DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions (the "Legal Terms") between Capital Enesti Inc. ("we", "us", "Processor") and the business customer using the Services ("you", "Customer"). By accepting the Legal Terms, you accept this DPA. If this DPA conflicts with the Legal Terms, this DPA prevails for the processing of Customer Personal Data. Capitalized terms not defined here have the meaning given in the Legal Terms.

1. SCOPE AND ROLES

This DPA applies when we process personal data on your behalf in providing the Services, including personal data about your customers, end users, subscribers, or contacts that you send to Cowliss, API Mercado, our Shopify apps, or any other Service ("Customer Personal Data"). For Customer Personal Data, you are the controller and we are the processor (or, where you are yourself a processor, we are your subprocessor). This DPA does not cover personal data we process as a controller, such as your own account and billing details, which our Privacy Policy covers.

Cowliss has its own data processing agreement and subprocessor list, which apply to Customer Personal Data processed in Cowliss and prevail over this DPA for that processing. This DPA applies to every other Service.

"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Legal Terms, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Canada's Personal Information Protection and Electronic Documents Act, Québec's Act respecting the protection of personal information in the private sector, and the California Consumer Privacy Act as amended.

2. DETAILS OF THE PROCESSING

• Subject matter and purpose: providing, securing, supporting, and improving the Services you use, as described in the Legal Terms and the Services' documentation.
• Nature of processing: collection, storage, organization, transmission, analysis, and deletion, including event ingestion, profile building, journey execution, and transactional email delivery (Cowliss); API request routing, key management, rate limiting, and billing (API Mercado); and store and order data handling (Shopify apps).
• Duration: for the term of the Legal Terms, plus the deletion period in section 9.
• Data subjects: your customers, end users, subscribers, contacts, and personnel whose data you send to the Services.
• Categories of data: identifiers and contact details (such as name, email address, user IDs), event and usage data, device and network data (such as IP address and user agent), message content, order and transaction data, and any other data you choose to send.
• Special categories: none. You must not send special categories of personal data, or data about children under 16, to the Services.

3. PROCESSING ON YOUR INSTRUCTIONS

We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law forbids it. The Legal Terms, this DPA, and your configuration and use of the Services are your complete instructions. We will tell you if we believe an instruction infringes Data Protection Laws. We will not sell or share Customer Personal Data, or use it for any purpose other than providing the Services, and we will not combine it with personal data we receive from others except as needed to provide the Services.

You are responsible for the lawfulness of your instructions and for having a lawful basis, and any notices and consents required, for the Customer Personal Data you send us.

4. CONFIDENTIALITY AND SECURITY

We ensure that anyone we authorize to process Customer Personal Data is bound by a duty of confidentiality. We implement appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature and risks of the processing. These include:

• encryption of data in transit using TLS;
• access to production systems and data restricted to personnel who need it, using individual accounts;
• hosting in data centres operated by our subprocessors, which maintain their own physical and environmental security controls;
• regular backups of production databases;
• logging and monitoring of production systems;
• keeping software and dependencies up to date with security patches; and
• logical separation of each customer's data.

We may update these measures as long as the overall level of protection is not reduced.

5. SUBPROCESSORS

You give us general authorization to engage subprocessors. Our current subprocessors are listed below. We will update this list at least 14 days before a new subprocessor starts processing Customer Personal Data. You may object on reasonable data protection grounds by emailing [email protected] within that period. If we cannot address your objection, you may terminate the affected Services, and that termination is your sole remedy. We impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible for their performance.

Shopify is not our subprocessor. When you use one of our Shopify apps, Shopify shares your store data with us under your own agreement with Shopify and Shopify's API terms.

6. DATA SUBJECT REQUESTS AND ASSISTANCE

If we receive a request from a data subject about Customer Personal Data, we will forward it to you and will not respond ourselves except to direct the person to you. Taking into account the nature of the processing, we will provide reasonable assistance, through the features of the Services or otherwise, to help you respond to such requests and to meet your obligations on security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities.

7. PERSONAL DATA BREACHES

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. We will give you the information you reasonably need to meet your own notification obligations, as it becomes available, and take reasonable steps to contain and remedy the breach. Our notice is not an admission of fault or liability.

8. INTERNATIONAL TRANSFERS

We are based in Canada, which the European Commission recognizes as providing adequate protection for personal data subject to PIPEDA. Some subprocessors process data in the United States and other countries. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA by reference, with Module Two (controller to processor) or Module Three (processor to processor) as applicable, and completed as follows: Clause 7 is not included; under Clause 9, option 2 (general written authorization) applies with the notice period in section 5; the optional wording in Clause 11 is not included; under Clauses 17 and 18, the law and courts of Ireland apply; and Annexes I and II are completed by sections 2 and 4 of this DPA. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs applies. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection. We rely on the EU-U.S. Data Privacy Framework or SCCs with our subprocessors, as applicable.

9. RETURN AND DELETION

Before the Services end, you may export Customer Personal Data using the features of the Services. Within 90 days after the Services end, we will delete Customer Personal Data, except where the law requires us to keep it. Copies in backups will be deleted as the backups expire on their normal cycle and will stay protected under this DPA until then.

10. AUDITS

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires. If that information is not sufficient to meet a requirement of Data Protection Laws, you may audit our compliance once per year, at your own cost, with at least 30 days' written notice, during business hours, in a way that does not disrupt our operations or breach our confidentiality obligations to others. Audits of subprocessors are satisfied by their own audit reports and certifications.

11. CALIFORNIA

Where the California Consumer Privacy Act applies, we act as your service provider. We will not sell or share Customer Personal Data, retain, use, or disclose it outside our direct business relationship with you or for any purpose other than the business purposes set out in the Legal Terms, or combine it with other personal information except as the law permits. We will comply with the law and tell you if we can no longer meet our obligations under it.

12. LIABILITY AND GENERAL

Each party's liability arising out of or related to this DPA, including under the SCCs to the extent the law allows, is subject to the limitations and exclusions of liability in the Legal Terms. This DPA ends when we stop processing Customer Personal Data. We may update this DPA to reflect changes in Data Protection Laws or the Services, as long as the changes do not materially reduce the protection of Customer Personal Data. If you need a countersigned copy, email [email protected].