Data Processing Agreement

1. Parties and how this DPA applies

1. This Data Processing Agreement ("DPA") is between Madyan Alkarhani, an individual operating Upsellano from Lebanon ("we", "us", "Processor"), contactable at privacy@upsellano.com, and the merchant that installs the App ("you", "Merchant").
2. This DPA forms part of our Terms of Service at https://upsellano.com/terms. You accept it when you accept the Terms by installing or using the App; no separate signature is needed. If you want a countersigned copy for your records, email privacy@upsellano.com.
3. It applies whenever we process Personal Data on your behalf through the App.
4. Order of precedence: if there is a conflict, the Standard Contractual Clauses and the UK Addendum (section 15) prevail, then this DPA, then the Terms.
5. We may update this DPA under the change process in the Terms (section 13 of the Terms). An update will not reduce the protection of Personal Data you have given us without your agreement, unless the law requires the change.

2. Definitions

• Data Protection Laws: all data protection and privacy laws that apply to the processing of Personal Data under this DPA, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the UK Data Protection Act 2018, the California Consumer Privacy Act as amended ("CCPA"), Lebanese Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data, and other laws of the countries where you or your customers are.
• Personal Data: personal data or personal information (as Data Protection Laws define those terms) that we process on your behalf through the App, as described in Annex 1.
• Sub-processor: a third party we engage to process Personal Data for the App (Annex 3).
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR; "business", "service provider", "sell", "share" and "consumer" have the meanings given in the CCPA.

3. Roles

1. For Personal Data about your store's customers and visitors, you are the controller (or "business") and we are your processor (or "service provider").
2. For information about you that we need to run the App and our business (store details, configuration, plan and billing status, support and privacy correspondence), we are an independent controller, as our Privacy Policy describes. This DPA doesn't cover that information.
3. If we ever used Personal Data for our own purposes, we would be a controller for that use. We won't (section 6). As part of the processing in section 4.3, and on your instruction, the App adds up your attributed order lines into one revenue total per billing cycle and shows it to you. That total is a single figure for your store, with no order, line or customer reference. We also use it to measure your plan usage under our Terms of Service. For that use the total is information about you, covered by section 3.2 and our Privacy Policy, and we don't use the underlying order lines for it.

4. Subject matter, duration, nature and purposes

1. Subject matter: providing the App to your store.

2. Duration: for as long as the App is installed on your store, plus the deletion periods in section 13.

3. Nature and purposes:

   • showing the App's offers on your storefront;
   • storefront analytics and A/B test measurement, only where Shopify's customer privacy settings allow analytics;
   • attributing order lines to the App's offers, and adding them up into revenue totals per billing cycle, for your analytics, your A/B test results and the plan usage shown in the App;
   • acting on Shopify's privacy webhooks.

   Details are in Annex 1.

5. Your instructions

1. We process Personal Data only on your documented instructions, including for international transfers. Your instructions are the Terms, this DPA and the settings you choose in the App. If the law requires us to process Personal Data otherwise, we tell you first, unless the law forbids it.
2. We tell you immediately if we believe an instruction infringes Data Protection Laws. We may then suspend that processing until you confirm or change the instruction.

6. Purpose limitation

We process Personal Data only for the purposes in section 4.3. We don't:

• sell or share it, or use it for advertising or cross-context behavioral advertising;
• combine it with data from other merchants or from other sources;
• use it to train artificial intelligence models;
• use it for any other purpose of our own.

Our use of the per-cycle revenue totals in section 3.3 to measure your plan usage is limited to those store-level figures; we don't use the order lines or other Personal Data about your customers for it.

7. Confidentiality

We make sure that everyone we authorize to process Personal Data is bound by confidentiality. Today only the operator, Madyan Alkarhani, has access to production systems. Anyone we later give access to must first sign written confidentiality terms, is given only the access needed for their role, and loses it when it is no longer needed.

8. Security

We maintain the technical and organizational measures in Annex 2. We may update them, provided the overall level of protection is not reduced.

9. Sub-processors

1. General authorization. You authorize us to use the Sub-processors in Annex 3, and new Sub-processors under this section.
2. Notice of changes. We tell you about an intended new or replacement Sub-processor at least 15 days before it starts processing Personal Data, by a notice in the App, by email to your store's contact email address (which we may read from Shopify for this purpose) where available, and by updating Annex 3 at https://upsellano.com/dpa. If a Sub-processor must be replaced urgently to keep the App running or secure, we tell you as soon as we can. For changes to our providers' own sub-processors, we pass on the provider's notice within 2 business days of receiving it.
3. Objections. Within that notice period you may object on reasonable data protection grounds by emailing privacy@upsellano.com. We will discuss your concerns in good faith and look for a solution. If we can't resolve them, you may stop using the App by uninstalling it, without any penalty, and we refund, through Shopify, the unused part of your current paid billing period.
4. Sub-processor terms. We bind each Sub-processor by a written contract imposing data protection obligations that meet Article 28(3) and (4) of the GDPR and the CCPA requirements in section 16. We remain responsible to you for the performance of our Sub-processors' obligations.

