Data Processing Agreement

1. Definitions and scope

"GDPR" means Regulation (EU) 2016/679. "Personal data", "processing", "controller", "processor", "sub-processor", "data subject", "supervisory authority" and "personal data breach" have the meanings given in Article 4 GDPR. "Applicable Data Protection Law" means the GDPR, the UK GDPR and Data Protection Act 2018 where relevant, and any other data-protection law applicable to a party.

This DPA applies where and only where we process personal data on your behalf in the course of providing the Service. It does not apply to personal data for which we are the controller — your account, billing and technical data — which is governed by our Privacy Policy.

Where this DPA conflicts with the Terms of Service on a matter of data protection, this DPA prevails.

2. Roles of the parties

You are the controller of the personal data contained in the sales-channel data you instruct us to retrieve and analyse — principally end-customer data received from Amazon and other platforms you connect. We are your processor in respect of that data.

You warrant that you have a lawful basis for the processing you instruct, that you have provided any notice and obtained any consent required from your end customers, and that your instructions do not breach Applicable Data Protection Law or the terms of the platforms you connect.

3. Subject matter and details of processing

The subject matter, duration, nature and purpose of the processing, the categories of data subject and the types of personal data are set out in Annex I. Annex I forms the documented scope of processing required by Article 28(3).

4. Processing on documented instructions

1. We process personal data only on your documented instructions, including as regards transfers to a third country, unless required to do otherwise by Union or Member State law to which we are subject. In that case we will inform you of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
2. Your instructions are: (a) this DPA; (b) the Terms of Service; (c) your configuration of and use of the Service, including which channels you connect and which features you enable; and (d) any further written instruction you give us.
3. We will inform you if, in our opinion, an instruction infringes Applicable Data Protection Law. We may suspend the affected processing until the instruction is confirmed, amended or withdrawn.
4. We will not process the personal data for our own purposes, and specifically will not sell it, use it for advertising, disclose it to third parties other than the sub-processors listed in Annex III, use it to train machine-learning or artificial-intelligence models, or use it to build or improve any product other than the Service provided to you.

5. Confidentiality

We ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access is limited to personnel who need it to provide, secure or support the Service.

6. Security

We implement the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk to data subjects, as required by Article 32 GDPR.

We may update those measures over time, provided the level of protection is not reduced. Annex II reflects the measures in place as at the effective date.

7. Sub-processors

1. You give us general written authorisation to engage sub-processors, on the terms of this clause.
2. The sub-processors engaged as at the effective date are listed in Annex III.
3. We will give you at least 30 days' notice of any intended addition or replacement of a sub-processor, by email to your account address or by notice in the Service, so that you have the opportunity to object.
4. You may object on reasonable grounds relating to data protection within that period. We will work with you in good faith to resolve the objection. If we cannot, you may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for the unused period.
5. We impose on each sub-processor, by written contract, data-protection obligations that are no less protective than those in this DPA. We remain fully liable to you for the performance of each sub-processor's obligations.

8. International transfers

Personal data processed under this DPA is stored and processed within the European Union, except for the transfers identified in Annex III. Where personal data is transferred to a third country without an adequacy decision, that transfer is governed by the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference and completed with the information in Annexes I to III.

Where the SCCs apply between you and us, Module Two (controller to processor) applies; where they apply between us and a sub-processor, Module Three (processor to processor) applies. Clause 7 (docking) applies. For Clause 9, Option 2 (general written authorisation) applies with the 30-day notice period in clause 7 above. For Clause 11, the optional independent-dispute-resolution wording does not apply. For Clause 17, the governing law is that of Estonia. For Clause 18(b), the forum is the courts of Estonia.

We will provide copies of the relevant clauses and any transfer impact assessment on request.

9. Assistance with data subject rights

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests to exercise data subject rights under Chapter III GDPR.

The Service provides export and deletion functions that allow you to respond to most requests yourself. Where you need our direct assistance, we act without undue delay and in any event within a period that allows you to meet your own statutory deadline.

If we receive a request directly from one of your end customers, we will not respond to it ourselves except to acknowledge receipt and redirect. We will forward it to you without undue delay.

10. Assistance with your other obligations

Taking into account the nature of processing and the information available to us, we assist you in ensuring compliance with your obligations under Articles 32 to 36 GDPR — security of processing, breach notification and communication, data protection impact assessments, and prior consultation with a supervisory authority.

11. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf. The notification will describe, to the extent known and as it becomes available: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point for further information.

We will not delay an initial notification in order to complete our investigation, and we will provide further information in phases as it becomes available. We do not notify your end customers or a supervisory authority on your behalf unless you instruct us to do so.

12. Audit and information

1. We make available to you all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.
2. In the first instance we will respond to reasonable written information requests, including security questionnaires, and provide documentation of our technical and organisational measures.
3. Where that is not sufficient to demonstrate compliance, you may conduct an on-site or remote audit, on at least 30 days' written notice, no more than once in any 12-month period, during business hours, subject to confidentiality undertakings, and conducted so as to minimise disruption to the Service. This frequency limit does not apply where an audit is required by a supervisory authority or follows a personal data breach.
4. Each party bears its own costs, save that we may charge a reasonable fee for audits that go materially beyond what is necessary to demonstrate compliance.
5. An auditor you mandate must not be a competitor of ours.

13. Deletion and return of data

At your choice, we delete or return all personal data processed on your behalf after the end of the provision of services, and delete existing copies, unless Union or Member State law requires storage of the personal data.

In practice: you may export your data at any time while your subscription is active. On termination we retain it for 90 days so you can reactivate or export, and then delete it. You may instruct us to delete it sooner, and we will do so within 30 days of that instruction. Data in backups is deleted as those backups expire on their normal rolling cycle, within 35 days; until then it remains protected by the measures in Annex II and is not processed for any other purpose.

We retain records we are legally required to keep — in particular accounting records under Estonian law — for the statutory period, and only for that purpose.

14. Amazon Selling Partner data

Where the personal data originates from the Amazon Selling Partner API, both parties additionally comply with Amazon's Data Protection Policy and Acceptable Use Policy. In particular, and notwithstanding any broader instruction from you:

• We use end-customer personal information only for order fulfilment and reconciliation, tax calculation, remittance and invoicing, and compliance with legal obligations.
• We delete plaintext end-customer identifiers within 30 days of order delivery, retaining only irreversibly pseudonymised identifiers for the analytics you have subscribed to, and retaining plaintext beyond that period only where a specific record must be kept to meet a statutory tax obligation, in restricted-access storage.
• We will not act on an instruction from you to use end-customer personal information for marketing, review solicitation, enrichment, resale, or any other purpose Amazon prohibits. Such an instruction is outside the scope of this DPA and we will refuse it.

This clause survives any conflicting instruction and reflects obligations we owe to Amazon independently of this DPA.

15. Liability and duration

This DPA takes effect when you accept the Terms of Service and continues for as long as we process personal data on your behalf. Clauses 5, 12, 13 and 14 survive termination.

Liability under this DPA is subject to the limitations in the Terms of Service, except that nothing in either document limits or excludes either party's liability to a data subject under Article 82 GDPR, or any liability that cannot be limited under Applicable Data Protection Law.

Questions about this DPA, requests for a countersigned copy, copies of the Standard Contractual Clauses, or security documentation: privacy@dlvinsight.com.