Data Processing Agreement — Seyaq Shopping Assistant

1. Subject and duration

The Processor processes personal data of the Controller's shoppers to provide the Shopping Assistant on the Controller's store, for as long as the subscription lasts and until the data is deleted as set out below.

2. Nature, purpose, data and people

Purpose: answering shoppers, helping with their cart and requests, store insights and security.

Data: shopper messages, a pseudonymous shopper id, cart contents read from the store, photos and voice messages (not kept), requests with the contact details shoppers give, usage events, action and security records — as listed in the Seyaq Privacy Policy.

People: the Controller's shoppers and store team members.

3. The Processor's obligations

The Processor processes the data only on the Controller's documented instructions — the Shopping Assistant terms, the Controller's settings and its use of the Assistant — unless the law requires otherwise, and tells the Controller if an instruction seems to break the law.

It keeps the data confidential and limits access to people bound to confidentiality; Seyaq support sees shopper conversations only under a time-limited grant the Controller can see and revoke.

It applies the security measures in section 7.

It uses the sub-processors listed in the Seyaq Privacy Policy, gives notice of a new one by email at least 30 days before it receives shopper data, and lets the Controller object and cancel if it cannot accept the change.

It helps the Controller answer shoppers' requests (access, correction, deletion, export) through the tools in WordPress, completing them within 30 days.

It notifies the Controller of a personal data breach affecting its shoppers without undue delay and within 72 hours of becoming aware of it, with what is known and what is being done.

At the end of the service it deletes the shopper data within 30 days (a disconnected store's data after 90 days unless it reconnects), except what the law requires it to keep, and lets the Controller download it first.

It makes available the information needed to show it meets this agreement — this document, the security description and answers to reasonable questions; on-site audits are not offered.

4. The Controller's obligations

The Controller has a lawful basis for the processing, tells its shoppers about the Assistant in its privacy notice, and gives only lawful instructions.

5. Transfers

Some sub-processors are outside the UAE and Saudi Arabia (Seyaq Privacy Policy). The Processor uses providers bound by data protection terms suited to such transfers and sends AI providers the minimum needed, without the shopper's identity.

6. Liability and law

Liability follows the Seyaq Terms of Service. This agreement is governed by the laws that govern those terms.

7. Security measures

Encryption in transit (TLS); credentials and tokens encrypted at rest (AES-256-GCM).

Every store's data separated by store in every query; signed requests between the store and Seyaq.

Sensitive data (card numbers, codes, passwords) hidden before storage or AI.

Operator access with an authenticator, roles, an audit log and a quarterly access review.

Backups expire within 35 days; deletions are re-applied after a restore.

Rate limits, abuse response and kill switches per store and platform.

Security reports to security@seyaq.ai; signed plugin updates. Privacy questions: privacy@seyaq.ai.