← Back to home

Data Processing Addendum

Effective Date: [To be updated]  |  Last updated: [To be updated]

This Data Processing Addendum (“DPA”) forms part of the agreement between SellerAxis, Inc. (“SellerAxis”, “Processor”) and the customer identified in the applicable order or agreement (“Customer”, “Controller”) for the provision of services (the “Services”). This DPA reflects the parties’ agreement with respect to the Processing of Personal Data in connection with the Services.

1. Definitions

  • “Applicable Data Protection Law” means all data protection and privacy laws applicable to the Processing of Personal Data under the Agreement, including the GDPR, the UK GDPR, and the California Consumer Privacy Act.
  • “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, and “Sub-processor” have the meanings given in Applicable Data Protection Law.
  • “Customer Personal Data” means Personal Data contained within Customer Data that SellerAxis Processes on behalf of Customer under the Agreement.

2. Scope and Roles

The parties acknowledge that, with respect to Customer Personal Data, Customer is the Controller and SellerAxis is the Processor. SellerAxis will Process Customer Personal Data only on documented instructions from Customer, including as necessary to provide the Services and as described in the Agreement and this DPA.

3. Processor Obligations

SellerAxis will:

  • Process Customer Personal Data only for the purposes described in the Agreement;
  • Ensure that personnel authorized to Process Customer Personal Data are bound by confidentiality obligations;
  • Implement and maintain the technical and organizational measures set out in Annex II;
  • Assist Customer, taking into account the nature of Processing, in fulfilling its obligations to respond to Data Subject requests and to comply with Articles 32–36 of the GDPR;
  • Make available information necessary to demonstrate compliance with this DPA.

4. Sub-processors

Customer provides general authorization for SellerAxis to engage Sub-processors to Process Customer Personal Data, subject to the following: (a) SellerAxis will maintain a current list of Sub-processors and make it available to Customer on request; (b) SellerAxis will impose data protection terms on each Sub-processor no less protective than those in this DPA; (c) SellerAxis will provide reasonable prior notice of any new Sub-processor, and Customer may object on reasonable data protection grounds; and (d) SellerAxis remains liable for the acts and omissions of its Sub-processors.

5. Data Subject Rights

SellerAxis will, to the extent legally permitted, promptly notify Customer of any request received from a Data Subject concerning Customer Personal Data. SellerAxis will not respond to any such request except on documented instructions from Customer or as required by Applicable Data Protection Law.

6. Security

SellerAxis will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration, or disclosure, as further described in Annex II.

7. Personal Data Breach Notification

SellerAxis will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Such notice will include, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, likely consequences, and the measures taken or proposed to address the breach.

8. Audits

SellerAxis will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer. Audits will be conducted no more than once per year (except in the case of a Personal Data Breach), on at least 30 days’ written notice, during business hours, and subject to reasonable confidentiality obligations.

9. International Data Transfers

Where Customer Personal Data originating in the EEA, the United Kingdom, or Switzerland is transferred to a country not recognized as providing an adequate level of protection, the parties agree that such transfers are made pursuant to the European Commission’s Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, which are hereby incorporated by reference.

10. Return or Deletion of Data

Upon termination or expiration of the Agreement, SellerAxis will, at Customer’s choice, delete or return all Customer Personal Data, and delete existing copies unless retention is required by applicable law. Deletion timelines are set forth in SellerAxis’s retention policies.

11. Liability

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set forth in the Agreement.

12. Conflict

In the event of any conflict between this DPA and the Agreement, this DPA will prevail with respect to the Processing of Customer Personal Data.

Annex I – Details of Processing

  • Subject matter: Provision of the Services under the Agreement.
  • Duration: The term of the Agreement plus any retention period required by law.
  • Nature and purpose: Hosting, processing, and transmitting Customer Data to enable the features of the Services.
  • Categories of Data Subjects: Customer’s authorized users, employees, contractors, and end customers whose information is included in Customer Data.
  • Categories of Personal Data: Contact details (name, email, phone), account credentials, order and shipping information, and any additional data submitted by Customer to the Services.

Annex II – Technical and Organizational Security Measures

  • Encryption of Personal Data in transit using industry-standard TLS;
  • Encryption at rest for stored Personal Data;
  • Role-based access controls, least-privilege principles, and periodic access reviews;
  • Multi-factor authentication for administrative access;
  • Network segmentation, firewalls, and intrusion detection;
  • Centralized logging and monitoring of security-relevant events;
  • Secure software development lifecycle, including code review and dependency scanning;
  • Regular vulnerability assessments and penetration testing;
  • Business continuity and disaster recovery procedures, with regular backups;
  • Personnel training on security and data protection, with confidentiality obligations;
  • Incident response procedures including breach investigation and notification.

Contact

For questions regarding this DPA, contact support@selleraxis.com.