Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the merchant ("Controller") and [Company legal entity — TBD] trading as Venqo.ai ("Processor") for the provision of the Venqo Service. It applies to personal data that the Processor processes on behalf of the Controller in connection with the Service and is designed to satisfy Article 28 of the EU GDPR and equivalent UK provisions.

Merchants who require a counter-signed DPA should email support@venqo.ai with "DPA" in the subject line. Executing the Venqo app install and/or these Terms is treated as acceptance of this DPA for merchants who do not require a separately signed copy.

The Controller determines the purposes and means of processing the personal data of its shoppers. The Processor processes personal data only on documented instructions from the Controller, as set out in the Service configuration and the Privacy Policy.

• Subject matter: processing of shopper personal data to provide the Venqo AI shopping assistant.
• Duration: for the term of the agreement and any post-termination retention period described in the Privacy Policy.
• Nature: collection, storage, retrieval, consultation, use, transmission, and deletion.
• Purpose: to operate the assistant, respond to shopper queries, provide analytics to the Controller, and fulfil legal obligations.
• Categories of data subjects:shoppers visiting the Controller's Shopify store; authorised users of the Controller's Venqo account.
• Categories of personal data: conversation messages, pseudonymous visitor identifiers, browser and device metadata, (optionally) email address or order number entered by a shopper for order lookup, authorised-user emails for the dashboard.
• Special categories: none intended. Shoppers may occasionally submit sensitive information in free-text; such content is not solicited and will be deleted on request.

The Processor shall:

• Process personal data only on documented instructions from the Controller, except where required by applicable law.
• Ensure that personnel authorised to process personal data are bound by confidentiality.
• Implement appropriate technical and organisational measures as described in Section 8.
• Assist the Controller in responding to data-subject requests, including access, rectification, erasure, restriction, portability, and objection.
• Assist the Controller with data protection impact assessments and prior consultations with supervisory authorities where required.
• At the Controller's choice, delete or return all personal data at the end of the agreement, subject to any retention required by law.
• Make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and permit reasonable audits (further detailed in Section 9).

The Controller provides general authorisation for the Processor to engage sub-processors. The current list of sub-processors is:

• Supabase, Inc. — database, authentication, storage (United States / European Union).
• Stripe, Inc. — billing and payment processing (United States).
• Resend, Inc. — transactional email delivery (United States).
• Inngest, Inc. — background job orchestration (United States).
• Anthropic, PBC — LLM inference for Claude models (United States).
• OpenAI, L.L.C. — LLM inference for GPT models (United States).
• Shopify Inc. — storefront and admin APIs; source of shop data and destination for order lookups (Canada / United States).
• Vercel, Inc. — application hosting and edge delivery (United States / global).

The Processor will notify the Controller of any intended additions or replacements at least 30 days in advance. The Controller may object on reasonable data-protection grounds; if the parties cannot agree, the Controller may terminate the affected part of the Service.

Where the Processor transfers personal data outside the EEA or the UK, it will rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with appropriate module selection, and the UK International Data Transfer Addendum where applicable. Supplementary measures (such as encryption in transit and at rest) are applied as described in Section 8.

The Processor will not use personal data processed under this DPA to train, fine-tune, or otherwise update machine-learning models. This commitment mirrors the AI usage section of the Privacy Policy and is aligned with Shopify's Partner Program Agreement / API Terms §2.3(24). Should the Processor introduce an opt-in per-merchant training feature in the future, it will require separate explicit consent from the Controller and an amendment to this DPA before any processing for that purpose begins.

The Processor implements the following measures:

• TLS 1.2+ for all data in transit.
• Encryption at rest for databases (Supabase) and object storage. Shopify access tokens are encrypted with a separately managed key.
• Multi-tenant isolation at the database layer via row-level security.
• Least-privilege access controls on production systems; named personnel only; access logged.
• Secret management via Vercel / Supabase vaults, with rotation on personnel changes.
• Dependency vulnerability scanning and regular patching.
• Incident response plan with a notification target of 72 hours to affected Controllers in line with GDPR Article 33.

On written request no more than once per 12-month period (and more frequently in the event of a material incident), the Processor will provide the Controller with a current security summary sufficient to assess compliance. On-site audits will be considered on a case-by-case basis and must be coordinated at least 30 days in advance.

The Processor will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data, and will provide information reasonably necessary for the Controller to comply with its own notification obligations.

On termination of the Service, the Processor will delete personal data within the retention windows set out in the Privacy Policy. Where the Controller requests earlier deletion, the Processor will action the request within 30 days, subject to legal retention obligations (for example, billing records required by tax law).

This DPA is governed by the laws specified in the main Terms [Jurisdiction — TBD]. Where this DPA conflicts with the Terms in relation to personal data, this DPA prevails.