Merchant Data Processing Addendum

1. Parties, effect and roles

This Data Processing Addendum (DPA) forms part of the UVAON Daily App Terms of Service only after it is published, expressly incorporated into those Terms and accepted by the Shopify merchant identified by its installed store (Merchant). USMIH Ltd., str. Sofia 65a, 1225 Sofia, Bulgaria, VAT BG207299888, info@seoexpert.bg (USMIH), processes Merchant Personal Data on the Merchant's behalf. “Merchant Personal Data” means information relating to an identified or identifiable person that USMIH processes for the Merchant through the app, as described in Schedule A. The Merchant is the controller of that data or, where it acts for another controller, is a processor authorized to appoint USMIH as a subprocessor. The Merchant is responsible for its lawful basis, notices, required consent and instructions. USMIH is responsible for its processor obligations under this DPA. Processing for which USMIH independently determines purposes and means, such as its own account, billing or security administration, is outside this DPA and remains subject to applicable law and the Privacy policy.

2. Instructions and purpose limits

USMIH will process Merchant Personal Data only on documented Merchant instructions and for the purposes in Schedule A, including instructions about transfers outside the European Economic Area (EEA), unless applicable law requires otherwise. Installation, feature settings, authorized staff actions, Shopify privacy requests and written instructions accepted by USMIH are documented instructions. USMIH will inform the Merchant before legally required processing unless the law prohibits notice. If USMIH considers an instruction to infringe applicable data-protection law, it will inform the Merchant without undue delay and may pause the affected processing while the parties resolve it. USMIH will not sell Merchant Personal Data or use it for third-party advertising.

3. Confidentiality and security

USMIH will restrict access to people who need Merchant Personal Data to provide, secure or support the app and ensure they are bound by confidentiality commitments or an equivalent legal duty. It will maintain technical and organizational measures appropriate to the risk, including Schedule B, and may replace a measure with one offering no materially lower overall protection. This does not promise a particular certification, uninterrupted availability or protection against every incident.

4. Subprocessors and objections

The Merchant gives general authorization to the subprocessors in Schedule C and their authorized subprocessors disclosed through the provider lists linked there. USMIH will bind its direct subprocessors to data-protection obligations providing materially equivalent protection for their work, require equivalent obligations in the onward processing chain, and remain responsible to the extent required by applicable law. Shopify is the Merchant's commerce platform and is not listed merely because the app connects to Shopify.

USMIH will maintain a current list of its direct subprocessors and links to their upstream subprocessor lists at the published DPA URL. For a subprocessor that USMIH directly adds or replaces, USMIH will notify the Merchant through the app or its registered contact at least 30 days before the change. The Merchant may object within 14 days of that notice on reasonable data-protection grounds. USMIH will consider a timely objection and seek a workable resolution before making the direct appointment. For an urgent security or continuity replacement, USMIH will notify the Merchant as soon as reasonably possible, explain the urgency and consider objections without undue delay.

Where an existing subprocessor proposes a change to its own subprocessors, USMIH will monitor the provider's designated notice channel and relay the notice to the Merchant without undue delay after receipt. The notice will identify the proposed change, the provider's planned effective date, the applicable provider objection deadline and the time remaining to raise an objection. Provider-controlled changes are subject to the provider's actual notice process; the 30-day notice and 14-day objection periods for USMIH's direct appointments do not apply to them.

For an upstream change, the Merchant may send a reasoned data-protection objection to USMIH before the provider objection deadline stated in the notice. USMIH will promptly assess the objection, raise it with the provider within the provider's applicable process where time permits, and discuss reasonable safeguards or a commercially workable alternative with the Merchant. If the available notice period is insufficient for that process, USMIH will explain the limitation and discuss mitigation or discontinuation of the affected service. An objection received after the provider's deadline will still be reviewed by USMIH but may not be capable of preventing the provider's change.

An objection does not itself postpone an upstream change, suspend the provider's processing or require immediate removal of stored data or backups. If no workable resolution is available, the Merchant may discontinue the affected feature or terminate its use of the app by uninstalling it. Hosting or database dependencies may require termination of the app as a whole rather than disabling one feature. Before uninstalling, the Merchant must complete any chosen export or return and verify receipt of a usable copy; a request alone does not delay uninstall-triggered deletion. Return, deletion and residual provider retention are governed by section 7 and the Privacy policy. Charges and adjustments remain governed by the Terms and Shopify billing conditions. This process does not limit any mandatory rights or obligations under applicable data-protection law.

