DATA PROCESSING AGREEMENT

Last updated: October 20, 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service between dobalo UG (haftungsbeschränkt), Schäferbrücke 9, 24568 Kaltenkirchen, Germany ("dobalo", the "Processor") and the Brand that uses the Services (the "Brand", the "Controller"). It applies automatically when a Brand connects a store or uses features in which dobalo processes personal data of the Brand's customers or of creators on the Brand's behalf, and meets the requirements of Article 28 GDPR.

1. Scope

1.1 Subject matter and duration. dobalo processes personal data on behalf of the Brand while the Brand uses these features. The DPA stays in force until return or deletion under section 8 is complete.

1.2 Nature and purpose. dobalo stores, reads and analyses the data to show campaign results, calculate creator compensation and the Brand's campaign charges, including platform fees, and arrange and track product samples. This includes creating sample draft orders and sending sample-request and fulfilment notifications.

1.3 Data subjects. The customers of the Brand's connected Shopify store, and creators for whom a product sample is arranged.

1.4 Categories of data.

• Store orders. Order number and ID; creation, processing, update and cancellation times; test-order flag; payment and fulfilment status; totals, subtotal, taxes, amounts received and refunded, and currency; payment transactions; line items (product and variant IDs and titles, SKU, quantity, prices); discount codes; Dobalo sample tags; dispute statuses and refund details; visit times and recognised campaign tracking values. The sales import does not request or store customer names, email addresses, phone numbers, postal addresses, IP addresses or payment card details.
• Products. Product and variant IDs, titles, SKUs, prices, availability, inventory quantities and images.
• Product samples. Creator identifiers, name, shipping address and optional telephone number; sample-request, decision, payment and fulfilment information; linked draft and order identifiers and invoice links; and email address and notification information used to arrange the sample. Shopify shipping checks include postal code and country.

1.5 Roles. For the data in section 1.4, the Brand decides on the purposes and means and is the controller. dobalo is the processor. This includes dobalo's use of a creator's account identifiers or contact details to fulfil a Brand's sample request. For dobalo's own administration of accounts, for example creator and Brand sign-up, security, payments and support, dobalo is a controller under its Privacy Policy.

2. Instructions and access

2.1 dobalo processes personal data only on the Brand's documented instructions, including instructions concerning international transfers, unless Union or Member State law requires otherwise. In that case, dobalo informs the Brand before processing unless the law prohibits that notice on important public-interest grounds. The Terms, this DPA and the Brand's use of the Services' settings are the instructions.

2.2 dobalo informs the Brand without delay if it considers an instruction to violate data protection law.

2.3 Shopify and AI assistants. On the Brand's instruction, dobalo discloses data to the Brand's selected Shopify store (sample draft orders) and to an AI assistant the Brand authorises through the MCP connector. If the Brand authorises an assistant through the MCP connector with advertising read access, dobalo discloses attributed-order summaries to that assistant. These include order identifiers, amounts, currencies, status and dates. The Brand is responsible for its arrangement with the selected assistant provider.

3. Confidentiality

dobalo ensures that everyone it authorises to process the data is bound to confidentiality, or is under an appropriate statutory duty of confidentiality.

4. Security

dobalo takes the technical and organisational measures required by Article 32 GDPR. The measures at the date above are set out in Annex 1. dobalo may change them if the level of protection is not reduced.

5. Sub-processors

5.1 The Brand gives general authorisation to use the sub-processors in Annex 2.

5.2 dobalo notifies the Brand at least 10 days before a new sub-processor processes the data, for example by email or in the Services. The Brand may object on reasonable data protection grounds. If the parties find no solution, the Brand may terminate the affected service.

5.3 dobalo imposes on each sub-processor data protection obligations equivalent to this DPA and remains responsible for its performance.

6. Data subject requests

6.1 dobalo assists the Brand, through appropriate technical and organisational measures, in answering requests from data subjects.

6.2 When a store owner submits a customer data or deletion request through Shopify, Shopify forwards it to dobalo ("customers/data_request" and "customers/redact"). dobalo makes the requested order data available to the Brand for download, so the Brand can provide it to its customer. For deletion requests, dobalo clears the stored details of the listed imported sales orders. It keeps the commission records required by law and an order reference record, so these orders are not imported again while the store stays connected. It also clears the order number copied into a matching product-sample request.

6.3 If a data subject contacts dobalo directly about this data, dobalo refers the person to the Brand where the Brand is identifiable.

