Data Processing Addendum

1. Definitions

The terms “Personal Data”, “Data Subject”, “Processing”, “Controller”, “Processor”, “Data Protection Officer”, and “ANPD” have the meaning assigned by the LGPD. “Sub-processor” means a third party engaged by the Processor to assist in the Processing.

2. Purpose and roles

2.1. The Merchant acts as Controller and IDCLIP as Processor of the Consumers' Personal Data processed through the App.

2.2. The Processor will process Personal Data solely to provide the App's features and in accordance with the Controller's documented instructions, of which the Terms of Use and the Privacy Policy form a part.

2.3. The details of the Processing (data categories, data subjects, purposes, and duration) are set out in Annex I.

3. Processor obligations

The Processor undertakes to:

1. process Personal Data only in accordance with the Controller's lawful instructions and the law, informing the Controller if it considers that an instruction violates the LGPD;
2. ensure the confidentiality of Personal Data, making sure that persons authorized to process it are bound by a duty of secrecy;
3. adopt the technical and organizational security measures described in Annex III;
4. assist the Controller in responding to Data Subject requests and in complying with its legal obligations (security, incidents, and impact reports), to the extent reasonable;
5. not use Personal Data for its own purposes other than providing the service, except for the use of aggregated and anonymized data, including for benchmarks, comparative analyses, and for preparing, publishing, and distributing studies, reports, indices, and materials about the e-commerce market and checkout performance, as set out in item 3 of the Privacy Policy and Clause 8.3 of the Terms of Use, provided the data does not allow identification of the Controller, the Store, or the Data Subjects;
6. maintain records of the Processing operations carried out.

4. Sub-processors

4.1. The Controller generally authorizes the engagement of the Sub-processors listed in Annex II, notably Cloudflare (data ingestion) and Supabase (data persistence).

4.2. The Processor will impose on each Sub-processor, by contract, data protection obligations equivalent to those of this DPA, and will be liable to the Controller for compliance with those obligations.

4.3. The Processor will inform the Controller of the addition or replacement of Sub-processors through reasonable means, allowing the Controller to object on legitimate data protection grounds.

5. International transfers

5.1. Where there is an international transfer of Personal Data (for example, hosting on servers outside Brazil), the Processor will adopt mechanisms compatible with art. 33 of the LGPD, including contractual clauses and guarantees of an adequate level of protection.

6. Responding to data subjects

6.1. If the Processor receives a request directly from a Data Subject, it will, unless legally required otherwise, forward or direct the Data Subject to the Controller, and will provide, to the extent reasonable, technical assistance so that the Controller can respond to the request in a timely manner.

7. Security incidents

7.1. The Processor will notify the Controller without undue delay after becoming aware of a security incident involving Personal Data processed under this DPA, providing the information reasonably available so that the Controller can comply with its duties to notify the ANPD and the Data Subjects.

7.2. The Processor will take reasonable measures to mitigate the effects and prevent recurrence of the incident.

8. Deletion and return

8.1. Once Processing ends (through termination of the subscription or uninstallation of the App), the Processor will, at the Controller's choice and as technically feasible, delete or return the Personal Data, except where retention is legally required, in which case it will maintain confidentiality.

8.2. History retention periods follow the contracted plan, as set out in the Privacy Policy.

8.3. The deletion or return provided for in item 8.1 does not reach previously aggregated and anonymized data which, because it does not allow identification of a natural person, does not constitute Personal Data and may be kept and used by the Processor as set out in item 3 of this DPA.

9. Audit and evidence

9.1. The Processor will make available to the Controller, upon reasonable request and under confidentiality, the information necessary to demonstrate compliance with this DPA, and may do so through reports, certifications, or responses to questionnaires, so as to preserve the security and confidentiality of third parties.

10. Liability

10.1. Each party is liable for the obligations assigned to it by the LGPD according to its role (Controller or Processor). The limitations of liability set out in the Terms of Use also apply to this DPA, to the maximum extent permitted by law, except for the Processor's obligations under this DPA, which remain enforceable.

11. Term and final provisions

11.1. This DPA remains in force for as long as there is Processing of Personal Data within the App and is governed by Brazilian law, with the courts of the District of Vila Velha, State of Espírito Santo, elected.

ANNEX I — Description of the Processing

ANNEX II — Sub-processors

ANNEX III — Security Measures

• Encryption of Personal Data in transit (TLS) and at rest;
• Least-privilege access control, authentication, and periodic permission review;
• Environment segregation (development, staging, and production);
• Logging, monitoring, and security alerts;
• Backups and recovery procedures;
• Vulnerability management and assessment of suppliers/sub-processors;
• Internal information security and confidentiality policies.