Vittorious Data Processing Agreement

1.1 Customer

"Customer" means the Shopify merchant, company, individual entrepreneur, or other business that enters into the Agreement for use of Vittorious.

The Customer's legal name, address, contact details, and relevant establishment are those identified in the Agreement, applicable order form, Shopify installation or billing record, or other account record through which the Customer enters into the Agreement.

1.2 Vittorious

"Vittorious" or "Processor" means:

Oleh Artemovych Savytskyi, individual entrepreneur (FOP) Trading name: Vittorious Ukrainian tax identification number: 2574105050 103 Sichovykh Striltsiv Street, Apt. 25 Kyiv, 04050 Ukraine Privacy contact: [email protected]

The Customer and Vittorious are each a "Party" and together the "Parties".

For this DPA:

Applicable Data Protection Law means privacy and data-protection laws applicable to the Processing of Customer Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, applicable EEA Member State data-protection laws, the UK Data Protection Act 2018, the California Consumer Privacy Act as amended ("CCPA"), and other applicable U.S. state comprehensive privacy laws.

Controller, Processor, Processing, Personal Data, and Data Subject have the meanings given to them by Applicable Data Protection Law. Where an applicable U.S. law uses different terminology, the terms include the closest equivalent concept.

Customer Personal Data means Personal Data Processed by Vittorious on behalf of the Customer in connection with the Services. It excludes Personal Data for which Vittorious independently determines the purposes and means of Processing as a Controller.

EEA means the European Economic Area.

EU SCCs means the European Commission Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of June 4, 2021.

Merchant Data means data, content, instructions, settings, and other information submitted to, made available to, or accessed by Vittorious through the Customer's use of the Services, including Shopify catalog information. Merchant Data may include Customer Personal Data.

Restricted Transfer means a transfer of Personal Data that requires an international-transfer safeguard under Applicable Data Protection Law.

Services means the Vittorious website, Shopify application, catalog and product audit functionality, Evidence-backed Runs, recommendations, AI-assisted generation, publishing and rollback functionality, support, and related B2B services provided under the Agreement.

Subprocessor means a third-party Processor engaged by Vittorious to Process Customer Personal Data on behalf of the Customer.

UK Addendum means the applicable International Data Transfer Addendum to the EU Commission Standard Contractual Clauses approved under UK data-protection law.

3.1 Customer as Controller

Where the Customer determines the purposes and means of Processing Customer Personal Data, the Customer is the Controller and Vittorious is the Processor.

3.2 Customer as Processor

If the Customer Processes Personal Data on behalf of another Controller and instructs Vittorious to Process that Personal Data as part of the Services, the Customer is a Processor and Vittorious is a Subprocessor in relation to that Personal Data.

The Customer represents that it is authorized by the relevant Controller to engage Vittorious and to provide the instructions set out in the Agreement and this DPA.

3.3 Vittorious as independent Controller

This DPA does not govern Processing for which Vittorious acts as an independent Controller, including Processing reasonably necessary for its own contractual administration, billing and accounting, security administration, legal compliance, business communications, and operation or marketing of the public Vittorious website. Such Processing is governed by the Vittorious Privacy & Cookie Policy and Applicable Data Protection Law.

Vittorious will Process Customer Personal Data only on documented instructions from the Customer, unless Applicable Data Protection Law requires otherwise.

The following constitute documented instructions:

• the Agreement and this DPA;
• the Customer's configuration and use of the Services;
• actions initiated or approved by authorized Customer users;
• instructions submitted through the Vittorious interface;
• authorized support requests;
• other written instructions agreed by the Parties.

If Vittorious is legally required to Process Customer Personal Data outside the Customer's instructions, Vittorious will inform the Customer before the Processing unless the applicable law prohibits that notice.

If Vittorious reasonably believes that an instruction infringes Applicable Data Protection Law, Vittorious will inform the Customer and may suspend the affected Processing until the issue is resolved.

The Customer is responsible for:

• complying with Applicable Data Protection Law in its use of the Services;
• providing required notices and obtaining all rights, permissions, consents, or other legal bases necessary for Processing Customer Personal Data through the Services;
• ensuring its instructions to Vittorious are lawful;
• determining whether the Services are suitable for the Customer's intended Processing;
• responding to Data Subject requests where the Customer is the Controller;
• configuring its Shopify store and Vittorious account consistently with its legal obligations;
• avoiding the intentional submission of unnecessary sensitive or special-category Personal Data.

