Data Processing Addendum (DPA)

1. Definitions

• Personal Data: any information relating to an identified or identifiable natural person processed by the Customer, or by third parties acting on the Customer's behalf, through the Service.
• Data Subject: the natural person to whom the Personal Data relates.
• Controller: the natural or legal person who determines the purposes and means of processing Personal Data. In this DPA, the Customer.
• Processor: the natural or legal person who processes Personal Data on behalf of the Controller. In this DPA, Fenicia.
• Sub-processor: third parties engaged by Fenicia to perform part of the processing, listed on the Subprocessors page.
• Security Incident: any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

2. Roles of the Parties

The Customer acts as Controller of the Personal Data it uploads, transmits, or has processed through the Service (e.g., data of its own end customers, suppliers, business contacts). Fenicia acts as Processor, processing such data on behalf of and following instructions from the Customer.

Fenicia acts as Controller only with respect to the Customer's own Account data (admin user data, billing, Service usage metrics), which is governed by our Privacy Policy.

3. Scope of Processing

Details of the processing (subject matter, duration, nature, purpose, categories of data and data subjects) are described in Annex I of this DPA. Processing is strictly limited to what is necessary to provide the Service in accordance with the Terms and Conditions and the Customer's documented instructions.

4. Customer Instructions

Fenicia shall process Personal Data only in accordance with the Customer's documented instructions, including those contained in the Terms, this DPA, and the Service configuration the Customer sets through the admin panel. Any instruction outside this framework must be formalized in writing.

If Fenicia considers that a Customer instruction infringes applicable law, Fenicia shall notify the Customer without undue delay and may suspend the execution of such instruction until its confirmation, modification, or withdrawal.

5. Personnel Confidentiality

Fenicia warrants that all personnel authorized to process Personal Data:

• Are bound by contractual or statutory confidentiality obligations surviving termination of employment.
• Have received adequate training on data protection and information security.
• Access Personal Data solely on a least-privilege basis and to the extent necessary to perform their duties.

6. Technical and Organizational Measures (Security)

Fenicia shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with GDPR art. 32 and LFPDPPP art. 19. Minimum measures include:

• Encryption in transit: TLS 1.2 or higher for all external communications.
• Encryption at rest: AES-256 for data stored in databases and object storage.
• Multi-tenant isolation: logical segregation of data between Customers via the tenantId field, enforced across all database queries.
• Access control: multi-factor authentication for personnel with production access; RBAC with granular permissions.
• Audit logs: traceability of access to production systems and Customer data.
• Backups: automated daily backups of operational databases, with periodic restore testing.
• Vulnerability management: automated dependency scanning, security patches applied according to an internal severity-based SLA.
• Incident response plan: documented procedure for detection, containment, eradication, recovery, and notification.

Full details of the measures implemented are described in Annex II.

7. Sub-processors

The Customer authorizes Fenicia to engage the sub-processors listed at /en/subprocessors, which process Personal Data on Fenicia's behalf for the provision of the Service.

General authorization with right to object. Fenicia shall notify the Customer, at least thirty (30) calendar days in advance, of any addition, removal, or replacement of sub-processors relevant to the Service, by updating the Subprocessors page and notifying the Billing Contact if the Customer is subscribed to notifications. The Customer shall have such period to object in writing to legal@fenicia.io on reasonable data protection grounds.

Sub-processor obligations. Fenicia shall impose on each sub-processor data protection obligations equivalent to those of this DPA through a written contract, and shall remain liable to the Customer for the performance of such obligations by the sub-processor.

8. Data Subject Rights (DSAR)

Fenicia shall reasonably assist the Customer in responding to Data Subject requests to exercise their rights of access, rectification, erasure, restriction, portability, and objectionunder GDPR, or equivalent rights under LFPDPPP (ARCO: Access, Rectification, Cancellation, Opposition), through the self-service tools available in the Service.

If a Data Subject contacts Fenicia directly to exercise its rights over data under the Customer's responsibility, Fenicia shall forward the request to the Customer without undue delay and shall not respond directly, unless otherwise instructed by the Customer.

9. Security Incident Notification

Fenicia shall notify the Customer without undue delay and, in any case, within seventy-two (72) hours after becoming reasonably aware of a Security Incident affecting the Customer's Personal Data. The notification shall be sent to the Billing Contact and to the security contact designated by the Customer (if any) and shall include, to the extent information is available:

• Description of the nature of the Incident.
• Categories and approximate number of Data Subjects and records affected.
• Likely consequences.
• Measures taken or proposed to mitigate possible adverse effects.
• Contact details for further information.

Fenicia shall reasonably cooperate with the Customer in fulfilling its notification obligations to supervisory authorities and, where applicable, to affected Data Subjects.

10. Data Protection Impact Assessments (DPIA) and Prior Consultation

Fenicia shall provide the Customer, upon reasonable request and at bearable cost, with the information and assistance necessary for the Customer to comply with its obligations to carry out Data Protection Impact Assessments and, where applicable, prior consultation of the supervisory authority.

