Data Processing Addendum

This Data Processing Addendum (“DPA”) describes how and why we, as Data Processor, obtain, store and process personal data. When we refer to ourselves as Data Processor we mean that Dataships acts as a “Data Processor” for the purposes of the GDPR, as a “Service Provider” for the purposes of the CCPA, and as a “Processor” for the purposes of the other US Data Protection Laws. This DPA (“Agreement”) forms part of and is subject to the privacy policy and terms & conditions (“Principal Agreement”) between the “Company” (“Customer” or “you”) and the “Data Processor” (“Dataships”). Together they are known as the “Parties”.

WHEREAS:

(A) The Company acts as a Data Controller and, where US Data Protection Laws apply, as a Business or Controller.

(B) The Company wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor.

(C) The Parties seek to implement a data processing arrangement that complies with the Applicable Data Protection Laws, including the contractual requirements of the CCPA and the other US Data Protection Laws.

(D) The Parties wish to lay down their rights and obligations.

IT IS AGREED AS FOLLOWS:

Unless otherwise defined herein, capitalised terms and expressions used in this Agreement shall have the following meaning:

“Agreement” means this Data Processing Addendum;

“Applicable Data Protection Laws” means all applicable laws, rules, regulations and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, including the GDPR and the US Data Protection Laws, as they may be amended or otherwise updated from time to time;

“Business”, “Business Purpose”, “Consumer”, “Cross-Context Behavioral Advertising”, “Personal Information”, “Share” and “Sensitive Personal Information” have the meanings given to them in the CCPA;

“CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, together with its implementing regulations at Cal. Code Regs. tit. 11, § 7000 et seq., in each case as amended from time to time;

“Customer Personal Data” means any Personal Data Processed by Dataships on behalf of the Company pursuant to or in connection with the Principal Agreement;

“Data Transfer” means:

· a transfer of Customer Personal Data from the Company to Dataships; or

· an onward transfer of Customer Personal Data from Dataships to a Subprocessor,

in each case, where such transfer would be prohibited by Applicable Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of Applicable Data Protection Laws);

“EEA” means the European Economic Area;

“GDPR” means Regulation (EU) 2016/679 (the “EU GDPR”) or, where applicable, the “UK GDPR” as defined in section 3 of the Data Protection Act 2018;

“Member State” means a member state of the EEA, being a member state of the European Union, Iceland, Norway, or Liechtenstein;

“Permitted Purposes” means the purposes set out under “Permitted Purposes” in the section headed “Description of Processing”;

“Personal Data” means any information relating to an identified or identifiable individual or device, or is otherwise “personal data”, “personal information”, “personally identifiable information” and similar terms, and such terms shall have the same meaning as defined by Applicable Data Protection Laws. Personal Data includes Personal Information;

“Service Data” means any data relating to the Customer Personal Data’s use, support and/or operation of the Services, including information relating to activity logs or other information the Company generates using Dataships’ Services;

“Services” means the services that Dataships provides;

“Subprocessor” means any person appointed by or on behalf of Dataships to process Personal Data on behalf of the Company in connection with the Agreement;

“US Data Protection Laws” means, to the extent applicable, federal and state laws relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States, including the CCPA and the comprehensive consumer privacy laws of other US states.

The terms “Controller”, “Data Controller”, “Data Processor”, “Processor”, “Data Subject”, “Personal Data Breach”, “Process”, “Supervisory Authority”, “Sell” and “Service Provider” shall have the same meaning as set out in the Applicable Data Protection Laws.

The Company represents and warrants that:

· it has complied, and will continue to comply, with all applicable laws, including Applicable Data Protection Laws, in respect of its processing of Customer Personal Data and any processing instructions it issues to Dataships; and

· it has provided, and will continue to provide, all notices, consents, legitimate interests and rights necessary under Applicable Data Protection Laws for Dataships to process Customer Personal Data for the purposes described in the Agreement.

The Company shall have sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which the Company acquired the Customer Personal Data. Without prejudice to the generality of the foregoing, the Company agrees that it shall be responsible for complying with all laws (including Applicable Data Protection Laws) applicable to the Services provided.

Dataships shall comply with all Applicable Data Protection Laws in the Processing of Customer Personal Data. Dataships shall Process Customer Personal Data only on the Company’s documented instructions, which are this DPA, the Principal Agreement and the Company’s configuration of the Services, and only for the Permitted Purposes.

This section applies to the extent US Data Protection Laws apply to Customer Personal Data. In that case, the Company is a “Business” or “Controller” and Dataships is a “Service Provider” or “Processor” (as applicable).

Dataships shall not:

(i) Sell or Share Customer Personal Data;

(ii) retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the Permitted Purposes;

(iii) retain, use or disclose Customer Personal Data outside the direct business relationship between Dataships and the Company;

(iv) combine Customer Personal Data with Personal Information that Dataships receives from or on behalf of any other person, or collects from its own interaction with the Consumer, except as permitted by Cal. Code Regs. tit. 11, § 7050; or

(v) use Customer Personal Data for Cross-Context Behavioral Advertising, or to build or augment a profile of a Consumer for use in providing services to another person.