The Customer will not intentionally use the Services to Process special-category Personal Data, criminal-offence data, payment-card data, health data, biometric identifiers, government authentication credentials, or similarly sensitive information unless the Parties expressly agree in writing to the relevant Processing and safeguards.

If such information is incidentally contained in product content, images, metafields, support materials, or other Merchant Data, Vittorious will Process it only as necessary to provide the Services under the Customer's instructions and this DPA.

Vittorious may Process Customer Personal Data only for the specific purposes necessary to provide the Services requested by the Customer, including:

1. authenticating the Customer's Shopify store and maintaining the authorized Shopify connection;
2. importing, synchronizing, storing, and updating permitted product and catalog information;
3. performing product, content, market, and Technical SEO audits;
4. collecting and comparing relevant public Search and Shopping evidence;
5. identifying catalog and product-page gaps, conflicts, and opportunities;
6. generating product-related recommendations and draft content from permitted facts and evidence;
7. receiving and using Customer-provided product facts and answers;
8. presenting recommendations for Customer review;
9. publishing changes expressly approved by the Customer;
10. maintaining publishing history and rollback functionality;
11. providing technical support and troubleshooting;
12. maintaining security, service reliability, fraud prevention, and abuse prevention to the extent necessary to provide the Services;
13. measuring and improving service reliability and performance where permitted by Applicable Data Protection Law;
14. assisting with privacy requests, security incidents, and compliance obligations relating to Customer Personal Data;
15. deleting, returning, exporting, or de-identifying Customer Personal Data as required by this DPA.

Vittorious will not Process Customer Personal Data for unrelated advertising, cross-context behavioral advertising, sale of Personal Data, or unrelated consumer profiling.

For the current core Shopify application, Vittorious requests only:

• read_products;
• write_products.

Vittorious does not request Shopify customer or order scopes as part of its core functionality and does not intentionally import Shopify customer lists or order records.

Customer Personal Data may nevertheless appear incidentally in catalog descriptions, images, metafields, merchant-supplied product facts, or support communications. Such data remains subject to this DPA when Vittorious Processes it on behalf of the Customer.

Vittorious uses offline Shopify sessions for its core store connection and does not intentionally rely on Shopify online sessions to collect identity information about individual Shopify staff users.

Vittorious will ensure that persons authorized to Process Customer Personal Data:

• access it only as necessary for their role;
• are subject to appropriate confidentiality obligations;
• receive appropriate privacy and security instructions;
• Process Customer Personal Data only in accordance with this DPA and authorized instructions.

Vittorious will apply role-based or least-privilege access principles to production systems containing Customer Personal Data.

Taking into account the nature, scope, context, and purposes of Processing and the risks to individuals, Vittorious will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

The measures applicable to the Services are described in Schedule 2 — Technical and Organizational Measures.

Vittorious may update its security measures over time to reflect technical developments, changes in the Services, or changes in risk, provided that Vittorious does not materially reduce the overall level of protection for Customer Personal Data during the term of the Agreement.

Vittorious will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notification will include information reasonably available to Vittorious concerning:

• the nature of the breach;
• affected categories of Personal Data and Data Subjects, where known;
• likely consequences, where reasonably assessable;
• measures taken or proposed to contain, investigate, and remediate the breach;
• a contact point for follow-up.

Vittorious may provide information in phases where all details are not immediately available.

Vittorious will take reasonable steps to contain and remediate the breach and will reasonably cooperate with the Customer regarding legally required notifications or assessments.

Notification under this Section does not constitute an admission of fault or liability.

Taking into account the nature of the Processing, Vittorious will provide reasonable assistance to enable the Customer to respond to requests by Data Subjects exercising rights under Applicable Data Protection Law.

If Vittorious receives a request directly from a Data Subject relating to Customer Personal Data for which the Customer is responsible, Vittorious will, where legally permitted, refer the Data Subject to the Customer or notify the Customer of the request.

Vittorious will not respond substantively on the Customer's behalf unless authorized by the Customer or legally required to do so.

Taking into account the nature of the Processing and information available to Vittorious, Vittorious will provide reasonable assistance with the Customer's obligations relating to:

• security of Processing;
• Personal Data Breach assessment and notification;
• data-protection impact assessments;
• prior consultation with supervisory authorities where required;
• legally required processor-risk assessments or equivalent obligations.

The Customer remains responsible for its own legal conclusions, filings, notices, and regulatory obligations as Controller.

