Shuppz Data Processing Addendum
A role-aware DPA framework for cases where Shuppz actually processes personal data on a merchant’s documented instructions.
Shuppz is currently a pre-incorporation Early Beta project. These documents are tailored to the current Shuppz product and are intended to govern the Beta framework, but the formal operator identity, legal contact, formation jurisdiction and any jurisdiction-specific dispute provisions must be completed and reviewed by qualified counsel before production commercial launch.
1. When this DPA applies
This Data Processing Addendum applies only when a separate merchant or business agreement expressly states that Shuppz processes specified personal data on behalf of the business as a processor or service provider.
It does not automatically make Shuppz a processor for all marketplace data. Shuppz may act as an independent controller for shopper accounts, marketplace intent, fraud prevention, security, product analytics and other processing where Shuppz determines the purposes and essential means.
2. Processing details
The applicable order, merchant agreement or data schedule must identify the subject matter, duration, purpose, categories of personal data, categories of data subjects and the business’s documented instructions.
Typical processor-scoped data, if a future feature supports it, may include merchant-imported customer contact or transaction data used solely to perform a merchant-requested function.
3. Instructions and confidentiality
Shuppz will process processor-scoped personal data only on documented instructions from the business, unless law requires otherwise.
Personnel authorized to process such data must be subject to appropriate confidentiality duties.
4. Security
Shuppz will implement technical and organizational measures appropriate to the risk, including access control, authentication, logging, vulnerability management, backup or recovery practices where relevant, and data minimization.
The exact security schedule should reflect the actual production architecture and be attached before executing this DPA for paid production service.
5. Subprocessors
Shuppz may use subprocessors to provide infrastructure or operational services. A production DPA must maintain an accurate subprocessor list and a mechanism for legally required notice of material changes.
Shuppz remains responsible for imposing appropriate data-protection obligations on subprocessors for processor-scoped data.
6. Data subject requests
Taking into account the nature of processing, Shuppz will reasonably assist the business with requests to access, correct, delete, restrict or port processor-scoped personal data when required by applicable law.
If Shuppz receives a request relating solely to business-controlled processor data, it may direct the requester to the business unless law requires another response.
7. Security incidents
Shuppz will notify the business without undue delay after confirming a security incident affecting processor-scoped personal data, consistent with applicable law and the parties’ production agreement.
A production DPA should define notice contacts and any contractually agreed reporting timeline.
8. Deletion and return
At the end of processor services, Shuppz will delete or return processor-scoped personal data as required by the business’s documented instructions and applicable law, subject to lawful retention obligations and secure backup cycles.
9. Audits and information
Shuppz will make information reasonably necessary to demonstrate compliance available to the business and will support proportionate audits as required by applicable law, subject to confidentiality, security and reasonable scope protections.
10. International transfers
Where restricted international transfers apply, the parties must use an approved transfer mechanism, such as applicable standard contractual clauses, and complete any required transfer assessment.
11. Role changes
If Shuppz begins determining the purposes and essential means of processing that was previously processor-scoped, the parties must reassess roles and update the governing documentation.
12. Pre-incorporation limitation
This DPA is a Shuppz-specific framework for counsel review. The contracting entity, security schedule, subprocessor schedule, governing law and signature blocks must be completed before it is executed.