Data Processing Addendum (DPA)

Effective: September 23, 2026

This DPA forms part of the Terms of Service between Shopinzip Inc ("Processor") and the Member ("Controller"). It applies when Shopinzip processes personal data on the Member's behalf ("Customer Personal Data"). It is accepted automatically when you accept the Terms.

1. Roles and scope

• The Member is the controller (or "business" under CCPA). Shopinzip is the processor (or "service provider").
• Subject matter: providing the GrowingWhale Service.
• Duration: the term of the subscription, plus the deletion period.
• Data subjects: the Member's customers, leads, website visitors, subscribers and staff.
• Data types: contact details, order and transaction data, messages, preferences, device and usage data, and any other data the Member submits.

2. Processor obligations

Shopinzip will:

1. process Customer Personal Data only on the Member's documented instructions. The Terms, the Member's configuration and their use of the Service are those instructions. We will inform the Member if an instruction appears unlawful.
2. ensure personnel are bound by confidentiality.
3. implement the security measures in Annex A.
4. engage subprocessors only under Section 4.
5. assist the Member, taking into account the nature of processing, with data-subject requests, security, breach notification and impact assessments. This assistance is at the Member's reasonable cost where it goes beyond self-service tools.
6. delete or return Customer Personal Data at the end of the Service, per the Data Deletion Instructions, unless retention is required by law.
7. make information reasonably necessary to demonstrate compliance available. Audits are limited to one per year, with 30 days' notice, at the Member's cost, subject to confidentiality. Our existing documentation or third-party reports satisfy audits first.

CCPA. Shopinzip will not:

• sell or share Customer Personal Data
• retain, use or disclose it outside the direct business relationship
• combine it with other data except as permitted by law

3. Controller obligations

The Member warrants that:

• it has a lawful basis, and all notices and consents required, for the processing, including marketing and messaging consents
• its instructions comply with law
• it will not submit special-category or sensitive data unless a feature expressly supports it

The Member is responsible for responding to its own data subjects.

4. Subprocessors

The Member authorizes the subprocessors listed below. We will update this page at least 14 days before adding or replacing a subprocessor. Members may subscribe to updates at hello@growingwhale.com. A Member may object on reasonable data-protection grounds. If we can't resolve the objection, the Member's sole remedy is to terminate the affected Service. We remain responsible for our subprocessors' performance, subject to the Terms' liability limits.

5. Personal data breach

We will notify the Member without undue delay, and within 72 hours after becoming aware of a breach affecting Customer Personal Data. The notice will include available details and the mitigation steps taken. Notifying data subjects and regulators is the Member's responsibility as controller, unless the law requires otherwise. Our notification is not an admission of fault or liability.

6. International transfers

Where Customer Personal Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses apply and are incorporated by reference: Module 2 (controller-to-processor) and Module 3 (processor-to-processor), with the UK Addendum where relevant. Governing law and forum under the SCCs will be Ireland.

7. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service.

Annex A: Security measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Encrypted storage of OAuth tokens, API keys and secrets
• Logical tenant isolation per Member
• Role-based, least-privilege access; MFA for staff and administrative access
• Audit logging and monitoring; alerting on anomalous access
• Secure development practices, dependency scanning and code review
• Regular backups, with a rolling 35-day retention
• Vendor security due diligence
• Documented incident response and breach notification procedure
• Staff confidentiality obligations and access revocation on offboarding

Subprocessors

Connectors that Members choose to enable (e.g. HubSpot, Shopify, Slack) are the Member's own vendors, not our subprocessors.

Contact

Shopinzip Inc · 222 Highview Drive, Clifton, NJ 07013, USA · hello@growingwhale.com