Data processing addendum

1. Parties, scope and order of precedence

This data processing addendum ("DPA") is concluded between you, the AFFIX customer ("Controller"), and LTD AFFIX SERVICE, company ID 400431868, the registered address shown for company ID 400431868 in the Public Registry of Georgia (napr.gov.ge) ("AFFIX" or "Processor"). It forms part of the terms and conditions and applies for as long as AFFIX processes personal data on your behalf.

It covers personal data that AFFIX processes for you when it hosts your website, shop, forms, bookings, customer accounts and email, runs AI Studio on your site or a site you connect, and syncs a connected Shopify store ("Customer Personal Data"). Data about you as our customer (your account, billing) is processed by AFFIX as a controller under the privacy policy.

If this DPA conflicts with the terms, this DPA prevails. If the standard contractual clauses incorporated below apply and conflict with this DPA, the standard contractual clauses prevail.

2. Details of the processing

• Subject matter and nature: hosting, storage, display, transmission, backup, email delivery, AI-assisted editing and support of your website and services.
• Purpose: providing the AFFIX services you ordered, under your instructions.
• Duration: for the term of your services, plus the deletion periods in section "Deletion and return".
• Data subjects: visitors of your website, your customers and prospective customers, people who fill in your forms, book, subscribe or apply, your email correspondents, and your staff with access to your site.
• Categories of data: identification and contact details (name, email, phone, address), order, booking and delivery details, account details, messages and form contents, uploaded files, technical data (IP address, browser, cookie identifiers), and any other data you choose to collect.
• Special categories: only if you collect them (for example prescriptions in a pharmacy template). You are responsible for having a legal basis and for telling us if extra safeguards are needed.

3. Your instructions

AFFIX processes Customer Personal Data only on your documented instructions. The terms, this DPA and the settings and actions you take in the service are your complete instructions. AFFIX may also process data where the law requires it; it will tell you first unless the law forbids it.

AFFIX will tell you if it believes an instruction breaks data protection law.

You are responsible for the lawfulness of the processing you instruct: for having a legal basis, for your own privacy notice (AFFIX provides a default one you can complete), for the cookie banner settings and for the tools and integrations you enable. Payment, SMS and other providers you connect with your own accounts are your own providers, not AFFIX sub-processors.

4. Confidentiality and security

AFFIX ensures that people authorised to process Customer Personal Data are bound by confidentiality and access it only when needed to provide or support the service.

AFFIX implements appropriate technical and organisational measures, including:

• encryption in transit (HTTPS/TLS) and encryption of secrets, tokens and access details at rest;
• hosting in EU data centres (Hetzner, Germany) with physical access control by the data centre operator;
• separation of customer sites, least-privilege access, two-factor authentication for staff and logging of access to sensitive data;
• regular backups and the ability to restore them, monitoring of availability and security updates;
• protection against attacks through Cloudflare, rate limits and anti-bot checks;
• a process for handling incidents and reviewing these measures.

5. Sub-processors

You give AFFIX general authorisation to use sub-processors. The current list is in the privacy policy, section "Who we share it with": Hetzner Online GmbH (hosting, EU), Cloudflare, Inc. (DNS, delivery and protection), Anthropic, PBC (AI Studio), Twilio Inc. (SMS, only where you have not connected your own provider), and DomainNameAPI (domains you register).

AFFIX imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible to you for their performance.

AFFIX will tell you about any intended addition or replacement of a sub-processor by email at least 30 days in advance. You may object on reasonable data protection grounds within that time; if we cannot resolve the objection, you may end the affected services and receive a refund of the unused part of the period.

6. Assistance

Taking into account the nature of the processing, AFFIX helps you answer requests from data subjects (most data can be viewed, exported, corrected and deleted in your site's admin panel). If a data subject contacts AFFIX directly about your site, AFFIX forwards the request to you and does not answer it itself unless you ask.

AFFIX gives you the information you reasonably need for data protection impact assessments and consultations with supervisory authorities.

7. Personal data breaches

AFFIX notifies you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. AFFIX takes reasonable steps to contain the breach and supports you in notifying authorities and data subjects.

8. International transfers

AFFIX is established in Georgia and stores Customer Personal Data on servers in the EU. Some sub-processors are located in or access data from the USA and other countries.

If you are established in the EU/EEA, or the GDPR applies to your processing, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) are incorporated into this DPA by reference for transfers to AFFIX, with you as data exporter and AFFIX as data importer: Module Two (controller to processor), or Module Three (processor to processor) where you are yourself a processor. For them: clause 7 (docking) applies; under clause 9 option 2 (general authorisation) applies with the 30-day notice above; the optional wording in clause 11 does not apply; under clause 13 the competent supervisory authority is that of your establishment or, if you have none in the EU, that of your EU representative; under clause 17 option 2 applies and, where that law does not allow third-party beneficiary rights, the law of Ireland; under clause 18 the courts of the EU Member State where you are established. Annex I is completed by section "Details of the processing", Annex II by section "Confidentiality and security" and Annex III by the list of sub-processors.

If the UK GDPR applies, the International Data Transfer Addendum to the EU standard contractual clauses issued by the UK Information Commissioner applies in the same way. If the Swiss data protection law applies, the clauses apply with the references adapted to it and the Swiss supervisory authority competent.

If you are established in Georgia, transfers are made under Articles 37 and 38 of the Georgian Law on Personal Data Protection.

For onward transfers AFFIX uses the standard contractual clauses with its sub-processors or their certification under the EU-US Data Privacy Framework.

9. Information and audits

AFFIX makes available to you on request the information needed to demonstrate compliance with this DPA. Where that is not enough, you may audit AFFIX, by yourself or through an independent auditor bound by confidentiality, once a year with 30 days' notice, during business hours and without disrupting the service or other customers' data; you bear your own costs. Audits required by a supervisory authority or after a breach are not limited in number.

10. Deletion and return

Before your services end you can export Customer Personal Data from your site's admin panel and mailboxes. After a service ends, AFFIX deletes Customer Personal Data according to the periods in the privacy policy, and removes it from backups when they are overwritten in the normal rotation, unless the law requires it to be kept.

11. Liability and term

Each party's liability under this DPA is subject to the liability section of the terms, except where the standard contractual clauses or mandatory law provide otherwise. This DPA ends when AFFIX no longer processes Customer Personal Data for you.

Questions about this DPA: [email protected]. If your organisation needs a signed copy, write to us and we will countersign this text.