Dataships shall comply with its applicable obligations under US Data Protection Laws and shall provide the same level of privacy protection to Customer Personal Data as is required of the Company by the CCPA. Dataships certifies that it understands the restrictions in this section and will comply with them.

Dataships shall notify the Company in writing within five (5) business days if it determines that it can no longer meet its obligations under US Data Protection Laws.

The Company may take reasonable and appropriate steps to ensure that Dataships Processes Customer Personal Data in a manner consistent with the Company’s obligations under US Data Protection Laws, and, on written notice, to stop and remediate any unauthorised Processing. Dataships shall make available to the Company the information reasonably necessary to demonstrate its compliance with this section. Dataships shall allow and cooperate with reasonable assessments by the Company or its designated assessor, no more than once in any twelve (12) month period, except following a Personal Data Breach or at the request of a regulator. Alternatively, Dataships may arrange, at its own expense, an independent assessment against an appropriate and accepted control standard at least annually, and provide a copy or summary of the report to the Company on request.

Where Dataships derives de-identified information from Customer Personal Data, Dataships shall take reasonable measures to ensure that the information cannot be associated with a Consumer or household. It publicly commits to maintain and use the information only in de-identified form and not to attempt to re-identify it, and shall contractually require any recipient to do the same.

The Parties agree that the Company discloses Customer Personal Data to Dataships for a Business Purpose and not for monetary or other valuable consideration, and that such disclosure is not a Sale or Share.

If this section conflicts with any other part of this DPA or the Principal Agreement, including the paragraphs on Service Data in the section headed “Relationship with the Agreement”, this section prevails for Customer Personal Data subject to US Data Protection Laws.

Dataships shall take reasonable steps to ensure the reliability of any employee, agent or contractor who may have access to the Customer Personal Data. In each case, Dataships shall ensure that access is strictly limited to those individuals who need to know or access the relevant Customer Personal Data, as strictly necessary for the purposes of the Principal Agreement and to comply with Applicable Data Protection Laws in the context of that individual’s duties. Dataships shall ensure that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Considering the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Dataships shall in relation to the Customer Personal Data implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

In assessing the appropriate level of security, Dataships shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.

Dataships shall not appoint (or disclose any Customer Personal Data to) any Subprocessor that is not disclosed in the list of Subprocessors in the Dataships Privacy Centre.

Dataships shall engage Subprocessors only under a written contract imposing obligations no less protective of Customer Personal Data than those in this DPA, including, where US Data Protection Laws apply, those in the section headed “US Privacy Law Terms”.

Dataships shall give the Company at least thirty (30) days’ notice, by updating the list of Subprocessors in the Dataships Privacy Centre and notifying the Company by email, before engaging a new Subprocessor. The Company may object to the new Subprocessor on reasonable data protection grounds during that period.

Taking into account the nature of the Processing, Dataships shall assist the Company by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company’s obligations, as reasonably understood by the Company, to respond to requests to exercise Data Subject or Consumer rights under the Applicable Data Protection Laws.

Dataships shall notify the Company if it receives a request from a Data Subject or Consumer under Applicable Data Protection Laws in respect of Customer Personal Data, and shall support the fulfilment of that request via its product offerings. Dataships shall not respond directly to such a request except on the Company’s instruction or as required by law.

The Company shall inform Dataships of any Data Subject or Consumer request with which Dataships must comply, and shall provide the information necessary for Dataships to do so. A customer redaction request transmitted by the Company’s e-commerce platform (including Shopify’s customers/redact webhook) is treated as the Company’s instruction.

On receipt of a request to delete or erase Customer Personal Data, or to opt out of marketing, Dataships shall mark the relevant individual as non-marketable. Dataships shall stop Processing the relevant Customer Personal Data for any purpose other than those set out in this section.

Dataships may retain a minimal record of the individual’s identifiers, consent history and the deletion, erasure or opt-out request, solely to:

(i) ensure the individual is not marketed to again; and

(ii) enable the Company to evidence how consent was collected and to establish, exercise or defend legal claims.

Dataships shall retain this record for the period stated under “Retention” in the section headed “Description of Processing”. It shall do so in reliance on the exceptions available under Applicable Data Protection Laws, including Article 17(3)(b) and (e) of the GDPR and Cal. Civ. Code § 1798.105(d), and shall not use the record for any other purpose.

Dataships shall notify the Company without undue delay upon becoming aware of a Personal Data Breach affecting Customer Personal Data, providing the Company with sufficient information to allow the Company to meet any obligations to report or inform Data Subjects or Consumers of the Personal Data Breach under the Applicable Data Protection Laws.