13.1 General authorization

The Customer grants Vittorious general written authorization to engage Subprocessors from the then-current Vittorious Subprocessor List available at:

https://vittorious.app/subprocessors

The list in effect when this DPA becomes binding between the Parties constitutes the agreed initial Subprocessor list.

13.2 New or replacement Subprocessors

Vittorious will provide at least 15 calendar days' prior notice before a new Subprocessor begins Processing Customer Personal Data or an existing Subprocessor is replaced, except where Applicable Data Protection Law requires a longer period.

Notice may be provided by email to the Customer's account contact or through another durable electronic notice mechanism associated with the Services.

13.3 Objections

The Customer may object to a proposed Subprocessor on reasonable data-protection grounds by notifying Vittorious in writing within 10 calendar days after receiving notice.

The Parties will work in good faith to address the objection. If the Parties cannot resolve a reasonable objection and Vittorious cannot provide the affected Services without the proposed Subprocessor on commercially reasonable terms, the Customer may discontinue the affected feature or terminate the affected Services without penalty for the unused prepaid portion of those affected Services, if any.

13.4 Subprocessor obligations

Vittorious will enter into a written agreement with each Subprocessor that imposes data-protection obligations appropriate to the Processing and, where required, obligations materially equivalent to those imposed on Vittorious under this DPA.

Vittorious remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law and the applicable international-transfer instrument.

Vittorious is established in Ukraine.

Where Customer Personal Data is transferred internationally and Applicable Data Protection Law requires a transfer mechanism, the Parties will rely on an applicable adequacy mechanism or appropriate safeguard.

Upon reasonable request, Vittorious will provide information available to it that the Customer reasonably needs to conduct a transfer impact assessment, transfer risk assessment, data-protection test, or similar assessment required by Applicable Data Protection Law.

Vittorious will implement reasonable supplementary safeguards where required by the applicable transfer mechanism and assessed risks.

If a transfer of Customer Personal Data from the EEA to Vittorious constitutes a Restricted Transfer subject to the GDPR, the EU SCCs are incorporated into this DPA by reference and apply to that transfer without modification except as necessary to select options and complete the annexes.

15.1 Applicable module

• Where the Customer is a Controller and Vittorious is a Processor, Module Two (Controller to Processor) applies.
• Where the Customer is a Processor acting on behalf of another Controller and Vittorious is a Subprocessor, Module Three (Processor to Processor) applies.

15.2 Completion of options

For purposes of the EU SCCs:

• Clause 7 (Docking Clause): applies.
• Clause 9(a): Option 2, general written authorization, applies.
• The advance notice period under Clause 9(a) is 15 calendar days.
• The optional independent dispute-resolution wording in Clause 11(a) is not selected.
• For Clause 17, the EU SCCs are governed by the laws of Ireland, unless the Parties expressly agree in writing to another eligible EEA Member State.
• For Clause 18, disputes under the EU SCCs are resolved by the courts of Ireland, unless the Parties expressly agree in writing to the courts of another eligible EEA Member State.
• Schedule 1 of this DPA supplies the information required for Annex I to the EU SCCs.
• Schedule 2 of this DPA supplies the information required for Annex II to the EU SCCs.
• The Subprocessor arrangement in Section 13 constitutes the agreed general authorization for purposes of Clause 9(a), Option 2.

15.3 Supervisory authority

For Annex I.C and Clause 13 of the EU SCCs, the competent supervisory authority is the supervisory authority determined under Clause 13 based on the Customer's establishment, representative, or other applicable GDPR connecting factor.

15.4 Conflict

If this DPA or the Agreement conflicts with the EU SCCs in relation to a transfer governed by the EU SCCs, the EU SCCs prevail to the extent of the conflict.

Nothing in the Agreement or this DPA is intended to modify the EU SCCs in a manner that reduces the rights or safeguards provided by them.

Where a transfer of Customer Personal Data to Vittorious is a Restricted Transfer under UK Data Protection Law and no adequacy mechanism applies, the Parties will use the UK Addendum to the EU SCCs as the applicable safeguard.

The applicable ICO-approved UK Addendum is incorporated by reference into the Parties' contractual documentation to the extent permitted by its terms and Applicable Data Protection Law, and its mandatory clauses apply without substantive modification.

