonably needed to show compliance and allow audits under Section 2.4.

2.2 California. Shopinzip will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside the direct business relationship with the Member; and will not combine it with personal information from other sources except as the CCPA regulations allow. Shopinzip will comply with the CCPA, provide the same level of privacy protection it requires, and notify the Member if it can no longer meet these obligations. The Member may take reasonable steps to stop and remediate unauthorized use. Shopinzip certifies that it understands these restrictions.

2.3 Other US states. For the New Jersey, Virginia, Colorado, Connecticut, Texas, Oregon and similar laws, Shopinzip will also bind each subprocessor by written contract to the same obligations, delete or return data at the end of the Service unless the law requires retention, and allow and cooperate with reasonable assessments by the Member.

2.4 Audits. Audits are limited to one per year, on 30 days' notice, during business hours, at the Member's cost and under confidentiality. Shopinzip's existing documentation and any third-party reports are provided first, and an on-site or further audit happens only if they don't reasonably show compliance or a regulator requires it.

3. Member obligations

The Member warrants that:

• it has a lawful basis, and has given every notice and obtained every consent required, for the processing, including marketing, messaging, call-recording and tracking consents;
• its instructions comply with law;
• it will not submit special-category or sensitive data unless a feature expressly supports it;
• it will not submit protected health information under HIPAA. Shopinzip is not a Business Associate and does not sign Business Associate Agreements.

The Member is responsible for responding to its own data subjects and for the accuracy of Customer Personal Data.

4. Subprocessors

• The Member gives general authorization to the subprocessors in Annex 3.
• Shopinzip updates Annex 3 at least 14 days before adding or replacing a subprocessor, and emails Members who subscribe at privacy@growingwhale.com.
• The Member may object on reasonable data-protection grounds within those 14 days. If Shopinzip can't reasonably resolve the objection, the Member may terminate the affected Service and receive a refund of prepaid fees for the unused period.
• Shopinzip binds each subprocessor by written contract to data-protection obligations no less protective than this DPA, and remains responsible for their performance, subject to Section 9.
• Third-Party Services the Member chooses to connect (such as Google APIs, Meta, Microsoft, HubSpot, Shopify, Slack, or the Member's own Stripe account) are not Shopinzip's subprocessors. Data flows to them at the Member's direction.

5. Data-subject requests

The Member can access, correct, export and delete Customer Personal Data using the Service's tools. If Shopinzip receives a request directly, it forwards it to the Member within 10 days and doesn't respond itself, except to direct the person to the Member, unless the law requires otherwise.

6. Personal data breach

• Shopinzip notifies the Member without undue delay after becoming aware of a breach affecting Customer Personal Data.
• The notice includes, as far as known: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact for more information. Shopinzip sends updates as it learns more.
• The Member, as controller, notifies regulators and affected people unless the law requires Shopinzip to.
• A notification is not an admission of fault or liability.

7. International transfers

7.1 EEA. Where Customer Personal Data from the EEA is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference: Module 2 (controller to processor) and Module 3 (processor to processor). The optional docking clause does not apply. Under Clause 9, option 2 (general authorization) applies with the notice period in Section 4. The optional language in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is that of the Member's establishment or EU representative. Under Clauses 17 and 18, the law and courts of Ireland apply. Annexes I, II and III of the Clauses are completed by Annexes 1, 2 and 3 of this DPA.

7.2 UK. For UK transfers, the UK International Data Transfer Addendum to the EU SCCs applies, with its tables completed by this DPA and its annexes.

7.3 Switzerland. For Swiss transfers, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent authority, and "Member State" read to include Switzerland so Swiss data subjects can enforce their rights.

7.4 India. Where the DPDP Act applies, Shopinzip processes Customer Personal Data only under this contract and the Member's instructions, applies reasonable security safeguards, informs the Member of any personal data breach in time for it to notify the Data Protection Board and affected people, and erases the data when the Service ends or the Member instructs.

8. Government requests

If a government authority asks Shopinzip for Customer Personal Data, Shopinzip will redirect it to the Member where possible, notify the Member unless legally prohibited, challenge requests it reasonably believes are unlawful, and disclose only the minimum required. Shopinzip has not built back doors into the Service for government access.

9. Liability

Shopinzip's liability under this DPA and, to the extent the SCCs allow, under the SCCs is subject to the limitations and exclusions in Section 18 of the Terms. Nothing in this DPA limits rights data subjects have under the SCCs.

10. Order of precedence

On the processing of personal data, this DPA prevails over the Terms. For restricted transfers, the SCCs prevail over this DPA.

11. Term, return and deletion

This DPA lasts as long as Shopinzip processes Customer Personal Data. When the Service ends, the Member may export its data during the export window in the Terms, after which Shopinzip deletes it as set out in the Data Deletion Instructions, unless the law requires retention. Shopinzip confirms deletion in writing on request.

Annex 1: Description of processing

Annex 2: Security measures

Shopinzip maintains technical and organizational measures appropriate to the nature of the processing and the risks involved. It may update them over time, provided overall protection is not reduced. As appropriate to the risk, they include measures such as:

• encryption of data in transit and at rest;
• protection of OAuth tokens, API keys and secrets, isolated per Member;
• logical separation of each Member's data;
• role-based, least-privilege access and strong authentication for staff access;
• logging and monitoring of systems and access;
• secure development practices, including code review;
• regular backups and the ability to restore data;
• security reviews of subprocessors before engaging them;
• an incident response and breach notification procedure;
• confidentiality obligations for staff and removal of access when they leave.

Annex 3: Subprocessors

Shopinzip uses subprocessors in the categories below. Where a provider is named, it is current. Shopinzip names each new provider in this list before it begins processing Customer Personal Data, under Section 4, and Members can request the current list at privacy@growingwhale.com at any time.

Third-Party Services that Members choose to connect are not subprocessors (Section 4).

Contact

Shopinzip Inc · 222 Highview Drive, Clifton, NJ 07013, USA · privacy@growingwhale.com