Data Processing Agreement (DPA)

1) Introduction, scope, and related documents

This DPA sets the conditions for processing personal data by Tanqory on behalf of the data controller (Merchant/customer), covering collection, use, disclosure, transfer, storage, deletion, and return of data.
It forms part of the Terms of Service, Privacy Policy, Data Retention, Security Standards, and Sub-processor list; if conflicts arise, order of precedence is: Order Form/SOW > this DPA > Terms.
Covers data of end customers, authorized users, business contacts, and data the Merchant inputs or generates on the platform.
Tanqory acts as “Processor” (and as Controller only for data needed to run its own services, e.g., account/billing per the Privacy Policy); the Merchant is “Controller.”
Appendices: A (processing details), B (technical/organizational measures), C (cross-border transfer instructions/SCC/IDTA), D (current Sub-processor list).
English controls if translations conflict.
Continued use of the services constitutes acceptance of this DPA and announced updates via durable medium (email/dashboard), except for immediate safety/legal changes.
Data outside scope (e.g., content a Merchant hosts for third parties without processing instructions) is not governed by this DPA.
Additional PCI/sensitive-data terms appear in Security Standards/Order Form if applicable.
Appendices A/B/C/D must be attached or linked as binding in each Order Form/dashboard issuance to keep scope/measures/transfers/Sub-processor list current.
Contacts: dpo@tanqory.com, security@tanqory.com.

2) Roles and definitions

Roles: Merchant is Controller; Tanqory is Processor; Sub-processor is a downstream processor engaged by Tanqory (Appendix D).
Definitions follow GDPR/PDPA and this DPA (Personal Data, Processing, Data Subject, SCC/IDTA, International Transfer, Breach, Instructions).
Where Tanqory is Controller (e.g., Merchant account/billing data), the Privacy Policy/Terms apply and are outside Merchant instructions.
Use of data for non-instruction purposes (e.g., service improvement using aggregated/de-identified data) occurs only after de-identification or under a suitable legal basis.
Merchant must provide lawful instructions/notices and inform Tanqory if instructions conflict with data laws.
Legal references include amendments/replacements (e.g., new SCC, IDTA/UK Addendum).
Conflicting instructions follow the latest written Merchant instruction unless law mandates otherwise.
Client-side processing under Merchant control is the Merchant’s responsibility.
Demo/trial accounts are still subject to this DPA when personal data is present.
Sub-processor means third parties Tanqory uses with obligations per Appendix D.

3) Purpose, scope, data types, and duration

Processing to deliver services stated in the Order Form/Terms: store/host shops, transactions, support services, Merchant-directed marketing, security/fraud prevention, authorized analytics.
Data processed (examples): contact details, customer/order data, tokenized payment data, logs/telemetry, Merchant-entered content (text/media), support data, user settings/permissions.
Sensitive data: should not be sent unless instructed/legally based with measures in Appendix B/Order Form (e.g., PCI scope).
Processing duration: contract term/service use and until returned/deleted per Section 9 and Appendix A schedule.
Merchant warrants lawful basis and adequate notice to Data Subjects (GDPR Art.6/13/14, PDPA notice/consent, CCPA notice).
Use of data for aggregated/de-identified service improvement occurs after de-identification without reasonable re-identification.
Purpose changes require Merchant instruction or clear legal basis.
Children’s data: service not designed for children; if Merchant sends child data, Merchant is responsible for legal basis and must inform Tanqory to apply additional safeguards.
AI/ADM processing follows AI policy/terms and this DPA.
See Appendix A for further scope details.

4) Instructions and cooperation

Tanqory processes only on the Merchant’s documented instructions (including UI/API/dashboard) unless required by law or urgent safety needs, in which case Tanqory will notify the Merchant if legally permitted.
If instructions may breach data law, Tanqory will notify for review; if Merchant insists, Tanqory may suspend actions that are not lawful.
Will assist with Data Subject rights (access/rectify/erase/restrict/port/opt-out) within reasonable SLA; Merchant remains responsible for responses to Data Subjects.
Will support DPIA/DTIA/TRA reasonably; Merchant bears reasonable costs if requests exceed standard practice.
Will assist compliance (PDPA/GDPR/CCPA, etc.) within reasonable scope, including logs/evidence for lawful requests.
Maintain ROPA where required for Processor activities.
Provide DPO/security contacts.
Important instructions should use durable medium (email/dashboard).
Urgent security instructions may be acted on first and notified afterward to prevent harm.
Merchant must provide notices/consents aligned with instructed processing.

5) Security measures

Implements technical/organizational measures per Appendix B (at minimum: encryption at rest/in transit, access control, MFA, logging, DLP, segmentation, backup/DR, vulnerability management, secure SDLC, authorized pentests).
Trains personnel with access and enforces NDA/confidentiality.
Least privilege with audit logs for L3/L4 per Data Classification Policy.
Secure key management with separation of duties and key rotation.
Security assessment of Sub-processors before use and periodic monitoring.
Incident response: detect → contain → notify → mitigate → investigate → improve; notify per Section 8.
Payment data: comply with PCI DSS v4.0; no storage of CVV/track/full PAN.
Patch/bug program and vuln disclosure channel (security@tanqory.com).
Data not needed for purpose will be deleted/de-identified (minimization).
Security testing/validation performed periodically and risk-based.

