Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") is between the brand that holds an Afflo account ("Brand", the controller) and [TO FILL] Legal company name, [TO FILL] Registered address, Slovakia, company ID [TO FILL] IČO ("Afflo", the processor). It applies to personal data that Afflo processes on the Brand's behalf when providing the Service ("Brand Personal Data"). It does not cover data for which Afflo is itself a controller, such as account holders' login data or the creator directory, which are described in the Privacy Policy. If this DPA conflicts with the Terms, this DPA prevails for the processing of Brand Personal Data.

2. Details of processing (Annex I)

• Subject matter and purpose: tracking affiliate referrals, attributing orders and leads to affiliates, calculating commissions, detecting fraud, managing affiliates and supporting payouts.
• Nature: collection through the tracking snippet, webhooks and integrations; storage; matching; hashing; display in the Brand's dashboard; deletion.
• Duration: for the term of the Brand's account, plus the deletion period in section 10.
• Data subjects: visitors and customers of the Brand's store; the Brand's affiliates and invited prospective affiliates; the Brand's team members.
• Categories of data: visitor and click IDs, landing and referring URLs, browser user agent, approximate country, salted hashes of IP addresses and e-mail addresses, order IDs, amounts, currencies, discount codes and refund status, and other order fields the Brand's systems send; for affiliates: name, e-mail, social handle, referral code, performance and payout details.
• Special categories of data: none intended. The Brand must not send health data or other special-category data to the Service.

3. Instructions

Afflo processes Brand Personal Data only on the Brand's documented instructions. The Terms, this DPA and the Brand's settings and use of the Service are those instructions. Afflo will not use Brand Personal Data for its own purposes, sell it, or combine it with other brands' data except to run the Service (for example aggregated fraud signals and service statistics that do not identify anyone). If Afflo believes an instruction breaks data-protection law, it will tell the Brand. If EU or member-state law requires other processing, Afflo will inform the Brand first unless the law forbids it.

4. Confidentiality

Afflo ensures that everyone authorised to process Brand Personal Data is bound by confidentiality and only accesses it as needed to provide or support the Service.

5. Security measures (Annex II)

Afflo implements appropriate technical and organisational measures under Article 32 GDPR, including:

• encryption in transit (HTTPS/TLS) for all traffic to the Service;
• salted hashing of shoppers' e-mail and IP addresses, and hashing of passwords and API keys;
• logical separation of each Brand's workspace and role-based access within it;
• HTTP-only, expiring session cookies;
• restricted, need-to-know access to production systems;
• infrastructure from established cloud providers, with their physical and network security controls;
• regular review of these measures as the Service develops.

6. Sub-processors

The Brand gives general authorisation for Afflo to use sub-processors. The current list is:

• Vercel Inc.: application hosting and content delivery (EU and US).
• Neon: managed Postgres database.
• Resend: transactional e-mail delivery.

Services the Brand connects itself (such as Shopify, WooCommerce, Stripe or PayPal) are chosen by the Brand and are not Afflo's sub-processors. Afflo will give at least 30 days' notice (by e-mail or in the app) before adding or replacing a sub-processor. The Brand may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Brand may close its account. Afflo imposes data-protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.

7. International transfers

Where Brand Personal Data is transferred outside the European Economic Area, Afflo ensures a valid transfer mechanism under Chapter V GDPR, such as an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

8. Assistance and data-subject requests

• Taking into account the nature of the processing, Afflo helps the Brand respond to requests from data subjects exercising their GDPR rights. If Afflo receives such a request directly, it will forward it to the Brand without undue delay and not respond itself except to redirect the requester.
• Afflo provides reasonable help with the Brand's security obligations, data-protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to the Service.

9. Personal data breaches

Afflo will notify the Brand without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Brand Personal Data. The notice will include the information then available that the Brand needs to meet its own notification duties under Articles 33 and 34 GDPR. Afflo will take reasonable steps to contain the breach and keep the Brand updated.

10. Deletion and return

While its account is open, the Brand can ask Afflo for a copy of Brand Personal Data in a common machine-readable format. Within 90 days after the account is closed, Afflo deletes Brand Personal Data, including from backups as they expire, unless EU or member-state law requires it to keep some of it. Records Afflo must keep for its own legal obligations (such as invoices) are not Brand Personal Data.

11. Information and audits

Afflo makes available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, primarily through written answers to the Brand's questions and documentation of its measures. Where that is not enough, the Brand may conduct an audit, or have an independent auditor bound by confidentiality do so, with at least 30 days' written notice, no more than once a year (unless required by a supervisory authority or after a breach), during business hours and at the Brand's cost.

12. Brand's obligations

• The Brand is responsible for having a lawful basis for the processing, for informing its customers and visitors, and for getting consent where required, including for the tracking snippet (see the Cookie Policy for brands).
• The Brand configures the Service (for example which forms the snippet runs on and what data its integrations send) and must not send data that is not needed for affiliate tracking.
• The Brand keeps its account credentials and API keys secure.

13. General

This DPA lasts as long as Afflo processes Brand Personal Data. The liability limits in the Terms apply to this DPA to the extent the GDPR allows. This DPA is governed by the same law as the Terms. Contact for data-protection matters:

• Company: [TO FILL] Legal company name
• Registered office: [TO FILL] Registered address, Slovakia
• Company ID (IČO): [TO FILL] IČO, [TO FILL] Commercial register entry
• VAT ID: [TO FILL] VAT ID (IČ DPH)
• Contact: [TO FILL] contact e-mail
• Data protection contact: [TO FILL] privacy e-mail