Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between PalySales Inc. ("Processor", "we", "us") and the merchant using our services ("Controller", "you").

This DPA sets out the terms that apply when we process personal data on your behalf in connection with providing the PalySales platform and related services.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Data Subject" means the individual to whom Personal Data relates (e.g., your customers).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, and deletion.
• "Sub-processor" means any third party engaged by us to process Personal Data on your behalf.
• "Data Protection Laws" means GDPR, CCPA, PIPEDA, NDPR, and other applicable privacy regulations.

3. Scope of Processing

3.1 Categories of Data Subjects

• Your customers who interact via WhatsApp, Instagram, or your storefront
• Your team members and employees
• Your business contacts and suppliers

3.2 Types of Personal Data

• Contact information (name, email, phone number, address)
• Order and transaction history
• Communication content (messages, chat history)
• Device and usage data
• Payment information (processed by third-party payment providers)
• AI-generated images and generation prompts
• Reference images for AI processing

3.3 Processing Purposes

• Providing the PalySales platform functionality
• Processing orders and facilitating payments
• Enabling AI-powered customer support and sales automation
• Sending transactional notifications
• Generating analytics and reports
• Maintaining service security and preventing fraud

4. Processor Obligations

We agree to:

• Process Personal Data only on your documented instructions
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist you in responding to Data Subject requests
• Notify you of any Personal Data breach without undue delay (within 72 hours)
• Delete or return Personal Data upon termination of services
• Make available information necessary to demonstrate compliance
• Allow for and contribute to audits and inspections

5. Controller Obligations

You agree to:

• Ensure you have a lawful basis for processing (consent, contract, legitimate interest)
• Provide clear privacy notices to your customers
• Obtain necessary consents where required
• Ensure instructions given to us are lawful
• Promptly notify us of any Data Subject requests you receive

6. Sub-processors

You authorize us to engage the following sub-processors to assist in providing our services:

We will notify you of any intended changes to sub-processors, giving you the opportunity to object. If you have legitimate grounds to object, we will work with you to find an alternative solution.

7. International Data Transfers

Personal Data may be transferred to and processed in countries outside your jurisdiction. For transfers from the EEA, UK, or Switzerland to countries not deemed adequate by relevant authorities, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement where applicable
• Data Privacy Framework certification where sub-processors are certified

8. Security Measures

We implement the following security measures:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Controls: Role-based access, multi-factor authentication
• Network Security: Firewalls, intrusion detection, DDoS protection
• Monitoring: 24/7 security monitoring and logging
• Incident Response: Documented procedures for security incidents
• Employee Training: Regular security awareness training
• Vendor Assessment: Security reviews of all sub-processors

9. Data Subject Rights

We will assist you in fulfilling your obligations to respond to Data Subject requests for:

• Access: Providing copies of their Personal Data
• Rectification: Correcting inaccurate data
• Erasure: Deleting data ("right to be forgotten")
• Portability: Exporting data in machine-readable format
• Restriction: Limiting processing
• Objection: Objecting to certain processing activities

We provide self-service tools in your dashboard to export and delete customer data. For complex requests, contact us at privacy@palysales.com.

10. Data Breach Notification

In the event of a Personal Data breach, we will:

• Notify you within 72 hours of becoming aware of the breach
• Provide details of the nature of the breach, categories of data affected, and estimated number of Data Subjects
• Describe the likely consequences and measures taken to address the breach
• Cooperate with your investigation and regulatory notifications

11. Data Retention and Deletion

Upon termination of your account:

• We will provide a 30-day period to export your data
• After 30 days, we will delete or anonymize all Personal Data
• Some data may be retained for legal compliance (e.g., transaction records for tax purposes)
• Backups are automatically purged within 90 days of deletion

12. Audits

Upon reasonable notice, we will make available information necessary to demonstrate compliance with this DPA. You may conduct audits (at your expense) or appoint an independent auditor, subject to confidentiality obligations and reasonable scheduling constraints.

13. Term and Termination

This DPA is effective upon your acceptance of our Terms of Service and continues until the termination of your account. Obligations relating to confidentiality and data deletion survive termination.

14. Contact

For questions about this DPA or to exercise your rights, contact us at: