Data Processing Addendum

1. Scope and roles

The merchant is the controller (or business) for personal data it determines to process through its store and checkout. Voss acts as processor (or service provider) for that data to the extent Voss processes it on the merchant's instructions. Terms such as controller, processor, personal data and processing have the meanings given by applicable data-protection law.

2. Merchant instructions

Voss will process merchant-controlled personal data only to provide, secure, support and improve the contracted service, to follow documented merchant instructions, and as required by law. The merchant instructs Voss to process data as necessary to operate the configured Shopify, Whop, order-sync, checkout and tracking features.

3. Confidentiality

Voss will ensure that people authorized to process merchant-controlled personal data are subject to appropriate confidentiality obligations.

4. Security

Voss will maintain reasonable technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures include access controls, tenant separation, encrypted network transport, restricted credentials, logging/monitoring and secure development practices appropriate to the service.

5. Subprocessors

The merchant authorizes Voss to use subprocessors necessary to provide the service. The current core list is published at Subprocessors. Voss will impose data-protection obligations on subprocessors appropriate to the services they perform.

6. International transfers

Where legally required, Voss and its subprocessors will use an appropriate transfer mechanism for personal data transferred across borders, which may include standard contractual clauses or another mechanism recognized by applicable law.

7. Data-subject requests

Taking into account the nature of the processing, Voss will provide reasonable assistance to the merchant with requests from individuals exercising applicable data-protection rights. If Voss receives a request relating to merchant-controlled shopper data, Voss may direct the requester to the merchant unless law requires otherwise.

8. Security incidents

Voss will notify the merchant without undue delay after becoming aware of a confirmed personal-data breach involving merchant-controlled data where notification is required by applicable law. Voss will provide reasonably available information needed for the merchant to meet its own legal obligations.

9. Deletion and return

On termination or valid merchant request, Voss will delete or return merchant-controlled personal data as required by applicable law and subject to reasonable backup cycles, fraud/security needs, legal retention requirements and transaction records that Voss must lawfully retain.

10. Compliance information

Voss will make information reasonably necessary to demonstrate compliance with processor obligations available to the merchant, subject to confidentiality, security and proportionality. Audit requests must not unreasonably interfere with Voss or expose other customers' information or security-sensitive details.

11. Processing details

Subject matter: ecommerce checkout, order synchronization, connected-service integrations, support and related merchant services.

Duration: for the merchant's use of Voss plus applicable retention periods.

Data subjects: merchants, merchant staff, shoppers, customers and other individuals whose data a merchant submits through the service.

Data types: identity/contact data, addresses, cart/order data, transaction/payment-status data, store/integration identifiers, device/network data and merchant-configured tracking data. Voss is not intended to store full payment-card credentials.

12. Order of precedence

If this DPA conflicts with the Terms of Service on a data-protection matter, this DPA controls for that matter.