Data Processing Agreement

1. Parties and Scope

This DPA is entered into between Legendary Index, Lda, a company established in São Brás de Alportel, Portugal ("Processor", "we"), and the merchant that installs or uses the IndexGPT Shopify application ("Controller", "you"). It governs our processing of personal data on your behalf in connection with the App, and takes precedence over any conflicting provision of the Terms of Service in respect of that processing.

2. Roles of the Parties

You are the controller of the personal data processed through the App on your behalf. We are the processor. Where we process personal data for our own purposes, such as administering your account, securing our systems, billing and communicating with you as our customer, we act as a controller and that processing is governed by our Privacy Policy rather than this DPA.

3. Subject Matter, Duration, Nature and Purpose

The subject matter is the provision of the App. The processing lasts for as long as the App is installed, plus the deletion period in section 11. The nature and purpose of the processing is to collect, store, organise, analyse and transmit store content and settings in order to deliver the features you use, including AI SEO scoring, indexing submissions, llms.txt and schema generation, brand and sentiment analysis, prompt tracking, and content generation.

4. Categories of Data Subject

The personal data processed under this DPA relates to you and to the users you authorise: the store owner, staff accounts and collaborators who use the App, and any individual whose name you choose to enter into the App, for example an author name used on generated content.

5. Types of Personal Data

Name, business email address, store name and domain, App configuration and preferences, usage and technical metadata, and any personal data contained in store content you instruct us to process. The App does not request access to your customers or orders, and we therefore do not process your customers’ personal data. You must not deliberately submit customer personal data, special category data under Article 9 GDPR, or children’s data into free-text fields in the App.

6. Our Obligations

• We process personal data only on your documented instructions, which include your use of the App and its features. The Terms of Service, this DPA and your configuration constitute your complete instructions.
• We notify you if, in our opinion, an instruction infringes applicable data protection law.
• We ensure that personnel authorised to process personal data are bound by an obligation of confidentiality.
• We implement and maintain the technical and organisational measures described in section 12.
• We do not use personal data processed on your behalf to train, fine-tune or develop machine learning models, and we do not permit any sub-processor to do so.
• We do not sell personal data or disclose it for cross-context behavioural advertising.

7. Your Obligations

• You determine the purposes of the processing and are responsible for having a lawful basis for it.
• You are responsible for the accuracy of the data you make available through the App, and for any content you publish using it.
• You are responsible for issuing your own privacy notices to your data subjects where required.
• You must not instruct us to process data in a way that breaches applicable law.

8. Sub-Processors

You give us general written authorisation to engage sub-processors. Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than this DPA, and we remain fully liable to you for their performance. Our current sub-processors, including the purpose and region of each, are published at indexgpt.app/sub-processors. We will update that page before a new sub-processor begins processing, and will notify you at least 30 days in advance if you have asked us in writing to be notified. You may object on reasonable grounds relating to data protection within that period; if we cannot offer a reasonable alternative, you may terminate the affected part of the service without penalty.

9. International Transfers

Where we or a sub-processor transfer personal data outside the European Economic Area, the transfer is made under the European Commission’s Standard Contractual Clauses (Decision 2021/914) or another lawful transfer mechanism, together with supplementary measures where appropriate. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies. The Standard Contractual Clauses are incorporated into this DPA by reference, with Module Two applying between you and us; you appoint us to enter into the Clauses with onward sub-processors on your behalf.

10. Assistance to the Controller

• We assist you, by appropriate technical and organisational measures and taking into account the nature of the processing, in responding to requests from data subjects exercising their rights.
• We assist you with data protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to us.
• We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data processed on your behalf, and provide the information reasonably available to us so that you can meet your own notification obligations.
• We promptly inform you if we receive a request from a data subject or an authority relating to personal data processed on your behalf, unless we are legally prohibited from doing so, and we do not respond to such a request ourselves except on your instruction or where legally required.

11. Deletion and Return

On uninstall, on termination, or on your written request, we delete or anonymise the personal data we process on your behalf within 30 days. Copies held in encrypted backups are removed as those backups rotate, within 90 days. We may retain personal data where and for as long as required by law, in which case we continue to protect it under this DPA and process it only for the purpose that requires its retention. On request made before deletion, we make available to you the data associated with your store in a commonly used format.

12. Security Measures

• Encryption of personal data in transit over public networks using current TLS versions.
• Access control and authentication for administrative and production access, granted on a least-privilege basis and reviewed when roles change.
• Separation of production, staging and development environments.
• Storage of API credentials and access tokens in access-controlled configuration, not in source code.
• Logging and monitoring of system and application activity, with alerting on error conditions.
• Managed infrastructure providers that maintain physical security, redundancy and backup of the underlying platform.
• Deletion routines that remove store data on uninstall or on request, as described in section 11.
• Confidentiality obligations for all personnel with access to personal data.

13. Audit

On reasonable written request, and no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach, we make available the information necessary to demonstrate compliance with Article 28 GDPR. We satisfy audit requests in the first instance by providing written responses to a reasonable security questionnaire and copies of any relevant third-party certifications held by our infrastructure providers. Any on-site audit must be agreed in advance, conducted during business hours, subject to confidentiality, and must not unreasonably disrupt our operations; the cost of an on-site audit is borne by you.

14. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, to the fullest extent permitted by applicable law. Nothing in this DPA limits any liability that cannot be limited under applicable data protection law, including liability to data subjects.

15. Term, Changes and Governing Law

This DPA takes effect when you install the App and continues for as long as we process personal data on your behalf. We may update it to reflect changes in law, in our processing, or in our sub-processors; the current version is always published at indexgpt.app/dpa, and we will notify merchants of material changes before they take effect. This DPA is governed by the laws of Portugal, and the courts of Portugal have exclusive jurisdiction, without prejudice to any mandatory rights of data subjects.

16. Contact

Questions about this DPA, requests for advance notice of sub-processor changes, and security questionnaires should be sent to hello@indexgpt.app.