For purposes of completing the UK Addendum:

• the Customer is the Exporter;
• Vittorious is the Importer;
• the EU SCCs incorporated under Section 15 are the underlying approved EU SCCs;
• the selected EU SCC module is Module Two or Module Three according to the Parties' roles;
• the Parties' information is provided in Section 1 and Schedule 1;
• the transfer details are provided in Schedule 1;
• the security measures are provided in Schedule 2;
• the Subprocessor arrangements are described in Section 13.

Vittorious will reasonably assist the Customer with information needed to perform the UK data-protection test or other legally required transfer assessment.

If incorporation by reference is not sufficient for a particular UK Restricted Transfer, the Parties will execute or electronically enter into the then-current ICO-approved UK Addendum or IDTA as necessary.

This Section applies where Vittorious Processes Customer Personal Data as a "service provider," "contractor," "processor," or equivalent role under an applicable U.S. state privacy law.

17.1 Limited and specified business purposes

The Customer discloses Customer Personal Data to Vittorious only for the limited and specified business purposes described in Section 6 and Schedule 1.

Vittorious will Process that data only for those purposes, the Customer's documented instructions, and other purposes expressly permitted for a service provider, contractor, or processor by Applicable Data Protection Law.

17.2 No sale or sharing

Vittorious will not sell Customer Personal Data.

Where the CCPA applies, Vittorious will not share Customer Personal Data for cross-context behavioral advertising.

17.3 No unrelated use

Vittorious will not retain, use, or disclose Customer Personal Data:

• for a commercial purpose unrelated to the purposes specified in this DPA;
• outside the direct business relationship between Vittorious and the Customer, except as permitted by Applicable Data Protection Law;
• to build or augment consumer profiles for unrelated purposes;
• for Vittorious's or another party's targeted or cross-context behavioral advertising.

17.4 Combining Personal Data

Vittorious will not combine Customer Personal Data received from or on behalf of the Customer with Personal Data received from another person, business, or source except to the extent the combination is permitted under Applicable Data Protection Law and necessary for an authorized purpose under this DPA.

17.5 Compliance and notice

Vittorious acknowledges and will comply with the applicable restrictions imposed on a service provider, contractor, or processor.

If Vittorious determines that it can no longer meet an applicable statutory obligation relating to Customer Personal Data, Vittorious will notify the Customer to the extent legally permitted.

The Customer may take reasonable and appropriate steps to stop and remediate unauthorized Processing.

17.6 Consumer requests and assessments

Vittorious will provide reasonable assistance required of a service provider, contractor, or processor for verified consumer requests and legally required cybersecurity, privacy, or risk assessments relating to Customer Personal Data.

Vittorious may use approved AI providers to perform product analysis, classification, evidence interpretation, recommendation generation, and draft-content generation requested by the Customer.

Vittorious will:

• minimize Customer Personal Data included in AI requests;
• use only information reasonably necessary for the requested task;
• maintain controls over approved AI providers and routing;
• not train Vittorious general-purpose AI models on Customer Personal Data;
• not intentionally permit third-party general-purpose AI models to be trained on Customer Personal Data submitted through Vittorious;
• use available commercial/API privacy settings designed to prevent model-training use of Customer Personal Data;
• not sell Customer Personal Data to AI providers;
• not send Shopify customer or order databases to AI providers as part of the core Services;
• not use Customer Personal Data for unrelated advertising or consumer profiling.

Where an AI routing provider is used, Vittorious will restrict routing to provider configurations that meet Vittorious's applicable data-handling requirements.

Customer Personal Data Processed under this DPA will not be disclosed by Vittorious to advertising or retargeting providers for targeted advertising, cross-context behavioral advertising, or advertising-audience creation.

Advertising, retargeting, and advertising conversion technologies may be used on publicly accessible Vittorious marketing pages in accordance with the Vittorious Privacy & Cookie Policy, but they will not be loaded within the authenticated Vittorious application, Shopify embedded application, or pages that display Merchant Data.

Personal Data Processed by Vittorious independently in connection with public-site marketing is outside the scope of this DPA and is governed by the Vittorious Privacy & Cookie Policy.

20.1 End of Services

Upon termination of the Services or uninstall of the Vittorious Shopify application, Vittorious will stop Processing Customer Personal Data for ordinary service purposes and will promptly revoke or delete Shopify authorization credentials.

Shopify access sessions and tokens will be deleted or rendered unusable promptly and, under normal operation, no later than 24 hours after Vittorious processes the uninstall event.

20.2 Return or export

Upon the Customer's written request made before termination or during the period in which relevant data remains available before scheduled deletion, Vittorious will provide a reasonable export or return of Customer Personal Data that can reasonably be returned using the Services or Vittorious's privacy-export process.

