Data Processing Agreement (DPA)

Data Processing Agreement

This Data Processing Agreement ("DPA") reflects the parties' agreement with respect to the Processing of Personal Data by Brainito on behalf of the Client.

Roles & Responsibilities

The Client is the Data Controller. Brainito is the Data Processor. Brainito will process Personal Data only on the Client's documented instructions.

Details of Processing

• Subject-matter: Marketing services as described in the main agreement.
• Duration: Until the termination of the main agreement.
• Nature and Purpose: To provide marketing, consulting, and related services.
• Categories of Data: As described in the Privacy Policy (e.g., Contact, Identity, Usage Data).

Processor Obligations

Brainito will:

• Implement appropriate technical and organizational security measures.
• Ensure personnel are subject to confidentiality obligations.
• Assist the Client in responding to data subject requests.
• Notify the Client of any suspected data breach without undue delay.

Sub-processors

The Client authorizes Brainito to engage sub-processors (third-party service providers) to deliver the services. A current, maintained list — including our email, hosting, database, payment, AI, and Shopify integration providers — is available on our Sub-processors page. Brainito will notify the Client of changes to sub-processors.

Connected Stores (Shopify)

Where the Client connects a Shopify store, Brainito processes the customer, order, product, and checkout data the Client authorizes via Shopify’s APIs to provide the services. Brainito responds to Shopify’s customer-redaction and shop-redaction requests to delete the relevant data.

Data Transfer Mechanisms

For transfers of personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, Brainito will rely on Standard Contractual Clauses (SCCs) as an appropriate safeguard.

Security Breach Procedures

Upon becoming aware of a data breach, Brainito will notify the Client without undue delay and provide reasonable information to help the Client meet its breach notification obligations.