Data Processing Addendum

1. Definitions

• “Breach Event” means any incident in which security is compromised, resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
• “Controller” means the customer accessing and using the Services under the TOS.
• “Data Privacy Laws” means all applicable data-protection and privacy laws, including the EU GDPR, UK GDPR, CCPA/CPRA and the DPDP Act, 2023.
• “Data Subject” means the identified or identifiable natural person whose Personal Data is processed.
• “Personal Data” means any information relating to a Data Subject that is protected as personal data under Data Privacy Laws and is contained in Store Data.
• “Personnel” means employees and contractors of the Processor or a Subprocessor.
• “Processing” means any operation performed on Personal Data, whether or not by automated means.
• “Processor” means Ad Astra Studios, Mumbai, Maharashtra, India.
• “Services” means the Kompound application and related services provided under the TOS.
• “Subprocessor” means any third party appointed by the Processor to assist in providing the Services.

2. Purpose

This DPA defines the conditions under which the Processor processes Personal Data on behalf of the Controller in providing the Services.

3. Compliance with Laws

The Processor warrants that Processing performed on behalf of the Controller will comply with Data Privacy Laws and will notify the Controller if it can no longer meet its obligations. The Controller is solely responsible for the quality and accuracy of the Personal Data, for the lawfulness of how it was obtained, and for meeting transparency and consent requirements toward Data Subjects, including the consent banner on its own storefront.

4. Ownership of Data

All Personal Data processed by the Processor in performing the Services remains the property of the Controller.

5. Duration of Processing

Processing continues for as long as the Processor provides the Services to the Controller and until deletion under Clause 17.

6. Types of Data

The Processor processes the categories of Personal Data and Data Subjects set out in Schedule 1.

7. Instructions for Processing

The Processor processes Personal Data only on the Controller’s documented instructions, which are the TOS, this DPA, the specific instructions in Schedule 2 and the settings the Controller selects in the Services, except where otherwise required by law, in which case the Processor will inform the Controller before Processing unless the law prohibits it. The Processor will inform the Controller if it believes an instruction infringes Data Privacy Laws.

AI processing notice. Where the Services include features powered by artificial intelligence (Ask Kompass, Kompound MCP), the Processor sends only aggregated figures and the user’s question to its AI Subprocessor, never customer-identifying Personal Data, and does not use Personal Data to train AI models.

8. Data Subject Rights

The Processor will promptly notify the Controller of any request received directly from a Data Subject and will assist the Controller, taking into account the nature of the Processing, in responding to requests to exercise rights under Data Privacy Laws, including through the platform data-request and redaction mechanisms described in Schedule 2.

9. Data Protection Impact Assessments

The Processor will assist the Controller with data-protection impact assessments and prior consultations with supervisory authorities by providing, on request, information about data flows, storage, methods of processing, encryption and deletion.

10. Confidentiality

Both parties will keep Personal Data confidential and disclose it only as this DPA permits. The Processor ensures that all Personnel authorised to process Personal Data are bound by confidentiality obligations and access it only as needed to provide the Services.

11. Liability

Each party is liable for its own breaches of this DPA as determined under Data Privacy Laws, subject to the limitations of liability in the TOS, which apply in aggregate to the TOS and this DPA together.

12. Data Security

The Processor implements and maintains appropriate technical and organisational measures to ensure a level of security appropriate to the risk, protecting Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Those measures are at least equivalent to Schedule 3.

13. Breach Notification

The Processor will notify the Controller without undue delay and in any case within seventy-two (72) hours of becoming aware of a Breach Event, providing all information reasonably available to help the Controller assess the breach and meet its own notification obligations, and will cooperate in the investigation and remediation.

14. Limitations on Use

The Processor will not use, or authorise the use of, Personal Data for any purpose other than performing its obligations under the TOS and this DPA. In particular, the Processor does not sell Personal Data, does not use it for advertising, and does not surface customer-identifying fields in any Report or export.

15. Subprocessor Requirements

The Controller authorises the Subprocessors listed in Schedule 4. The Processor may engage additional or replacement Subprocessors provided that: (a) each is bound by obligations equivalent to this DPA; (b) the Processor remains fully liable for their acts and omissions; and (c) the Processor gives the Controller at least thirty (30) days’ notice, by email to the account owner, giving the Controller the opportunity to object on reasonable data-protection grounds. If an objection cannot be resolved, the Controller may terminate the affected Services.