The Customer is responsible for requesting and retrieving an export before the data is permanently deleted.

20.3 Deletion

Unless Applicable Data Protection Law requires or permits continued retention, Vittorious will delete or irreversibly de-identify Customer Personal Data stored in ordinary production systems no later than 30 days after termination or uninstall.

20.4 Backups

Customer Personal Data may remain in encrypted, access-restricted rolling backups for up to 35 days after the relevant backup was created.

Backups will not be used for ordinary Processing. If an older backup is restored for disaster recovery, Vittorious will re-apply applicable deletion records before previously deleted Customer Personal Data returns to ordinary production use.

20.5 Lawful retention

Vittorious may retain limited information beyond these periods where required by law or reasonably necessary for billing and tax obligations, fraud or security investigations, legal claims, regulatory compliance, or a documented legal hold.

During any such extended retention, the retained Customer Personal Data will remain protected under this DPA and will not be used for unrelated purposes.

Vittorious will make available to the Customer information reasonably necessary to demonstrate compliance with Vittorious's processor obligations under Applicable Data Protection Law.

The Parties will ordinarily use a proportionate, documentation-first audit process. The Customer may request relevant security documentation, privacy and retention information, Subprocessor information, responses to reasonable security or privacy questionnaires, and independent audit or certification reports if Vittorious obtains them.

Where that information is insufficient to satisfy a legal audit right, the Customer may conduct or appoint an independent auditor to conduct an audit of Vittorious's relevant compliance controls.

Except following a material Personal Data Breach, a substantiated compliance concern, or a request by a competent regulator, such audits will normally:

• occur no more than once in any 12-month period;
• require at least 30 days' prior written notice;
• take place during normal business hours;
• be scoped to systems and controls relevant to Customer Personal Data;
• avoid access to other customers' data or Vittorious confidential information not relevant to the audit;
• be subject to reasonable confidentiality and security requirements.

The Customer bears its own audit costs unless the audit identifies a material breach of this DPA by Vittorious, in which case the Parties will reasonably allocate necessary remediation and verification costs.

Nothing in this Section limits a mandatory audit right under Applicable Data Protection Law or the EU SCCs.

If Vittorious receives a legally binding request from a public authority for Customer Personal Data, Vittorious will, to the extent legally permitted:

• notify the Customer;
• review the request for validity;
• challenge or seek clarification of requests that Vittorious reasonably considers unlawful or materially overbroad where a reasonable legal basis exists to do so;
• disclose only the minimum information legally required.

Where the EU SCCs or UK transfer instrument applies, the obligations in that instrument govern and prevail in the event of conflict.

Vittorious may use self-hosted support software within Vittorious-controlled infrastructure.

Where ordinary support conversations, users, messages, and attachments remain within Vittorious-controlled infrastructure and are not disclosed to the software vendor, the software vendor is not treated as a Subprocessor solely because Vittorious uses its self-hosted software.

Any third-party support, email, storage, or communication provider that Processes Customer Personal Data on Vittorious's behalf will be evaluated and disclosed as a Subprocessor where required.

Except to the extent Applicable Data Protection Law, the EU SCCs, the UK Addendum, or another mandatory transfer instrument provides otherwise, each Party's liability arising from or relating to this DPA is subject to the exclusions and limitations of liability in the Agreement.

Nothing in this DPA limits rights of Data Subjects or obligations that cannot lawfully be limited.

This DPA begins when it becomes binding as part of the Agreement and remains in effect for as long as Vittorious Processes Customer Personal Data on behalf of the Customer.

Sections that by their nature must survive termination, including confidentiality, deletion, retained-data protection, liability, audit rights relating to prior Processing, and international-transfer obligations, survive for as long as necessary to fulfill their purpose.

In the event of a conflict concerning Processing of Customer Personal Data, the following order of precedence applies:

1. the EU SCCs, UK Addendum, or other mandatory transfer instrument, for Processing governed by that instrument;
2. this DPA;
3. the Agreement.

The Vittorious Privacy & Cookie Policy describes Vittorious's public privacy practices but does not reduce contractual obligations under this DPA.

Vittorious may update this DPA to reflect changes in Applicable Data Protection Law or the Services.

Vittorious will not materially reduce the protection of Customer Personal Data under an existing Agreement through a unilateral DPA update.

