Data Processing Agreement (DPA)

1. Scope

This Data Processing Agreement ("DPA") forms part of the agreement between you and Recommendor and applies to any personal data Recommendor processes on your behalf as a processor, including your shoppers' and customers' data synced from your store or collected on your storefront (order and customer records, session recordings, and shopping assistant conversations).

2. Roles

For personal data processed through Recommendor, you (the store) are the data controller and Recommendor is the data processor, processing personal data only on your documented instructions as set out in this DPA and our Terms of Service, except where required to do otherwise by law.

3. Nature and purpose of processing

Recommendor processes catalog, order, customer, session recording, and conversation data solely to provide the features you enable: product recommendations, on-site search, the AI shopping assistant, abandoned cart and product alert emails, retention and win-back scoring, demand forecasting, and analytics. Processing is read-only with respect to your store's catalog and records — Recommendor does not write back to your store.

4. Sub-processors

You authorize Recommendor to engage the sub-processors listed in our Privacy Policy (currently an LLM provider for the shopping assistant, an email provider for outbound messages, and our infrastructure providers), each bound by data protection terms consistent with this DPA. We'll give notice of any new sub-processor so you can object on reasonable grounds before it takes effect.

5. Security measures

• Per-store data isolation, so no store's data is accessible from another store's account.
• Encryption of data in transit, and at rest where supported by our infrastructure providers.
• Session recording masking that always hides password and payment fields and excludes staff sessions and Do-Not-Track visitors.
• Access controls limiting staff and sub-processor access to what's needed to operate the service.

6. Data subject requests and assistance

Recommendor will assist you, to the extent required by applicable law, in responding to requests from your shoppers or customers to access, correct, export, or delete their personal data, and in meeting your obligations relating to data protection impact assessments and breach notification.

7. International transfers

Where personal data is transferred outside the region in which it was collected, Recommendor relies on appropriate safeguards, such as [transfer mechanism, e.g. Standard Contractual Clauses], as required by applicable data protection law.

8. Deletion and return of data

On termination of your account, Recommendor will delete or return personal data processed on your behalf in accordance with the retention and deletion schedule described in our Privacy Policy, except where retention is required by applicable law.

9. Full agreement and signature

This page summarizes the key terms of our DPA in plain language. The full Data Processing Agreement, including definitions, liability terms, and signature blocks, is available as a downloadable PDF on request. Request a copy and we'll send it, or arrange a countersigned version, by email.