Data Processing Addendum

1. Scope

Reachmerce is a product operated by Kodensoft (kodensoft.com). In these documents, “Reachmerce,” “we,” “us,” and “our” refer to Kodensoft operating the Reachmerce services.

This Data Processing Addendum (“DPA”) forms part of the Agreement between Customer and us when we process Customer Personal Data on Customer’s behalf as a processor or service provider in connection with Reachmerce.

This DPA applies to Shopify-synced customers and orders, campaign leads, call/SMS/email logs stored in Customer’s workspace, and similar Customer Personal Data. It does not replace Customer’s obligations as controller/business with respect to its end customers.

2. Definitions

“Customer Personal Data” means personal data that Customer uploads to or syncs into the Services, or that we process on Customer’s behalf to provide the Services. “Applicable Data Protection Law” includes GDPR, UK GDPR, and CCPA/CPRA where applicable. Terms not defined here have the meaning in the Agreement or Applicable Data Protection Law.

3. Roles

Customer is the controller (or business). We are the processor (or service provider) for Customer Personal Data. For our own account, marketing site, and early-access list data, we act as an independent controller as described in the Privacy Policy.

4. Processing instructions

We will process Customer Personal Data only to provide the Services, per Customer’s documented instructions in the Agreement and product configuration, and as required by law. If we believe an instruction violates Applicable Data Protection Law, we will inform Customer where legally permitted.

5. Confidentiality and security

We will ensure personnel authorized to process Customer Personal Data are bound by confidentiality. We will implement appropriate technical and organizational measures as described on our Security page and as updated to reflect industry practice.

6. Subprocessors

Customer authorizes us to use subprocessors necessary to operate Reachmerce, including cloud hosting, Shopify, Twilio, Stripe, Resend, and AI model providers. We remain responsible for subprocessors’ performance under this DPA. We will impose data-protection terms no less protective than this DPA.

7. Assistance

Taking into account the nature of processing, we will provide reasonable assistance for data subject requests, security incidents, and DPIAs where required by Applicable Data Protection Law and related to our processing of Customer Personal Data.

8. Breach notification

We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably available to help Customer meet its notification obligations.

9. Return and deletion

Upon termination of the Services, we will delete or return Customer Personal Data per the Agreement, except where retention is required by law or permitted for limited backup and dispute purposes.

10. CCPA / CPRA

Where CCPA/CPRA applies, we act as a service provider/contractor: we will not sell Customer Personal Data, retain it for purposes outside providing the Services, or combine it with other data except as permitted by law and the Agreement.

11. Contact

Data protection inquiries: info@kodensoft.com