If a change materially affects Customer rights or Processor obligations, Vittorious will provide appropriate notice and, where required, obtain agreement to the updated terms.

Except where an applicable international-transfer instrument specifies otherwise, this DPA is governed by the governing-law provision of the Agreement.

This Schedule forms part of the DPA and, where applicable, supplies the information required for Annex I of the EU SCCs.

A. Parties to the Transfer

Data Exporter

Name: Customer legal name as identified in the Agreement, Shopify installation/account record, or applicable order form. Address: Customer address identified in the Agreement or account record. Contact: Customer privacy or account contact identified in the Agreement or Customer account. Role: Controller, or Processor where the Customer Processes Personal Data on behalf of another Controller.

Data Importer

Name: Oleh Artemovych Savytskyi, individual entrepreneur (FOP), trading as Vittorious Address: 103 Sichovykh Striltsiv Street, Apt. 25, Kyiv, 04050, Ukraine Tax ID: 2574105050 Contact: [email protected] Role: Processor or Subprocessor.

B. Subject Matter

Provision of the Vittorious B2B Shopify product-audit, evidence-analysis, recommendation, AI-assisted drafting, publishing, rollback, support, and related Services requested by the Customer.

C. Duration

For the term of the Agreement and for the limited post-termination retention periods described in the DPA.

D. Nature of Processing

Processing operations may include:

• receipt and retrieval;
• access;
• collection from authorized Shopify APIs;
• recording and storage;
• organization and structuring;
• synchronization;
• comparison with public Search and Shopping evidence;
• extraction and normalization;
• analysis and scoring;
• classification;
• AI-assisted generation;
• display to authorized Customer users;
• modification at Customer instruction;
• transmission to approved Subprocessors;
• publication of Customer-approved changes to Shopify;
• backup;
• export;
• deletion or irreversible de-identification.

E. Purposes

The limited purposes described in Section 6, principally Shopify catalog synchronization, content, market, and Technical SEO audits, evidence-backed analysis, gap detection, product recommendations, draft-content generation, merchant review, publishing and rollback, service support and security, and privacy/compliance assistance.

F. Categories of Data Subjects

Customer Personal Data may relate to:

• Customer representatives and business contacts;
• authorized Customer personnel;
• individuals whose names, images, biographies, quotes, or other information are included by the Customer in product catalog content, descriptions, images, metafields, or product facts;
• individuals referenced in support communications;
• other individuals whose Personal Data is incidentally included in Merchant Data supplied by the Customer;
• individuals appearing on public product pages or evidence sources where their Personal Data is incidentally relevant to requested product analysis.

Vittorious does not request Shopify customer or order scopes as part of its core Services and does not intentionally import merchant customer lists or orders.

G. Categories of Personal Data

Depending on Merchant Data submitted by the Customer, Customer Personal Data may include:

• names and business contact details;
• business role or affiliation;
• product-related text that identifies an individual;
• image or image-alt information containing or identifying an individual;
• merchant-provided product facts;
• content in product descriptions or metafields;
• support communications, screenshots, and attachments;
• shop/store identifiers where associated with an identifiable sole trader or individual;
• technical identifiers and request metadata associated with the Customer's use of the Services;
• public webpage information incidentally containing Personal Data;
• audit, recommendation, or publishing records associated with the foregoing information.

H. Sensitive or Special-Category Data

The Services are not designed for intentional Processing of special-category Personal Data, criminal-offence data, or similarly sensitive Personal Data.

The Customer must not intentionally submit such data unless expressly agreed in writing and legally appropriate safeguards are in place.

Incidental sensitive information contained in Merchant Data will be subject to the same security and instruction limitations as other Customer Personal Data.

I. Frequency

Processing may occur continuously, periodically, or on Customer request throughout the term of the Services, including synchronization events, product updates, audits, Evidence-backed Runs, generation requests, publishing actions, support interactions, and scheduled technical operations.

J. Retention

Primary retention rules include:

• Shopify sessions/tokens after uninstall: promptly deleted or rendered unusable, normally within 24 hours after processing the uninstall event;
• ordinary Customer Personal Data after termination/uninstall: deletion or irreversible de-identification within 30 days, unless lawful retention is required;
• raw fetched public-page cache: normally up to 14 days;
• normalized public-page content: normally up to 60 days, subject to evidence retained within an active audit;
• pseudonymized application/security logs: normally up to 90 days;
• support correspondence: normally up to 3 years after the relevant matter or relationship ends;
• backups: rolling retention no longer than 35 days.

