Data Processing Addendum

1. Parties & scope

This Data Processing Addendum ("DPA") is entered into between KAK Digital LLC ("KAK", "we", "Processor") and the customer (the Shopify merchant, "Customer", "Controller") that has accepted the KAK Edge Terms of Service. This DPA forms part of those Terms and governs the processing of Personal Data by KAK on Customer's behalf.

To the extent any Personal Data is subject to the GDPR, the UK GDPR, CCPA/CPRA, DPDPA 2023, or other applicable data protection laws, this DPA reflects the parties' agreement on those terms.

2. Roles

• Customer is the Controller of the Personal Data it directs KAK to process.
• KAK is the Processor acting on documented instructions from Customer.
• For California: Customer is the "Business", KAK is the "Service Provider".
• For Indian DPDPA: Customer is the "Data Fiduciary", KAK is the "Data Processor".

3. Scope of processing

KAK processes the following categories of Personal Data on Customer's behalf:

• Shopper identifiers: SHA-256 hashed email addresses and phone numbers (for Meta CAPI transmission)
• Shopper behavioural events: page views, add-to-cart, checkout events (storefront tracker data)
• Shopper order & customer mirrors: name, email, phone, order history (mirrored from Shopify Admin API under Customer's authorisation)
• Merchant account data: the Customer's own name, email, Shopify shop domain, billing information

KAK processes this data solely to:

• Operate Customer's KAK Edge dashboard and analytics
• Hash and forward conversion events to Meta via Conversions API on Customer's behalf
• Maintain service availability, security, fraud prevention, and billing
• Respond to Customer instructions and data-subject requests

4. Customer's instructions

KAK will process Personal Data only per Customer's documented instructions, including via product configuration, API calls, and written communications. The Terms of Service, product documentation, and this DPA constitute Customer's standing instructions.

5. Confidentiality

KAK ensures that personnel authorised to process Personal Data are under a confidentiality obligation.

6. Security

KAK implements appropriate technical and organisational measures to protect Personal Data. These are documented at /trust.html and summarised in Annex A below.

7. Sub-processors

Customer authorises KAK to engage the sub-processors listed at /subprocessors.html for the purposes of providing the Service. KAK will:

• Impose on each sub-processor data-protection terms no less protective than this DPA
• Remain liable for each sub-processor's compliance
• Notify Customer by email at least 30 days in advance of adding a new sub-processor, giving Customer an opportunity to object on reasonable grounds

8. Data-subject rights

KAK will assist Customer in responding to data-subject requests. Specifically:

• Customer can export all processed data from their dashboard (GDPR Art. 20 portability)
• Shopify GDPR webhooks (customers/data_request, customers/redact, shop/redact) are handled automatically by KAK within 30 days
• Customer can trigger full-account deletion from the dashboard; see Section 11

9. Breach notification

KAK will notify Customer without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach affecting Customer's data. The notification will include at minimum: nature of the breach, categories and approximate number of records concerned, likely consequences, and measures taken or proposed.

10. International transfers

For transfers of Personal Data from the European Economic Area, United Kingdom, or Switzerland to countries without an adequacy decision, the parties rely on the Standard Contractual Clauses (Module 2, Controller-to-Processor) of Commission Implementing Decision (EU) 2021/914, incorporated by reference. UK transfers rely on the UK International Data Transfer Addendum.

11. Return or deletion of data

On termination of the KAK Edge subscription, KAK will:

• Retain Personal Data in read-write mode for 14 days so Customer can reactivate or export
• Switch to read-only mode for the next 15 days so Customer can still export data
• Permanently delete all Personal Data within 30 days of termination, excluding rolling backups which roll off within an additional 30 days (total maximum 60 days)
• Issue a SHA-256 deletion certificate to Customer by email on completion

Customer may also request earlier deletion by emailing hello@kakedge.com.

12. Audits

Customer may audit KAK's compliance with this DPA once per 12-month period, at Customer's expense and on reasonable written notice. KAK will make available the documentation necessary to demonstrate compliance, including this DPA, the Trust page, and any third-party attestation reports inherited from our sub-processors.

13. Liability

Each party's liability under this DPA is subject to the liability caps and exclusions set out in the Terms of Service.

14. Governing law

This DPA is governed by the law and jurisdiction selected in the Terms of Service, except where mandatorily required otherwise by applicable data-protection law.

15. How to execute

By using KAK Edge you are deemed to have accepted this DPA. If you need a signed copy for your vendor-assurance files, email hello@kakedge.com with your company name and we will return a countersigned PDF within 5 business days at no cost.

Annex A — Technical & organisational measures

A full list is maintained at /trust.html. Highlights:

• TLS 1.3 in transit; AES-256 at rest (inherited)
• Per-tenant isolated databases (one Supabase project per merchant)
• AES-256-GCM encryption of third-party OAuth tokens
• SHA-256 hashing of PII before external transmission
• PBKDF2-SHA512 (210k iterations) password storage
• HMAC signature verification on all inbound webhooks
• Audit logging of all sensitive admin actions
• Background, encrypted, 30-day point-in-time backups
• Sub-processors with SOC 2 Type II or equivalent independent audits