Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between subZwallet and you (the "Merchant"). This DPA reflects the parties' agreement regarding the processing of Personal Data in accordance with Article 28 of the General Data Protection Regulation (GDPR).

1. Definitions

• "Controller": The Merchant, who determines the purposes and means of processing Personal Data
• "Processor": subZwallet, who processes Personal Data on behalf of the Controller
• "Personal Data": Any information relating to an identified or identifiable natural person
• "Processing": Any operation performed on Personal Data
• "Data Subject": The individual to whom Personal Data relates

2. Details of Processing

2.1 Subject Matter

The Processor provides subscription management, loyalty rewards, and related e-commerce services to the Controller through the subZwallet application.

2.2 Duration

Processing occurs for the duration of the Merchant's use of the Service, plus 30 days following account termination (retention period), after which data is deleted.

2.3 Nature and Purpose

The Processor processes Personal Data to:

• Create and manage customer subscription contracts
• Process recurring payments and billing
• Calculate and award loyalty points and rewards
• Send automated customer notifications
• Provide analytics and reporting to the Controller

2.4 Types of Personal Data

• Customer contact information (name, email, phone)
• Shipping and billing addresses
• Payment method tokens (via Shopify)
• Order history and subscription details
• Communication preferences
• Loyalty program participation data

2.5 Categories of Data Subjects

• Customers of the Controller's Shopify store
• Subscribers to products/services
• Loyalty program participants
• Users of the customer portal

3. Processor Obligations

3.1 Processing Instructions

The Processor shall only process Personal Data on documented instructions from the Controller, including with regard to transfers of Personal Data to third countries.

3.2 Confidentiality

All personnel authorized to process Personal Data are bound by confidentiality obligations.

3.3 Security Measures

The Processor implements appropriate technical and organizational measures including encryption, access controls, authentication, regular security assessments, and employee training on data protection.

4. Sub-processors

The Controller authorizes the Processor to engage sub-processors for hosting, infrastructure, and related services. The Processor maintains appropriate data processing agreements with all sub-processors and will inform the Controller of any changes to sub-processors with at least 30 days notice.

5. Data Subject Rights

The Processor shall assist the Controller in responding to Data Subject requests regarding their rights under GDPR, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)

6. Data Breach Notification

The Processor shall notify the Controller without undue delay (and in any case within 24 hours) upon becoming aware of any Personal Data breach affecting the Controller's data.

7. Data Return and Deletion

Upon termination of services, the Processor shall, at the Controller's choice, return or delete all Personal Data, unless storage is required by law. Data is automatically deleted 30 days after account termination.

8. Audit Rights

The Controller has the right to audit the Processor's compliance with this DPA. Audits shall be conducted no more than once per year, with 30 days advance notice, during normal business hours.

9. International Transfers

Where Personal Data is transferred outside the EEA, the Processor ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Contact Information