Data Processing Addendum

1. Scope and roles

You are the controller of personal data about your store's visitors, customers, subscribers and anyone who contacts your store ("Store Personal Data"). Suplify processes Store Personal Data as your processor. "GDPR" means Regulation (EU) 2016/679 and, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection (FADP); "Data Protection Law" means GDPR and any other law that applies to the processing, including US state privacy laws.

Suplify is an independent controller (not your processor) for data about you and your team as our customers, and for limited processing of Store Personal Data needed for platform security, fraud and abuse prevention across stores, and our own legal obligations. Stripe processes payment data as an independent controller under its own terms with you.

2. Details of the processing (Annex 1)

• Subject matter and purpose: hosting and running your store; processing orders and payments through Stripe; having orders produced, packed and shipped by fulfilment suppliers and carriers; sending order, shipping, account and marketing emails you set up; customer support tools and your store inbox; subscriptions; consent records and visit counts; AI features you use on store content; fraud prevention for your orders.
• Nature of processing: collection, storage, organisation, retrieval, use, transmission to sub-processors, restriction, deletion.
• Categories of data subjects: store visitors, customers and recipients of orders, newsletter subscribers, people who contact your store.
• Types of personal data: name, email, phone, billing and delivery address, order history and contents, payment status (not full card numbers), subscription status, messages, consent choices, marketing preferences, technical data (IP address, device and browser, random visit identifier).
• Special categories: none intended. Product purchases (for example supplements) may in rare cases allow inferences about health; do not ask customers for health data, and tell us before you do.
• Duration: for the term of the Terms plus the deletion period in section 9.

3. Your instructions

Suplify processes Store Personal Data only on your documented instructions, which are: the Terms and this DPA, your settings and actions in Suplify, and other written instructions we agree. This includes transfers to third countries as described in section 7. If Suplify must process data by law, it will tell you first unless the law forbids it. Suplify will tell you if it believes an instruction infringes Data Protection Law.

You are responsible for the lawfulness of the processing you instruct: a lawful basis, a privacy notice in your store (we generate one you can edit), consent where required (for example for marketing emails and advertising tags), and answering your customers' requests.

4. Confidentiality

Suplify ensures that everyone authorised to process Store Personal Data is bound by confidentiality and accesses it only as needed for their work (for example to fix a problem or answer a support request you send).

5. Security (Annex 2)

Suplify implements appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, costs and the risks to data subjects. Current measures:

• Encryption: TLS for all connections; encryption at rest for the database, file storage and backups; backups are encrypted to a key that the production servers cannot read; payment-provider keys stored encrypted.
• Access control: tenant separation enforced in the database with row-level security, so each store's data is accessible only to its members; role-based staff access with least privilege; sign-in by one-time email codes; server access only by SSH keys; secrets kept out of code and logs.
• Hosting: database in Switzerland and servers in Germany with providers that hold recognised security certifications (such as ISO 27001 or SOC 2); firewall and DDoS protection through Cloudflare.
• Availability and resilience: nightly encrypted backups kept for 30 days, regular restore drills, zero-downtime deployments with rollback, uptime and health monitoring with alerting.
• Integrity: automated tests and continuous integration before every release; database changes through reviewed migrations; audit logs for legal documents, domains and sensitive admin actions.
• Monitoring and response: error and security monitoring with alerts; a documented process to assess and report incidents.
• Secure development: security headers and rate limits on sensitive endpoints; secret scanning, dependency audits and static code analysis in continuous integration, which must pass before any deployment; a daily check that every database table keeps row-level security.
• Data minimisation: no full card numbers ever reach Suplify (Stripe hosts the payment form); suppliers receive only what they need to ship an order; visit counts use a random identifier without name, email or IP address.
• Vendors: sub-processors are bound by data processing terms with equivalent protection and are reviewed before use.

Suplify may update these measures as long as the overall level of protection is not reduced.

6. Sub-processors

You give Suplify general authorisation to engage sub-processors. The current list (Annex 3):

• Supabase, Inc.

  Purpose: Database, sign-in and file storage (all account, store, order and customer data)

  Location: Data hosted in Zurich, Switzerland

  Transfer safeguard: Switzerland has an EU adequacy decision; Standard Contractual Clauses (SCCs) for any support access from the US

• Hetzner Online GmbH

  Purpose: Application servers, logs and encrypted backups

  Location: Germany

  Transfer safeguard: Within the EU

• Cloudflare, Inc.

  Purpose: Content delivery, DNS, security and bot protection, domain registration, inbound email routing

  Location: Global network; company in the United States

  Transfer safeguard: EU-U.S. Data Privacy Framework and SCCs

• Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.)

  Purpose: Customer payments, merchant payouts, subscription billing, fraud prevention, optional tax calculation

  Location: Ireland and United States

  Transfer safeguard: EU-U.S. Data Privacy Framework and SCCs. Stripe is also an independent controller for its own legal and fraud-prevention duties

• Resend (Plus Five Five, Inc.)

  Purpose: Sign-in codes, order and shipping emails, store mailboxes, marketing emails sent for merchants

  Location: Sending in the EU region; company in the United States

  Transfer safeguard: SCCs

• Anthropic, PBC

  Purpose: AI text generation (brand, product and policy texts, claims checks)

  Location: United States

  Transfer safeguard: SCCs; inputs are not used to train models

• OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.)

  Purpose: AI text, image, translation and voice-note transcription features

  Location: United States

  Transfer safeguard: SCCs; inputs are not used to train models

• Google (Google Ireland Ltd. / Google LLC)

  Purpose: Address autocomplete at checkout (Google Maps Platform), optional "Continue with Google" sign-in, and Google Ads / Analytics tags only where a merchant turns them on

  Location: Global network; company in the United States

  Transfer safeguard: EU-U.S. Data Privacy Framework and SCCs

• Openprovider (Hosting Concepts B.V.)

  Purpose: Registration of domain names a merchant buys through the platform (registrant name, address, email, phone)

  Location: The Netherlands

  Transfer safeguard: Within the EU; registry operators outside the EEA receive the data the registry requires (GDPR Art. 49(1)(b))

• Telegram (Telegram Messenger Inc.) and Slack (Slack Technologies, LLC, a Salesforce company)

  Purpose: Optional chat-app channels: owner messages and the Super Agent's answers when an owner connects Telegram or Slack, order alerts and daily summaries, and operational alerts to the platform team. Not used unless the owner connects the app

  Location: Global networks; companies outside the EU/EEA (Slack: United States)

  Transfer safeguard: The owner's own choice to use the service (GDPR Art. 49(1)(b)); Slack: EU-U.S. Data Privacy Framework and SCCs

• Klaviyo, Inc.

  Purpose: Email-list and measurement integration, only where a merchant connects Klaviyo to their store

  Location: United States

  Transfer safeguard: EU-U.S. Data Privacy Framework and SCCs; the merchant is the controller of the data sent

• Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API)

  Purpose: Advertising measurement: the platform's own sign-up pixel, and the Meta Pixel / Conversions API of stores whose merchant connects it (page and purchase events, hashed email or phone where sent; consent required in the EU, EEA, UK and Switzerland)

  Location: Ireland and United States

  Transfer safeguard: EU-U.S. Data Privacy Framework and SCCs; Meta acts as joint controller for pixel collection

• Other advertising and measurement tools a merchant chooses (TikTok, Snapchat, Pinterest, AppLovin)

  Purpose: Pixels the merchant switches on under Tracking; they load only after consent where the law requires it and are the merchant's own choice and responsibility

  Location: Ireland, United Kingdom, United States, Singapore (varies by tool)

  Transfer safeguard: EU-U.S. Data Privacy Framework and SCCs, varying by tool

• Vetted fulfilment suppliers

  Purpose: Production, packing and shipping of orders (name, delivery address, phone or email where the carrier needs it, order contents)

  Location: Germany for orders shipped from the EU; United States for orders shipped from the US

