Data Processing Addendum

This Addendum forms part of the AmoraOS Terms of Service between AmoraOS LLC, 30 N Gould St, Suite R, Sheridan, WY 82801 ("AmoraOS", the "Processor" or "Service Provider"), and the Merchant (the "Controller" or "Business"). It applies whenever AmoraOS processes personal data of the Merchant's customers, staff or partners on the Merchant's behalf.

1. Roles and scope

The Merchant decides which stores, marketplaces, help desks and carriers to connect and therefore what personal data enters AmoraOS and for what purpose. AmoraOS processes that data only to provide the service described in the Terms. The parties agree that, for shopper data, the Merchant is the controller / business and AmoraOS the processor / service provider.

Subject matter and duration: order fulfillment and related operations, for the term of the Terms plus the deletion period below. Data subjects: the Merchant's customers (shoppers), the Merchant's staff, and brand and partner users the Merchant invites. Data categories: name, shipping and billing address, email, phone, order contents and value, order status, delivery tracking, support ticket text, and account and audit records for users. No payment card data. No special categories, other than the fact that an order contains alcohol and is therefore subject to age-verified delivery.

2. Instructions

AmoraOS processes personal data only on the Merchant's documented instructions, which are: the Terms, this Addendum, the settings and connections the Merchant configures, and the actions its users take in the product. AmoraOS will tell the Merchant if an instruction appears to break the law. AmoraOS will not sell personal data, share it for cross-context behavioral advertising, retain, use or disclose it outside the direct business relationship, or combine it with data from other sources except to provide the service, and it certifies that it understands these CCPA restrictions.

3. Confidentiality of staff

Only AmoraOS personnel who need access to run or support the service have it, under written confidentiality obligations, and every access is through a named account with a role. AmoraOS support will look at a Merchant's data only to answer that Merchant's request or to investigate a problem.

4. Security measures

AmoraOS maintains the measures in Annex 1 and will not reduce their overall level during the term. In summary: encryption in transit and at rest, network isolation of the database, encrypted application secrets, role-based access, two-factor sign-in, 12-character minimum passwords, audit logging, encrypted backups with a rehearsed restore, separate test and production environments, and a written incident response policy.

5. Sub-processors

The Merchant authorizes the sub-processors in Annex 2. AmoraOS will give 30 days' notice by email to Merchant administrators before adding or replacing a sub-processor; the Merchant may object on reasonable data-protection grounds within that period and, if no solution is found within a further 30 days, may terminate the affected service without penalty and receive a pro-rated refund of prepaid fees. AmoraOS binds each sub-processor to protections no weaker than this Addendum and remains responsible for their performance.

6. Data subject requests and assistance

If a shopper's request reaches AmoraOS directly, AmoraOS will forward it to the Merchant within 5 business days without responding on the Merchant's behalf, unless the Merchant instructs otherwise. AmoraOS will act on requests the Merchant or Shopify relays (including Shopify's customer data request and redaction webhooks) within 30 days, and provides the Merchant with self-service export and deletion tools. AmoraOS will give reasonable help with the Merchant's security and privacy assessments, taking into account the nature of the processing.

7. Security incidents

AmoraOS will notify the Merchant without undue delay, and within 72 hours of confirming a personal data breach affecting the Merchant's data, with what is known about the nature of the incident, the data and people affected, the likely consequences, and the measures taken, and will update as facts develop. Notice goes to the administrator email on the account.

8. Audits

On written request no more than once a year, AmoraOS will provide written answers and supporting evidence about the measures in Annex 1, such as its incident response policy, backup and restore records and access controls, within 30 days. Where that is not sufficient to meet a legal requirement, the Merchant may conduct an audit at its own cost, during business hours, with 30 days' notice, under confidentiality, without disrupting the service, and no more than once a year unless a security incident has occurred.

9. Deletion and return

The Merchant can export all its data from the product at any time. On termination or on request, AmoraOS deletes the Merchant's personal data 14 days after the request (the Merchant may cancel within that window), and purges a store's data when the store uninstalls the AmoraOS app and the platform's redaction request arrives, 48 hours after uninstall. Encrypted backups age out after 7 days. AmoraOS may keep what the law requires it to keep, under these protections, for as long as required.

10. International transfers

AmoraOS processes and stores data in the United States. If the Merchant transfers personal data of people in the European Economic Area, United Kingdom or Switzerland, the parties incorporate the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum by reference, with the Merchant as data exporter and AmoraOS as data importer, and Annexes 1 and 2 of this Addendum serving as the annexes to those clauses.

11. Liability and precedence

Liability under this Addendum is subject to the limitations in the Terms. If this Addendum conflicts with the Terms on data protection, this Addendum prevails.

Annex 1 — Security measures

Annex 2 — Sub-processors

Marketplace channels the Merchant connects (for example AccelPay, Barcart, LiquidRails, Big Thirst, LiquorPilot) are the Merchant's own counterparties, not AmoraOS sub-processors.