Data Processing Agreement (DPA)

Last Updated: September, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Sequence Commerce, Inc. (“Processor”) and the Customer (“Controller”) for the purchase of services from Processor.

1. Definitions

“Personal Data” means any information relating to an identified or identifiable natural person.

“Processing” means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or deletion.

“Data Subject” means the individual to whom Personal Data relates.

“Applicable Law” means all applicable data protection laws including GDPR, CCPA, and other relevant regulations.

2. Processing of Personal Data

2.1 Scope and Roles

• Customer is the Controller of Personal Data
• Sequence Commerce is the Processor acting on Controller’s behalf
• This DPA applies to all Personal Data processed by Processor

2.2 Processor’s Obligations

Processor shall:

• Process Personal Data only on documented instructions from Controller
• Ensure persons authorized to process Personal Data have committed to confidentiality
• Implement appropriate technical and organizational security measures
• Not engage subprocessors without Controller’s prior authorization
• Assist Controller in responding to data subject requests
• Delete or return all Personal Data upon termination

2.3 Controller’s Obligations

Controller shall:

• Ensure lawful basis for Processing
• Provide necessary instructions for Processing
• Ensure accuracy of Personal Data
• Comply with all applicable data protection laws

3. Security Measures

3.1 Technical Measures

• Encryption of Personal Data at rest and in transit, using industry-standard algorithms provided by our cloud infrastructure subprocessors (AWS, Cloudflare)
• Role-based access controls with multi-factor authentication for personnel with access to Personal Data
• Periodic security reviews of platforms and vendors
• Network-level protections including firewalls provided by cloud infrastructure subprocessors
• Logging and monitoring of access to systems that process Personal Data

3.2 Organizational Measures

• Security awareness guidance provided to personnel with access to Personal Data
• Access to Personal Data limited on a need-to-know basis
• Written incident response procedures for suspected Personal Data breaches
• Periodic reviews of internal data handling practices

4. Subprocessors

4.1 Authorized Subprocessors

Controller agrees to the subprocessors listed at https://sequencecommerce.com/subprocessors/

4.2 New Subprocessors

• Processor will notify Controller of new subprocessors
• Controller has 30 days to object to new subprocessors
• Processor ensures subprocessors comply with this DPA

5. Data Subject Rights

Processor shall assist Controller in fulfilling obligations to respond to data subject requests for:

• Access to Personal Data
• Rectification of Personal Data
• Erasure of Personal Data
• Restriction of Processing
• Data portability
• Objection to Processing

6. Personal Data Breach

6.1 Notification

Processor shall notify Controller without undue delay upon becoming aware of a Personal Data breach

6.2 Information Provided

• Nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences
• Measures taken or proposed

6.3 Cooperation

Processor shall cooperate with Controller in investigating and mitigating the breach

7. Data Transfers

7.1 Transfer Mechanisms

For transfers outside the EEA, parties shall ensure:

• Standard Contractual Clauses are in place
• Appropriate safeguards exist
• Data subject rights are protected

7.2 Transfer Impact Assessment

Processor has conducted assessments confirming transfers can be performed lawfully

8. Audit Rights

8.1 Controller Rights

Controller may audit Processor’s compliance with this DPA through:

• Written questionnaires
• Remote audits
• On-site inspections (with reasonable notice)

8.2 Audit Procedures

• Maximum one audit per year unless breach occurs
• Costs borne by Controller
• Confidentiality agreements required

9. Duration and Termination

9.1 Duration

This DPA remains in effect for the duration of the Services Agreement

9.2 Termination

Upon termination, Processor shall:

• Stop Processing Personal Data
• Delete or return Personal Data as instructed
• Provide certification of deletion

10. Liability and Indemnification

10.1 Liability Cap

Liability under this DPA is subject to the limitations in the Terms of Service

10.2 Indemnification

Each party shall indemnify the other against claims arising from its breach of this DPA

11. Governing Law

This DPA is governed by the laws specified in the Terms of Service

12. Order of Precedence

In case of conflict:

1. Applicable data protection laws
2. This DPA
3. Terms of Service
4. Privacy Policy

Annex 1: Processing Details

Categories of Data Subjects

• Customers
• Website visitors
• Newsletter subscribers
• Business contacts

Categories of Personal Data

• Contact information (name, email, phone)
• Account data (username, preferences)
• Transaction data (orders, payments)
• Usage data (browsing behavior)
• Communication data (support tickets)

Processing Purposes

• Order fulfillment
• Customer service
• Marketing (with consent)
• Legal compliance
• Fraud prevention
• Service improvement

Processing Duration

• Active account data: Duration of relationship
• Transaction records: 7 years
• Marketing data: Until consent withdrawn
• Log data: 90 days

Annex 2: Security Measures

Technical Safeguards

• Encryption at rest via cloud infrastructure subprocessor default (AWS-managed AES-256)
• TLS for all data transmission over public networks
• Multi-factor authentication for personnel accounts with access to Personal Data
• Vulnerability management through cloud infrastructure subprocessor patching cycles
• Automated backup of production systems via cloud infrastructure subprocessor

Organizational Safeguards

• Security practices aligned with ISO 27001 controls (certification held by underlying cloud infrastructure subprocessors, not by Sequence Commerce)
• Security guidance provided to personnel
• Written incident response procedures
• Business continuity planning through cloud infrastructure subprocessor redundancy
• Vendor security review as part of subprocessor engagement

How to Execute This DPA

For Business Customers

1. Download the DPA template
2. Complete company information
3. Sign and return to: legal@sequencecommerce.com

For Enterprise Customers

Custom DPAs available upon request

Standard Execution

By using our Services, you agree to this DPA as published

Contact Information

General Inquiries: Email: contact@sequencecommerce.com

This DPA is incorporated into and subject to the terms of the Sequence Commerce Terms of Service.