Data Processing Agreement

1. Parties

Controller: the customer using MarketSolve under the Terms ("Customer").

Processor: MarketConsultive GmbH, Allgäuerstraße 35, 87719 Mindelheim, Germany, represented by its Managing Director Abdullah Gül ("Processor"). MarketSolve is a brand of MarketConsultive GmbH.

2. Conclusion

This DPA is concluded electronically when the Customer accepts the Terms during sign-up. No separate signature is required.

3. Subject matter and duration

3.1 This DPA covers the processing of personal data by the Processor on behalf of the Customer in providing the MarketSolve products booked by the Customer.

3.2 The term of this DPA corresponds to the term of the service contract, including the trial period. It does not end before the data has been deleted or returned in accordance with section 14.

4. Nature and purpose of processing

Processing comprises collecting, storing, organising, retrieving, using, transmitting and deleting data, solely for the purpose of providing the services:

• Support: receiving, storing and answering customer enquiries by email and website chatbot; generating AI reply drafts; knowledge search.
• Mail: managing contacts, segments and consents; sending newsletters and automated emails; tracking delivery, opens and clicks.
• Reviews: sending review requests; collecting, storing and displaying reviews and photos in the Customer's shop.
• Rechnungen (Invoices): retrieving order data and automatically uploading customs invoices for non-EU orders to MarketPrint.
• Across products: synchronising shop and order data from the Shopify store connected by the Customer.

5. Types of data

• End-customer names
• Email addresses and other contact details
• Shipping and billing addresses
• Order data (for example products, amounts, order and shipping status)
• Message content from support requests and chats
• Reviews and uploaded photos
• Records of marketing consents and unsubscribes
• Invoice documents
• Technical usage data related to emails and widgets (for example delivery, open and click events)

6. Categories of data subjects

• End customers and prospects of the Customer
• Newsletter subscribers and other contacts of the Customer
• Persons contacting the Customer through support channels or the chatbot
• Authors of reviews
• Employees of the Customer who use MarketSolve

7. Instructions and obligations of the Processor

7.1 The Processor processes data only on documented instructions from the Customer. The Terms, this DPA and the Customer's settings and actions in the application constitute instructions. The Processor does not process the data for its own purposes.

7.2 If the Processor considers an instruction to be unlawful, it will inform the Customer without delay and may suspend its execution until the Customer confirms or changes it.

7.3 If the Processor is legally required to carry out other processing, it will inform the Customer beforehand, unless the law prohibits this.

8. Confidentiality

The Processor only uses personnel who are bound to confidentiality or subject to a statutory duty of secrecy. Access to customer data is limited to persons who need it to provide the services.

9. Technical and organisational measures

The Processor implements appropriate measures under Art. 32 GDPR, in particular:

• Hosting in the EU (Frankfurt)
• Encryption in transit via TLS
• Encryption of stored data at rest
• Additional encryption of stored credentials (for example API keys) using AES-256-GCM
• Strict tenant separation through row-level security in the database
• Role-based access control
• Regular backups
• Logging of security-relevant events

10. Subprocessors

The Customer grants general authorisation for the use of subprocessors. The current subprocessors are:

• Vercel Inc., USA: hosting of the applications, region Frankfurt (fra1)
• Supabase: database, file storage and authentication, region EU (Frankfurt)
• Amazon Web Services (AWS) Simple Email Service: email sending, region eu-central-1 (Frankfurt)
• Postmark (ActiveCampaign LLC), USA: receiving and sending support emails
• Anthropic PBC, USA: generating AI reply drafts; data is not used for training
• OpenAI, USA: embeddings for knowledge search

11. Changes and obligations regarding subprocessors

11.1 The Processor will notify the Customer by email in advance of any intended changes. The Customer may object within 30 days for a valid data protection reason. If the parties cannot reach agreement, the Customer may terminate the affected subscription for cause.

11.2 The Processor contractually binds subprocessors to data protection obligations equivalent to those in this DPA.

11.3 Shopify is not a subprocessor of the Processor. The Shopify store is the Customer's own system, which the Customer connects to MarketSolve. The same applies to MarketPrint as the recipient of customs invoices in the Rechnungen (Invoices) product.

12. International transfers

Transfers to subprocessors outside the EU/EEA take place only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of the EU Standard Contractual Clauses and, where the recipient is certified, the EU-U.S. Data Privacy Framework.

13. Assistance to the Customer

13.1 The Processor assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects (Art. 15 to 22 GDPR). If a data subject contacts the Processor directly, the Processor forwards the request to the Customer.

13.2 The Processor also assists the Customer with its obligations under Art. 32 to 36 GDPR, to the extent the information available to it allows.

13.3 The Processor notifies the Customer of personal data breaches without undue delay, and at the latest within 48 hours of becoming aware of them, providing the information required under Art. 33(3) GDPR to the extent available to it.

14. Deletion and return after termination

After the services end, the Customer can export its data via its account for 30 days. The Processor then deletes the data, including any copies, unless there is a legal obligation to retain it. Data in backups is overwritten in the course of regular backup cycles.

15. Evidence and audits

On request, the Processor provides the Customer with the information necessary to demonstrate compliance with this DPA. The Customer may carry out audits, including inspections, itself or through an auditor bound to confidentiality. Inspections must be announced with reasonable notice, as a rule at least 30 days, carried out during normal business hours and must not disproportionately disrupt operations. Compliance may also be demonstrated through current audit reports or certifications.

16. Liability and final provisions

16.1 Liability is governed by Art. 82 GDPR and otherwise by the liability provisions of the Terms.

16.2 In the event of conflict between this DPA and the Terms on data protection matters, this DPA prevails.

16.3 German law applies. The place of jurisdiction is Memmingen, Germany, to the extent legally permissible. Should any provision be invalid, the validity of the remaining provisions remains unaffected.