Data Processing Addendum

Last updated: Nov 5, 2026.

This Data Processing Addendum ("DPA") is part of the Terms of Use between you, the merchant, and the Waise team ("Waise"). It applies to the personal information in your store from the moment you accept the Terms, with no separate signature.

1. Roles

For the personal information of your store's shoppers and customers ("Store Personal Data"), you are the "business" under the California Consumer Privacy Act (CCPA) and the "controller" under the GDPR and UK GDPR, and Waise is your "service provider" and "contractor" under the CCPA and your "processor" under the GDPR. Waise is the controller only of information about you as a merchant, as its Privacy Policy describes.

2. Subject matter, nature and duration

Waise processes Store Personal Data only to provide the service described in the Terms: hosting your store, taking and showing orders, sending the email and text messages you set up, answering shoppers in the chat when you turn it on, and backups and security. Processing lasts for as long as your account exists and then for the retention periods in section 9.

3. Categories of data and data subjects

• Shoppers and customers: name, email, phone, shipping and billing addresses; orders; email and SMS marketing consents with their date and source; reviews and questions; shopper-chat messages; back-in-stock requests; visits (analytics only where the shopper's consent or the law allows).
• Your staff: account details, sign-ins and Pulse conversations.
• No payment card numbers. Shoppers pay on your payment processor's page; Waise does not receive or store card numbers.

4. Your instructions

Waise processes Store Personal Data only on your documented instructions. The Terms, your settings and the actions you take or approve in the admin and in Pulse are those instructions. Waise will tell you if it believes an instruction breaks the law.

5. CCPA terms

Waise will not: (a) sell or share Store Personal Data, including for cross-context behavioral advertising; (b) retain, use or disclose it for any purpose other than the business purposes in section 2, or outside the direct business relationship with you; (c) combine it with personal information Waise receives from others, except as the CCPA allows; or (d) use it to train AI models. Waise will comply with the CCPA's obligations that apply to service providers, give the same level of privacy protection the CCPA requires, notify you if it can no longer meet them, and allow you to take reasonable and appropriate steps to stop and remedy unauthorized use.

6. Confidentiality and security

Only staff who need access to help you may access Store Personal Data, and they are bound by confidentiality. Every staff entry into a store is logged and shown to you. Waise maintains these measures: encryption in transit; hashed passwords; two-step verification; role-based permissions; encrypted secrets; rate limits; a security log; and encrypted off-site backups. Waise does not currently hold a SOC 2 or ISO 27001 certification.

7. Sub-processors

You authorize Waise to use the sub-processors below. Waise has a written agreement with each that protects the data at least as well as this DPA. Waise will give at least 30 days' notice before adding or replacing one; if you object on reasonable data-protection grounds, you may cancel without penalty before the change.

Services you connect yourself (your payment processor, carriers, advertising and analytics tools, or your own AI provider) act under your own agreement with them and are not Waise's sub-processors.

8. Shoppers' requests

Waise will help you respond to requests to know, access, correct, delete or port Store Personal Data, and to opt out. The admin lets you export a customer's data, delete a customer (including their chats), and export all your data. If a shopper contacts Waise directly, Waise will refer them to you.

9. Retention, deletion and return

Shopper chats and Pulse conversations: 365 days after the last message. Form IP addresses: 90 days. Abandoned checkouts: 180 days. Security events: 730 days. After cancellation or suspension, your store is kept for 90 days, during which you can export everything; it is then deleted, and encrypted backups are purged within 30 more days. Records the law requires Waise to keep are kept as the law requires.

10. Security incidents

Waise will notify you without undue delay, and where feasible within 72 hours after becoming aware, of a security incident affecting Store Personal Data, with what is known, and will update you as it learns more.

11. Audits

Once a year, on written request, Waise will answer a reasonable security questionnaire and provide the information needed to show compliance with this DPA. On-site audits are not included.

12. International transfers

Waise's servers are in Germany (EU). Where Store Personal Data of people in the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum apply and are incorporated by reference; for those clauses, the governing law and courts are those of Ireland.

13. Liability and precedence

The limitation of liability in section 12 of the Terms applies to this DPA. On personal data, this DPA prevails over the Terms.

14. Contact

Privacy and data-protection requests: the support screen in your store's admin (Pulse), or the contact page.