Data Processing Addendum

“Controller,” “Processor,” “Data Subject,” “Personal Data,” and “Personal Data Breach” have the meanings given in the GDPR (Regulation (EU) 2016/679) and, where applicable, the UK GDPR. “Customer Personal Data” means the personal data contained within Merchant Data (as defined in our Terms of Service) that the customer submits to the Service. In this Addendum, the customer is the Controller and Inventory Assassin is the Processor.

Inventory Assassin processes Customer Personal Data solely to provide the Inventory Assassin Service described in our Terms of Service: storing uploaded inventory/sales records, computing diagnostic scores and recommendations, and displaying results back to the customer. Processing continues for the duration of the customer's subscription (or use of the free tier) and ends upon account deletion, as described in Section 4.

• Process Customer Personal Data only on the customer's documented instructions, including as set out in our Terms of Service and this Addendum, unless required otherwise by law (in which case we will inform the customer before processing, unless legally prohibited from doing so).
• Ensure personnel authorized to process Customer Personal Data are subject to confidentiality obligations.
• Implement appropriate technical and organizational security measures, including encryption in transit, database-level row-level security isolating each organization's data, and restricted internal access to production systems (see our Privacy Policy, Section 8).
• Engage subprocessors only as listed in Section 5 below, and update that list before adding a new subprocessor or materially changing an existing one's role, giving the customer the opportunity to object on reasonable data-protection grounds.
• Assist the customer, insofar as reasonably possible, in responding to Data Subject requests (access, correction, erasure, portability, etc.) relating to Customer Personal Data.
• Notify the customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide reasonably available information to help the customer meet its own breach-notification obligations.
• At the customer's choice, delete or return Customer Personal Data at the end of the engagement, except where retention is required by law — see Section 4.
• Make available information reasonably necessary to demonstrate compliance with this Addendum, and allow for reasonable audits or inspections, subject to reasonable advance notice, confidentiality, and no more than once per year absent a Personal Data Breach or legal requirement.

Deleting an account (self-service, from account settings) permanently deletes the organization's Customer Personal Data, including all uploaded inventory/sales records and derived analyses, subject to limited retention of billing records as required for accounting or legal purposes. See our Privacy Policy, Section 6.

Where Customer Personal Data is transferred outside the EEA, UK, or Switzerland to a country not deemed adequate, such transfer is made subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses or a recipient's certification under an approved transfer framework, incorporated here by reference.

This Addendum does not expand either party's liability beyond what is set out in the Terms of Service's limitation of liability, except to the extent such limitation is unenforceable against GDPR-mandated liability provisions.

Questions about this Addendum, or a request for a signed counterpart, can be sent to inventoryassassins@gmail.com.