Parties and scope

This Data Processing Agreement (“DPA”) is between the customer that accepted the Leavecart Terms or an order form (“Customer”) and Polaround OÜ, registry code 14357013, registered at Raba tn 48, Keila, Harju maakond, 76609, Estonia (“Processor”). It applies where Processor handles personal data on Customer’s behalf in connection with Leavecart.

Customer is the controller and Polaround OÜ is the processor unless the parties’ roles differ for a particular activity. This DPA forms part of the agreement and takes priority on personal-data processing matters.

Documented instructions

Processor will process personal data only on Customer’s documented instructions, including the agreement, Customer’s product settings, approved integrations, support requests, and lawful written directions. Processor will notify Customer if an instruction appears to infringe applicable data protection law, unless prohibited from doing so.

Processor obligations

Processor will:

• ensure people authorized to process personal data are bound by confidentiality;
• maintain appropriate technical and organizational security measures;
• assist Customer, taking account of the nature of processing, with data-subject requests, security, breach notifications, impact assessments, and regulator consultations;
• keep information needed to demonstrate compliance and provide it to Customer on reasonable request;
• delete or return personal data after the service ends, at Customer’s choice, unless law requires retention.

Security and incidents

Processor will apply measures appropriate to the risk, including tenant-scoped authorization, role controls, encrypted integration credentials, signed webhook verification, idempotency controls, audit history, privacy-filtered logging, tested releases, and controls that block messaging when configured safeguards fail.

Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data and will provide available information reasonably required for Customer’s legal obligations. Notification does not constitute an admission of fault.

Subprocessors

Customer gives general written authorization for Processor to use subprocessors needed to provide Leavecart. Processor remains responsible for imposing data protection obligations materially equivalent to this DPA. Processor will give active customers reasonable prior notice of a new subprocessor and a reasonable opportunity to object on substantiated data-protection grounds.

International transfers

Processor will not transfer personal data outside the EEA without a lawful transfer mechanism. Where required, the parties will use an adequacy decision, European Commission standard contractual clauses, or another valid safeguard. Customer authorizes Processor to complete relevant transfer documentation on Customer’s behalf solely as needed to provide the service.

Audits

On reasonable written request, Processor will provide information necessary to demonstrate compliance. If that information is insufficient, Customer may conduct one proportionate audit per year, subject to reasonable notice, confidentiality, security restrictions, and avoidance of disruption. Additional audits are allowed after a material incident or where a regulator requires them. Customer bears its audit costs unless the audit identifies a material breach by Processor.

Processing details

Subject and duration

Provision of conversational commerce recovery, merchant configuration, messaging operations, safety controls, support, and reporting for the term of the agreement and the limited deletion or return period after termination.

Nature and purpose

Collection, organization, storage, retrieval, analysis, transmission, generation, restriction, deletion, and reporting as needed to operate Customer-configured storefront and recovery conversations and measure outcomes.

Data subjects

Customer personnel, merchant customers and prospects, shoppers, recipients of Customer messaging, and individuals represented in Customer support or commerce data.

Personal data

Names, business contact details, phone numbers, email addresses, account and role data, Shopify identifiers, cart and checkout contents, order context, product interests, message content, consent and opt-out state, storefront page context, pseudonymous chat-session identifiers, delivery events, interaction history, and attribution records. Special-category data is not intentionally required and must not be submitted unless expressly agreed in writing with appropriate controls.

Return, deletion, and contact

At Customer’s choice after termination, Processor will return or delete Customer personal data within a reasonable operational period, except where law requires retention or limited backup copies remain subject to protection and deletion cycles. Suppression data may be retained where necessary to honour opt-outs and legal messaging restrictions.

DPA notices and instructions may be sent through the contact page or to polaroundeesti@gmail.com. Changes to this DPA that materially affect active processing will be communicated to Customer and will not reduce mandatory data-protection obligations.