Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between the merchant (“Controller”) and bikrighor, operated by Agilo IT (“Processor”). It applies when we process personal data on the merchant’s behalf while providing the Service, including data about the merchant’s customers, store visitors and people who message the merchant through connected channels. It applies automatically; you do not need to sign a separate document.

Where a data-protection law such as the GDPR applies, the terms below are intended to meet its requirements for a controller–processor contract.

• Process personal data only on the merchant’s documented instructions, which are these Terms, this DPA and the merchant’s use of the Service’s features, unless law requires otherwise. We tell the merchant if we think an instruction breaks the law.
• Make sure people allowed to process the data are bound by confidentiality.
• Apply the security measures in section 4.
• Not sell the data or use it for our own advertising, profiling or to train models.
• Keep a record of our processing activities and give the merchant the information needed to show compliance.

• Tenant isolation. Every table is keyed to the merchant’s organization and protected by row-level security so one merchant’s data cannot be read through another’s account.
• Encryption. TLS in transit. Connected-service credentials and channel access tokens are encrypted at rest.
• Authentication. Passwords are salted and hashed; sessions use short-lived signed tokens; login attempts are rate-limited and bot-checked.
• Access control. Role-based permissions for team members, and a per-store audit log of sensitive actions.
• Storage. Uploaded and inbound media is stored in private object storage and served with safe content types.
• Operations. Backups, error monitoring, dependency updates and restricted production access.

The merchant gives general authorization for us to use the sub-processors below. We have contracts with them requiring protection no weaker than this DPA. We will tell merchants about additions or replacements by email or in the dashboard at least 14 days ahead, and a merchant may object on reasonable data-protection grounds in that time. If we cannot resolve the objection, the merchant may cancel the affected service.

Services a merchant chooses to connect, such as Meta (Messenger, Instagram, WhatsApp), payment gateways, couriers and SMS or email providers, are not our sub-processors. They act on the merchant’s own instruction and contract.

• Data subject requests. If someone asks us directly about data we process for you, we pass it to you and do not answer substantively without your instruction. The dashboard lets you export, correct and delete customer data; we will help with what the dashboard cannot.
• Assessments. We provide reasonable help with data-protection impact assessments and consultations with authorities where they relate to our processing.

If we confirm that a breach of security has led to accidental or unlawful loss, access or disclosure of personal data we process for you, we will tell you without undue delay and, where we can, within 72 hours of confirming it. We will describe what happened, the data involved, and the steps we are taking, and keep updating you as we learn more.

You authorize processing in the countries where we and our sub-processors operate. Where the law requires a transfer mechanism, we use appropriate safeguards, such as standard contractual clauses, and will make them available on request.

You can export your data while your account is active. When your subscription ends, or when you ask us, we delete or anonymize the personal data we process for you within 90 days, unless law requires us to keep it. Backups are overwritten on the normal cycle. See Data Deletion for how to request deletion earlier.

On reasonable written request, and not more than once a year unless there has been a breach, we will give you the information needed to show we meet this DPA, and allow an audit by you or an independent auditor under confidentiality, during business hours and without disrupting the Service. Each party bears its own costs.

• You are responsible for having a lawful basis and any required consent to put personal data into the Service and to message people.
• You must give your customers a privacy notice that matches how you use the Service, including any pixels or analytics you turn on.
• You must keep team access, passwords and connected credentials under control, and remove people who leave.

Each party’s liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms about personal data, this DPA applies.