Dataships shall co-operate with the Company and take reasonable commercial steps as are directed by the Company to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

Upon termination or expiration of the Principal Agreement, Dataships shall delete or return to the Company all Customer Personal Data in its possession or control. This requirement shall not apply to Customer Personal Data retained under the section headed “Consent and Suppression Records”, or to the extent Dataships is required by applicable law to retain some or all of the Customer Personal Data. Nor shall it apply to Customer Personal Data that Dataships has archived on back-up systems, which Dataships shall securely isolate, protect from any further Processing and eventually delete in accordance with Dataships’ deletion policies, except to the extent required by applicable law.

If Customer Personal Data processed under this Agreement is transferred from a country within the EEA or the United Kingdom to a country outside it, the Parties shall ensure that the Customer Personal Data is adequately protected. Where required, this shall include the European Commission’s standard contractual clauses and, for transfers from the United Kingdom, the UK International Data Transfer Addendum.

Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement (“Confidential Information”) confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:

· disclosure is required by law; or

· the relevant information is already in the public domain.

Each Party’s liability arising out of or related to this DPA shall be subject to the exclusions and limitations of liability set forth in the Principal Agreement. Any claims made against Dataships under or in connection with this DPA shall be brought solely by the Company that is a party to the Principal Agreement.

This DPA shall remain in effect for as long as Dataships carries out Processing operations on behalf of the Company or until termination of the Principal Agreement, whichever is later.

The Parties agree that this DPA shall replace any existing data processing agreement or similar document that the Parties may have previously entered into in connection with the Services.

In the event of any conflict or inconsistency between this DPA and the Dataships Standard Terms of Business, the provisions of the following documents (in order of precedence) shall prevail: (i) this DPA; and then (ii) the Dataships Standard Terms of Business.

Except for any changes made by this DPA, the Principal Agreement remains unchanged and in full force and effect.

Notwithstanding anything to the contrary in the Principal Agreement, Dataships may collect, use and disclose Service Data for its legitimate business purposes, limited to: (i) accounting, tax, billing, audit and compliance; (ii) providing, developing, optimising and maintaining the Services; (iii) investigating fraud and wrongful or unlawful use of the Services; and (iv) complying with applicable law.

To the extent any Service Data is considered personal data under Applicable Data Protection Laws, Dataships shall be responsible for and shall process such data in accordance with the Dataships Privacy Policy and Applicable Data Protection Laws. This DPA does not apply to Service Data, except that where Service Data contains Personal Information subject to US Data Protection Laws, Dataships shall process it only for the Permitted Purposes and the section headed “US Privacy Law Terms” applies to it.

No one other than a Party to this DPA has any right to enforce any of its terms.

This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Principal Agreement, unless required otherwise by Applicable Data Protection Laws.

Subject matter and duration: Dataships’ provision of consent collection and consent management Services to the Company, for the term of the Principal Agreement and any retention period permitted by this DPA.

Nature of Processing: collection, recording, storage, analysis, transmission to systems selected by the Company, and deletion.

Permitted Purposes: Dataships Processes Customer Personal Data only for the following purposes, each of which is a Business Purpose:

(a) presenting consent and marketing-information widgets at the Company’s checkout and other collection points, in wording determined by the individual’s location and applicable law;

(b) recording each individual’s consent interaction and determining the individual’s marketable status under applicable marketing laws;

(c) verifying SMS opt-ins where enabled by the Company;

(d) syncing marketable status and related properties to the Company’s e-commerce platform and the marketing platforms selected by the Company;

(e) maintaining an audit log so that the Company can evidence consent, and maintaining the records described in the section headed “Consent and Suppression Records”;

(f) testing widget presentation for the Company and reporting the results to the Company;

(g) assisting the Company in responding to Data Subject and Consumer rights requests;

(h) helping to ensure security and integrity, detecting and preventing fraud, and debugging to repair errors in the Services;

(i) building or improving the quality of the Services, provided that Dataships does not use Customer Personal Data to perform services on behalf of any other person; and

(j) complying with applicable law, and establishing, exercising or defending legal claims.

Categories of individuals: individuals who shop at or visit the Company’s online store and interact with a Dataships collection point.

Categories of Personal Data: email address; mobile phone number; IP address; billing address country; order identifier and order value; Dataships contact and session identifiers; details of each consent interaction (collection point, widget, wording, language and privacy policy presented, action taken and timestamps); and marketable status with the rationale for it. Dataships does not require, and the Company shall not provide, Sensitive Personal Information or special category data.

Retention: Customer Personal Data is retained for the term of the Principal Agreement. Records retained under the section headed “Consent and Suppression Records” are kept for the term of the Principal Agreement and, after it ends, for the longest limitation period applicable to claims concerning the consent to which they relate, after which they are deleted. On termination, all other Customer Personal Data is dealt with under the section headed “Deletion or return of Customer Personal Data”.

Subprocessors: as listed in the Dataships Privacy Centre, which list is incorporated by reference.

Last updated on: 16th October 2026