10. Data subject requests

1. Shopify forwards your customers' requests to the App through its mandatory privacy webhooks:
   • Data request: the App lists the request for you in the App (a notice on its home page and a Customer data requests page), with a summary and a CSV of the records it holds for the named orders, so you can answer the customer. If it holds nothing, the request is closed as "No data held". The customer's ID, email and phone are never stored.
   • Erasure request: the named orders' records are deleted at once, as Annex 1 describes.
2. For other requests about Personal Data the App holds, we give you reasonable help so you can respond, taking into account the nature of the processing.
3. If a shopper contacts us directly, we refer them to you and don't answer the request ourselves unless you instruct us to.

11. Assistance

Taking into account the nature of the processing and the information available to us, we give you reasonable help to meet your obligations on security, Security Incidents, data protection impact assessments and prior consultation with supervisory authorities, as far as they concern the App. We don't charge for this help, unless a request is manifestly excessive, in which case we agree a reasonable fee with you in advance.

12. Security Incidents

1. Notice: we notify you without undue delay after becoming aware of a Security Incident affecting your Personal Data and, where feasible, within 48 hours.
2. Content: the notice includes what we know at the time: the nature of the incident, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact point. If we don't know everything yet, we send what we have and update you as we learn more.
3. Method: by email to your store's contact email address (which we may read from Shopify for this purpose), by a notice in the App, or through another official Shopify merchant contact channel.
4. Your notifications: you decide whether to notify supervisory authorities and the people affected; we help you with the information we have. We don't notify them on your behalf unless you ask us to or the law requires it.
5. Detection: we rely on our hosting provider's failure alerts, the App's health checks and the App's own logs.
6. Notifying you is not an admission of fault.

13. Deletion or return at the end

1. During the agreement: Personal Data is kept only for the periods in Annex 1, and the App's daily jobs delete it, or reduce it to aggregated totals, automatically.
2. Your choice: at the end of the agreement, you choose between deletion and return. If you want a copy of Personal Data the App holds, ask at privacy@upsellano.com before you uninstall; we provide what the App holds in a common electronic format (CSV). Copies we send you by email are deleted from our mailboxes within 30 days of sending. Uninstalling the App is your instruction to delete.
3. Uninstall:
   • when you uninstall, the App's access to your store ends at once and its access tokens are deleted;
   • about 48 hours later, Shopify sends a shop deletion request and we delete all of your store's data;
   • we don't export data automatically before deletion. Once deletion has started we can't guarantee that data can be recovered or exported, and we don't delay deletion required by Shopify or by law in order to make an export.
4. Backups: records in the hosting provider's backups are not edited individually. They expire on the provider's schedule (its point-in-time recovery covers the previous 3 days on our current hosting plan), and they stay protected under this DPA until then.
5. Confirmation: on request, we confirm the deletion in writing.

14. Information and audits

1. Information: we make available the information reasonably needed to show compliance with this DPA and Article 28 of the GDPR, including this DPA, Annex 2, our providers' data processing terms and answers to a reasonable written security questionnaire.
2. Audits: if that information isn't enough, or a supervisory authority requires it, you (or an independent auditor bound by confidentiality, who is not our competitor) may audit our compliance with this DPA, including by inspection:
   • with at least 30 days' written notice, or less if a supervisory authority or a Security Incident requires it;
   • no more than once in any 12 months, unless a supervisory authority requires it, or following a Security Incident;
   • remotely, unless a supervisory authority requires an on-site inspection or a remote audit can't reasonably establish compliance; during normal business hours; and without access to other merchants' data or to our providers' facilities beyond what they allow;
   • at your cost, unless the audit reveals a material breach of this DPA by us. We don't charge fees for cooperating with an audit, except our reasonable costs for an audit going beyond these limits, agreed in advance.
3. Audits of our Sub-processors take place through the reports and certifications they make available.

