Data Processing Agreement (DPA)

This Data Processing Agreement (hereinafter "DPA") is part of, and governed by, the General Terms and Conditions of Service for BRADcommerce (the "Terms"). It governs the processing of personal data by UAB Invertus ("Processor") on behalf of its Client ("Controller") in the context of the BRADcommerce Service.

1. Definitions

Unless otherwise defined herein or in the Terms, capitalized terms shall have the meaning given to them under the GDPR:

• Data Breach: A breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.
• Data Protection Laws: European and Lithuanian laws governing data protection, including the GDPR, the ePrivacy Directive as implemented in the relevant EU member states, national laws, and supervisory authority guidelines.
• Data Subject: A natural person whose identity can be directly or indirectly determined, particularly by identifiers like name, ID number, location data, or online identifiers.
• End Visitor: A natural person who interacts with the Controller's website, store, or systems and whose data is processed through the Service.
• Joint Controller Arrangement: The separate agreement between BRADcommerce and a Partner that sets out their joint controllership arrangement under Article 26 of the GDPR for processing activities resulting from a Partner Integration.
• Partner: A third party (such as an email marketing platform, advertising platform, or other ecommerce tool) with whom BRADcommerce has established a technical integration to enable data exchange under the Controller's instruction. Partners are not Sub-Processors of BRADcommerce; they have their own relationship with the Controller and may act as joint controllers with BRADcommerce in respect of certain processing activities.
• Partner Integration: The technical connection between BRADcommerce and a Partner that enables the bidirectional exchange of Data on behalf of the Controller.
• Personal Data ("Data"): Any information relating to an identified or identifiable natural person. References in this DPA to "Data," "Personal Data," and "personal data" have the same meaning.
• Security Measures: Technical and organizational measures ensuring an appropriate level of data security, meeting the minimum requirements set out in the Supervisory Authority's guidelines and Article 32 of the GDPR.
• Service: The BRADcommerce cloud-based ecommerce data and insights platform, as defined in the General Terms and Conditions of Service, through which the Processor carries out the processing activities described in this DPA.
• Sub-Processor: A third party engaged by the Processor to process Data on behalf of the Controller in connection with the Service.
• Supervisory Authority: State Data Protection Inspectorate of the Republic of Lithuania, and any other competent supervisory authority for the Controller's processing

2. Roles and Scope

2.1 Controller and Processor Roles

Controller: The Client, as the data Controller, determines the purposes and means of the processing of personal data under this DPA. The Controller is responsible for ensuring that the processing of personal data complies with applicable data protection laws, including the GDPR.

Processor: UAB Invertus, acting as the data Processor, shall process personal data in accordance with this DPA, applicable data protection laws, and recognized industry best practices.

This DPA forms an integral part of the contractual relationship between the Parties and supplements the BRADcommerce General Terms and Conditions of Service. It applies exclusively to the processing of personal data by the Processor on behalf of the Controller in the context of providing the BRADcommerce services. The effective date of this DPA is set out in Section 18.3. The processing will continue for the duration of the subscription and until the personal data is deleted in accordance with this DPA.

2.2 Joint Controllership Acknowledgment

The Parties acknowledge that certain processing activities carried out through Partner Integrations may result in joint controllership between BRADcommerce and the Partner within the meaning of Article 26 of the GDPR. Such joint controllership is governed by a separate Joint Controller Arrangement between BRADcommerce and each relevant Partner. The essence of each such arrangement is made available to data subjects through the Privacy Policy.

The Controller acknowledges that activating a Partner Integration may involve joint controllership and warrants that it has obtained the consents required from End Visitors before activating any such integration.

2.3 BRADcommerce as Controller for Its Own Purposes

BRADcommerce acts as an independent data controller for processing activities related to its own business operations (such as account management, billing, security monitoring, and the creation and use of aggregated and anonymized data as described in Section 7.2 of the Terms). Such processing is described in the Privacy Policy and falls outside the scope of this DPA.

3. Categories of Data Subjects

The personal data processed under this DPA may relate to the following categories of individuals:

• End Visitors: Natural persons who interact with the Controller's website, store, or systems, including anonymous and identified visitors, customers, and account holders;
• Controller's authorized representatives and users: Employees, contractors, or other authorized representatives of the Controller who use the BRADcommerce platform on the Controller's behalf;
• Subscribers and recipients of Partner communications: Where Partner Integrations involve communications platforms, the recipients of those communications;
• Other individuals whose data the Controller submits or generates through the Service in accordance with this DPA and applicable law.

4. Types of Personal Data Processed

4.1 Data Submitted by the Controller

Account registration, administration, and billing data of the Controller's users is processed by BRADcommerce as an independent controller in accordance with Section 2.3. The categories below are processed under this DPA only to the extent necessary to provide the Service:

• Identification and contact details of Controller's representatives: name, surname, job title, company name, email address, phone number;
• Account data of Controller's users: account credentials (stored in hashed form), authentication tokens, user roles, or permissions;
• Configuration and instruction data: integration settings, segment definitions, automation rules, and other configuration of the Service.

