Data Processing Agreement

This DPA forms part of, and is incorporated by reference into, the Season 28 Connect Terms of Service (the "MSA"). By accepting the Terms of Service — including via the console legal-acceptance gate — you accept this DPA. A separately signed copy is available for enterprise agreements (signature block at the end).

1. Definitions

Terms in bold have the meaning given in UK GDPR and the Data Protection Act 2018 ("DPA 2018"):

• Personal Data — Article 4(1) UK GDPR.
• Processing — Article 4(2) UK GDPR.
• Data Subject — individuals whose Personal Data is processed: here, the Controller's customers and the Controller's staff users with console access.
• Sub-processor — any third party engaged by the Processor to process Personal Data on the Controller's behalf.
• SCCs — the UK International Data Transfer Addendum ("UK IDTA") and, where applicable, EU Standard Contractual Clauses Module Two, available from the ICO and the European Commission.

2. Roles and scope

• The Controller is the Controller of Personal Data relating to its customers and end users of the platform.
• The Processor is the Processor, processing that Personal Data on the Controller's documented instructions (this DPA, the MSA, and the admin actions the Controller takes via the Connect console and its Shopify integration).
• Where Season 28 processes data for its own platform security, billing, fraud/abuse prevention and service administration as described in the Season 28 Connect Privacy Policy, Season 28 acts as an independent Controller for that limited purpose. The Controller acknowledges this dual role.

3. Subject-matter and duration

4. Controller obligations

The Controller warrants that:

• It has a valid lawful basis (Article 6 UK GDPR) for the Processing it instructs, and any consents required (including marketing consent before marketing is sent).
• It has provided appropriate transparency/privacy information to its Data Subjects.
• For any special-category data, it has identified the Article 9 condition relied upon.
• Age of digital consent — where the Controller's customers include children below the applicable age of digital consent (13 in the UK), the Controller is responsible for the lawful basis, including any required parental consent. The platform does not perform age verification; the Controller is responsible for upstream age gating in its own store and marketing.

5. Processor obligations

The Processor will:

• a. Process only on documented instructions — the MSA, this DPA, and the Controller's admin actions via the console + Shopify integration. If required to process for another reason by law, it will inform the Controller first unless legally prohibited.
• b. Ensure persons authorised to process are under an appropriate confidentiality obligation.
• c. Implement the technical and organisational measures in Annex 2, appropriate to the risk (Article 32).
• d. Respect the sub-processor conditions in clause 7.
• e. Assist with Data Subject requests (Articles 15–22), taking into account the nature of Processing. In practice, because the Controller is the controller of its customers' data:
  • The Shopify customers/data_request webhook is handled — the request is audit-logged and the Controller's admin is notified so the Controller can fulfil the access request.
  • The Shopify customers/redact and shop/redact webhooks are handled — on a redaction request the individual's Personal Data is erased or anonymised across the platform (a complete cascade covering the customer's records and uploaded images; order records are anonymised, not deleted, where financial-record retention applies). A customer using the mobile app can also delete their own account and associated data in-app.
• f. Assist with Articles 32–36 (security, breach notification, DPIAs) taking into account the information available to it.
• g. Notify the Controller without undue delay, and within 72 hours, on becoming aware of a Personal Data breach affecting the Controller's data, with the Article 33(3) information to the extent known.
• h. Make available information necessary to demonstrate compliance and allow for audits by the Controller or its mandated auditor (30 days' notice, reasonable confidentiality undertakings, once per twelve months unless a breach warrants follow-up).
• i. On termination, at the Controller's choice, delete or return all Personal Data within 90 days unless retention is required by law; deletion confirmed in writing.

6. International transfers

Primary hosting of Personal Data is within the UK/EEA (MongoDB Atlas EU region; Railway EEA deployment; Vercel EEA region for the console). Where Personal Data is transferred to a sub-processor outside the UK/EEA (see Annex 3), the transfer is governed by the UK IDTA and, where applicable, EU SCCs Module Two.

7. Sub-processors

The Controller authorises the Processor to engage the sub-processors listed in Annex 3. The Processor will:

• a. Maintain an up-to-date sub-processor list (published with the Privacy Policy).
• b. Give at least 30 days' prior notice before adding or replacing a sub-processor, during which the Controller may object on reasonable grounds; if unresolved, the Controller may terminate the affected portion of the MSA without penalty.
• c. Impose data-protection obligations on each sub-processor no less protective than those in this DPA.
• d. Remain liable for its sub-processors' acts and omissions as for its own.

8. Liability

Subject to the limitations in the MSA, save that nothing limits liability for supervisory-authority fines (Articles 83–84) caused by a party's breach of this DPA, or for breach of confidentiality.

9. Order of precedence

If this DPA conflicts with the MSA, this DPA prevails for Personal Data processing matters.

10. Governing law

England and Wales; exclusive jurisdiction of the courts of England and Wales, without prejudice to mandatory data-protection rights.

Signatures (enterprise / where a signed copy is required)

Annex 1 — Processing details

See clause 3.

Annex 2 — Technical and organisational measures

Access control

• Role-based access (super_admin / org_admin / user) with least-privilege defaults; strict per-tenant organisation-scoped queries, verified by an isolation test suite (scripts/test-org-isolation.js, 54/54 checks at the effective date).
• Passwords hashed with bcrypt (cost factor 12); password reset via time-limited hashed codes; account lockout after repeated failed logins; short-lived JWT sessions with a token-version revocation claim.
• Admin and security-relevant actions audit-logged; audit records minimised (IP/user-agent stripped on erasure).
• Two-factor authentication enabled on all production-infrastructure provider accounts (MongoDB Atlas, Railway, Cloudinary, Resend, Shopify Partner). Confirmed active 2026-08.

Encryption

• TLS 1.2+ in transit on all endpoints.
• AES-256 at rest (MongoDB Atlas default; encrypted backups).
• Secrets held in environment configuration only, never logged; Shopify access tokens stored select:false.

Network / application security

• App-level rate limiting; CORS allow-list; trust proxy configured to prevent X-Forwarded-For spoofing.
• Webhook signature verification (HMAC raw-body) on Shopify, Stripe, Resend and Twilio ingestion.
• Input validation and guards against NoSQL/operator injection on request-derived query values.

Resilience

• Daily MongoDB Atlas snapshots with rolling retention; a daily backup-verification job checks snapshot age + critical-collection counts.

Personnel

• Confidentiality obligations on all personnel handling Personal Data; need-to-know access reviewed periodically.

Breach detection + response

• Error/security monitoring via Sentry (typed operational alerts: rate-limit, webhook-HMAC failure, cost ceilings), with PII kept out of diagnostic payloads; documented incident-response process; 72-hour breach notification commitment.

Annex 3 — Sub-processors

Reconciled against the codebase 2026-07-19. Locations are the provider's stated processing regions; confirm current regions with each provider at review time.

This list is current at the effective date. The authoritative, live list is maintained alongside the Privacy Policy; material changes are notified per clause 7.