Data Processing Agreement

1. Roles

The Merchant is the Controller and determines the purposes and means of processing its catalog data. NSOLVIA acts as Processor and processes data only on the Merchant's documented instructions, which include the Terms of Service and use of the services.

2. Data processed

• Categories of data: product titles, descriptions, prices, availability, images, variants, and product identifiers (GTIN/SKU); merchant account email and store URL; store access credentials where a product requires them (held confidential, used only to operate the service, deleted with the account).
• Data subjects: the Merchant and its authorized users. Where the Merchant installs the NSOLVIA sales assistant, shopper conversations are processed solely to operate the assistant for the Merchant's store session; NSOLVIA does not profile shoppers or use conversations for any other purpose.

3. Purpose and duration

NSOLVIA processes the data solely to read, enrich, deliver, and — where the purchased product requires it — publish catalog-derived data as the Merchant's services describe. Processing continues for the duration of the subscription and ends upon deletion (within 30 days of termination).

4. Service providers

NSOLVIA operates on industry-standard, secured cloud infrastructure and uses a small number of vetted service providers strictly to operate the services (such as hosting, payment processing, and email delivery), each bound by data protection obligations. NSOLVIA does not sell or share the Merchant's data with anyone for their own purposes, and remains responsible for its providers' compliance.

5. Security measures

NSOLVIA implements technical and organizational measures appropriate to the risk, including: encryption in transit (HTTPS) on all endpoints, token-based access controls, restricted internal access, rate-limiting, and secrets management (no credentials in code or public repositories).

6. International transfers

Data is stored and processed in the United States. Where data originates in a region requiring a transfer mechanism, the parties will rely on an appropriate mechanism (e.g., Standard Contractual Clauses) as applicable.

7. Data subject rights and assistance

NSOLVIA will assist the Merchant, taking into account the nature of processing, in responding to data subject requests (access, correction, deletion, portability) and in meeting the Merchant's security, breach-notification, and impact-assessment obligations.

8. Personal data breach

NSOLVIA will notify the Merchant without undue delay after becoming aware of a personal data breach affecting the Merchant's data, and will provide information reasonably available to help the Merchant meet its notification obligations.

9. Deletion and return

Upon termination, NSOLVIA will delete the Merchant's data within 30 days, unless retention is required by law. On request, NSOLVIA will provide an export of the Merchant's catalog data before deletion.

10. Audit

Upon reasonable written request and subject to confidentiality, NSOLVIA will make available information necessary to demonstrate compliance with this DPA.

11. Governing terms

This DPA is subordinate to the NSOLVIA Terms of Service. In case of conflict regarding data processing, this DPA prevails.

12. Contact

teams@nsolvia.com