Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into between you, the merchant ("Merchant", "you"), and iSend LLC, a Wyoming limited liability company doing business as Caesar, of 30 N Gould St, Ste R, Sheridan, WY 82801, USA ("Caesar", "we", "us"). It forms part of the Agreement, as defined in the Terms of Service. It takes effect when you accept the Terms or connect your store, whichever occurs first, and it remains in effect for as long as we process Merchant Personal Data. No signature is required. A countersigned copy may be requested by email to [email protected].

If this DPA conflicts with the Terms on a matter of personal data, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

1. Definitions

• "Data Protection Laws" means all laws that apply to the processing of Merchant Personal Data under the Agreement. These include:
  • the EU General Data Protection Regulation 2016/679 ("GDPR");
  • the UK GDPR and Data Protection Act 2018;
  • the Swiss Federal Act on Data Protection;
  • the California Consumer Privacy Act as amended by the CPRA ("CCPA");
  • other US state consumer privacy laws ("US State Privacy Laws");
  • Canada's PIPEDA.
• "Merchant Personal Data" means personal data in Merchant Data that we process on your behalf in providing the Services, as described in Annex 1.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Merchant Personal Data.
• "Subprocessor" means a third party we engage to process Merchant Personal Data.
• "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• "controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "sell" and "share" have the meanings given in the applicable Data Protection Laws.

Other capitalized terms, including Message-Delivery Logs, have the meanings given in the Terms.

2. Roles and scope

2.1 Merchant Personal Data. With respect to Merchant Personal Data, you are the controller (or "business"), and Caesar is your processor (or "service provider"). Where you act as a processor for another controller, Caesar is your subprocessor.

2.2 Caesar's own records. This DPA does not cover data that we process as an independent controller for our own purposes. Our Privacy Policy governs that data, which covers:

• account, billing and verification data;
• security, fraud and abuse prevention, including the platform-wide do-not-contact list;
• compliance records: acceptance records, opt-out and do-not-contact records, Message-Delivery Logs, and the record of consent status we received for each contact;
• records relating to a specific abuse report, legal claim or regulatory inquiry, which may include the Messages involved, retained only for as long as that matter requires.

Except for the last item, these records do not include Message content. We will not use this Section to process Message content or Recipient data for our own marketing or for the benefit of any other merchant.

2.3 Determination of roles. Roles are determined by how data is actually processed. Our choice of technical means does not by itself make us a controller.

3. Your responsibilities as controller

You confirm, and will ensure throughout the term of the Agreement, that:

• (a) you have a lawful basis for collecting Merchant Personal Data, sharing it with us and having us process it. This includes any consent that the law requires before a Message is sent, as described in the Messaging Policy;
• (b) you have provided every notice that Data Protection Laws and Messaging Laws require. This includes a privacy notice that covers your messaging and your use of service providers such as Caesar;
• (c) your instructions comply with Data Protection Laws;
• (d) Merchant Personal Data is accurate and lawfully obtained, and you will not submit sensitive or special-category data (Section 10.3 of the Terms);
• (e) you will respond to requests from data subjects, with our assistance as described in Section 8.

You will indemnify the Caesar Parties for claims, fines and losses arising from your breach of this Section. That indemnity forms part of Section 21 of the Terms and is not subject to the liability cap.

4. Our obligations as processor

4.1 Instructions. We process Merchant Personal Data only on your documented instructions, including instructions regarding international transfers, unless the law requires otherwise. Where the law requires otherwise, we will notify you before processing, unless the law prohibits such notice. Your instructions consist of:

• the Agreement;
• your configuration and use of the Services, including activating the Agent and Campaigns, and your Agent Settings;
• written instructions that you give us and that we agree to follow.

Processing beyond these instructions may be subject to additional fees.

4.2 Unlawful instructions. If we believe that an instruction violates Data Protection Laws, we will notify you, and we may suspend the affected processing until you withdraw or modify the instruction. We are not obligated to provide legal advice.

4.3 Confidentiality. Every person we authorize to process Merchant Personal Data is bound by confidentiality obligations and has access only as needed.