7. Assistance, breaches and transfers

7.1 Assistance. Taking into account the nature of the processing and the information available to it, dobalo assists the Brand with its obligations under Articles 32 to 36 GDPR: security, breach notification, data protection impact assessments and prior consultation.

7.2 Personal data breach. dobalo notifies the Brand without undue delay after becoming aware of a personal data breach affecting this data, and provides the information it has that the Brand needs for its own notifications.

7.3 International transfers. Where a sub-processor processes data outside the European Economic Area, dobalo ensures an adequate level of protection. It does so through the EU Standard Contractual Clauses (Module 3, processor to processor) or the EU-US Data Privacy Framework, as stated in Annex 2.

8. End of service, deletion and return

8.1 When the relevant services end, dobalo will, at the Brand's choice, return or delete the personal data processed on its behalf and delete existing copies, unless Union or Member State law requires retention. This includes data held by sub-processors. Legally retained data remains protected and is used only for the required retention purpose.

8.2 The Brand requests return or deletion by writing to support@dobalo.com. dobalo completes it within 30 days for live data. Copies in the hosting provider's backups expire on its backup schedule. Until then they are not used for ordinary processing, and if a backup is ever restored, data that was due for deletion is deleted again.

8.3 When the Brand uninstalls the Dobalo app and dobalo receives Shopify's uninstall notification for the current installation, dobalo immediately deletes the store's stored access credentials and disconnects it. When dobalo processes Shopify's "shop/redact" notification, it deletes the store's access credentials, sync details and creator codes, deletes imported orders that are not linked to a creator commission, and clears the imported order details of the others; for those it keeps an order reference record and the commission records required by law. It keeps a reference to the store (its Shopify domain and the community it belonged to) while retained orders or commissions still need it. After at least seven days, cleanup deletes the store connection unless retained orders, commissions, pending installations or webhook records still need it; links from product samples to the store are cleared.

8.4 During operation, dobalo removes order details in a daily cleanup, as described in the Privacy Policy.

9. Audits and information

dobalo provides the Brand with the information needed to show compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Brand or an auditor it appoints. Audits are announced in good time, take place during normal business hours, and do not unreasonably disrupt operations or reveal other customers' data.

10. Liability and precedence

Liability under this DPA follows Section 11 of the Terms of Service, and the law in Section 14 of the Terms applies. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

Annex 1 – Technical and organisational measures

• Encryption. Databases are encrypted at rest and internal traffic is encrypted in transit by the hosting provider (Railway DPA, Exhibit C). Store access and refresh tokens and creator shipping-address payloads are additionally encrypted at field level using AES-256-GCM. Production browser-to-API and Shopify API communications use HTTPS/TLS.
• Access control. Role-based access. Within the application, only owners and admins of the Brand's community can view order details. Creators can access information about their own sample requests, including their status, order number and applicable payment link.
• Least privilege. The standard connection requests read_orders and read_products. Shopify sample fulfilment additionally requests write_draft_orders when authorised by the Brand.
• Request authenticity. Requests and notifications from Shopify are verified by their HMAC signature.
• Retention. Order details are removed in a daily cleanup, as described in the Privacy Policy.
• Telemetry and logging. Operational telemetry includes pseudonymous user, community and sample-request identifiers, event types and error information. Errors handled by the Shopify and sample API request handlers are sanitised before routine logging. Browser replay masks inputs and marked sensitive content.

Annex 2 – Sub-processors

Each entry gives the legal entity, service, data categories, location and transfer safeguard.

• Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA. Service: API, background workers, database, Redis cache and backups. Data: all data in section 1.4. Location: United States. Safeguard: EU Standard Contractual Clauses, or the Data Privacy Framework where certified (Railway DPA, section 9).
• Twilio Inc. (SendGrid), USA. Service: transactional email for sample requests and notifications. Data: creator and manager email addresses, usernames and sample context. Location: United States. Safeguard: EU-U.S. Data Privacy Framework (Twilio Inc. is self-certified), otherwise the EU Standard Contractual Clauses. The Twilio Data Protection Addendum forms part of the agreement.
• PostHog Inc., USA. Service: product analytics, error tracking, and session replay of the dobalo web app with inputs and marked sensitive content masked. Data: pseudonymous identifiers, event types, error information and masked session recordings. Location: United States (US cloud). Safeguard: EU Standard Contractual Clauses.
• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Service: web hosting and the analytics proxy, which forwards telemetry, including session replay traffic, to PostHog. Data: pseudonymous telemetry and masked session recordings passing through. Location: United States. Safeguard: EU Standard Contractual Clauses (2021/914), incorporated by Vercel's data processing agreement, plus the UK Addendum.