Data Processing Addendum

This DPA is part of the Terms of Service between Crush Suite Corporation ("Processor") and the Merchant ("Controller"). It applies to Customer Personal Data: personal data about the Merchant's customers that CrushSuite processes to provide the Apps.

1. Instructions. CrushSuite processes Customer Personal Data only to provide the Apps, as described in the Terms, the Privacy Policy and the Merchant's App settings, which together are the Merchant's documented instructions. CrushSuite will tell the Merchant if it believes an instruction breaks the law.
2. Details of processing. Subject matter and purpose: alcohol shipping compliance, age verification and club management. Duration: the subscription, plus the deletion period. Data subjects: the Merchant's customers and club members. Data types: contact details, order and shipping data, club membership and billing records, and dates of birth used for age verification. No payment card numbers.
3. CCPA service provider terms. CrushSuite will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Terms; use it outside the direct business relationship with the Merchant; or combine it with personal data from other sources, except as the CCPA permits. CrushSuite will comply with the CCPA, provide the same level of privacy protection the CCPA requires, and notify the Merchant if it can no longer meet these obligations. The Merchant may take reasonable steps to stop unauthorized use.
4. Confidentiality. Everyone at CrushSuite with access to Customer Personal Data is bound to keep it confidential.
5. Security. CrushSuite maintains the measures in section 6 of the Privacy Policy.
6. Subprocessors. The Merchant authorizes the subprocessors listed in the Privacy Policy. CrushSuite will notify the Merchant before adding a new one. The Merchant may object on reasonable data-protection grounds. If the objection can't be resolved, the Merchant's remedy is to uninstall the Apps. CrushSuite will bind each subprocessor to obligations at least as protective as this DPA and remains responsible for its subprocessors.
7. Assistance. CrushSuite will help the Merchant respond to customer privacy requests (including through Shopify's privacy webhooks), and with security and any required data protection assessments, taking into account the nature of the processing.
8. Breach notice. CrushSuite will notify the Merchant without undue delay after confirming a breach of Customer Personal Data, and will provide the information the Merchant reasonably needs to meet its own notice duties.
9. Deletion. When the subscription ends, CrushSuite will delete Customer Personal Data as described in the Privacy Policy, except for anonymized compliance records required by law.
10. Audits. On written request no more than once a year, CrushSuite will answer a reasonable security questionnaire and provide information needed to show compliance with this DPA.
11. Transfers. Customer Personal Data is processed in the United States. Where required, the parties agree to the EU Standard Contractual Clauses (Module 2) and the UK Addendum, which are incorporated by reference.
12. Liability. Liability under this DPA is subject to section 11 of the Terms.