Data Processing Addendum

The Processor processes shopper data on the Controller's behalf solely to provide product recommendations, product search, demand forecasting and customer analytics for the Controller's store, for as long as the Controller's account exists.

Data subjects: visitors and customers of the Controller's store. Data categories: product view, cart, purchase and search events; order lines with values and quantities; pseudonymous identifiers supplied by the Controller (session ids, customer ids); images uploaded by shoppers for visual search; and aggregates derived from the above (segments, forecasts). The Controller decides which identifiers it sends and must not send special categories of data.

The Processor processes the data only on the Controller's documented instructions. The service configuration the Controller sets in the dashboard, and the acts of sending data to the documented endpoints, are those instructions. The Processor informs the Controller if, in its view, an instruction breaks data-protection law.

Persons authorised to process the data are bound by confidentiality. The Processor applies measures appropriate to the risk, including encryption in transit, EU-based hosting, per-account isolation of data, role-based access, and logging of administrative access. Details of the current measures are available on request.

The Controller gives general authorisation for the sub-processors listed in the Privacy Policy. The Processor announces intended additions or replacements at the same place at least 30 days ahead; the Controller may object on reasonable data-protection grounds, in which case the parties look for a solution and the Controller may terminate if none is found. The Processor remains responsible for its sub-processors.

All application data is hosted in the EU. Where the optional AI features run on the Controller's own OpenAI key, that processing happens under the Controller's direct relationship with OpenAI and is not a sub-processing by the Processor.

Taking the nature of the processing into account, the Processor helps the Controller answer data-subject requests (access, deletion, portability and the rest) and, where needed, with security, breach notification and impact assessments under Articles 32 to 36 of the GDPR.

The Processor notifies the Controller of a personal data breach affecting the Controller's data without undue delay after becoming aware of it, with the information the Controller needs for its own notifications.

On termination of the account, or earlier on the Controller's request, the Processor deletes the shopper data within 30 days, unless EU or Bulgarian law requires keeping specific records. Export endpoints for catalog, events and segments are available while the account is active.

The Processor makes available the information needed to show compliance with this addendum and, at most once a year and with reasonable notice, allows an audit by the Controller or an auditor it appoints, at the Controller's cost and without access to other customers' data.

The liability arrangements of the Terms of Service apply to this addendum. It is governed by Bulgarian law.