Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the By the Numbers Terms & Conditions (the "Terms") between Unsupervised LLC, a Delaware limited liability company operating By the Numbers ("BTN"), and the merchant that installs or uses the By the Numbers app ("Merchant"). It is incorporated into the Terms by reference, and Merchant accepts it by accepting the Terms or by installing or using the Service. No signature is needed. It applies whenever BTN processes Merchant Personal Data to provide the Service.

1. Definitions

Terms not defined here have the meaning given in the Terms or in Data Protection Laws.

• Data Protection Laws: all laws on personal data that apply to the processing under this DPA, including the EU GDPR (Regulation 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA ("CCPA").
• Merchant Personal Data: personal data that BTN processes on Merchant's behalf to provide the Service, including data received from Merchant's Shopify store, from the das Pixel storefront pixel, and from integrations Merchant connects.
• Service: the By the Numbers app and related services described in the Terms.
• Destination Platform: a third-party platform that Merchant connects and instructs BTN to send data to (for example Klaviyo, Mailchimp, Attentive, Google Ads, Meta, TikTok, Reddit or Microsoft Advertising).
• Sub-processor: a third party BTN engages to process Merchant Personal Data on BTN's behalf. Destination Platforms are not Sub-processors (see section 2.4).
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Merchant Personal Data.
• SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• "Controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "sell" and "share" have the meanings given in Data Protection Laws.

2. Scope and roles

2.1 Roles. For Merchant Personal Data, Merchant is the controller (or, where Merchant acts for another controller, a processor) and BTN is a processor and, under the CCPA, a service provider. BTN is an independent controller only for the data its privacy policy says it controls, such as Merchant's own account and billing contact details and website visitor data; this DPA does not cover that data.

2.2 Instructions. BTN will process Merchant Personal Data only on Merchant's documented instructions, unless the law requires otherwise, in which case BTN will tell Merchant first unless the law forbids it. Merchant's instructions are the Terms, this DPA, and Merchant's configuration of the Service (for example connecting an integration, enabling das Pixel, or creating and syncing a segment). BTN will tell Merchant if it believes an instruction breaks Data Protection Laws.

2.3 Details. The subject matter, nature, purpose, duration, categories of data and data subjects are set out in Annex I.

2.4 Destination Platforms. When Merchant connects a Destination Platform and instructs BTN to send it data (such as audience lists, segment membership, or conversion events), BTN does so as Merchant's processor. The Destination Platform receives that data under Merchant's own agreement with it, not as BTN's Sub-processor. Merchant is responsible for having a lawful basis, any required consent, and appropriate terms with each Destination Platform. Merchant can stop any such transfer at any time by disconnecting the integration or asking BTN to stop it.

2.5 Merchant obligations. Merchant will (a) give data subjects the notices and obtain the consents that Data Protection Laws require for the processing, including for storefront tracking and ad-platform sharing; (b) configure Shopify's customer privacy settings so that consent signals reach the Service; and (c) not instruct BTN to process special categories of personal data or data of children under 16.

3. BTN's obligations

3.1 Confidentiality. BTN will ensure that everyone it authorises to process Merchant Personal Data is bound by a duty of confidentiality.

3.2 Security. BTN will implement and maintain the technical and organisational measures in Annex II, appropriate to the risk. BTN may update those measures as long as the overall level of protection does not decrease.

3.3 Sub-processors. Merchant gives BTN general authorisation to engage Sub-processors. The current list is in Annex III and at https://www.bythenumbersapp.com/subprocessors. BTN will give Merchant at least 30 days' notice of any new Sub-processor by updating that list and emailing every Merchant that has subscribed to updates there. Merchant may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Merchant may terminate the affected Service and BTN will refund any prepaid fees for the unused period. BTN will impose data protection terms on each Sub-processor that are no less protective than this DPA and remains liable for its Sub-processors' performance.

3.4 Data subject requests. BTN will promptly forward to Merchant any request it receives from a data subject about Merchant Personal Data and will not respond except to direct the person to Merchant. Taking into account the nature of the processing, BTN will help Merchant respond to such requests, including by erasing a customer's data when Shopify sends a customer redaction request, normally within 3 to 10 days and in any event within 30 days.

3.5 Assistance. BTN will give Merchant reasonable help with data protection impact assessments, prior consultations with regulators, and Merchant's security obligations, to the extent Merchant cannot meet them using the Service.

3.6 Security Incidents. BTN will notify Merchant without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Merchant Personal Data. The notice will describe, as far as then known, what happened, the data and data subjects affected, likely consequences, and the steps taken or proposed. BTN will update Merchant as it learns more and take reasonable steps to contain and remedy the incident. Notifying Merchant is not an admission of fault.

3.7 Deletion and return. While the app is installed, Merchant can export its reports and segments through the Service. When Merchant uninstalls the app, BTN deletes Merchant's store data from its application database straight away and removes Merchant's data warehouse tables within 24 hours. When Shopify sends its shop redaction request, about 48 hours after uninstall, BTN deletes Merchant's remaining storefront event data. Copies in database backups age out within 7 days, and deleted warehouse data can remain in Google Cloud's recovery storage for up to 14 days before it is permanently erased. BTN keeps data longer only where the law requires it, in which case it keeps the data confidential and uses it only for that purpose.

3.8 Audits. BTN will make available the information reasonably necessary to show compliance with this DPA, including written answers to security questionnaires no more than once a year. If that is not enough to show compliance, or a regulator requires it, Merchant may carry out an audit, at its own cost, on at least 30 days' notice, during business hours, no more than once a year, by an independent auditor bound by confidentiality, and without access to other customers' data.

