Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between Eva Commerce, Inc. (“Eva”) and the customer identified in the applicable Order Form (“Customer”) whenever the Services involve the Processing of Personal Data on Customer’s behalf. It is incorporated by reference into each Order Form that identifies data processing as in scope. The version of this DPA in effect on the Effective Date of the applicable Order Form governs that Order Form.

1. Roles and Scope

Customer is the controller (or a processor acting on behalf of a controller) and, under California law, the “business.” Eva is the processor and, under California law, the “service provider.” This DPA applies to Personal Data that Eva Processes in the course of providing the Services, such as management of email and SMS marketing, storefront and marketplace operations, advertising management, analytics, and customer relationship data handled inside Customer’s platforms.

2. Definitions

“Applicable Data Protection Laws” means, to the extent applicable to the Processing, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the Swiss FADP, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). “Personal Data,” “Processing,” “Data Subject,” “Controller,” “Processor,” “Business,” “Service Provider,” “Sell,” and “Share” have the meanings given in Applicable Data Protection Laws. “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by Eva.

3. Details of Processing

Subject matter and duration: the Services described in the applicable Order Form, for the term of that Order Form. Nature and purpose: provision, maintenance, and improvement of the contracted Services, including campaign execution, lifecycle marketing, reporting, and support. Categories of Data Subjects: Customer’s end customers, subscribers, and prospects. Types of Personal Data: name, email address, phone number, shipping and billing address, order and transaction history, and engagement data. Eva does not request and does not intend to Process special categories of personal data.

4. Customer Instructions

Eva shall Process Personal Data only on Customer’s documented instructions, including with regard to international transfers, unless required otherwise by applicable law, in which case Eva will inform Customer of that legal requirement before Processing unless the law prohibits it. The Order Form, the Master Agreement, and this DPA constitute Customer’s complete documented instructions. Eva will promptly inform Customer if, in Eva’s opinion, an instruction infringes Applicable Data Protection Laws.

5. Confidentiality

Eva ensures that all personnel authorized to Process Personal Data are bound by written or statutory obligations of confidentiality and Process Personal Data only as needed to deliver the Services.

6. Security

Eva implements and maintains appropriate technical and organizational measures designed to protect Personal Data against Security Incidents, consistent with Article 32 GDPR, including: encryption of data in transit and at rest; role-based access controls on a least-privilege basis; multi-factor authentication for administrative access; logging and monitoring of production systems; segregated environments; regular backups; personnel security training; and vendor due diligence. Eva reviews and updates these measures as technology and risk evolve, provided the overall level of protection is not reduced.

7. Subprocessors

Customer provides general authorization for Eva to engage subprocessors to deliver the Services. The current list is published at eva.guru/subprocessors. Eva will update that page at least thirty (30) days before adding or replacing a subprocessor. Customer may object in writing on reasonable data protection grounds within that period; the parties will then work in good faith on an alternative, and if none is reasonably available Customer may terminate the affected portion of the Services. Eva imposes data protection obligations on each subprocessor no less protective than those in this DPA and remains liable for its subprocessors’ performance.

8. Data Subject Rights

Taking into account the nature of the Processing, Eva shall assist Customer through appropriate technical and organizational measures in fulfilling Customer’s obligation to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection, and opt-out rights under the CCPA). If Eva receives a request directly from a Data Subject relating to Customer’s Personal Data, Eva will forward it to Customer without undue delay and will not respond except to direct the Data Subject to Customer.

9. Security Incidents

Eva shall notify Customer without undue delay after becoming aware of a Security Incident, and in any event within seventy-two (72) hours, providing information reasonably available to Eva about the nature of the incident, the categories and approximate volume of Personal Data and Data Subjects concerned, the likely consequences, and the measures taken or proposed. Eva will take reasonable steps to contain and remediate the incident and will cooperate with Customer’s own notification obligations. Eva’s notification is not an acknowledgment of fault or liability.

10. Assistance

Eva shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, to the extent required of Customer under Applicable Data Protection Laws and taking into account the information available to Eva.

11. International Transfers

Where Personal Data originating from the EEA, the UK, or Switzerland is transferred to Eva in the United States, the parties enter into the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference, with Customer as data exporter and Eva as data importer. For UK transfers, the UK International Data Transfer Addendum applies. The details of Processing in Section 3 serve as Annex I, and the security measures in Section 6 serve as Annex II. In case of conflict between the Standard Contractual Clauses and this DPA, the Standard Contractual Clauses prevail.

12. California Service Provider Terms

Eva is Customer’s Service Provider. Eva shall not: sell or share Personal Data; retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Order Form and this DPA, or outside the direct business relationship with Customer; or combine Personal Data received from Customer with personal information from other sources except as permitted for Service Providers under the CCPA. Eva certifies that it understands and will comply with these restrictions, will notify Customer if it can no longer meet them, and grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data.

13. Artificial Intelligence Tools

Eva shall not use Customer’s Personal Data, Customer confidential information, or Customer content to train or fine-tune any artificial intelligence model, whether Eva’s or a third party’s, without Customer’s prior written consent. Where AI tools are used to deliver the Services, Eva configures them so that Customer data is excluded from model training to the extent the tool provides such controls.

14. Audits

Eva shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, no more than once per year and upon at least thirty (30) days’ written notice, first by way of documentation, completed questionnaires, and third-party certifications or reports where available. On-site inspections occur only where such materials are reasonably insufficient or where required by a supervisory authority, during business hours, without disrupting Eva’s operations, and subject to Eva’s confidentiality requirements. Each party bears its own audit costs.

15. Return and Deletion

Upon termination or expiration of the applicable Order Form, Eva shall, at Customer’s choice, return or delete Personal Data in its possession or control within sixty (60) days of Customer’s written request, except where retention is required by applicable law, in which case Eva will continue to protect the retained data under this DPA and delete it when the retention requirement ends.

16. Liability and Precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Master Agreement and the applicable Order Form, except where Applicable Data Protection Laws do not permit such limitation. In case of conflict regarding the Processing of Personal Data, the order of precedence is: the Standard Contractual Clauses, then this DPA, then the Order Form, then the Master Agreement.

17. Contact

Privacy questions and Data Subject requests: privacy@eva.guru.