Data Processing Addendum

1. Parties, scope and priority

This DPA forms part of the Optimato Terms of Service between the merchant identified in the Shopify account and Optimato, based in Tel Aviv, Israel ("Optimato"). The merchant is the controller and Optimato is the processor of the personal data described in Annex A ("Merchant Personal Data").

If you act as a processor for another controller, you confirm its authority to appoint Optimato as subprocessor and issue these instructions. Account information identifies the merchant; keep its business address and privacy contact current.

This DPA does not govern Optimato's independent controller processing of merchant account, staff-access and billing-contact information for account administration, security and legal purposes. The Privacy Policy describes that processing. Staff information included in merchant-managed conversations or instructions can be Merchant Personal Data for those purposes; the same person's data can fall under different roles for different uses.

"Applicable Data Protection Law" means the privacy and data protection laws applicable to the processing, including the EU GDPR and UK GDPR where they apply. "Personal data breach" means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Merchant Personal Data.

Mandatory transfer clauses prevail, then this DPA for processing matters, then the Terms. Mandatory regional rights and service-provider restrictions remain applicable.

2. Processing and documented instructions

Annex A describes the processing. Optimato processes Merchant Personal Data only on documented merchant instructions, including this DPA, the Terms, enabled settings and authorised use of the service, unless applicable law requires otherwise. If legally required to process outside those instructions, Optimato will inform the merchant beforehand unless the law prohibits that notice.

Optimato will promptly tell the merchant if, in its opinion, an instruction infringes applicable data protection law. It may pause the affected processing while the parties resolve the issue. It will not follow an unlawful instruction.

The merchant determines the lawful purposes and basis, provides notices, obtains necessary channel-specific consent and supplies lawful instructions. Imported contact information does not establish consent. Email permission and WhatsApp permission are separate. Optimato re-checks messaging eligibility immediately before sending; the merchant must not circumvent that control.

Optimato will not sell Merchant Personal Data, use it for advertising, train AI models on it or use it for unrelated independent purposes. Anthropic's Claude models process relevant context for store-related drafting and replies. AI cannot issue refunds, cancel orders or grant discounts beyond merchant limits; those actions require a person. There are no automated decisions with legal or similarly significant effects.

Instructions must come from an authorised account user or verified contact. Do not submit special-category data, payment credentials or other highly sensitive data without our written agreement. Ordinary compliance assistance is included; substantial additional work and fees require advance agreement and must not obstruct mandatory assistance.

3. Confidentiality and security

Optimato will ensure that people authorised to process Merchant Personal Data are subject to confidentiality obligations, receive appropriate instructions and have access only as needed for their duties.

Optimato will maintain the technical and organisational measures in Annex B, taking account of the nature, scope and risks of processing. Changes must not materially reduce the overall protection required by this DPA and applicable law.

The merchant manages its staff permissions, store information, lawful messaging configuration and connected-provider accounts. This does not reduce Optimato's own security duties.

4. Subprocessors and other providers

The merchant gives general written authorisation for the subprocessors identified in Annex C, subject to the change process below. A listed provider is a subprocessor only to the extent Optimato appoints it to process Merchant Personal Data on the merchant's behalf. Merchant-contracted delivery providers and providers acting as independent controllers must be identified accurately rather than automatically treated as Optimato subprocessors.

Before a subprocessor handles Merchant Personal Data, Optimato will bind it to written data protection obligations providing equivalent protection for the relevant processing. Optimato remains responsible to the merchant for its subprocessors' performance of those obligations as required by applicable law.

Optimato will notify the merchant of an intended addition or replacement, including the provider's identity, function, processing locations and applicable safeguards, and give a meaningful opportunity to object on reasonable data protection grounds before the change takes effect.

Notice goes to your account contact at least 14 days before an intended addition or replacement. Object within 10 days on reasonable privacy grounds. We discuss a workable alternative or stop affected processing; if unresolved, either party may end the affected service with a refund of its unused prepaid portion. Emergency security or legal changes may require faster notice, which we give promptly, preserving objections and mandatory authorisation rights.

5. Individual rights requests

Taking account of the processing, Optimato will provide appropriate technical and organisational assistance so the merchant can respond to individual rights requests. If Optimato receives a request directly, it will promptly inform the merchant and will not independently decide its merits unless required by law. Optimato may acknowledge the request and direct the person to the merchant.

