PREAMBLE

This Data Processing Agreement ("DPA") is entered into between Devs With Impact ("Processor" or "We") and the merchant ("Controller" or "Merchant") using Devs With Impact's applications and services. This DPA supplements and forms part of the Devs With Impact Terms of Service and Privacy Policy, and governs the processing of personal data by Devs With Impact on behalf of the Merchant.

By installing and using our application, the Merchant agrees to the terms of this DPA. This DPA applies to the processing of personal data accessed via the Shopify API in connection with the provision of our services.

SECTION 1 – DEFINITIONS

For the purposes of this DPA, the following terms shall have the meanings set out below:

•       "Agreement" means the Devs With Impact Terms of Service and Privacy Policy, together with this DPA.

•       "Controller" means the Merchant who determines the purposes and means of processing personal data.

•       "Processor" means Devs With Impact, which processes personal data on behalf of the Controller.

•       "Personal Data" means any information relating to an identified or identifiable individual, processed via our application.

•       "Data Subject" means the individual to whom Personal Data relates, including the Merchant's end customers.

•       "Processing" means any operation performed on Personal Data, including collection, storage, use, transfer, or deletion.

•       "Sub-processor" means any third party engaged by the Processor to assist in processing Personal Data on behalf of the Controller.

•       "Security Incident" means any unauthorised or unlawful access to, accidental or unlawful destruction, loss, alteration of, or unauthorised disclosure of Personal Data.

•       "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data and privacy, as applicable to the respective party in its role under this DPA.

•       "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health information, biometric data, or criminal records.

SECTION 2 – ROLES AND RESPONSIBILITIES

Devs With Impact acts as a Processor of Personal Data on behalf of the Merchant (Controller). The Merchant determines the purposes and means of data processing, while Devs With Impact processes data solely in accordance with the Merchant's documented instructions and as necessary to provide the services.

This DPA does not apply to instances where we process data for our own purposes as a Controller, such as managing our own business operations or complying with legal obligations.

The Merchant shall ensure that its instructions to us comply with all applicable Data Protection Laws, and that the Personal Data provided to us has been collected lawfully. The Merchant shall not provide Sensitive Data to us for processing under this DPA, and we shall have no liability for any Sensitive Data submitted in breach of this restriction.

SECTION 3 – PROCESSOR OBLIGATIONS

As Processor, we shall:

•       Process Personal Data solely in accordance with the Controller's documented instructions and for no other purpose;

•       Maintain the confidentiality of all Personal Data processed on behalf of the Controller;

•       Ensure that all personnel authorised to process Personal Data are bound by appropriate confidentiality obligations;

•       Implement and maintain appropriate technical and organisational security measures to protect Personal Data against Security Incidents;

•       Notify the Controller without undue delay upon becoming aware of any Security Incident;

•       Assist the Controller in responding to data subject rights requests in accordance with applicable Data Protection Laws;

•       Support the Controller in fulfilling its compliance obligations, including data protection impact assessments where applicable;

•       Delete or return all Personal Data upon termination of the Agreement, unless retention is required by applicable law;

•       Make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA.

SECTION 4 – CONTROLLER OBLIGATIONS

As Controller, the Merchant shall:

•       Ensure that all Personal Data provided to us has been collected lawfully and in compliance with applicable Data Protection Laws;

•       Maintain a transparent and up-to-date privacy policy that discloses its data processing activities to end customers;

•       Obtain all necessary consents from data subjects for the processing of their Personal Data;

•       Ensure that its instructions to us do not cause us to violate any applicable law or regulation;

•       Notify us promptly of any changes to its processing instructions.

SECTION 5 – SUB-PROCESSORS

We may engage sub-processors to assist in providing our services. All sub-processors are bound by data protection obligations no less protective than those set out in this DPA.

Our current authorised sub-processors are listed below. We will inform the Controller of any intended addition or replacement of sub-processors by updating this list. If the Controller reasonably objects to a new sub-processor on legitimate data protection grounds, it must notify us in writing within 30 days of being informed.

Sub-processor

Location

Purpose

Shopify Inc.

Canada

App platform, billing, and store data API

SECTION 6 – SECURITY MEASURES

We shall implement and maintain appropriate technical and organisational measures to protect Personal Data against Security Incidents. These measures include, but are not limited to:

•       Secure access controls and authentication for systems holding Personal Data;

•       Encryption of Personal Data in transit and at rest where applicable;

•       Regular review and testing of security practices and infrastructure;

•       Confidentiality obligations for all personnel with access to Personal Data;

•       Procedures for detecting, reporting, and investigating Security Incidents.

