Data Processing Agreement

This DPA is entered into between:

• The Processor: Akash Chaterjee, trading as WEBx47, of Mansarovar, Jaipur, RJ, 302020, IN (“we”, “Processor”), operator of the PromoLock Shopify app.
• The Controller: the merchant that has installed PromoLock (“Controller”), being the Shopify store on whose behalf personal data is processed.

This DPA forms part of, and is subject to, the terms under which the Controller uses PromoLock (the “Main Agreement”).

The Controller determines the purposes and means of processing the personal data. The Processor processes that personal data only on the Controller's behalf. “Personal data”, “processing”, “data subject”, “controller” and “processor” have the meanings given in the GDPR. “Applicable Data Protection Law” means the EU GDPR, the UK GDPR, and the UK Data Protection Act 2018, as applicable.

• Process personal data only on the Controller's documented instructions, including as set out in this DPA and the Main Agreement, unless required to do otherwise by law.
• Ensure that personnel authorised to process the personal data are bound by an obligation of confidentiality.
• Implement appropriate technical and organisational measures to protect the personal data (see Section 5).
• Not sell the personal data or use it for any purpose other than providing the service.
• Assist the Controller, taking into account the nature of processing, in responding to data subject requests and in meeting its obligations regarding security, breach notification, and impact assessments.
• On termination, delete the personal data within a reasonable period, unless retention is required by law.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

The Processor maintains measures appropriate to the risk, including encryption of personal data in transit, access controls restricting who can access stored data, and data minimisation limiting stored data to what each feature requires.

The Controller authorises the Processor to engage the sub-processors listed below. The Processor remains responsible for their performance and will inform the Controller of intended changes, giving the Controller the opportunity to object.

Personal data is stored in the United States, and the Processor operates from India. Where personal data of UK or EU data subjects is transferred outside the UK or EEA, such transfers are made under appropriate safeguards, including the Standard Contractual Clauses adopted by the European Commission and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference.

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will provide information reasonably available to help the Controller meet its own notification obligations.

The Processor will, taking into account the nature of the processing, assist the Controller by appropriate measures in fulfilling the Controller's obligation to respond to requests from data subjects exercising their rights under Applicable Data Protection Law, and honours Shopify's mandatory data-deletion webhooks.

On expiry or termination of the Main Agreement, or on uninstall of the app, the Processor will delete the data associated with the Controller's store within a reasonable period, unless applicable law requires storage.

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Main Agreement. This DPA is governed by the same law as the Main Agreement under which the Controller uses PromoLock.

By installing or continuing to use PromoLock, the Controller accepts this DPA. No signature is required for it to take effect; it is incorporated into the Main Agreement under which the Controller uses the app. A merchant that requires a counter-signed copy for its records may request one from the Processor.