6) Sub-processors

Sub-processor use is allowed per Appendix D; updates via dashboard/email (durable medium) with reasonable right to object.
Contracts with Sub-processors will impose protections equivalent to this DPA (GDPR Art.28-equivalent), including deletion/return at end of service.
If Merchant objects to a new Sub-processor and no reasonable workaround exists, either party may terminate the affected services per contract.
No Sub-processor lacking adequate security/legal standards for the data used.
Cross-region data uses transfer measures per Section 7 and Appendix C.
Current Sub-processor list available in dashboard or on request to dpo@tanqory.com.
Sub-processors must notify breaches and cooperate in investigation/remediation.
Use of Sub-processors does not relieve Tanqory of contractual responsibility to Merchant.
Restricted activities (e.g., AI training) must include prohibitions on out-of-scope use or improvement of the Sub-processor’s own services unless expressly authorized.
Maintain Sub-processor records for audit/compliance.

7) Cross-border transfers

If transferring outside protected regions (EEA/UK/SG, etc.), use SCC/UK IDTA/BCR or suitable legal basis per Appendix C.
Conduct DTIA/TRA per EDPB/ICO guidance when using non-adequate countries and apply supplementary measures by risk.
No transfers to sanctioned/blocked regions under applicable law.
Merchant may request data region in Order Form (subject to feasibility and law).
DR/HA transfers must maintain equivalent protections and notify if affecting Data Subject rights.
Foreign cloud/AI providers are listed in Appendices D/C with applicable technical/organizational measures.
Foreign court/authority orders will be assessed under applicable law; Merchant will be notified where permitted.
Limit cross-border access to need-to-know with appropriate roles/permissions.
Maintain transfer records for audit/legal compliance.
Ensure Sub-processors follow the same transfer requirements.

8) Breach notification

Notify Merchant without undue delay and within 72 hours of becoming aware of a personal data breach affecting data processed for Merchant (or shorter period if law requires).
Notice will include breach nature, categories/estimated volume of affected data, likely consequences, measures taken/proposed, and follow-up contacts.
Cooperate on investigation/mitigation/regulator and Data Subject notifications as required; Merchant is responsible for notices to Data Subjects unless law requires otherwise.
Keep breach records for compliance reference.
Sub-processor breaches will be coordinated and relevant information forwarded to Merchant.
If containment requires temporary suspension/limitation, Tanqory will act proportionately and notify.
Risk assessments use legally/standard-recommended frameworks (e.g., EDPB breach guidelines).
Payment-data incidents follow PCI and processor rules.
Reporting channels: security@tanqory.com (urgent) and dpo@tanqory.com.
High-risk ADM/AI incidents will be notified per applicable laws/standards (e.g., EU AI Act serious incident if applicable).

9) Deletion and return of data

Upon termination or Merchant request, Tanqory will delete or return all personal data processed on behalf of Merchant, except where law requires retention or legal hold applies.
Use secure/cryptographic erasure and delete from backups in the next feasible cycle; erased data will not be restored for normal use.
If Merchant requests return, data will be provided in a common/machine-readable format where feasible.
Data retained for legal/accounting obligations will be segregated/protected (purpose limitation) and deleted when due.
Sub-processors must also delete/return data per instructions and contract.
Merchant should download/backup needed data before end date; if not requested in time, Tanqory may delete per policy.
Deletion/return evidence will be logged/provided upon Merchant request.
Aggregated/de-identified data created under contract may persist if not reasonably re-identifiable.
Security/legal logs may be retained only as necessary with stated periods.
Deletion in third-party systems is enforced via contract and oversight.

10) Data Subject rights and requests

Merchant is primarily responsible for Data Subject requests (access/rectify/erase/restrict/object/portability/opt-out); Tanqory will assist as reasonably required.
Request channels: dpo@tanqory.com or designated form; identity verification required.
Target SLA for assistance: intake ≤2 Business Days, updates every 10 Business Days, target closure 30 days or notice if longer.
If requests are unclear/unlawful, Tanqory may seek clarification or refuse per applicable law with reasons.
Requests affecting backups/multi-layer systems: delete in the next feasible cycle and communicate timing.
Fees: none unless manifestly unfounded/excessive per law.
ADM/AI requests: provide human review/reasons/objection rights per applicable law.
Merchant remains liable if failing notice/consent/legal-basis obligations.
Requests/actions will be logged to evidence compliance.
Merchant should supply legally compliant rights templates/disclosures for relevant locales.

11) Audits and inspection rights

Merchant may request compliance evidence (e.g., SOC 2/ISO 27001 reports, security questionnaires) and/or conduct document/remote assessments reasonably without harming security/operations.
Onsite audits require prior notice and agreed scope/time/confidentiality with security limitations; Merchant bears reasonable costs.
Findings will receive risk-based remediation plans.
Tanqory may provide independent third-party audits to minimize operational impact.
Access to other customers’ data/trade secrets/unrelated systems will be restricted.
Confidentiality obligations apply to all audit information/reports.
Excessive/repetitive audits may be deferred or require clear legal/regulatory justification.
Merchant must follow site security/data rules during visits.
Sub-processors are audited via Tanqory per contract; no direct onsite unless contractually provided.
Evidence is provided in forms that do not compromise system security.

12) Liability and indemnity

Each party is liable for breaches of this DPA per applicable law/contract and may limit/exclude liability per the main agreement (Terms/Order Form).
Tanqory is not liable for processing per Merchant instructions or Merchant failures in notice/legal basis/Data Subject responses.
Merchant indemnifies Tanqory for claims arising from Merchant’s instruction/actions violating data law/DPA.
Tanqory indemnifies Merchant per the main contract for breaches of security/legal obligations directly by Tanqory.
Liability caps follow the main contract/Order Form unless law prohibits limitation.
No liability for indirect/consequential damages unless mandated by law.
Non-excludable liabilities (e.g., death/serious injury from gross negligence) follow applicable law.
Force majeure: neither party liable for events defined in the main agreement.
Merchant must ensure secure lawful data and instructions before sending to Tanqory.
Enforcing this clause does not waive other contractual rights.

Change history