Shopify's mandatory privacy webhooks deliver customer access and deletion requests. Optimato handles these within 30 days of receipt, providing the export to the merchant for delivery to the customer. Exports are deleted after 14 days. The merchant must tell Optimato promptly if an earlier applicable deadline requires faster assistance; Shopify's workflow does not extend a statutory deadline.

Customer deletion anonymises the person and removes identifying content. A one-way address hash remains in suppression records to prevent further messaging after opt-out. Such hashes may remain personal data and are not described as anonymous.

We use proportionate identity and authority checks and provide exports only to authorised merchant users. We promptly route direct requests to the merchant. Suppression hashes and consent evidence remain protected during store use and are removed on store erasure, except necessary evidence for a specific legal claim; renewed marketing requires a new lawful opt-in.

6. Impact assessments and regulatory assistance

Taking account of the processing and information available to it, Optimato will assist the merchant with security obligations, breach assessments, data protection impact assessments and prior consultation with supervisory authorities. It will provide relevant information about the service's processing and cooperate with lawful regulatory requests.

Contact support@optimato.xyz for assistance. Ordinary assistance is included; substantial extra work requires advance agreement on any fees and must not obstruct mandatory duties.

7. Personal data breaches

Optimato will notify the merchant without undue delay after becoming aware of a personal data breach affecting Merchant Personal Data. The notice will describe the nature of the breach; the categories and approximate numbers of affected people and records where known; a contact for follow-up; likely consequences; and measures taken or proposed to address and mitigate the breach.

Information may be supplied in stages as it becomes available. Optimato will investigate, take reasonable containment and remediation steps, preserve relevant evidence and keep the merchant informed. A notice is not an admission of liability.

The merchant is responsible for deciding whether it must notify an authority or affected individuals, with Optimato's assistance. Optimato will not notify them on the merchant's behalf without instructions unless required by law.

Initial notice is due without undue delay and no later than 48 hours after awareness, to the merchant’s account contact. Keep that contact current or provide a separate incident contact to support. Updates follow as information becomes available; this does not replace the controller’s regulatory deadline.

8. International transfers

Optimato will make restricted international transfers only in accordance with applicable law and documented instructions. Hosting in Frankfurt does not establish that all processing or access stays in the EU.

EU transfers to Israel may rely on the European Commission’s adequacy decision where it covers the processing. For a restricted transfer from you to Optimato requiring and eligible for the EU SCCs under Decision 2021/914, those clauses are incorporated by reference: Module Two for controller-to-processor, Module Three for processor-to-subprocessor. An inapplicable module does not authorise a transfer.

For UK restricted transfers requiring these safeguards, the approved ICO UK Addendum B.1.0, as lawfully revised, is incorporated with the applicable EU SCCs. Tables 1–3 use the parties, modules, choices and annex information in this DPA. For Table 4, neither party may end the Addendum solely because a revised approved version is issued. Its mandatory clauses apply.

For applicable SCCs, Clause 7 docking applies; Clause 9 uses general authorisation with section 4’s notice period; Clause 11’s optional independent dispute-resolution wording is excluded. Clauses 17 and 18 select Irish law and Irish courts, preserving protected individual forum rights. Clause 13 determines the competent authority from the exporter’s actual circumstances. The exporter is the accepting merchant identified in its Shopify account and privacy contact; the importer is Optimato, Tel Aviv, Israel, support@optimato.xyz. Annexes A–C provide processing details, security and providers. Acceptance binds the parties to applicable incorporated clauses. Essential additional identity or transfer details and required assessments and supplementary measures must be completed before restricted processing begins. This DPA does not execute a provider’s contract on its behalf. We require appropriate safeguards for onward transfers and provide safeguard information or copies subject to lawful redactions; affected transfers stop if safeguards cannot be maintained.

Any applicable mandatory transfer terms prevail over conflicting limits in the Terms or this DPA. If adequate safeguards cannot be maintained, the affected transfer must stop while the parties agree a lawful alternative or end the affected processing.

9. Return, deletion and retention

At the end of processing, Optimato will, at the merchant's choice, return or delete Merchant Personal Data and delete existing copies unless applicable law requires retention. The merchant should request return before uninstall or promptly coordinate an authorised request with support@optimato.xyz so it can be completed before erasure. Return does not suspend a lawful deletion duty.

Uninstall stops outgoing work and discards the Shopify token. Store data is erased after Shopify's store-deletion request. Shopify sends that request no earlier than 48 hours after uninstall; that is not a guarantee of complete deletion exactly 48 hours after uninstall. Mandatory privacy requests are handled within 30 days of receipt.