15. International transfers

1. Where Personal Data goes. Personal Data is stored with our hosting provider in the United States and accessed by us from Lebanon. You authorize these transfers.
2. EU transfers. Where you transfer Personal Data subject to the GDPR to us in a country without an adequacy decision, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA, with you as data exporter and us as data importer, and with the choices in Annex 4.
3. UK transfers. Where you transfer Personal Data subject to the UK GDPR to us, the International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0), issued under section 119A of the UK Data Protection Act 2018, as it applies from time to time, is incorporated, with the details in Annex 4. 3a. Swiss transfers. For transfers subject to the Swiss Federal Act on Data Protection (FADP), the clauses in 15.2 apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR are read as references to the FADP; and "Member State" is not read so as to prevent data subjects in Switzerland from enforcing their rights where they habitually reside.
4. Direct application. To the extent the GDPR or the UK GDPR applies to our processing directly, we comply with it directly as well. The clauses above apply to the extent a transfer safeguard is required.
5. Onward transfers. Our hosting provider, Render, is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing agreement with us also includes the Standard Contractual Clauses (processor to processor) and the UK Addendum.
6. Government access. We have not received any request from a public authority for Personal Data processed for merchants. If we receive one, we will tell you, unless the law forbids it, challenge it where there are reasonable grounds, and disclose only the minimum required. On request, we give you the information about our processing and locations you need for your transfer impact assessment.

16. California (CCPA) terms

This section applies when you are a "business" under the CCPA, to personal information about California consumers that we process for you under this DPA ("CA Personal Information"). For CA Personal Information it prevails over the rest of this DPA if they conflict.

1. Role. We are your "service provider". You disclose CA Personal Information to us, and we process it on your behalf, only for the limited and specified business purposes in paragraph 2.
2. Business purposes. We process CA Personal Information only to: (a) display the App's offers on your storefront; (b) assign storefront visitors to A/B test versions you configure, where consent allows, and record which version was shown; (c) record storefront offer events and, where the App reads orders, order lines, so that we can attribute orders to the App's offers and give you performance and A/B reports; (d) store that data, and delete it on the schedule in this DPA or on your instruction; (e) keep the App secure, and detect, prevent and investigate security incidents and fraudulent or illegal activity; (f) debug and fix errors that impair the App's intended functionality; and (g) add the attributed order lines up into one revenue total per billing cycle, so that the App can show you your plan usage and which plan limit applies under our Terms of Service.
3. Prohibitions. We will not: (a) sell or share CA Personal Information; (b) retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes in paragraph 2, or as otherwise permitted by the CCPA; (c) retain, use or disclose it outside the direct business relationship between you and us; or (d) combine it with personal information we receive from, or on behalf of, another person, or collect from our own interaction with the consumer, except as the CCPA expressly permits service providers to do. We will not provide cross-context behavioral advertising.
4. Same level of protection. We will comply with the CCPA provisions that apply to us as a service provider, and provide CA Personal Information the same level of privacy protection the CCPA requires of businesses, including reasonable security procedures and practices (Annex 2).
5. Your right to take reasonable steps. You may take reasonable and appropriate steps to help ensure that we use CA Personal Information consistently with your CCPA obligations, including reviewing our documentation, asking reasonable written questions and, at least once every 12 months if you choose, an assessment under section 14.
6. Notice if we can no longer comply. We will tell you without undue delay, and within 5 business days, if we determine that we can no longer meet our obligations under the CCPA or this section.
7. Stopping unauthorized use. Upon notice, you may take reasonable and appropriate steps to stop and remediate any unauthorized use of CA Personal Information, including requiring us to stop the processing concerned, and to confirm in writing that we no longer retain or use CA Personal Information of consumers whose valid deletion requests you have sent us.
8. Consumer requests. We help you respond to consumers' requests through the App's functions and Shopify's privacy webhooks. If a consumer sends a request to us directly, we act on your instructions or tell the consumer we can't act on it because we are your service provider, and refer them to you.
9. Audits and assessments. If the CCPA requires you to complete a cybersecurity audit or risk assessment, we cooperate as reasonably needed, including by making available relevant information in our possession, and we will not misrepresent any relevant fact.
10. Sub-processors. We notify you of each Sub-processor that processes CA Personal Information (section 9), under a written contract with obligations no less protective than this section.
11. Aggregated information. We don't attempt to re-identify individuals from aggregated totals the App creates.
12. Certification. We certify that we understand the restrictions and obligations in this section and will comply with them.

17. Your obligations

1. You have a lawful basis for the processing you instruct, and you give your store's customers the notices required by law, for example in your store's privacy policy.
2. If your store must ask visitors for consent to analytics, you set this up with Shopify's customer privacy settings (cookie banner). The App sends storefront analytics, and assigns A/B test versions, only when those settings allow analytics.
3. You don't instruct us to process special categories of data or data the App isn't designed for.
4. You tell us about any consumer request under the CCPA that we must comply with as your service provider, and give us the information we need to comply. Requests delivered through Shopify's privacy webhooks meet this.

