Data Processing Addendum

1. Roles

For the personal data processed to attribute sales on your store, you are the controller and Yonto is the processor. Yonto processes that data only on your documented instructions, which include these terms and your use of the Service.

For your own account data — the person who signs in, their email, your business details and billing — Yonto is a controller in its own right. That processing is described in the Privacy Policy and is outside this DPA.

2. Subject matter and duration

The subject matter is the provision of the attribution Service. Processing lasts for the term of your subscription and any wind-down period described in clause 13.

3. Nature and purpose of processing

To record clicks on creators' tracked links; to match later purchases to those clicks by click identifier, discount code, your store's order notification or a report from your own systems; to report attribution figures to you and render them as a shareable report; and — where you ask us to — to email a creator their tracked link.

4. Types of personal data

From visitors to your store:

• A random click identifier, recorded with the click together with the visitor's browser type (user agent) and the page they came from (referrer) — and, where your store runs our pixel, held in a first-party cookie on your site for 30 days;
• For orders credited to a creator: the order number as the store shows it, the store platform's own ID for the order, the order total and currency, and — where the order came through a tracked link — that click's random identifier; and for refunds of those orders, the refund number and amount.

Where you connect Shopify, Shopify sends Yonto the full order for every order in your store, including the shopper's name, email address, phone number, addresses, items bought and IP address. Yonto uses the discount code and landing page in it to attribute the order, and discards everything else immediately: shopper contact details, addresses, line items and IP addresses are never stored or logged. Orders not credited to a creator are not recorded at all; Yonto keeps only the time the latest order or refund notification arrived, one value per store, overwritten each time. Yonto never receives payment card details.

About the creators you run campaigns with, supplied by you when you create a campaign:

• The creator's name;
• Their handle and the platform it belongs to (for example Instagram, TikTok, YouTube, or a newsletter), together with a normalised copy of that handle used to recognise the same creator across your own campaigns;
• Optionally the creator's email address, used only to send that creator their tracked link and discount code when you choose to send it.

The creator's name, handle, and the campaign's attribution figures appear on any report you share or download. A creator's email address does not appear on a report and is disclosed only to our transactional email provider, and only when you send them their link.

5. Categories of data subjects

• Visitors to your store who arrive via a creator's tracked link;
• Shoppers who complete an attributed purchase;
• Creators whose details you add to a campaign.

6. Our obligations as processor

• Process personal data only on your documented instructions;
• Ensure persons authorised to process it are bound by confidentiality;
• Implement appropriate technical and organisational security measures (clause 7);
• Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach and impact-assessment obligations;
• Tell you if, in our opinion, an instruction infringes data-protection law — rather than simply carrying it out;
• Make available information needed to demonstrate compliance, and allow for reasonable audits (clause 12).

7. Security

The measures in place, taking account of the state of the art and the risk involved:

• Encryption of personal data in transit;
• Access scoping so each business can reach only its own data, enforced in the database rather than only in application code;
• Least-privilege access to production systems, and secrets held outside the codebase;
• High-entropy, non-enumerable tokens for shared reports, revocable with effect from the next request;
• Short-lived signed links for third-party rendering, so a report's permanent share token is never disclosed to a sub-processor.

Because we deliberately avoid collecting shopper contact details or line items, the data at risk is minimal by design — which is a stronger control than any of the above.

8. Sub-processors

You authorise Yonto to engage the following sub-processors to provide the Service. We remain responsible for their performance, and each is bound by written terms no less protective than this DPA.

Before we add one, you get 30 days. We will give you at least 30 days' notice before engaging a new sub-processor or replacing an existing one, so that you have time to consider it and object on reasonable data-protection grounds.

If you object. Tell us within those 30 days and we will try to offer you a reasonable alternative. If we cannot, you may terminate your subscription without penalty by giving us notice before the change takes effect, and we will refund the unused remainder of any period you have already paid for, pro rata. This is a deliberate exception to the no-refund position in our Refund Policy: an objection right you cannot afford to exercise is not a right.

One exception, for emergencies. If a sub-processor has to be replaced urgently to protect the security of your data or to keep the Service running — a provider suffering a breach, failing, or withdrawing at short notice — we may make the change without waiting 30 days. We will tell you as soon as we reasonably can and in any event within 7 days of the change. Your right to object, and to terminate and be refunded under this clause, then runs from that notice exactly as it would have run from notice given in advance. We will not use this exception to avoid giving notice we could reasonably have given.

• Supabase — Database and authentication.
• Vercel — Application hosting.
• Resend — Transactional email, including sending a creator their tracked link.
• Paddle — Payments, as merchant of record.
• Browserless — Rendering a report to PDF when you, or someone you shared it with, download one. It receives the report as displayed — the creator's name and handle, the campaign name, and that campaign's attribution figures. It is given a short-lived signed link rather than the report's share link, retains nothing after the render, and is not used unless a PDF is requested.

9. International transfers

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses, or an adequacy decision.

10. Data-subject requests and breaches

We will promptly notify you of, and assist with, any data-subject request we receive relating to your data — including from a creator whose details you entered, since you are the controller of those details and the decision is yours.

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own notification deadlines.

11. California (CCPA / CPRA) service-provider terms

Where you are subject to the CCPA/CPRA, Yonto acts as a service provider and the personal information you disclose is provided only for the limited purpose of performing the Service. Yonto does not sell or share that personal information, does not retain, use or disclose it for any purpose other than performing the Service, and does not combine it with personal information from another source except as the CCPA permits. Yonto certifies that it understands and will comply with these restrictions.

12. Audit

On reasonable written request and no more than once a year (unless required by a supervisory authority), we will provide information reasonably necessary to demonstrate compliance with this DPA. Audits are at your cost, during business hours, and must not disrupt the Service or risk the confidentiality of other customers' data.

13. Return and deletion

Personal data processed on your behalf is kept until you delete it or ask us to. Deleting a business in the Service deletes that business's data immediately. When your account is closed — cancelling a subscription does not close it — and in any case on your written request, we will delete all personal data processed on your behalf within 30 days, except where the law requires us to keep it, and will confirm deletion in writing on request. Before then you may export your attributed conversion data at any time, whether or not your subscription is active. Shared report links stop working on termination. See the Privacy Policy for retention detail.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, to the extent the law permits. Where Standard Contractual Clauses apply to a transfer, those clauses prevail over this DPA to the extent of any conflict.

15. General

If there is a conflict between this DPA and the Terms of Service on the processing of personal data, this DPA prevails. This DPA is governed by the law of England and Wales.

16. Contact

Data protection contact: privacy@yontosales.com.