4.4 Purpose limitations. We do not:

• (a) sell or share Merchant Personal Data, as those terms are defined in the CCPA and US State Privacy Laws;
• (b) use Merchant Personal Data for targeted advertising or cross-context behavioral advertising;
• (c) combine Merchant Personal Data with personal data we receive from other merchants or from our own interactions with individuals, except as Data Protection Laws permit service providers to do. This exception covers the following purposes:
  • to detect, prevent or investigate security incidents, fraud or illegal activity, including by suppressing numbers that reported unwanted or unlawful messages or asked Caesar not to contact them;
  • to apply opt-outs on shared lines as carrier rules require;
  • to comply with the law;
• (d) use Message content, or identifiable Merchant Personal Data, to train AI models shared with other customers, or permit our Subprocessors to use it to train their own models, unless you opt in to a program that expressly provides for such use. The use of data to generate responses in real time, for retrieval, or for your own configuration in providing the Services does not constitute training;
• (e) retain, use or disclose Merchant Personal Data outside our direct business relationship with you, or for any purpose other than the business purposes set out in Annex 1, except as Data Protection Laws allow.

4.5 De-identified data. We may create de-identified or aggregated data from Merchant Personal Data, such as reply rates or common questions. We will take reasonable measures to ensure that such data cannot be linked to any person, publicly commit not to re-identify it, and require any recipient of it to do the same.

5. Security

We implement and maintain the technical and organizational measures set out in Annex 2. They are designed to protect Merchant Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing. We may update these measures, provided that the overall level of protection is not materially reduced. You are responsible for your own security choices, including your account security and the data you connect.

6. Subprocessors

6.1 General authorization. You authorize us to engage Subprocessors. Our current Subprocessors are listed on our Subprocessor List, which forms Annex 3.

6.2 Notice of changes. We provide at least 15 days' notice before adding or replacing any Subprocessor. We do so by updating the Subprocessor List and by email to your account administrators and to anyone who has subscribed to updates. In an emergency, for security or continuity reasons, we may provide shorter notice, and we will notify you as soon as possible.

6.3 Objections. You may object on reasonable data-protection grounds by email to [email protected] within the notice period. We will work with you in good faith to resolve the objection. If we cannot resolve it within a reasonable time, you may terminate the affected part of the Services, and we will refund any prepaid fees for that part. This is your sole remedy. If you do not object within the notice period, you are deemed to have accepted the change.

6.4 Flow-down and responsibility. We impose data-protection obligations on each Subprocessor that are at least as protective as those in this DPA, to the extent they apply to its service. We remain responsible to you for our Subprocessors' performance of those obligations, as Data Protection Laws require.

7. International transfers

7.1 Processing locations. Caesar is based in the United States. We and our Subprocessors process Merchant Personal Data in the United States and in the other locations shown on the Subprocessor List.

7.2 EEA transfers. Where Merchant Personal Data from the European Economic Area is transferred to Caesar, the SCCs are incorporated into this DPA as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor;
• in Clause 7, the docking clause applies;
• in Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in Section 6.2;
• in Clause 11, the optional language does not apply;
• in Clause 13, the supervisory authority is the authority with competence over you under Article 3 and Article 27 of the GDPR;
• in Clauses 17 and 18, the SCCs are governed by the laws of Estonia, and disputes are resolved by the courts of Estonia;
• Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and Annex III by the Subprocessor List.

7.3 UK transfers. For transfers from the United Kingdom, the UK Addendum applies:

• the information required by its Tables 1 to 3 is set out in this DPA and its Annexes;
• for Table 4, either party may terminate the UK Addendum as the UK Addendum permits.

7.4 Swiss transfers. For transfers from Switzerland, the SCCs apply with the following modifications:

• references to the GDPR are to be read as references to the Swiss Federal Act on Data Protection;
• the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner;
• "Member State" includes Switzerland, so that data subjects there can exercise their rights.

7.5 Requests from public authorities. If a public authority requests Merchant Personal Data from us, we will:

• (a) redirect the authority to you where possible;
• (b) notify you of the request promptly, unless the law prohibits such notice;
• (c) challenge requests that we reasonably consider unlawful;
• (d) disclose only the minimum that the law requires.

8. Data subject requests

We will assist you in responding to requests from data subjects and consumers, taking into account the nature of the processing. We do so through features of the Services, such as exporting or deleting a contact's data and suppressing a contact. Where those features are insufficient, we will provide reasonable assistance on request. If we receive a request directly that relates to Merchant Personal Data, we will forward it to you and will not respond to it ourselves, except to inform the requester that we have done so, unless you instruct otherwise or the law requires otherwise. Assistance beyond what is reasonably included in the Services may be charged at our standard rates.

