Data Processing Addendum

1. Roles and scope

For personal data about the Merchant's customers, visitors and staff that the Merchant enters into or collects through the Platform ("Customer Data"), the Merchant is the controller (or a processor for its own clients) and Eekaam is a processor. For data about the Merchant itself, Eekaam is a controller under its Privacy Policy. Where the CCPA/CPRA applies, Eekaam is a service provider.

2. Details of processing

• Subject matter: hosting and operating the Merchant's online store.
• Duration: the life of the account plus the 30-day export period and backup roll-off.
• Nature and purpose: storing, displaying, transmitting and backing up Customer Data to take and fulfil orders, run customer accounts, send order and (with consent) marketing email, provide analytics to the Merchant, and run integrations the Merchant enables.
• Data subjects: the Merchant's customers, store visitors, newsletter subscribers and staff.
• Categories: names, email addresses, phone numbers, postal addresses, order history and amounts, payment status (never card numbers), IP addresses and device data, marketing consent records, customer account credentials (hashed), messages sent through the store.
• Special categories: none intended; Merchants must not collect them through the Platform.

3. Eekaam's obligations

• Process Customer Data only on the Merchant's documented instructions — the Terms, the Merchant's use of the dashboard and APIs, and the integrations the Merchant enables — and tell the Merchant if an instruction appears to breach the law.
• Ensure staff with access are bound by confidentiality and access only what their role requires.
• Implement the technical and organisational measures in section 6.
• Engage sub-processors only as set out in section 5.
• Help the Merchant respond to data-subject requests (access, erasure, portability, objection) through the dashboard's customer, export and deletion tools, and by email where the tools do not cover a request.
• Help the Merchant with security, breach notification, impact assessments and consultations with authorities, on reasonable request.
• Delete or return Customer Data at the end of the service as set out in section 8.
• Make available the information needed to demonstrate compliance and allow audits as set out in section 9.
• Not sell or share Customer Data, use it for its own purposes, combine it with data from other sources, or retain it beyond the service, except as the law requires.

4. Merchant's obligations

The Merchant is responsible for the lawfulness of the Customer Data it collects, for providing privacy notices to its customers, for obtaining the consents its integrations require (cookies, pixels, marketing email, SMS), for handling its customers' rights requests, and for configuring the Platform's settings appropriately.

5. Sub-processors

The Merchant gives general authorisation for the sub-processors listed at eekaam.com/sub-processors. Eekaam gives at least 30 days' notice by email before adding one that processes Customer Data for every account; the Merchant may object on reasonable grounds and, if unresolved, terminate for a pro-rated refund. Eekaam remains liable for its sub-processors. Services the Merchant connects itself (payment gateways, ad platforms, AI assistants, marketplace apps) are the Merchant's own processors or controllers, not Eekaam's sub-processors.

6. Security measures

• Encryption in transit (TLS 1.2+) and at rest (AWS-managed encryption for databases, storage and backups).
• Tenant isolation: every query is scoped to the Merchant's store; Postgres row-level security policies.
• Password hashing (bcrypt), optional two-factor authentication, device recognition and new-device alerts, login lockout and rate limiting.
• Role-based access for staff accounts; all dashboard actions logged.
• Secrets in a managed vault, never in code; production access limited to named engineers.
• Daily encrypted backups; tested restore procedure.
• Vulnerability monitoring, dependency updates and error monitoring (Sentry) with personal data minimised in logs.

7. Personal data breaches

Eekaam notifies the Merchant of a personal data breach affecting Customer Data without undue delay and no later than 72 hours after confirming it, by email to the account owner, with the nature of the breach, the categories and approximate number of records, the likely consequences, and the measures taken. Eekaam cooperates with the Merchant's own notifications to authorities and data subjects.

8. Deletion and return

Merchants can export customers, orders, products and themes at any time. After the account is closed or the subscription ends, Customer Data remains exportable for 30 days, is then deleted from live systems, and is purged from backups within a further 30 days, except data Eekaam must retain by law (which stays isolated and is deleted when the retention period ends).

9. Audits

On written request, no more than once a year unless required by a supervisory authority or after a breach, Eekaam will provide its security documentation and answer reasonable questionnaires, and will allow an audit by the Merchant or an independent auditor bound by confidentiality, at the Merchant's cost and on 30 days' notice.

10. International transfers

Customer Data is hosted in India (AWS Mumbai) and processed by sub-processors in the United States and EU. For data subjects in the EEA, UK and Switzerland, transfers are covered by the European Commission's Standard Contractual Clauses (module 2, controller-to-processor, and module 3 with sub-processors), the UK International Data Transfer Addendum and the Swiss amendments, which are incorporated by reference with Eekaam as data importer and the Merchant as data exporter.

11. Liability and precedence

Liability under this DPA is subject to the limits in the Terms and Conditions. If this DPA conflicts with the Terms on a data-protection matter, this DPA prevails; if the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

Contact: privacy@eekaam.com · Eekaam SMC (Pvt) Ltd, Karachi, Pakistan.