Data processing addendum

Effective date and application

Effective September 25, 2026 · Version 2026-09-25.1

This Data Processing Addendum ("DPA") forms part of the ShopPath Customer Terms or other written agreement between Customer and Tamga Technologies LLC. It applies only when Tamga processes Customer Personal Data on Customer's behalf.

Roles and instructions

Customer is the controller or business and Tamga is the processor or service provider, unless applicable law uses different terms. Tamga will process Customer Personal Data only to provide, secure, support, troubleshoot, and maintain the contracted ShopPath service; follow Customer's documented configuration and support instructions; comply with law; and perform the activities described in this DPA.

Tamga will not sell Customer Personal Data, share it for cross-context behavioral advertising, or authorize Customer Content or raw Journey Evidence to train a general-purpose artificial-intelligence model without Customer's separate affirmative consent.

Customer responsibilities

Customer will provide lawful instructions, required notices, and a valid legal basis for processing. Customer will limit data submitted to what is necessary for storefront testing and will not intentionally place payment credentials, authentication secrets, or sensitive personal data in a journey.

Confidentiality and security

Tamga will ensure personnel authorized to process Customer Personal Data are bound by confidentiality duties and will maintain reasonable administrative, technical, and organizational safeguards appropriate to the service and risk. Current controls are summarized in the Security overview.

Subprocessors

Customer authorizes Tamga to use the providers listed on the Subprocessor List for the stated purposes. Tamga remains responsible for their performance to the extent required by applicable data-protection law and will impose appropriate confidentiality and data-protection obligations. Active customers may request notice of a material subprocessor change by contacting support.

Requests and compliance assistance

Taking into account the nature of processing and information available, Tamga will provide reasonable assistance with verified data-subject requests, security obligations, impact assessments, regulator inquiries, and demonstrations of compliance. Customer is responsible for responding to requests as controller unless law requires Tamga to respond directly.

Security incidents

Tamga will notify Customer without undue delay after confirming a security incident involving Customer Personal Data and will provide available information reasonably needed for Customer's response. Notice is not an admission of fault. Customer must keep its account and security contacts current.

Deletion and return

During the service, Customer may access reports for the availability period included in its plan and may request deletion through documented account or support channels. Plan-based report expiration closes Customer and public-link access but does not itself delete the underlying Customer Personal Data. After termination or a verified deletion request, Tamga will delete or return Customer Personal Data as required by the agreement, subject to backup cycles, security preservation, and legal obligations.

De-identified information

Tamga may derive aggregated or de-identified information from use of ShopPath only when it cannot reasonably be linked to Customer or a person. Tamga will maintain that information in de-identified form, will not attempt to re-identify it, and will require recipients to apply compatible restrictions where applicable. De-identified information that no longer constitutes personal data is outside this DPA.

International transfers

ShopPath is currently focused on United States customers. If Customer's use requires a restricted transfer from the European Economic Area, United Kingdom, or another jurisdiction, the parties will put an applicable transfer mechanism in place before that data is submitted. Contact support to arrange the required terms.

Audit information

On reasonable written request, Tamga will provide information reasonably necessary to demonstrate compliance with this DPA. If that information is insufficient and applicable law requires an audit, the parties will agree on a scoped, confidential audit that minimizes disruption and avoids access to other customers' data. Customer bears its audit costs unless a material breach is found.

Processing details

Subject matter and purpose: approved storefront journey execution, evidence storage, reporting, analysis, support, billing, security, and service operation. Duration: the service term plus the applicable deletion period. Data subjects may include Customer users, storefront personnel, and individuals whose information is publicly visible in captured storefront content. Data may include business contact data, account identifiers, public storefront content, URLs, screenshots, recordings, and diagnostic metadata. Customer should not submit sensitive data.

Order of precedence and contact

If this DPA conflicts with the Customer Terms on personal-data processing, this DPA controls. All other terms remain in effect. Questions may be sent to support@getshoppath.com.