Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Koarge Inc. ("Koarge," "we," "us," or "our") and the merchant that uses the Koarge checkout Service ("Customer," "you," or "your"). It governs Koarge's processing of Customer Personal Data on your behalf when you use the Service.

This DPA applies where and to the extent that Koarge processes Customer Personal Data as a processor (or equivalent under Applicable Data Protection Laws) in connection with the Service. It should be read together with our Terms of Service and Privacy Policy.

You are the controller (or business) of Customer Personal Data. You determine the purposes and means of processing.

Koarge is the processor (or service provider) of Customer Personal Data. We process that data only to provide the Service and on your documented instructions.

This DPA covers Customer Personal Data processed through the Service (for example, checkout and order-related information). It does not cover information for which Koarge is an independent controller, such as your account and billing data, which is described in our Privacy Policy.

The subject matter, nature, and purpose of processing are the provision of on-site checkout and related merchant tools. The duration is the term of your subscription and any retention period required to provide the Service or comply with law.

You are responsible for the lawfulness of processing Customer Personal Data and for providing all required notices and obtaining all required consents from Data Subjects.

You will not instruct Koarge to process Customer Personal Data in a way that would cause Koarge to violate Applicable Data Protection Laws.

You will ensure that your use of the Service, your configurations, and your instructions are accurate and complete.

You will maintain your own privacy policy for Your Customers and will not rely on this DPA or our Privacy Policy as a substitute for your controller obligations.

Koarge will process Customer Personal Data only on your documented instructions, including as configured through the Service, unless Applicable Data Protection Laws require otherwise (in which case we will inform you unless legally prohibited).

Koarge will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

Koarge will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in Security below.

Taking into account the nature of processing, Koarge will assist you, where reasonably possible, in fulfilling your obligations to respond to Data Subject requests and to meet security, breach, and impact-assessment duties under Applicable Data Protection Laws.

Upon termination of the Service, Koarge will delete or return Customer Personal Data in accordance with your instructions and our retention practices, except where retention is required by law.

Koarge will treat Customer Personal Data as confidential and will not disclose it except to personnel and Sub-processors who need access to provide the Service, or as required by law.

Koarge will ensure that anyone who processes Customer Personal Data on its behalf is subject to confidentiality duties no less protective than those in this DPA.

Koarge will implement appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

Measures may include access controls, encryption in transit, logging and monitoring, vulnerability management, and staff training, scaled to the nature of the Service and the risks involved.

You are responsible for securing your own systems, credentials, and integrations with the Service, and for configuring the Service in a manner consistent with your security and compliance requirements.

You authorize Koarge to engage Sub-processors to process Customer Personal Data as needed to provide the Service. Current categories include infrastructure hosting, email/messaging, analytics, and payment-related providers (such as Stripe, which processes payments on your Stripe account under Stripe's terms).

Koarge will impose data-protection obligations on Sub-processors that are materially no less protective than those in this DPA.

Koarge remains responsible for Sub-processor performance insofar as they process Customer Personal Data on Koarge's behalf.

Koarge will provide notice of material changes to Sub-processors where required by Applicable Data Protection Laws or as otherwise communicated through the Service or our websites.

If a Data Subject contacts you regarding Customer Personal Data processed through the Service, you are responsible for responding as controller.

If a Data Subject contacts Koarge directly about Customer Personal Data, we will generally redirect them to you, unless Applicable Data Protection Laws require us to respond directly.

Taking into account the nature of processing, Koarge will provide reasonable assistance to help you respond to requests to access, correct, delete, or export Customer Personal Data, including through Service functionality where available.

Koarge will provide reasonable assistance to help you meet obligations under Applicable Data Protection Laws relating to:

Security of processing, taking into account the nature of the Service and the information available to Koarge.

Personal Data Breach notification, as set out in Personal Data Breach Notification.

Data protection impact assessments and prior consultation with Supervisory Authorities, where reasonably required and related to the Service.

You will reimburse Koarge for reasonable costs of assistance that go beyond ordinary Service support, unless the need for assistance arises from Koarge's breach of this DPA.

Koarge will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data processed under this DPA.

The notice will include, where available: a description of the nature of the breach; the categories and approximate number of Data Subjects and records concerned; likely consequences; and measures taken or proposed to address the breach.

Koarge will reasonably cooperate with your investigation and remediation efforts. Notification under this section is not an admission of fault or liability.