K. Competent Supervisory Authority

For transfers governed by the EU SCCs, the competent supervisory authority is determined in accordance with Clause 13 of the EU SCCs based on the Data Exporter's applicable establishment, representative, or GDPR connection.

This Schedule forms part of the DPA and, where applicable, supplies the information required for Annex II of the EU SCCs.

Vittorious applies the following measures to the extent relevant to the affected systems and Processing.

1. Data Minimization

• Shopify core application permissions are limited to read_products and write_products.
• Shopify customer and order scopes are not requested for the core Services.
• AI requests use field-level allowlists so that only data reasonably required for a task is submitted.
• Advertising systems are segregated from Customer Personal Data.
• Internal identifiers, secrets, billing information, and unrelated Merchant Data are excluded from AI payloads by default.

2. Encryption in Transit

• External application and API traffic carrying Customer Personal Data is protected using HTTPS/TLS.
• Vittorious requires TLS 1.2 or later for supported external connections under its control.
• Administrative connections to production infrastructure use encrypted protocols.

3. Encryption at Rest

• Production storage containing Customer Personal Data uses encrypted disks, volumes, database storage, or equivalent infrastructure-level encryption.
• Production backups containing Customer Personal Data are encrypted at rest.
• Secrets and access credentials are not stored in application source code.

4. Access Control

• Production access is limited to persons with a legitimate operational need.
• Least-privilege principles are used for application, database, and infrastructure access.
• Privileged administrative accounts use multi-factor authentication where the underlying provider supports it.
• Administrative access uses individual accounts or auditable credentials rather than shared credentials where reasonably practicable.
• Access is revoked when no longer required.

5. Network and Infrastructure Security

• Production databases, Redis, ClickHouse, and equivalent internal data services are not intentionally exposed directly to the public Internet.
• Network controls, reverse proxies, firewalls, security groups, or equivalent mechanisms restrict access to production services.
• CDN, proxy, bot-protection, and abuse-prevention controls may be used at the application edge.

6. Environment Separation

• Production and development environments are logically separated.
• Unsanitized production Customer Personal Data is not used in development by default.
• Test data should be synthetic, de-identified, or minimized where feasible.
• Production credentials are not intentionally shared with ordinary development environments.

7. Shopify Credential Protection

• Shopify access tokens and sessions are treated as confidential credentials.
• Tokens are accessible only to systems and personnel that require them.
• Following uninstall, Shopify credentials are promptly deleted or rendered unusable, normally within 24 hours after processing the uninstall event.

8. Logging and Monitoring

• Application, access, and security events are logged to support reliability, fraud prevention, incident investigation, and compliance.
• Logs are pseudonymized or minimized where reasonably practicable.
• Ordinary pseudonymized access, application, and security logs containing Customer-related identifiers are retained for no more than 90 days unless isolated for an incident, legal claim, fraud investigation, or legal hold.
• Access to security logs is restricted.

9. Vulnerability and Change Management

• Dependencies and application components are monitored for known security vulnerabilities using automated or manual processes appropriate to the technology stack.
• Security updates are evaluated and deployed according to risk.
• Material infrastructure and application changes are subject to controlled deployment practices.
• New external data recipients, Shopify scopes, AI providers, or tracking technologies are subject to privacy/security review before production use.

10. Backup and Recovery

• Production backups are encrypted and access-restricted.
• Backups containing Customer Personal Data use a rolling retention period not exceeding 35 days.
• Backup restoration is periodically tested.
• Backup-restoration procedures include re-applying applicable deletion records so that deleted Customer Personal Data is not unintentionally returned to ordinary production use.

11. Availability and Resilience

• The Services use backup, recovery, monitoring, and job-recovery mechanisms appropriate to the service architecture.
• Active processing jobs are stopped or invalidated following Shopify uninstall.
• Service components are monitored for operational errors and failed processing where appropriate.

12. Data Lifecycle and Deletion

• Raw fetched-page cache is configured for a normal maximum validity of 14 days.
• Normalized public-page content is configured for a normal maximum validity of 60 days unless relevant evidence is retained within an active audit.
• Ordinary Customer Personal Data is scheduled for deletion or irreversible de-identification no later than 30 days after termination/uninstall, subject to lawful-retention exceptions.
• Deletion processes cover relevant production databases, analytics stores, caches, job data, files, and support data.
• A legal hold, where required, must be documented and limited to data reasonably necessary for the legal purpose.

