Data Processing Agreement (DPA)
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Prebit ("Processor", "Prebit Engage") and the Merchant ("Controller") and applies whenever Prebit Engage processes personal data of the Controller's customers on the Controller's behalf.
1. Roles
The Merchant is the data controller for its own customers' personal data (synced from their connected commerce platform). Prebit Engage is the data processor, processing that data solely to provide the Service and solely on the Controller's documented instructions (as expressed through platform configuration — e.g. the automations, campaigns, and consent rules the Controller sets up).
2. Subject matter and duration
Processing continues for the duration of the Merchant's subscription and any post-termination retention window described in the Privacy Policy.
3. Nature and purpose of processing
Syncing and storing customer identity, order, product, and cart data from the Controller's connected store; sending marketing and transactional messages over WhatsApp, email, SMS, and RCS per the Controller's automation/campaign configuration; tracking delivery/engagement events; computing analytics and revenue attribution.
4. Categories of data subjects
The Controller's end customers.
5. Categories of personal data
Name, email, phone number, order/purchase history, cart contents, marketing consent status per channel, and messaging engagement data (delivery/open/click/reply).
6. Processor obligations
Prebit Engage will:
- Process personal data only on the Controller's documented instructions
- Ensure personnel with data access are bound by confidentiality obligations
- Implement technical and organizational security measures including encryption of credentials at rest, server-side authorization on every data access, and audit logging of sensitive actions
- Engage subprocessors only as disclosed in the Privacy Policy §4, and remain responsible for their compliance with this DPA
- Assist the Controller in responding to data-subject requests (access, correction, erasure) to the extent the platform's tooling supports this [Note: currently processed manually upon request]
- Notify the Controller without undue delay upon becoming aware of a personal data breach affecting the Controller's data
- Delete or return personal data at the end of the engagement, per the retention terms in the Privacy Policy
7. Controller obligations
The Controller represents that it has a valid legal basis (consent or otherwise, as required by applicable law) for sharing its customers' personal data with Prebit Engage and for every message sent through the platform, and that its instructions to Prebit Engage (via platform configuration) comply with applicable data protection law.
8. International transfers
[Note: Specify hosting region(s) and any subprocessor transfers outside India, consistent with the Privacy Policy §10, once finalized.]
9. Audit rights
The Controller may request reasonable information demonstrating Prebit Engage's compliance with this DPA.
10. Liability
Liability under this DPA is subject to the limitation of liability in the Terms of Service §9.
11. Contact
Data protection queries: [email protected]