4. International transfers

4.1 Location. BTN processes and stores Merchant Personal Data in the United States, on Google Cloud in the us-central1 region. BTN may transfer it elsewhere only in line with this section.

4.2 EU transfers. To the extent Merchant Personal Data subject to the EU GDPR is transferred to BTN in a country without an adequacy decision, the parties incorporate the SCCs by reference, as follows:

• Module Two (controller to processor) applies where Merchant is a controller; Module Three (processor to processor) applies where Merchant is a processor.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorisation), with the notice period in section 3.3.
• Clause 11(a): the optional language does not apply.
• Clause 13: the competent supervisory authority is the one determined under Clause 13(a) for Merchant.
• Clause 17: Option 1, the law of Ireland.
• Clause 18(b): the courts of Ireland.
• Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

4.3 UK transfers. For personal data subject to the UK GDPR, the SCCs apply as amended by the UK International Data Transfer Addendum (version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018). Table 1 is completed with the parties' details in Annex I; Table 2 by section 4.2; Table 3 by this DPA's Annexes; and in Table 4, neither party may end the Addendum as set out in its Section 19.

4.4 Swiss transfers. For personal data subject to the Swiss FADP, the SCCs apply with these changes: the competent supervisory authority is the Federal Data Protection and Information Commissioner; references to the GDPR include the FADP; references to member states do not stop Swiss data subjects bringing claims in Switzerland; and the governing law and courts in Clauses 17 and 18 remain as set out in section 4.2.

4.5 Onward transfers. BTN will ensure that any transfer of Merchant Personal Data to a Sub-processor outside the EEA, UK or Switzerland is covered by an appropriate safeguard under Data Protection Laws.

4.6 Precedence. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

5. US state privacy laws (CCPA/CPRA)

5.1 Service provider. For personal information subject to the CCPA or similar US state laws, Merchant is the business and BTN is the service provider (or processor). Merchant discloses personal information to BTN only for the limited and specified business purposes in Annex I.

5.2 Restrictions. BTN will not:

• sell or share the personal information;
• retain, use or disclose it for any purpose other than the business purposes in Annex I, or outside the direct business relationship with Merchant, except as the CCPA permits;
• combine it with personal information BTN receives from or on behalf of others, or collects from its own interactions with consumers, except as the CCPA permits a service provider to do.

5.3 Compliance. BTN will comply with the CCPA's obligations that apply to service providers and give the personal information the same level of privacy protection the CCPA requires of Merchant. BTN will notify Merchant if it determines it can no longer meet those obligations.

5.4 Merchant's rights. Merchant may take reasonable and appropriate steps to ensure BTN uses the personal information consistently with Merchant's CCPA obligations (including through section 3.8) and, on notice, to stop and remedy any unauthorised use.

5.5 Consumer requests. BTN will help Merchant respond to verifiable consumer requests as described in section 3.4.

5.6 Ad-platform transfers. Where Merchant instructs BTN to send personal information to a Destination Platform for advertising (for example audience syncs or das Pixel conversion events), that disclosure is Merchant's own, made at Merchant's direction. Merchant is responsible for any "sale" or "sharing" notice and opt-out it requires. BTN will honour the opt-out and consent signals Shopify passes to the Service and will stop a Destination Platform transfer on Merchant's request.

5.7 Subcontractors. BTN's Sub-processors are bound by written terms consistent with this section.

6. General terms

6.1 Liability. Each party's liability under this DPA, including under the SCCs to the extent the law allows, is subject to the limitation of liability in the Terms (section 9 of the Terms: liability is limited to the fees Merchant paid BTN in the 12 months before the claim, with no liability for indirect or consequential damages). Nothing in this DPA limits a party's liability to data subjects under the SCCs or under Data Protection Laws where that cannot lawfully be limited.

6.2 Term. This DPA takes effect when Merchant installs or first uses the Service, or, for a Merchant already using the Service, when this DPA is incorporated into the Terms. It lasts as long as BTN processes Merchant Personal Data.

6.3 Order of precedence. If there is a conflict: the SCCs prevail over this DPA, and this DPA prevails over the Terms and any other agreement between the parties, on the processing of Merchant Personal Data. On every other matter, the Terms govern.

6.4 Changes. BTN may update this DPA to reflect changes in Data Protection Laws or in the Service, as long as the update does not materially reduce the protection given to Merchant Personal Data. BTN will give notice of material changes by email.

6.5 Governing law. Except where the SCCs require otherwise, this DPA is governed by the laws of the State of Delaware, and disputes are handled in the courts of Delaware, as set out in the Terms.

6.6 Notices. Notices to BTN go to privacy@bythenumbersapp.com. Notices to Merchant go to the email address on Merchant's account.

6.7 Acceptance and countersigned copies. By accepting this DPA, each party is treated as having signed the SCCs and the UK Addendum incorporated in section 4, and Annex I gives their party details. A Merchant that needs a countersigned copy for its records can request one from BTN at privacy@bythenumbersapp.com.

Annex I: Parties and processing details

A. Parties

B. Description of processing

Annex II: Technical and organisational measures

Annex III: Sub-processors

BTN uses the Sub-processors below to provide the Service. The current list is also published at https://www.bythenumbersapp.com/subprocessors.

Not Sub-processors: Shopify (Merchant's own platform); Destination Platforms Merchant connects (section 2.4); Vercel, which hosts only BTN's marketing website and does not process Merchant Personal Data; and MaxMind, whose GeoIP2 database BTN runs locally, so no data is sent to MaxMind.