13. Privacy Request Controls

• Privacy requests are received through [email protected] and tracked through an internal process.
• Requester identity or authority is reasonably verified before disclosure or deletion.
• Searches and deletion actions cover relevant production systems, analytics stores, support systems, and files as applicable.
• Shopify mandatory privacy requests are handled through authenticated Shopify privacy webhooks.

14. Incident Response

• Vittorious maintains an incident-response process for detection, triage, containment, investigation, breach assessment, notification, remediation, and post-incident review.
• Security incidents involving Customer Personal Data are escalated to appropriate personnel.
• The process supports notice to affected Customers without undue delay where required.

15. Subprocessor Management

• Subprocessors receiving Customer Personal Data are subject to privacy and security review appropriate to the Processing.
• Written data-protection terms are required where Applicable Data Protection Law requires them.
• International-transfer requirements are reviewed before Restricted Transfers are enabled.
• The current Subprocessor List is maintained at https://vittorious.app/subprocessors.

16. AI Processing Controls

• AI providers are accessed through controlled application integrations rather than unrestricted end-user provider access.
• Vittorious minimizes the content transmitted in each AI request.
• Commercial/API privacy settings are configured to prevent use of Customer Personal Data for general-purpose model training where such controls are available.
• Routing providers are restricted to approved provider configurations.
• Shopify customer and order databases are not intentionally transmitted to AI providers as part of the core Services.

17. Advertising Isolation

• Advertising, retargeting, and advertising-conversion technologies are allowed only on approved publicly accessible marketing pages.
• Advertising technologies are not loaded in the authenticated Vittorious application or Shopify embedded app.
• Customer Personal Data governed by this DPA is not intentionally transmitted to advertising systems for targeted or cross-context behavioral advertising.

18. Support Data

• Ordinary live-chat data is maintained using self-hosted support infrastructure under Vittorious control.
• Support records participate in applicable retention, export, and deletion workflows.
• External support integrations that Process Customer Personal Data are reviewed as potential Subprocessors before use.

19. Physical Security

Vittorious does not operate its own data centers. Physical security for hosted production infrastructure is provided by the applicable approved hosting/data-center providers and is evaluated as part of Subprocessor and infrastructure review.

20. Confidentiality and Organizational Controls

• Personnel with access to Customer Personal Data are subject to confidentiality obligations.
• Access is granted according to role and operational need.
• Privacy and security requirements are documented for relevant operational processes.
• Material privacy/security incidents and remediation actions are documented.

This Schedule applies only to the extent an applicable U.S. state privacy law governs Customer Personal Data.

Specific Business Purposes

Customer Personal Data is disclosed to Vittorious for these limited purposes:

1. connecting and authenticating the Customer's Shopify store;
2. importing and synchronizing authorized Shopify product/catalog information;
3. analyzing products and catalog content;
4. performing content, market, and Technical SEO audits;
5. retrieving relevant public Search and Shopping evidence;
6. generating product recommendations and drafts;
7. displaying results to the Customer for review;
8. publishing only Customer-approved changes;
9. maintaining rollback and product-change history;
10. providing support and troubleshooting;
11. protecting the Services against security threats, fraud, abuse, and duplicate processing;
12. maintaining service performance and reliability;
13. assisting with privacy and legal-compliance obligations;
14. returning, exporting, deleting, or de-identifying Customer Personal Data.

These purposes do not include sale of Customer Personal Data, cross-context behavioral advertising, unrelated consumer profiling, or advertising-audience creation.

Restrictions

Vittorious will:

• Process Customer Personal Data only for the limited purposes above and permitted statutory purposes;
• not sell Customer Personal Data;
• not share Customer Personal Data for cross-context behavioral advertising where the CCPA applies;
• not use Customer Personal Data for unrelated targeted advertising;
• not retain, use, or disclose it outside the direct business relationship except where permitted by law;
• not combine it with Personal Data from other sources except where lawfully permitted for an authorized purpose;
• provide reasonable assistance with consumer requests and legally required Customer assessments;
• notify the Customer if Vittorious can no longer comply with an applicable service-provider, contractor, or processor obligation;
• allow the Customer to take reasonable steps to stop and remediate unauthorized Processing.

Questions concerning this DPA may be sent to:

[email protected]

Oleh Artemovych Savytskyi, individual entrepreneur (FOP) Vittorious 103 Sichovykh Striltsiv Street, Apt. 25 Kyiv, 04050 Ukraine