18. Liability, term and law

1. Each party's liability under this DPA is subject to the limits in the Terms of Service (section 17 of the Terms), to the extent the Standard Contractual Clauses and Data Protection Laws allow. Nothing limits the rights that data subjects have under the Standard Contractual Clauses or Data Protection Laws.
2. This DPA lasts as long as we process Personal Data for you, including the deletion and backup periods in section 13.
3. Governing law and forum are as in the Terms of Service (section 19), except that the Standard Contractual Clauses and the UK Addendum are governed by the law, and subject to the courts, set out in Annex 4.

Annex 1 — Details of the processing

Data subjects: your store's customers and visitors who use pages where the App's widgets appear; customers whose orders include the App's offers.

Categories of Personal Data: pseudonymous data only, as listed below. The App doesn't request or store names, email addresses, phone numbers, physical addresses, customer IDs, IP addresses, payment details or special categories of data.

Frequency: continuous while the App is installed.

Received but not read or stored: the customer's ID, email address and phone number in Shopify's privacy webhooks; any other cart line properties on orders (only the App's own offer and A/B properties are kept).

Customer IDs: Shopify includes the logged-in customer's ID in signed app proxy requests. The App uses the request only to verify Shopify's signature and doesn't store or log that ID.

Hosting network: requests to the App pass through our hosting provider's network, which receives the requester's IP address to deliver them. Under its own terms, Render also handles limited connection and activity data about use of its platform as an independent controller. Render may process network and request metadata, including IP address and device data and HTTP request details (such as the method, status, host, requested path or URL and a request ID), for hosting, security and operational logging, including through Cloudflare as its network provider. Render documents that the logs available to its customers are kept for a period that depends on the workspace plan (7, 14 or 30 days).

Annex 2 — Security measures

• HTTPS for all traffic between Shopify, browsers and the App. Webhook and app proxy requests are verified with Shopify's signatures (HMAC); invalid signatures are rejected.
• TLS required for every connection between the App and its database; the App refuses to start in production without it.
• Database encryption at rest by the hosting provider, backups included.
• Shopify access tokens additionally encrypted by the App (AES-256-GCM). The keys are held in the hosting provider's secret settings, not in source code.
• The App's request logs record the method, path without query strings, status, size and timing. No tokens, secrets or customer data are logged.
• The database is reachable only from the App's private network; external access is disabled.
• Storefront analytics: a consent check before sending, server-side validation, and size and rate limits per store.
• Data minimization: no customer contact fields requested; pseudonymous keys for erased orders; retention enforced by daily jobs (Annex 1).
• Administrative access to production is limited to the operator, with two-factor authentication on the accounts that control production.
• Backups: 3-day point-in-time recovery, with a tested restore.
• Monitoring: hosting provider alerts for failed deploys, failed scheduled jobs and unhealthy services; health checks.

Annex 3 — Sub-processors

Shopify is your own commerce platform, which you engage under your agreement with Shopify; it delivers data to the App at your instruction. We don't engage Shopify as our Sub-processor.

Annex 4 — Transfer clauses: choices and details

EU Standard Contractual Clauses (Module Two):

• Clause 7 (docking clause): not used.
• Clause 9(a): Option 2, general written authorization; the notice period is the one in section 9.2 of this DPA.
• Clause 11 (redress): the optional wording is not used.
• Clause 13 (supervision): (i) the supervisory authority of the Member State where the data exporter is established; (ii) if it isn't established in the EU but has appointed a representative under Article 27(1) GDPR, the authority of the representative's Member State; (iii) otherwise, the authority of the Member State where the data subjects whose Personal Data is transferred are located.
• Clause 17: Option 1, the law of Ireland.
• Clause 18(b): the courts of Ireland.
• Annex I.A (parties): data exporter: you, with the details in your Shopify account, as controller. Data importer: Madyan Alkarhani (Upsellano), individual operator, Lebanon, as processor; address: Lebanon (no street address is published); contact: privacy@upsellano.com. Activities: providing the App. Signature and date: accepting the Terms of Service.
• Annex I.B (description): Annex 1 of this DPA. Transfers are continuous.
• Annex I.C (competent supervisory authority): as in Clause 13.
• Annex II (technical and organizational measures): Annex 2 of this DPA.
• Annex III (sub-processors): Annex 3 of this DPA.

UK International Data Transfer Addendum (version B1.0):

• Table 1 (parties): as in Annex I.A above.
• Table 2 (selected clauses): the EU Standard Contractual Clauses incorporated by section 15.2, Module Two, with the choices above.
• Table 3 (appendix information): Annexes 1 to 3 of this DPA.
• Table 4: neither party may end the Addendum under its Section 19.
• The Addendum is governed by the laws of England and Wales, and disputes go to the courts of England and Wales.