  Transfer safeguard: Within the EU, or SCCs where data goes to the US

• Shipping carriers chosen by the supplier

  Purpose: Delivery and tracking (name, address, phone or email for delivery notices)

  Location: The shipping and destination countries

  Transfer safeguard: As needed to deliver the order (GDPR Art. 49(1)(b) for deliveries outside the EEA)

Suplify will tell you about any intended addition or replacement at least 30 days in advance by email or in your dashboard (urgent replacements needed for security or continuity: as soon as possible). You may object on reasonable data protection grounds within that period; if we cannot address your objection, you may terminate the affected Services without penalty and receive a refund of prepaid fees for the unused period.

Suplify imposes data protection obligations on each sub-processor that offer at least the same protection as this DPA, and remains responsible to you for their performance.

7. International transfers

Healis LLC is established in the United States; Store Personal Data is hosted in Switzerland and Germany and some sub-processors are in the United States. To the extent Suplify's processing of Store Personal Data from the EU/EEA involves a transfer to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated by reference, with you as data exporter and Suplify as data importer, as follows: clause 7 (docking) applies; clause 9 option 2 (general authorisation, 30 days' notice); clause 11 optional language does not apply; clauses 17 and 18: the law and courts of Ireland; Annexes I to III are completed by sections 2, 5 and 6 of this DPA, and the competent supervisory authority is the one determined under clause 13.

For the UK, the UK International Data Transfer Addendum to the SCCs applies; for Switzerland, the SCCs apply with references to GDPR read as the FADP and the FDPIC as competent authority. Suplify relies on sub-processors' EU-U.S. Data Privacy Framework certification or SCCs (Module Three) for onward transfers. Where SCCs apply and conflict with this DPA, the SCCs prevail.

8. Assistance, breaches and audits

Data subject requests: Suplify provides tools in your dashboard to view and manage customer data, and will help you answer access, correction, deletion, portability and objection requests, including by exporting or deleting data on your instruction. If a data subject contacts Suplify directly about your store, we will forward the request to you without undue delay and not answer it ourselves unless you instruct us.

Personal data breaches: Suplify will notify you without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting Store Personal Data, with the information then available (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact), and update you as we learn more. Suplify will take reasonable steps to contain the breach and help you meet your duties to notify authorities (within 72 hours under Article 33 GDPR) and data subjects. Notifying you is not an admission of fault.

Other help: Suplify will give you reasonable information and help for data protection impact assessments, prior consultations and security obligations (Articles 32 to 36 GDPR), taking into account the nature of the processing and the information available to us.

Audits: Suplify will make available the information necessary to show compliance with Article 28 GDPR, including this DPA, a description of its security measures and sub-processor certifications, and will answer reasonable written questionnaires once a year. If that is not enough, or if an authority requires it, you may audit Suplify (yourself or through an independent auditor bound by confidentiality) with 30 days' notice, during business hours, at your cost, without access to other customers' data and not more than once a year unless there was a breach.

9. Return and deletion

When the Terms end, you can export your store's customer and order data for 30 days. After that Suplify deletes Store Personal Data (backups are overwritten within a further 30 days), unless the law requires us to keep it (for example order records kept for tax purposes), in which case we keep it protected and only for that purpose.

10. US state privacy laws

Where US state privacy laws (for example the California Consumer Privacy Act) apply, Suplify acts as your service provider or processor: it processes Store Personal Data only for the business purposes described in this DPA; will not sell or share it, or use it for cross-context behavioural advertising; will not retain, use or disclose it outside the direct business relationship with you or combine it with other data except as those laws allow; will comply with those laws and tell you if it can no longer do so; and you may take reasonable steps to stop unauthorised use.

11. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the SCCs do not allow such limitation. This DPA lasts as long as Suplify processes Store Personal Data for you.

12. Contact

Data protection contact: Healis LLC, 5830 E 2nd St, Ste 7000 #36257, Casper, WY 82609, United States. Email: support@suplify.ai (subject "DPA").