The Merchant is responsible for its own secure use of our services, including maintaining the security of its account credentials and any Personal Data in transit to or from our services.

SECTION 7 – SECURITY INCIDENT NOTIFICATION

Upon becoming aware of a Security Incident, we shall notify the Controller without undue delay and, where feasible, no later than 72 hours from the time we become aware. The notification will include, to the extent known at the time:

•       The nature of the Security Incident, including the categories and approximate number of data subjects and Personal Data records affected;

•       The likely consequences of the Security Incident;

•       The measures taken or proposed to address the Security Incident and mitigate its effects.

Notification of a Security Incident shall not constitute an acknowledgment of fault or liability on our part.

SECTION 8 – DATA SUBJECT RIGHTS

We shall provide reasonable assistance to the Controller in fulfilling data subject rights requests under applicable Data Protection Laws, including:

•       Right of access to Personal Data;

•       Right to rectification of inaccurate or incomplete data;

•       Right to erasure of Personal Data;

•       Right to restriction of processing;

•       Right to data portability.

Where a data subject submits a request directly to us, we will not respond directly unless required by law or directed by the Controller. We will promptly notify the Controller of any such request.

We have implemented the following Shopify mandatory webhooks to support data subject rights: Customer Data Request, Customer Data Redaction, and Shop Data Redaction.

SECTION 9 – INTERNATIONAL DATA TRANSFERS

Personal Data may be transferred to and processed in countries outside of the Merchant's jurisdiction where necessary for the provision of our services. We shall ensure that any such international transfers are carried out in accordance with applicable Data Protection Laws and that appropriate safeguards are in place.

Where Personal Data originating from the European Economic Area, United Kingdom, or other jurisdictions with transfer restrictions is processed, we will rely on appropriate transfer mechanisms as required under applicable law.

SECTION 10 – DELETION AND RETURN OF DATA

Upon termination or expiration of the Agreement, we shall, at the Controller's election, delete or return all Personal Data processed on the Controller's behalf, including any copies held by sub-processors, unless applicable law requires retention.

Where the Controller requests deletion via Shopify's mandatory webhook processes, we shall confirm receipt and complete the deletion within 30 days of the request, unless legally required to retain the data.

SECTION 11 – CONFIDENTIALITY AND COMPLIANCE RECORDS

We shall maintain appropriate records of our processing activities carried out on behalf of the Controller, to the extent required by applicable Data Protection Laws. Upon reasonable request, we will make available to the Controller all information necessary to demonstrate compliance with this DPA.

We shall not disclose Personal Data to any government authority or law enforcement agency except where required by applicable law. Where legally permissible, we will notify the Controller prior to any such disclosure.

SECTION 12 – TERM AND TERMINATION

This DPA remains in effect for the duration of the Agreement. It will terminate automatically upon termination or expiration of the Agreement, subject to any surviving obligations, including those relating to data deletion and confidentiality.

In the event of any conflict or inconsistency between this DPA and the Agreement, the provisions of this DPA shall prevail with respect to the processing of Personal Data.

SECTION 13 – GOVERNING LAW

This DPA is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Hong Kong SAR.

SECTION 14 – CONTACT

For any questions or requests regarding this DPA or our data processing activities, please contact:

Devs With Impact

Email: contact@devswithimpact.com

Website: www.devswithimpact.com

ANNEX A – DATA PROCESSING DETAILS

The following describes the subject matter, nature, purpose, and duration of the processing carried out by the Processor on behalf of the Controller.

Categories of Data Subjects

Merchants using the Devs With Impact application and their end customers whose data is processed through the app.

Categories of Personal Data

Store owner name, email address, billing address, store name, domain, Shopify plan, product data, order data, app activity logs, browser and operating system information.

Sensitive Data

None. The Merchant must not submit Sensitive Data for processing under this DPA.

Frequency of Processing

Continuous, for as long as the Merchant uses the application.

Nature of Processing

Collection, storage, use, and disclosure of Personal Data as necessary to provide promotion mechanics functionality and related support services.

Purpose of Processing

To provide, maintain, and improve the Devs With Impact application; to process subscriptions and manage accounts; to provide customer support; and to comply with applicable legal obligations.

Duration of Processing

For the duration of the Merchant's use of the application, and for such period thereafter as required by applicable law or as necessary to fulfil surviving obligations under the Agreement.

Sub-processors

Shopify Inc. (Canada) — app platform, billing, and store data API. Additional sub-processors to be listed as applicable.