Data Processing Addendum (DPA)

Ecom Intelligence is operated by ROA BUSINESS SOLUTIONS LLC.

This Data Processing Addendum («DPA») applies when Ecom Intelligence processes personal data on behalf of a customer who uses the platform for their online store. It supplements the Terms of Service and the Privacy Policy.

1. Roles

For personal data of a customer's own shoppers that the customer connects or imports (for example through Shopify), the customer is the controller and ROA BUSINESS SOLUTIONS LLC is the processor. For account, billing and security data of the customer's own users, ROA BUSINESS SOLUTIONS LLC acts as controller, as described in the Privacy Policy.

2. Scope and instructions

• We process personal data only to provide the features the customer uses, following the customer's documented instructions (the Terms, this DPA and the customer's use of the platform).
• We do not sell the personal data we process for a customer and do not use it to build profiles for unrelated purposes.
• If we believe an instruction breaks the law, we will tell the customer.

3. Confidentiality and security

People with access to this data are bound by confidentiality. We apply the technical and organizational measures described on the Security Practices page.

4. Subprocessors

The customer authorizes the providers listed on the Subprocessors page. We keep that list current and require each provider to protect data under terms no less protective than this DPA.

5. Assistance

Taking into account the nature of the processing, we help the customer answer data-subject requests (access, correction, deletion), and we process Shopify privacy webhooks (customer data request, customer redaction and shop redaction) as described in the Data Deletion Policy.

6. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting data we process for them, with the information we have to help them meet their own obligations.

7. Return and deletion

When the customer deletes their account or uninstalls the app, we delete or anonymize the personal data we process for them as described in the Data Deletion Policy, except where the law requires us to keep records (for example billing records).

8. International transfers

Where personal data is transferred outside its country of origin, we rely on a lawful transfer mechanism, such as standard contractual clauses, where the applicable law requires one.

9. Audits and information

On reasonable written request, we provide the information needed to show compliance with this DPA. The customer may ask for an audit no more than once a year unless a regulator requires otherwise, with reasonable notice and during business hours.

10. Contact

Questions about this DPA or requests for a signed copy: [email protected]. English is the controlling version.