Data Processing Addendum

This Data Processing Addendum (the "DPA") is part of the Terms and Conditions between you, the merchant who installs a Marka Shopify app ("you"), and Marka Modern Retail Private Limited, Basement, Plot No. 39, Sector 27, Gurugram, Haryana 122001, India ("Marka", "we"). It applies whenever an app processes personal data for your store, and it takes effect when you install the app. You do not need to sign it. If you need a signed copy, write to support@houseofmarka.com.

1. Definitions

• Data protection law means every law on personal data that applies to the processing, including the EU General Data Protection Regulation (the "GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the US state privacy laws (such as the California Consumer Privacy Act), and India's Digital Personal Data Protection Act 2023.
• Personal data, processing, controller, processor and data subject have the meanings those laws give them.
• Store personal data means personal data that an app processes on your behalf, as described in Annex I.

2. Roles

You are the controller of store personal data, and we are your processor. Under the US state laws you are the business and we are your service provider. Under India's DPDP Act you are the Data Fiduciary and we are your Data Processor.

For the data we need to run our relationship with you (your account, billing and support), we are a controller, as described in the Privacy Policy.

3. Your instructions

We process store personal data only:

• to provide the app you installed, as you configure it;
• as these Terms and this DPA describe;
• or as you otherwise instruct us in writing.

If we think an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids it.

You confirm that you have a lawful basis for the processing you instruct, and that your store's privacy notice and consent settings cover it.

4. Confidentiality

Everyone at Marka who can access store personal data is bound to keep it confidential.

5. Security

We maintain the technical and organisational measures described in Security, which is Annex II of this DPA. We may improve them, but we will not make them less protective.

6. Subprocessors

You authorise the subprocessors listed on Subprocessors (Annex III).

We will give you at least 30 days' notice before we add or replace one. If you object on reasonable data-protection grounds and we cannot resolve it, you may stop using the app concerned, and we will refund the unused part of any prepaid period.

We bind each subprocessor to data-protection terms at least as protective as this DPA, and we remain responsible to you for its work.

7. Helping you with requests and duties

• Requests from data subjects. We help you answer them through Shopify's privacy requests, which each app handles as described in Data Requests and Deletion. If someone writes to us directly about your store, we pass it to you and do not answer it ourselves unless you ask us to.
• Other duties. We give you the information you reasonably need for a data protection impact assessment, or for a consultation with a regulator, about the app.

8. Personal data breaches

We will tell you about a personal data breach affecting store personal data without undue delay and within 48 hours of confirming it. We will give you the information we have and keep you updated, and we will take reasonable steps to contain it.

9. Deletion at the end

When you uninstall an app, we delete store personal data as set out in Data Requests and Deletion, except where the law requires us to keep it. You can ask for a copy before you uninstall.

10. Audits

On request, we will give you the information you reasonably need to show that we meet this DPA. If that is not enough, you may audit our compliance once a year, at your cost, on 30 days' written notice. The audit is done during business hours, without disrupting the service or seeing other merchants' data, and by someone bound to confidentiality.

11. International transfers

We are in India, and the apps are hosted in the United States. Where store personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the following are incorporated into this DPA:

• the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), Module Two (controller to processor), with you as data exporter and us as data importer;
• the UK International Data Transfer Addendum to those clauses;
• the amendments needed for Switzerland, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

For the clauses:

• Clause 7 (docking) applies.
• Clause 9 is option 2, with the notice period in section 6.
• In Clause 11, the optional wording does not apply.
• Clauses 17 and 18 choose the law and courts of Ireland.
• Annexes I to III are set out below.

12. US state laws

As your service provider, we will not:

• sell or share store personal data;
• keep, use or disclose it outside our direct business relationship with you, or for any purpose other than providing the app;
• combine it with personal data from other sources, except as the law allows a service provider to.

We will tell you if we can no longer meet these duties.

13. Order of precedence and liability

If this DPA conflicts with the Terms, this DPA wins for data protection, and the Standard Contractual Clauses win over both. Liability under this DPA is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses do not allow a limit.

Annex I: Details of the processing

• Subject matter and duration. Providing the app you installed, for as long as it is installed and until the data is deleted as described in section 9.
• Nature and purpose. Hosting, storing, analysing and displaying data to run the app's features, as described for each app in the Privacy Policy.
• Data subjects. Your customers and the visitors to your store, and your staff who use the app.
• Categories of personal data, by app:
  • Marka Reviews. Customer names and emails; order references and products bought; reviews, ratings, photos and videos; questions; incentive codes; email delivery events.
  • Marka Bundles & Upsells. Keyed hashes of customer IDs; random visit IDs; offer events; order summaries; locale and country for offers after payment; personalisation text added to cart lines.
  • Marka Cart Drawer. Customer IDs; random visit IDs; drawer events; orders for 60 days; carts; derived spend tier and interests. Where Shopify grants access, email, phone and address, encrypted.
  • Marka Metrics. Customer IDs; order and customer records with city, region, country and postal code; where the store keeps them on, names, emails and phone numbers, encrypted; storefront visit events with a visit ID and a pseudonymised browser ID.
• Sensitive data. None is intended. The apps do not ask for special categories of data. A review's text is written by the shopper.
• Frequency. Continuous, while the app is installed.

Annex II: Security measures

See Security.

Annex III: Subprocessors

See Subprocessors.