Data Processing Agreement

Definitions

For the purposes of this Data Processing Agreement ("DPA"):

• "Controller" refers to the customer (agency or store owner) that determines the purposes and means of processing personal data through the Services.
• "Processor" refers to Merkanthub, Inc., which processes personal data on behalf of the Controller.
• "Data Subject" refers to an identified or identifiable individual whose personal data is processed.
• "Personal Data" means any information relating to a Data Subject that is processed through the Services.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, modification, disclosure, or deletion.
• "Sub-processor" means a third party engaged by Merkanthub to process Personal Data on behalf of the Controller.

Scope and Purpose

This DPA applies when Merkanthub processes Personal Data on behalf of the Controller in connection with the Services. The purpose of processing is to provide the e-commerce management, analytics, integrations, and optimization features described in the Terms of Service.

The categories of Personal Data processed and the categories of Data Subjects are determined by the Controller based on which features and integrations are enabled.

Obligations of the Processor

Merkanthub shall:

• Process Personal Data only on documented instructions from the Controller, unless required by applicable law.
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing.
• Assist the Controller in responding to requests from Data Subjects exercising their rights under applicable data protection laws.
• Assist the Controller in ensuring compliance with security, breach notification, and data protection impact assessment obligations.
• At the choice of the Controller, delete or return all Personal Data upon termination of the Services, and delete existing copies unless retention is required by law.
• Make available to the Controller all information necessary to demonstrate compliance with data processing obligations.

Obligations of the Controller

The Controller shall:

• Ensure that there is a lawful basis for the processing of Personal Data by Merkanthub.
• Provide clear and documented instructions regarding the processing of Personal Data.
• Comply with applicable data protection laws, including providing appropriate notices and obtaining necessary consents from Data Subjects.
• Promptly notify Merkanthub of any data subject requests that require processor assistance.

Sub-processors

Merkanthub engages third-party sub-processors to assist in providing the Services. Sub-processors fall into the following categories:

• Cloud infrastructure providers — for hosting and data storage.
• Authentication service providers — for identity verification and access management.
• Integration service providers — for connecting with third-party platforms.
• Content delivery providers — for website performance and security.
• AI processing providers — for generating insights and automated analysis from platform data, subject to agreements that prohibit use of data for model training.

A detailed list of current sub-processors, including their names, locations, and processing activities, is available upon request by contacting info@merkanthub.com. We will notify the Controller before engaging any new sub-processor, providing an opportunity to object.

Data Subject Rights

Merkanthub will assist the Controller in fulfilling Data Subject requests, including requests for access, rectification, deletion, portability, and restriction or objection to processing. We will promptly notify the Controller if we receive a request directly from a Data Subject and will not respond to the request without the Controller's authorization unless required by law.

Data Breach Notification

Merkanthub will notify the Controller without undue delay (and in no event later than 72 hours) upon becoming aware of a personal data breach. The notification will include:

• A description of the nature of the breach, including the categories and approximate number of Data Subjects affected.
• The name and contact details of the point of contact for further information.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach and mitigate its effects.

International Data Transfers

Where Personal Data is transferred outside the country of origin, Merkanthub ensures that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as adopted by applicable authorities, or other transfer mechanisms recognized under applicable data protection laws.

Audit Rights

The Controller has the right to audit Merkanthub's compliance with this DPA. Audits may be conducted by the Controller or a qualified third-party auditor appointed by the Controller, subject to reasonable advance notice (at least 30 days) and confidentiality obligations. Merkanthub may provide relevant certifications, audit reports, or compliance documentation as an alternative to on-site audits where appropriate.

Term and Termination

This DPA remains in effect for the duration of the Controller's use of the Services. Upon termination, Merkanthub will, at the Controller's election, return or delete all Personal Data within 30 days, except where retention is required by applicable law. Merkanthub will certify deletion upon request.