Data processing agreement (DPA)

Last updated: [date]. This Data Processing Agreement ("DPA") is part of the contract between the store that uses SeekGist ("Customer", the controller) and [SeekGist legal entity name] ("SeekGist", the processor).

1. What is processed

SeekGist is designed to work without shopper names, emails, phone numbers or addresses. The Customer will not send such data in product data or events.

2. SeekGist's duties

SeekGist will:

1. process personal data only on the Customer's documented instructions, which are this contract and the settings the Customer chooses in the Service;
2. make sure the people who process the data are bound by confidentiality;
3. apply the security measures in Annex 1;
4. use subprocessors only as set out in section 3;
5. help the Customer answer data subject requests, using the export and delete tools in the Service;
6. help the Customer with security, breach notices, impact assessments and consultations with authorities, as far as the processing allows;
7. delete or return the data at the end of the contract (section 8);
8. give the Customer the information needed to show compliance, and allow audits as set out in section 6.

3. Subprocessors

The Customer gives general permission to use the subprocessors listed in Annex 2. SeekGist will tell the Customer at least [30] days before it adds or replaces a subprocessor. The Customer may object on reasonable data protection grounds. SeekGist puts the same data protection duties on each subprocessor and stays responsible for them.

4. Transfers

Personal data is transferred outside [country/region] only with safeguards the law accepts, such as standard contractual clauses. [To be confirmed.]

5. Personal data breaches

SeekGist will tell the Customer without undue delay, and within [48] hours, after it becomes aware of a personal data breach that affects the Customer's data. The notice will describe what happened, the likely effects, and the steps taken.

6. Audits

SeekGist will answer reasonable security questionnaires and share summaries of its security reviews. On-site audits are possible once a year with [30] days' notice, at the Customer's cost, unless a breach makes an audit necessary. [Audit terms to be confirmed.]

7. The Customer's duties

The Customer is responsible for having a legal basis for the processing, for telling its shoppers about it (for example in its own privacy policy), and for the instructions it gives.

8. End of the contract

After the contract ends, the Customer can export its data for [30] days. Then SeekGist deletes it, including from search indexes, within [period], and from backups when they expire, except where the law requires SeekGist to keep it.

Annex 1: Security measures

• Each store's data is separated in the database with row-level security, and each store has its own search index.
• API keys and passwords are stored only as hashes. Platform access tokens are encrypted at rest.
• All traffic uses TLS.
• Team access uses roles (owner, admin, editor, viewer), two-factor sign-in is available, and important actions are written to an audit log.
• Secrets come from the environment or a secret store, never from code.
• Backups with point-in-time recovery. [Restore drill results to be added.]
• Logs do not contain API keys, passwords or session tokens.
• Log retention can be set per store.

Annex 2: Subprocessors