Llama Upsells Data Processing Addendum

This Data Processing Addendum (DPA) is part of the Terms of Service (the Terms). It is an agreement between us, Llama Commerce LLC, and you, the merchant that installs Llama Upsells.

It covers shopper data that we process for you when we provide the app. Shopper data is personal data about your customers.

For shopper data, you are the controller and we are your processor. Under US state privacy laws, we are your processor or service provider.

The Privacy Policy lists the shopper data that the app processes and why. We process it while the app is installed, and until we delete it as this DPA says.

This DPA does not cover merchant account data, such as staff names and emails. We are the controller of that data.

We process shopper data only on your documented instructions. Your instructions are the Terms, this DPA, and your configuration of the app.

We may also process shopper data where the law requires us to. Where the law allows, we tell you first.

Everyone we allow to process shopper data has a duty to keep it confidential.

We use reasonable technical and organizational measures to protect shopper data.

You give us general authorization to use subprocessors. The Privacy Policy lists their categories, under Sharing Your Personal Information.

We give notice of a change by updating that list.

You may object to a change by uninstalling the app. Uninstalling is your only remedy for an objection.

Where the law requires, we help you:

• Respond to shopper requests about data we hold
• Carry out data protection impact assessments

We notify you without undue delay after we learn of a security incident that affects shopper data under this DPA.

When you uninstall the app, we delete or change some records at once. The Data Retention section of the Privacy Policy lists them.

Other records stay after uninstall. On your request, we delete the shopper data we hold for you, as required by applicable law.

Copies held by our subprocessors stay under each subprocessor's own retention rules. You may ask us to delete them.

Once a year, on your written request, we give you written information that shows how we meet this DPA.

You must keep that information confidential. It is the only audit that this DPA allows.

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, we are your service provider. We do not:

• Sell or share shopper personal information
• Keep, use, or disclose it for any purpose other than the business purpose of providing the app to you
• Keep, use, or disclose it outside the direct business relationship between you and us
• Combine it with personal information that we receive from others or collect ourselves, except as that law allows

We certify that we understand these restrictions and will comply with them.

All liability under this DPA is subject to the Limitation of liability section of the Terms. It counts toward the same cap.

If this DPA conflicts with the Terms about shopper data, this DPA controls. If the Privacy Policy conflicts with the Terms or this DPA, the Terms and this DPA control.

We change this DPA the same way we change the Terms.

Questions about this DPA? Write to support@llamacommerce.io.

Our mailing address is Llama Commerce LLC, 148 Lafayette St, 3rd Floor, New York, NY 10013, United States.