Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between scriptsCanFly by Simon Laube, Bifangstrasse 4, 5610 Wohlen AG, Switzerland ("we", "us", the "Processor") and the Merchant (the "Controller"). It governs the processing of personal data of the Merchant's customers that we process on the Merchant's behalf when operating their shop on the Platform, in accordance with Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of the EU General Data Protection Regulation (GDPR).

For data where we determine purposes and means ourselves (e.g. the Merchant's own account data, platform analytics, invoice numbering, transactional emails we are legally required to send), we act as an independent controller; that processing is described in our Privacy Policy and is not subject to this DPA.

• Categories of data subjects: the Merchant’s shop customers and newsletter subscribers
• Categories of data: contact details (name, email, phone), billing and delivery addresses, order and subscription data, payment status (never full card details), customer account data, product reviews, communication related to orders
• Purpose: hosting and operating the Merchant’s shop — storing orders and customers, sending order-related emails in the Merchant’s name, generating invoices and credit notes, providing customer accounts
• Duration: for as long as the Merchant’s shop exists on the Platform, plus statutory retention periods

• We process the data only to operate the Merchant’s shop as described in the Terms and this DPA, and otherwise only on the Merchant’s documented instructions given through the Platform’s features
• We ensure that persons authorized to process the data are bound by confidentiality
• We implement appropriate technical and organizational measures (encryption in transit, access controls, row-level tenant separation, backups)
• We assist the Merchant, insofar as reasonably possible, in responding to data subject requests and in meeting their security and notification obligations
• We notify the Merchant without undue delay after becoming aware of a personal data breach affecting their customers’ data
• On deletion of the shop or termination of the account, we delete the customer data, unless statutory retention duties (e.g. bookkeeping records) require continued storage
• We make available the information reasonably necessary to demonstrate compliance with this DPA

The Merchant authorizes the use of the following sub-processors for the processing described above:

• Supabase (database, authentication, file storage)
• Vercel (hosting and content delivery)
• Stripe (payment processing on the Merchant’s own Stripe account)
• Resend (transactional email delivery)
• OpenAI (AI-assisted content and image generation, where the Merchant uses AI features)
• Google (Google Fonts delivered from Google servers when a shop uses them; sign-in with Google for customer accounts where the customer chooses it)
• Pexels and Unsplash (stock photos and videos delivered from their servers where a shop uses them; their services are queried when the Merchant or the AI searches stock media)
• Lorem Picsum (placeholder images delivered from its servers while a design still shows one)

These providers may process data outside Switzerland or the EU/EEA; where they do, transfers are safeguarded by adequacy decisions or standard contractual clauses. We will inform Merchants of intended changes to this list (e.g. via the Platform or the date at the top of this page); if a Merchant objects to a new sub-processor on reasonable data protection grounds and no solution is found, the Merchant may terminate their account.

• The Merchant is the controller of their customers’ data and responsible for the lawfulness of the processing, including a valid legal basis and their own privacy policy
• The Merchant handles their customers’ data subject requests; we assist as described above
• Instructions to us are given through the Platform’s features (e.g. deleting a customer, exporting data); instructions beyond the Platform’s functionality require a separate agreement

The liability provisions of the Terms of Service apply. In case of conflict between this DPA and the Terms regarding the processing of the Merchant's customer data, this DPA prevails. This DPA is governed by the same law and jurisdiction as the Terms.