16. International Data Transfers

The Services are hosted in the United States and operated from India. The Processor will not transfer Personal Data originating in the EEA, UK or Switzerland to a country without an adequacy decision except under appropriate safeguards, namely the Standard Contractual Clauses (Module Two, controller-to-processor) approved by the European Commission and the UK International Data Transfer Addendum, which are incorporated by reference, with the parties, subject matter and measures completed by reference to this DPA and its Schedules. Transfers of Personal Data originating in India comply with the DPDP Act and any restrictions notified under it.

17. Destruction or Return of Data

Collection stops immediately when a store is disconnected or the Apps are uninstalled. At the Controller’s choice, the Processor will delete or return the Personal Data within thirty (30) days of disconnection, termination or a written request, except to the extent storage is required by applicable law. Deletion requests received through a platform (for example Shopify’s customer or shop redaction webhooks) are honoured within forty-eight (48) hours. The Controller may export its Reports at any time before disconnecting.

18. Audits and Compliance

On request, no more than once in any twelve-month period unless required by a supervisory authority or following a Breach Event, the Processor will make available the information necessary to demonstrate compliance with this DPA, including third-party reports where they exist, and will permit an audit or inspection by the Controller or an independent auditor bound by confidentiality, on reasonable notice, during business hours, limited to the systems, procedures and documentation relevant to the Processing.

19. Recordkeeping Obligations

The Processor maintains records of Processing carried out on behalf of the Controller as required by Data Privacy Laws and will make them available to the Controller on request within a reasonable period.

20. Schedule 1 — Types of Data and Data Subjects

Categories of Personal Data

• Contact and identity details as provided by the connected platform (name, email address, postal address, telephone number, customer tags).
• Order and transaction data (orders, refunds, payment status, amounts, currencies, discount codes).
• Marketing attribution data (referrer, UTM parameters, click identifiers, campaign, channel, first and last touch).
• Email and SMS engagement data as provided by the connected email platform.
• Storefront session and event data collected by the Kompound Pixel where consent permits, with the recorded consent state.
• Technical identifiers (IP address, device and browser information) within the above.

Categories of Data Subjects

• Customers of the Controller’s stores.
• Visitors to the Controller’s storefronts, where the Kompound Pixel is installed.
• Recipients of the Controller’s email and SMS campaigns.
• Employees and contractors of the Controller who use the Services.

21. Schedule 2 — Specific Processing Instructions

• Process Personal Data only as necessary to provide the Services described in the TOS: reading connected-platform data on a read-only basis, computing Reports, Dashboards, Cohorts, forecasts and AI answers, and keeping them current.
• Never display customer-identifying fields in a Report or export; identify an order only by a link to the Controller’s own store administration.
• Honour the consent state recorded by the Controller’s storefront for Pixel data.
• Assist the Controller in responding to Data Subject requests, and act on platform data-request and redaction webhooks within 48 hours.
• Refrain from using Personal Data for the Processor’s own purposes, for advertising or for AI model training.
• Limit access to Personal Data to authorised Personnel.
• Implement the measures in Schedule 3 and notify Breach Events under Clause 13.
• Delete Personal Data under Clause 17.

22. Schedule 3 — Technical and Organisational Security Measures

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
• Per-store isolation enforced with row-level security in the database, in addition to application-layer permission checks.
• Four-role access control (Owner, Admin, Analyst, Viewer) granted per store; multi-factor authentication available to all accounts.
• An audit log of changes to costs, settings, filters and roles.
• Secrets and connector credentials held in a managed vault, encrypted with envelope encryption.
• Daily backups with point-in-time recovery; backups encrypted at rest.
• Monitoring and logging of access and errors; dependency vulnerability scanning; critical patches within 48 hours.
• Least-privilege production access for Personnel, logged; separate development and production environments with synthetic data in development.
• SOC 2 Type II examination under way.

23. Schedule 4 — Subprocessors

Questions about this DPA and requests for a signed copy: support@kompound.app.