5. International transfers

USMIH will not transfer Merchant Personal Data outside the EEA, United Kingdom or Switzerland, where applicable, without a lawful transfer basis and safeguards required by applicable law. Render hosts the app and database in Frankfurt, but its terms permit US processing/transfers. Resend sends Back in Stock mail from its Ireland sending region while storing message content and delivery records in the United States. USMIH will maintain applicable transfer safeguards under the Render DPA and Resend DPA, including their contractual transfer mechanisms where required, and make relevant transfer information reasonably available to the Merchant. An EU sending region does not imply EU-only storage. This DPA alone does not replace Standard Contractual Clauses required for a particular transfer.

Google Workspace processes the limited privacy/support case metadata described in Schedule A internationally under USMIH's applicable Google Cloud Data Processing Addendum, including its applicable transfer safeguards.

6. Rights assistance, incidents and regulatory help

Taking account of the processing and information available to it, USMIH will reasonably assist the Merchant with individual rights requests, including access, correction, deletion, restriction, portability and objection, through authorized app export/redaction tools and info@seoexpert.bg. The Merchant verifies identity and decides the response. USMIH will also reasonably assist with security, breach notifications, data-protection impact assessments and prior consultation where applicable to its processing.

USMIH will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting Merchant Personal Data. It will provide known facts about the incident, affected data and people, likely consequences and measures taken or proposed, and update them as more becomes available. It will cooperate on containment and remediation. The Merchant remains responsible for its own notifications to authorities and individuals.

7. Return, deletion and retention

During service the Merchant may use available authenticated exports or request a return of Merchant Personal Data in a reasonably usable electronic form. If the Merchant chooses return before ending service, it must complete the export or return and verify that it has received a usable copy before uninstalling the app. USMIH will reasonably assist with that return while the app remains installed. Submitting a return request does not pause or hold uninstall-triggered deletion. Uninstalling instructs deletion of the remaining app-held active records; the Merchant may also end service with deletion without return. USMIH will identify any legally required retention unless prohibited and restrict retained data to that purpose.

Deletion of active app records does not immediately erase Render recovery data, created logical exports, service logs, or Resend's message records and backups. Those copies remain protected and cycle out under separately disclosed provider periods; USMIH will not use them for new app purposes and will reapply necessary deletion controls after a backup restore. The Privacy policy states current feature periods and provider behavior. USMIH will give notice of material retention changes under the Terms. This clause is not an exact-second deletion guarantee.

The manual Google Workspace case register is managed separately from app-uninstall deletion. Removing a row does not immediately erase its prior contents from Google Sheets version history. Case retention, file-level deletion and Google's residual recovery/deletion periods are described in the Privacy policy.

8. Demonstration and audit

USMIH will make reasonably necessary information available to demonstrate compliance with this DPA and Article 28 obligations. The Merchant or an independent auditor bound by confidentiality may audit the processing on reasonable prior notice, beginning with documents and remote review where sufficient. If those do not adequately establish compliance, the parties will arrange a proportionate inspection during business hours that protects other customers' data, security secrets and service availability. USMIH will cooperate with competent supervisory authorities as required by law. Provider facilities remain subject to provider audit terms; USMIH will supply available provider reports or contractual information rather than promise direct access to their premises.

9. Priority and changes

If this DPA conflicts with the Terms or Privacy policy about USMIH's processor obligations for Merchant Personal Data, this DPA controls on that issue; other commercial terms remain under the Terms. A material reduction in DPA protection requires advance notice and a valid acceptance or other lawful amendment process. A website edit alone will not retroactively change an accepted DPA. The contact for DPA notices and requests is info@seoexpert.bg; the Merchant's contact is its current Shopify store contact or another address supplied in the app.

Schedule A — processing description

Schedule B — minimum security measures

Store-specific authorization and protected-action checks; minimum necessary staff and service access; confidentiality for authorized personnel; AES-256-GCM field encryption for stored Wishlist customer IDs and Restock addresses; managed PostgreSQL encryption at rest for primary database and backups; TLS for the configured database connection and HTTPS for public/app-to-provider interfaces; secret management; logs designed to avoid raw secrets and request query values; privacy export/redaction procedures; and incident handling under section 6. Provider controls follow their published security terms.

Schedule C — initial subprocessors

Current upstream subprocessor lists for the providers above: Render and Resend and Google Workspace. These linked lists identify the providers' onward processing chain; provider-controlled changes follow section 4.