11. International Transfers

Personal Data is processed primarily in infrastructure located in the United States of America (AWS region us-east-1). Where Personal Data is transferred from a jurisdiction requiring additional safeguards (e.g., the European Economic Area to the United States), such transfers shall be based on:

• The European Union Standard Contractual Clauses (SCC) adopted by Commission Decision 2021/914, Module 2 (Controller to Processor), which are deemed incorporated into this DPA by reference and shall prevail in case of conflict.
• Any other valid transfer mechanism under applicable law at the time of the transfer.

12. Return and Deletion of Data upon Termination

Upon termination of the contract, in accordance with the cycle described in §§ 4.5 and 11B of the Terms, the Customer will have a thirty (30) calendar day window to export its Personal Data through the export tool available in the Service.

After such period, Fenicia shall proceed to definitive deletion of the Customer's Personal Data from operational production systems and, within a reasonable additional period, from backups. Excepted from deletion is data that Fenicia is legally required to retain, which shall be blocked from any further processing beyond the legally required retention period.

13. Audits

Fenicia shall make available to the Customer, upon reasonable request and subject to confidentiality obligations, the information necessary to demonstrate compliance with the obligations under this DPA. Such information may include:

• Summaries of security policies and procedures.
• Certifications and audit reports of Fenicia and its relevant sub-processors (e.g., SOC 2 Type II, ISO 27001), to the extent available.
• Responses to reasonable security questionnaires.

On-site audits are contemplated only upon express requirement from a supervisory authority, or where the information above is insufficient to demonstrate compliance, and shall be conducted upon reasonable notice, during business hours, without interfering with Fenicia's operations, and at the Customer's cost.

14. Liability

The parties' liability under this DPA is subject to the limitations set forth in § 9 of the Terms and Conditions. Where the SCCs prevail and establish a different liability regime, those provisions shall apply with respect to the international transfers they cover.

15. Term and Relationship with the Terms

This DPA shall remain in force as long as Fenicia processes Personal Data on behalf of the Customer. Obligations regarding confidentiality, data deletion, and incident notification shall survive termination to the extent applicable. In the event of conflict between this DPA and the Terms and Conditions regarding the processing of Personal Data, this DPA shall prevail.

Annex I — Processing Details

Subject Matter

Provision of the SaaS e-commerce platform Service in accordance with the Terms.

Duration

Duration of the contract, plus the post-termination retention periods set forth in the Terms and in § 12 of this DPA.

Nature and Purpose

Collection, storage, structuring, consultation, use, communication by transmission (to integrations selected by the Customer), comparison, combination, restriction, erasure, and deletion of Personal Data, for the sole purpose of providing the Service's functionalities.

Categories of Data Subjects

• Customer's end customers (buyers on connected channels).
• Customer's suppliers and business contacts.
• Customer's employees and internal users accessing the Service.

Categories of Personal Data

• Identification data (first name, last name).
• Contact data (email, phone, postal address).
• Transactional data (order history, amounts, tokenized payment methods).
• Shipping data (delivery addresses, logistic preferences).
• Customer tax data (RFC, legal name) for enterprise contracts with OTH.
• Technical identifiers (user IDs, marketplace account IDs, access logs).

Fenicia does not store payment card data on its systems; payments are processed directly through Stripe pursuant to Stripe's own PCI DSS compliance.

Special Categories of Data

The Service is not designed to process special categories of personal data (health data, racial origin, political opinions, biometric data, etc.). The Customer undertakes not to upload such categories to the Service without Fenicia's prior express written authorization.

Annex II — Technical and Organizational Measures

1. Physical security

The Service infrastructure is hosted in Amazon Web Services (AWS) data centers in the us-east-1 region, subject to the physical controls documented in AWS's SOC 2 and ISO 27001 reports.

2. Logical access control

• Mandatory multi-factor authentication for personnel with production access.
• Least-privilege principle with granular RBAC.
• Periodic access reviews and revocation upon role change.

3. Encryption

• In transit: TLS 1.2+ for all external and inter-service communications.
• At rest: AES-256 for databases (MongoDB Atlas) and object storage (AWS S3).
• Secrets managed via AWS Secrets Manager.

4. Multi-tenant isolation

All database records are segregated by the tenantId field. Database queries are filtered by tenantId at the service layer, enforced through code review and automated internal rules.

5. Backups and recovery

• Automated daily backups of operational databases.
• Backup retention under documented internal policies.
• Periodic restore testing.

6. Monitoring and incident response

• Centralized application and infrastructure event logging (AWS CloudWatch).
• Automated alerting on anomalous events.
• Documented incident response plan with defined roles and escalation paths.

7. Vulnerability management

• Automated dependency scanning at every build (CI/CD).
• Patching based on severity.
• Security-focused code reviews (OWASP ASVS).

8. Training and awareness

Periodic data protection and information security training for all personnel with access to production systems or Customer data.

Contact

For any matters related to this DPA or to Personal Data processing: