Data Processing Addendum (DPA)

1. Nature and Purpose

This Data Processing Addendum (“DPA”) supplements the Sallift Terms of Service and applies to the processing of customer personal data on behalf of merchants under data protection laws, including the GDPR and CCPA.

2. Roles and Responsibilities

• Merchant is the Data Controller: Determines the legal basis for processing shopper data and collecting consent for marketing communications.
• Sallift is the Data Processor: Processes personal data strictly in accordance with documented merchant instructions and configurations.

3. Technical & Organizational Security Measures

Sallift implements industry-standard safeguards including:

• Encryption at rest (AES-256-CBC) for all merchant platform tokens and API credentials.
• Strict multi-tenant row-level data segregation preventing cross-tenant leakage.
• Suppression list synchronization to ensure prompt honoring of unsubscribe requests.
• Role-based access control (RBAC) and comprehensive audit logging.

4. Sub-processors

Merchant authorizes Sallift to engage hosting, infrastructure, and messaging sub-processors (including AWS, Resend, Meta Platforms, and Stripe) subject to equivalent data protection obligations.