Data Processing Addendum

This addendum forms part of the Shopppio Terms. For your shoppers' personal data you are the Data Fiduciary and Shopppio is your Data Processor under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (where other laws apply, you are the controller and Shopppio the processor). It covers all personal data Shopppio processes to run your store.

"Personal data", "processing", "Data Fiduciary", "Data Processor", "Data Principal", "personal data breach" and "Board" have the meanings given in the DPDP Act, 2023 and the DPDP Rules, 2025. "Shoppers" means the Data Principals whose data your store holds: customers, visitors, people who message your store and people you import.

Subject matter: running your storefront, checkout, orders, customer records, messaging (email, SMS, WhatsApp, Instagram) and the tools you turn on. Data: names and account ids, email addresses and phone numbers, delivery addresses, orders and payment status (never full card numbers), messages, consent records, IP address and device details, and ad-click ids. Duration: while you use Shopppio, then the deletion period in section 10.

Shopppio processes your shoppers' data only on your documented instructions. Your settings and actions in Shopppio (the channels and features you turn on, the messages you send, the requests you answer) are those instructions. We tell you if we believe an instruction breaks the law. We do not use your shoppers' data for our own purposes, combine it with other stores' data, or sell it.

Everyone at Shopppio who can reach your shoppers' data is bound by confidentiality, gets access only for their role, and only for as long as they need it.

Reasonable security safeguards as Rule 6 requires: encryption in transit (TLS) and at rest; payment and messaging credentials encrypted with keys held in Google Cloud KMS; role-based access with per-module levels for your team and for Shopppio staff; logs of access and processing kept for at least one year; monitoring and alerts on our queues and services; backups; and contracts with every sub-processor that require the same.

You authorise the sub-processors below. Each is bound by written terms at least as protective as this addendum. We give you 30 days' notice before adding or replacing one, and you may object; if we can't resolve an objection you may stop using the affected feature or close your store. Your store's own privacy notice lists only the sub-processors your store actually uses.

Shopppio gives you the tools to meet your duties to shoppers: a privacy notice you publish in your shoppers' languages, a consent record for every opt-in and withdrawal, a preference centre and one-click unsubscribe, and a request portal for access, correction, erasure, nomination and grievances, with the 90-day deadline tracked. Where a request needs more than the tools, we help you in time for you to answer within 90 days.

If we become aware of a personal data breach affecting your shoppers' data we will tell you without delay and in any case within 24 hours, with what we know of its nature, extent, timing, location and likely impact, and what we have done. We keep you updated, give you a draft of the details the Board needs so you can report within 72 hours, and give you the tools to tell affected shoppers.

We keep your shoppers' data while you keep it, under the retention settings you choose (inactive shoppers and abandoned carts can be erased automatically, with the 48-hour notice the Rules require). When you erase a shopper, their data is deleted, except order records you must keep by law, which keep no contact details. When you delete your store, it goes offline at once and everything under it is deleted after 30 days (you can cancel in that time). Processing logs are kept for at least one year, as Rule 8(3) requires.

Your store's data is stored with Google Cloud in the United States (us-central1), and some sub-processors are outside India as listed. The DPDP Act allows this except to countries the Government restricts; if a country we use is restricted, we will move the processing or tell you what changes.

We give you the information you reasonably need to show you meet the DPDP Act, including for a data protection impact assessment if you are notified as a Significant Data Fiduciary. Once a year, on 30 days' notice, you or an auditor bound by confidentiality may audit our compliance with this addendum.