DATA PROCESSING ADDENDUM (DPA)

This Data Processing Addendum ("DPA") supplements and forms an integral part of the Terms of Service and Privacy Policy entered into by and between Aheadworks Inc. (hereinafter - “we”, “us”, “LangShop”)  and the entity or individual agreeing to these terms ("Controller", "Merchant", or "you").

1. DEFINITIONS AND INTERPRETATION

1.1 "Applicable Data Protection Law" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA), as amended from time to time.

1.2 "E-Commerce Platforms" means the supported digital commerce platforms through which LangShop application services are deployed, integrated, or installed, including but not limited to Shopify, Magento Open Source, and Adobe Commerce.

1.3 "Personal Data", "Controller", "Processor", "Processing", "Data Subject", and "Personal Data Breach" shall have the meanings given to them under Applicable Data Protection Law.

1.4 "Service Data" means data, store content, catalog data, and metadata processed by LangShop on behalf of the Merchant to provide localization and translation services across supported E-Commerce Platforms.

2. SCOPE AND NATURE OF PROCESSING

2.1 Role of the Parties: The Merchant acts as the Data Controller with respect to any Personal Data processed via the LangShop Application, and LangShop acts as a Data Processor.

2.2 Excluded Customer Data: Merchant acknowledges and agrees that LangShop's primary function is storefront content localization and catalog translation. LangShop does not access, request, collect, store, or process shopper/customer transaction data, payment/financial details, customer account passwords, or order histories managed by Shopify, Magento Open Source, Adobe Commerce, or associated merchant databases.

2.3 Details of Processing:

• Subject Matter: Provision of the LangShop multi-platform storefront localization, catalog management, and multi-language translation platform across supported E-Commerce Platforms (Shopify, Magento Open Source, and Adobe Commerce).

• Duration: The duration of the Agreement plus the period from Agreement termination until deletion or return of data in accordance with Section 8 of this DPA.

• Categories of Data Subjects: Merchant's staff, administrative account owners, system administrators, and store managers interacting with the LangShop application interface or extension backend.

• Types of Data Processed:

• Merchant Personal Data: Merchant account owner name, email address, store URL/domain, preferred language, API access credentials/tokens, and support request history.

• Storefront & Catalog Content (Non-Personal Commercial Data): Product titles, product descriptions, category/collection titles, blog posts, static pages, CMS blocks, dynamic app texts, theme strings, and store catalog metadata.

3. PROCESSOR OBLIGATIONS

3.1 Compliance with Instructions: LangShop shall process Personal Data strictly on documented instructions from the Merchant, including with respect to transfers of Personal Data to a third country or an international organization, unless required to do so by applicable legal obligations.

3.2 Confidentiality: LangShop ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Security Measures: LangShop shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as set forth in Section 5 below.

4. SUB-PROCESSORS AND PROCESSING LOCATIONS

4.1 Primary Application Infrastructure & Processing Location: LangShop's central application infrastructure, databases, and application hosting are hosted with Hetzner Online GmbH in secure data centers located in Germany (EU) and Finland (EU).

4.2 Authorized Third-Party Sub-processors: Merchant grants general written authorization to LangShop to engage the sub-processors listed below to assist in delivering the Services across supported platforms:

4.3 Changes to Sub-processors: LangShop shall inform the Merchant of any intended changes concerning the addition or replacement of sub-processors by updating its online Privacy Policy.

5. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

LangShop implements industry-standard technical and organizational security controls across all supported platform integrations, including:

• Data Encryption: All data in transit across public networks is encrypted using SSL/TLS protocol. Data at rest in primary hosting environments (Hetzner) is secured under modern encryption standards.

• Access Control: Strict role-based access limits (RBAC) based on the principle of least privilege for backend management and integration key management.

• System Integrity: Continuous monitoring, vulnerability management, and regular security updates across server environments.

6. DATA BREACH NOTIFICATION

LangShop shall notify the Merchant without undue delay (and in any event within 72 hours) upon becoming aware of a confirmed Personal Data Breach affecting Merchant Personal Data, and shall provide reasonable cooperation and information to assist Merchant in meeting its security breach notification obligations under Applicable Data Protection Law.

7. DATA SUBJECT RIGHTS AND AUDIT COOPERATION

7.1 Assistance with Requests: Taking into account the nature of the processing, LangShop shall assist the Merchant by appropriate technical and organizational measures, insofar as possible, in fulfilling Merchant's obligation to respond to Data Subjects' requests exercising their rights under Applicable Data Protection Law.

7.2 Audits and Inspections: LangShop shall make available to the Merchant all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA. If an audit is required under Applicable Data Protection Law, it shall be conducted during normal business hours upon reasonable prior written notice, without unreasonably disrupting LangShop's operations.

8. TERM, DELETION, AND RETURN OF DATA

Upon uninstallation of the LangShop application/extension or termination of the Agreement, LangShop shall delete or return all Personal Data to the Merchant in accordance with the retention schedule set forth in our Privacy Policy and relevant platform compliance guidelines, unless retention is required by applicable law.

9. GOVERNING LAW

This DPA shall be governed by and construed in accordance with the governing law and jurisdiction specified in the LangShop Terms of Service.