Data Processing Agreement

1. Definitions

2. Roles and Scope

3. Processor Obligations

1. Process Personal Data only on documented instructions from the Controller.
2. Ensure that persons authorized to Process Personal Data are committed to confidentiality.
3. Implement appropriate technical and organizational measures (see Schedule B).
4. Engage Sub-processors only in accordance with Section 4.
5. Assist the Controller with breach notification, impact assessments, and prior consultations.
6. Delete or return all Personal Data after the end of the provision of the Service.
7. Make available all information necessary to demonstrate compliance and allow audits.

4. Sub-processors

5. International Transfers

Where Personal Data is transferred outside the EEA, UK, or other adequate jurisdiction, the parties agree that such transfers are governed by the Standard Contractual Clauses, incorporated by reference. Where MageRa engages a Sub-processor outside an adequate jurisdiction, MageRa will enter into SCCs with that Sub-processor.

6. Security of Processing

7. Personal Data Breach Notification

8. Data Subject Rights

MageRa will promptly notify the Controller of any request received directly from a Data Subject and will not respond except to acknowledge receipt and direct the Data Subject to the Controller, unless instructed otherwise in writing.

9. Audit Rights

The Controller may conduct an on-site audit no more than once per calendar year, on 30 days' prior written notice, at the Controller's expense. MageRa will make available summaries of its most recent third-party security assessments (SOC 2 Type II, ISO 27001, or equivalent).

10. Return or Deletion

Upon termination, MageRa will, at the Controller's choice, delete or return all Personal Data and delete existing copies, unless retention is required by law.

11–14. Liability, Precedence, Changes, Contact

• Liability: Subject to the limitations in the Terms of Service.
• Precedence: SCCs prevail over this DPA; this DPA prevails over the Terms for data-processing matters.
• Changes: Material changes communicated via banner or email.

Schedule A — Details of Processing

A.1 Subject Matter and Duration

MageRa Processes Personal Data for the purpose of providing, securing, and supporting the Service for the duration of the customer's subscription plus a reasonable wind-down period not to exceed 90 days.

A.2 Nature and Purpose

• Operating and maintaining the Service (authentication, billing, license fulfillment).
• Customer support and responding to support requests.
• Detecting, preventing, and addressing fraud, abuse, and security incidents.
• Aggregating usage analytics to improve the Service.

A.3 Categories of Data Subjects

• The Controller's employees, contractors, and end-users.
• The Controller's end-customers (where the Controller uses the Service to operate a store).

A.4 Categories of Personal Data

• Account data: name, email, hashed password, role.
• Billing data: billing contact, address, tax ID, payment-method token.
• End-customer data: name, email, address, order history, IP address.
• Support data: content of tickets, emails, chat transcripts.
• Technical data: IP, browser, device, pages viewed, timestamps.

Schedule B — Technical and Organizational Measures

Contact