Data processing addendum

Effective and last updated: 3 November 2026

This Data processing addendum (“DPA”) forms part of the Terms of service between the merchant (“Controller”) and Saim Tech (“Processor”), a business trading under that name at 63 E1 Wapda Town, Lahore 54700, Pakistan, for Termpact. The Controller accepts this DPA by installing or using Termpact.

1. Subject matter and duration

The Processor processes personal data to provide Termpact to the Controller, for as long as the app is installed and until deletion under section 9.

2. Nature and purpose

Storing, organising, retrieving, using and deleting personal data to apply contract prices and order rules, manage credit and receivables, run the buyer portal and order inbox, send the notifications the Controller enables, and support and secure the service.

3. Data subjects and categories of data

• Data subjects: the Controller’s business customers and their contacts; applicants for trade accounts; the Controller’s staff who use Termpact; senders of documents to the order inbox.
• Personal data: names, email addresses, phone numbers, postal addresses, job titles, company and location names, order and payment information, payment terms and credit settings, tax-exemption certificates, document contents, Shopify staff IDs and audit records.
• Special categories: none are intended. The Controller should not send them.

4. Processor obligations

The Processor will:

1. process personal data only on the Controller’s documented instructions (these terms and the Controller’s use and configuration of Termpact), unless the law requires otherwise — in which case it informs the Controller unless the law forbids it;
2. ensure that people authorised to process the data are bound by confidentiality;
3. implement the security measures in Annex A;
4. use subprocessors only under section 5;
5. assist the Controller, taking into account the nature of the processing, in responding to data subject requests (including through Shopify’s customer data request and redaction webhooks) and in meeting its obligations on security, breach notification, impact assessments and prior consultation;
6. make available the information reasonably needed to demonstrate compliance with this DPA and allow audits under section 8.

5. Subprocessors

The Controller gives general authorisation for the subprocessors on the subprocessor list. The Processor gives at least 30 days’ notice in the app before adding or replacing one; the Controller may object on reasonable data protection grounds. The Processor imposes data protection obligations on each subprocessor no less protective than this DPA and remains liable for their performance.

6. International transfers

Personal data is hosted in Australia (servers, database and email: Amazon Web Services in Sydney), stored in the United States (files and encrypted backups at Backblaze) and processed in the United States by the other providers on the subprocessor list. The Processor operates from Pakistan, where its personnel access the data to run and support the service. For transfers from the EEA, the UK or Switzerland, the parties agree to the Standard Contractual Clauses (Annex B).

7. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Controller’s data, with the information then available, and keeps the Controller updated.

8. Audits

The Processor answers reasonable written security questionnaires once a year and provides summaries of independent assessments when available. On-site audits, where required by law, take place with 30 days’ notice, during business hours, at the Controller’s cost, under confidentiality.

9. Deletion

When the app is uninstalled, Shopify sends a store-deletion request 48 hours later; the Processor then deletes the Controller’s data from live systems (normally within minutes, always within 30 days) and from backups within the following 30 days. The Controller can export its data from the app before uninstalling.

10. Order of precedence

If this DPA conflicts with the Terms of service about personal data, this DPA prevails; the Standard Contractual Clauses prevail over both.

Annex A — Security measures

• Encryption in transit (TLS 1.2+) and at rest; envelope encryption of access tokens and personal fields (AES-256-GCM data keys per record, wrapped by a master key held outside the database); keyed hashes for email matching.
• Tenant isolation with Postgres row-level security enforced for the application’s database role; automated checks in CI that every tenant table is isolated and deleted with its store.
• Role-based access for the Controller’s staff; audit log of changes; least-privilege access for the Processor’s personnel with strong authentication.
• Scrubbing of tokens, emails, IP addresses and postal addresses from application logs, traces and error reports; shortened IP addresses and no query strings in web server access logs.
• Encrypted backups with 30-day point-in-time recovery at a separate provider; restore tested regularly.
• Dependency and container scanning in CI; malware scanning of uploaded files; rate limiting and abuse protection on public endpoints.
• Incident response procedure and breach notification under section 7.

Annex B — Standard Contractual Clauses

EU

The standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated by reference, with these choices:

• Module 2 (controller to processor) applies; where the Controller is itself a processor, Module 3 (processor to processor) also applies.
• Clause 7 (docking clause) is included.
• Clause 9: option 2, general written authorisation, with the list and 30 days’ notice in section 5.
• Clause 11: the optional language is not used.
• Clause 13: the competent supervisory authority is the one determined under that clause.
• Clause 17: the SCCs are governed by the law of Ireland.
• Clause 18: disputes are resolved by the courts of Ireland.

These choices apply only to the SCCs. Everything else in the Terms of service and this DPA stays governed by the laws of Pakistan, as the Terms of service say.

United Kingdom

For transfers subject to UK data protection law, the UK International Data Transfer Addendum to the SCCs (version B1.0, issued by the Information Commissioner) applies. Its tables are completed with the information in this Annex B; either party may end it as allowed by its section 19.

Switzerland

For transfers subject to the Swiss Federal Act on Data Protection (FADP), the SCCs apply with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and “Member State” including Switzerland so that data subjects there can enforce their rights.

Annex I — Description of the transfer

A. Parties

• Data exporter: the Controller — the merchant that installs Termpact, identified by its Shopify store; contact details as held in its Shopify account. Role: controller (or processor for its own customers, under Module 3). Accepts the SCCs by accepting this DPA.
• Data importer: Saim Tech, 63 E1 Wapda Town, Lahore 54700, Pakistan; contact privacy@termpact.com. Role: processor. Accepts the SCCs by publishing and applying this DPA.

B. Description of the transfer

Item	Description
Data subjects	The Controller’s business customers and their contacts; applicants for trade accounts; the Controller’s staff who use Termpact; senders of documents to the order inbox (section 3)
Categories of personal data	Names, email addresses, phone numbers (given by trade applicants), postal addresses, job titles, company and location names, order and payment information, payment terms and credit settings, tax-exemption certificates, contents of purchase orders sent to the order inbox, Shopify staff IDs and audit records (section 3)
Sensitive data	None intended
Frequency	Continuous, while the app is installed
Nature of the processing	Collection from the Controller’s Shopify store and from buyers and applicants, storage, organisation, retrieval, use, transmission (emails, statements, webhooks the Controller sets up) and deletion (section 2)
Purpose	Providing Termpact to the Controller: contract prices, order rules, credit and receivables, buyer portal, order inbox, trade applications and notifications, plus support and security of the service
Retention	While the app is installed. Data is deleted after Shopify’s store-deletion request, sent 48 hours after uninstall (live systems normally within minutes, always within 30 days; backups within the following 30 days). Order inbox documents and tax-exemption certificates are deleted 24 months after last use; other retention periods are in the Privacy policy
Transfers to subprocessors	As listed on the subprocessor list, for the activities and locations shown there, for the duration above

C. Competent supervisory authority

As determined under clause 13 of the SCCs.

Annex II — Technical and organisational measures

The measures in Annex A. For transfers to subprocessors, the Processor imposes measures no less protective (section 5).

Annex III — List of subprocessors

The subprocessor list, under the general authorisation in section 5.