9. Security Incidents

9.1 Notice. We will notify you of a Security Incident affecting Merchant Personal Data without undue delay after we become aware of it and, where reasonably practicable, within 48 hours. Our notice will describe the information known to us at that time:

• the nature of the incident;
• the categories and approximate number of individuals and records affected;
• the likely consequences;
• the measures taken or proposed.

We will provide additional information as it becomes available.

9.2 Response. We will take reasonable steps to contain, investigate and mitigate the incident, and will provide reasonable assistance with your own notification obligations. You are responsible for deciding whether to notify authorities and affected individuals, and for making any such notification. You must not name Caesar in a notification without first consulting us, unless the law requires it.

9.3 No admission. Notifying you of a Security Incident does not constitute an admission of fault or liability.

10. Assistance with assessments

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with the data protection impact assessments and prior consultations with supervisory authorities that Data Protection Laws require of you. Assistance beyond providing our standard documentation may be charged at our standard rates.

11. Return and deletion

11.1 Export. During the term of the Agreement and for 30 days after it ends, you may export Merchant Personal Data through the Dashboard or by request to us. This Section does not apply to data that a Store Platform requires us to delete sooner, such as Shopify store data shortly after you uninstall the Caesar app.

11.2 Deletion during the term. While the Agreement is in effect, we delete the Merchant Personal Data relating to an individual 2 years after that individual's last activity that we process, such as a Message, an order or a store visit, unless you instruct us to delete it sooner. It is then removed from backups as they are overwritten in the normal backup cycle, within 30 days after that.

11.3 Deletion at the end of the Agreement. Within 90 days after the Agreement ends, or sooner where a Store Platform requires it, we delete Merchant Personal Data from our active systems. It is then removed from backups as they are overwritten in the normal backup cycle, within 30 days after that. Until then, backups remain protected and are not used for any other purpose.

11.4 Caesar's own records. Sections 11.2 and 11.3 do not apply to the records described in Section 2.2, which we retain as an independent controller under our Privacy Policy.

12. Audits and information

12.1 Information. We will make available the information reasonably necessary to demonstrate our compliance with this DPA. We will ordinarily do so through our documentation, responses to a reasonable security questionnaire once per year, and any third-party audit reports or certifications we hold.

12.2 Audits. If that information is insufficient to satisfy a legal requirement, you may audit our compliance, subject to the following conditions:

• no more than once in any 12-month period, unless a supervisory authority requires it or following a Security Incident affecting your data;
• at least 30 days' prior written notice;
• during normal business hours;
• conducted by you or by an independent auditor bound by confidentiality obligations;
• without access to other customers' data, and without disruption to our operations;
• at your expense, unless the audit reveals a material breach by us.

13. US State Privacy Laws

13.1 Service provider terms. To the extent the CCPA or another US State Privacy Law applies, we act as your service provider or processor, and:

• (a) we process Merchant Personal Data only for the limited and specified business purposes set out in Annex 1;
• (b) we comply with the obligations that apply to service providers and processors, and we provide the level of privacy protection those laws require;
• (c) we do not sell or share Merchant Personal Data. We do not retain, use or disclose it outside our direct business relationship with you, or for any purpose other than those set out in Annex 1, except as those laws allow;
• (d) we do not combine it with other personal data, except as Section 4.4(c) allows;
• (e) we will notify you if we determine that we can no longer meet our obligations under those laws;
• (f) you may take reasonable and appropriate steps to ensure that we use Merchant Personal Data consistently with your obligations, and to stop and remediate unauthorized use, including through the rights in Section 12;
• (g) we bind each Subprocessor to written terms that meet these requirements, and we provide you with notice and an opportunity to object as described in Section 6;
• (h) we will assist you in responding to consumer requests (Section 8), and we will delete or return data at the end of the Agreement (Section 11).

We certify that we understand these restrictions and will comply with them.

13.2 Your duties. You are responsible for providing consumers with any notice at collection, and for offering any opt-outs, that these laws require of you as the business.

14. Shopify and other Store Platforms

Where Merchant Personal Data originates from Shopify, we handle it in accordance with Shopify's API terms and its requirements for protected customer data. In particular, we:

• use it only to provide the Services you have enabled;
• respect the marketing-consent status that Shopify records for each customer;
• respond to Shopify's customer data request and redaction webhooks;
• delete store data after you uninstall, as Shopify requires.