Backups awaiting expiry remain protected and are not used for ordinary business processing. If restored, deletion instructions are re-applied. The obligations in this DPA continue for any Merchant Personal Data remaining in backups or lawfully retained records.

Request return before uninstall or promptly coordinate it before erasure. We provide a commonly readable electronic export and confirm deletion on request. Exports expire after 14 days. Protected backups await expiry and erasures are re-applied on restoration. Any required preservation is limited to necessary records and ends when its legal purpose ends. AI conversation content follows the 2-year content rule. These obligations extend to appointed subprocessors under their processing contracts.

10. Information and audits

Optimato will make available the information needed to demonstrate compliance with this DPA and applicable processor obligations, and allow and contribute to audits, including inspections, by the merchant or its authorised auditor.

The parties will protect other tenants' data, secrets and service security during an audit. Information or an existing report may help answer a request, but this DPA makes no claim of certifications or independent audits already obtained.

Ordinary audits require 15 business days’ notice, occur in business hours at most once per 12 months and use an independent auditor bound by confidentiality. Documentation and remote review come first where sufficient, without eliminating necessary inspection. Protect other tenants and secrets. Limits do not apply to regulators, relevant incidents or credible material noncompliance. You bear your auditor’s costs; extra assistance fees require advance agreement. We bear reasonable remediation and assistance costs caused by our material breach. No limit or fee may defeat mandatory audit rights.

11. Liability, duration and changes

The main Terms govern contractual liability, subject to applicable law and any mandatory transfer terms. No provision limits individuals' statutory rights or removes Optimato's responsibility for subprocessors where required by law.

This DPA continues while Optimato processes Merchant Personal Data, including protected residual copies. Changes must remain consistent with applicable law and binding transfer safeguards.

The Terms’ liability provisions apply, including the higher cap for personal-data obligations, subject to mandatory rights and transfer terms. Material DPA changes require 30 days’ notice except where law or urgent security requires faster action, cannot reduce legally required protection, and cannot authorise new purposes without lawful instructions. Israeli law and Tel Aviv–Yafo courts apply except where mandatory transfer terms or other mandatory law requires otherwise.

12. Contacts and agreement details

Optimato contact: support@optimato.xyz, Optimato, Tel Aviv, Israel.

Merchant legal name, address and authorised contact: the merchant identified in the accepted Shopify subscription/account record. The accepting Shopify merchant account identifies the merchant and records agreement; authorised acceptance binds both parties to applicable provisions. Keep its business address and privacy/incident contacts current and supply any additional identity details necessary before a restricted transfer.

Annex A — Processing details

Do not submit sensitive or children’s information without a lawful basis, required permissions and appropriate safeguards, including our written agreement for special-category or highly sensitive data. Optional integrations must disclose material additional data types before activation.

Annex B — Technical and organisational security measures

• Transport and storage: HTTPS/TLS for service communications, including database connections; encryption at rest; additional application-level encryption for provider tokens and keys.
• Store separation: Database-level row-level security separates store data, with access scoped to the relevant tenant.
• Access controls: Role-based merchant staff permissions; masking of customer contact details for staff without permission; Shopify sign-in, with no Optimato passwords.
• Accountability: Logging of staff views of customer records and privileged actions. Logs avoid customer content and secrets. Logging is an accountability control, not a promise that every failed access-log write blocks access.
• Environment separation: Separate test and production environments.
• Recovery: Daily encrypted backups with a restore check on every backup; 30-day backup expiry and 3-day point-in-time recovery; erasures re-applied after restoration.
• Error handling: Error tracking with personal data removed from reports; Sentry EU region with IP storage disabled.
• Incidents: An incident response and personal data breach procedure, investigation and merchant notification under section 7.
• Data lifecycle: Content wiping, export expiry, storefront event deletion and uninstall erasure under section 9; suppression controls to prevent renewed messaging after opt-out.
• Authorised processing: Confidentiality obligations and instructions for authorised personnel, with access limited to service duties.

These measures do not assert any certification, independent security audit, SLA or guarantee that incidents cannot occur. No security certification, independent audit or SLA is represented by these measures.

Annex C — Provider and subprocessor register

The register below describes the services and relevant provider roles. Configured storage regions do not guarantee that support access or onward processing stays in that region. Optional providers require disclosure and activation before receiving data.

Regions describe configured storage where known, not guaranteed limits on support or onward processing. Only named, disclosed and authorised optional providers receive data; a generic review-app category does not authorise an unnamed subprocessor.