Data Processing Addendum

Last updated: 12 August 2026

1. Purpose and precedence

This DPA supplements the Merchant Terms where YoopCart processes personal data on behalf of a merchant. It prevails for that processing if it conflicts with the Merchant Terms.

2. Roles and instructions

The merchant is controller and YoopCart is processor unless applicable law assigns another role. YoopCart processes merchant customer data only on documented instructions contained in the agreement, product configuration, support requests, and lawful use of the Services, unless law requires otherwise.

3. Processing details

Processing supports hosting and operating stores, accounts, catalogues, carts, checkout, orders, customers, communications, security, support, reporting, backups, and selected integrations. Data may include identity, contact, billing and shipping details; account and order data; store activity; device and network information; support data; and any personal data entered by the merchant. Data subjects may include customers, visitors, merchant staff, suppliers, and contacts. Processing continues for the agreement and documented retention period.

4. Processor obligations

YoopCart will maintain confidentiality; ensure authorised personnel are bound by confidentiality; implement appropriate technical and organisational safeguards; assist with data-subject requests, security, impact assessments, and regulator consultations where reasonably required; delete or return data at the end of the Services subject to lawful retention; and provide information reasonably necessary to demonstrate compliance.

5. Security incidents

After confirming a personal data breach affecting merchant customer data, YoopCart will notify the merchant without undue delay and provide available information reasonably required for the merchant's obligations. YoopCart will investigate, contain, mitigate, and remediate the incident. Notice is not an admission of fault.

6. Subprocessors

The merchant provides general authorisation for subprocessors needed to provide the Services. YoopCart remains responsible for imposing data-protection obligations appropriate to the processing. We will make a current subprocessor list available and provide notice of material additions where required, with a reasonable objection process for substantiated data-protection concerns.

7. International transfers

Where protected personal data is transferred outside the EEA, UK, or Switzerland without an adequacy decision, the parties incorporate the applicable standard contractual clauses and supplementary safeguards. The appropriate controller-to-processor module applies unless the transfer requires another module.

8. Merchant obligations and audits

The merchant must have a lawful basis, provide required notices, honour individual rights, configure the Services appropriately, protect credentials, and give lawful instructions. Audits should first use current security documentation and independent reports; additional audits require reasonable notice, confidentiality, limited scope, and reimbursement of exceptional costs unless a material breach is found.

9. Contact

Data-protection questions and subprocessor requests may be sent to privacy@yoopcart.com.