15. Liability

Caesar's liability arising out of or relating to this DPA is subject to Section 20 of the Terms. Liability under this DPA and the Terms is subject to one combined aggregate cap, and this DPA does not increase it. Nothing in Section 20 of the Terms limits your liability under this DPA. Nothing in this DPA or the Terms limits:

• liability that cannot be limited under Data Protection Laws;
• the rights of data subjects under the SCCs.

16. General

This DPA is governed by the law that governs the Terms, except as Section 7 requires otherwise. We may update this DPA to reflect changes in the law or in our Services, with notice as described in Section 23 of the Terms. Updates will not materially reduce the protection given to Merchant Personal Data, unless the law requires it. Questions about this DPA should be sent to [email protected].

Annex 1: Details of processing

Parties.

• Data exporter: the Merchant identified in the account, acting as controller (or as processor for its own controller).
• Data importer: iSend LLC (Caesar), acting as processor (or subprocessor). Contact: [email protected].

Subject matter. Provision of the Services: an AI sales agent that messages the Merchant's shoppers and prospects to recover checkouts and sell products. The Services include conversation management, human handoff and reporting.

Duration. For the term of the Agreement, plus the export and deletion periods set out in Section 11.

Frequency. Continuous.

Nature and purpose of processing (the business purposes).

• Receiving and storing store data from the Merchant's Store Platform and connected tools.
• Determining when a Campaign's conditions are met, as configured by the Merchant.
• Generating messages and replies with third-party AI models.
• Sending and receiving messages over iMessage, SMS/MMS, RCS or email.
• Applying consent, opt-out, quiet-hours and frequency controls.
• Human handoff and replies by our team at the Merchant's request.
• Creating discount codes and draft orders where the Merchant enables them.
• Analytics and reporting of results to the Merchant, and billing.
• Support, security, and fraud and abuse prevention.

Categories of data subjects.

• The Merchant's customers, shoppers and prospects, including individuals who abandoned a checkout or cart.
• Other individuals who message the Merchant through the Services.
• The Merchant's staff whose details appear in Merchant Data.

Categories of personal data.

• Identifiers and contact details: name, phone number, email address, store customer ID.
• Location: shipping or billing address, or the city, state and postcode used to determine time zone and answer delivery questions.
• Commerce data: checkouts, carts and their contents and value, orders and order history, discount codes used, and subscription status where connected.
• Store activity data: pages, products and collections viewed, searches, items added to or removed from the cart, and checkout steps, where the Merchant installs our store tracking.
• Message data:
  • the content of messages and attachments;
  • timestamps, delivery status and channel;
  • whether each message was written by AI or by a person.
• Consent and preference data: marketing-consent status, source and timestamp, opt-outs, and do-not-contact status.
• Derived conversation data: intent and quality scores, topics and objections raised, and typical reply times with this Merchant.

Sensitive data. None intended. The Merchant must not submit sensitive or special-category data (Section 10.3 of the Terms).

Retention. As described in Section 11.

Annex 2: Technical and organizational measures

1. Access control. Least-privilege and role-based access for our staff, limited to the merchants they support. Unique accounts. Multi-factor authentication for access to production systems and administrative tools. Prompt removal of access when roles change.
2. Encryption. Data is encrypted in transit (TLS) and at rest, including backups. Secrets and Store Platform access tokens are stored in protected, encrypted form.
3. Segregation. Each Merchant's data is kept logically separate. Production and test environments are separate, and we avoid using real shopper data for testing.
4. Logging and monitoring. Administrative actions and access to production systems are logged. Consequential actions are recorded in an audit log, and abnormal activity triggers monitoring and alerts.
5. Secure development. Production changes are subject to code review, dependency management and change control. Changes to AI prompts and playbooks are reviewed.
6. Availability and resilience. We perform regular backups and maintain restore procedures. A kill switch pauses sending globally, by brand, by Channel or by Campaign.
7. Messaging safeguards. Automated opt-out handling, consent-status checks before sending, quiet-hours and frequency controls, SMS only from registered numbers, content guardrails and AI notices.
8. Incident response. A documented incident response process, including evidence preservation and notice to affected merchants under Section 9.
9. Vendor management. Risk-based review of Subprocessors, and written data-protection terms with each Subprocessor.
10. Personnel. Confidentiality obligations for all personnel, and data-protection and security training for personnel with access to Merchant Personal Data.
11. Data minimization. Context sent to AI providers is limited to what is needed to write a reply, and excludes phone numbers, email addresses and payment details unless a shopper writes them in the conversation.
12. Review. These measures are reviewed and improved periodically.

Annex 3: Subprocessors

See the current Subprocessor List.