4.2 Data Automatically Collected About End Visitors Through the Service

When the Controller uses the BRADcommerce Service to track End Visitors on the Controller's website, the following personal data may be collected and processed automatically, subject to the consent of the End Visitor obtained by the Controller:

• Identifier data:
  • User ID (for logged-in End Visitors)
  • Session IDs and visitor IDs (where consent for session stitching is obtained)
  • Subscriber identifiers from integrated Partners (where consent for cross-platform identification is obtained)
• Technical and system usage data:
  • IP address (used for geographic inference at country level and discarded thereafter where feasible)
  • Country, region (geolocation data derived from IP)
  • Browser type and version
  • Device type (e.g., desktop, tablet, mobile)
  • Operating system
  • User agent string
  • Session logs
  • Date and time of actions taken on the Controller's website
• Behavioral and browsing data:
  • Page views and navigation paths
  • On-site search queries and results
  • Clicks and engagement events
  • Products viewed, added to cart, purchased, and other commerce engagement
  • Session duration and frequency
• Inferred data:
  • Interest profiles derived from End Visitor behavior
  • Customer segment classifications
  • Engagement scores and lifecycle stage indicators
• Ecommerce activity data:
  • Product catalog metadata
  • Order, transaction, and purchase data
  • Cart and checkout behavior

4.3 Data Received from Partners

Where the Controller has activated a Partner Integration, the Processor may receive personal data from the Partner about End Visitors, including:

• Subscriber identifiers and contact details (where the Partner is, e.g., an email marketing platform)
• Engagement events (such as email opens, clicks, bounces, unsubscribes)
• Campaign metadata
• Segment membership and tags assigned by the Partner

The Controller acknowledges that the receipt of such data from the Partner may constitute joint controllership between BRADcommerce and the Partner, as further described in Section 8.

4.4 Data Sent to Partners

Where the Controller has activated a Partner Integration, the Processor may send personal data about End Visitors to the Partner, including:

• Interest profiles and segment memberships
• Behavioral signals (such as recent product views, cart activity, purchase history)
• Triggered event notifications for marketing automation
• Aggregated metrics and counts

Data is sent to Partners only on the Controller's documented instructions and only where the End Visitor has provided the required consent for the specific cross-platform sharing purpose, as managed through the consent infrastructure described in Section 7.

4.5 Special Category Data

The Service is not designed or intended to be used for the purpose of collecting, profiling, or inferring special category data within the meaning of Article 9 of the GDPR, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, sex life, sexual orientation, genetic data, or biometric data used for identification purposes.

To reduce the risk that inferred interest profiles reveal or are liable to disclose such information, the Processor categorizes inferences derived from behavioral data at a level of generality designed not to reveal special category information. The resulting interest profiles are intentionally less granular than the underlying behavioral data from which they are derived.

The Controller acknowledges that the resulting profiles are intentionally less granular than the underlying behavioral data, and that this approach may limit the specificity of insights, segments, and personalization available through the Service.

Where the Processor is notified of, or otherwise becomes aware of, special category data having been submitted, generated, inferred, or processed through the Service, the Processor will take appropriate steps to restrict, delete, anonymize, suppress, or otherwise prevent further processing of such data, except to the extent applicable law requires otherwise. The approach described in the preceding paragraphs constitutes the Processor's primary safeguard against the processing of special category data; this paragraph applies to cases that come to the Processor's attention and does not create an obligation to systematically monitor or scan data processed through the Service.

5. Data Processing Purposes

The Processor shall process Personal Data only for the following purposes:

• Service delivery: providing the BRADcommerce platform to the Controller, including data collection, processing, storage, dashboard display, and insights generation;
• AI-driven insights: generating analytics, alerts, recommendations, and insights based on the Controller's data for use by the Controller;
• Profile building and personalization: constructing End Visitor profiles and supporting personalization across channels, subject to consent obtained by the Controller;
• Partner data exchange: facilitating the bidirectional exchange of data with Partners as configured by the Controller;
• Support and operations: providing technical support to the Controller and ensuring the operational continuity of the Service;
• Security and integrity: monitoring the Service for security threats, fraud, and abuse;
• Service improvement: improving the Service's performance, reliability, and functionality for the Controller through the analysis of that Controller's own usage and configuration data; cross-customer aggregation, benchmarking, or product improvement using data from multiple Controllers is carried out by BRADcommerce as an independent controller in accordance with Section 2.3, and is outside the scope of this Section;
• Legal compliance: complying with legal obligations applicable to the Processor.

The Processor shall not process Personal Data beyond these purposes or outside the Controller's documented instructions, except where required by applicable law.

The Processor shall not use Personal Data for its own purposes, including profiling, resale, or independent analytics, except as described in Section 2.3 (BRADcommerce as Controller for Its Own Purposes).

6. Party Obligations

6.1 General Obligations

Both Parties shall ensure that personal data is protected against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, especially during electronic transmission. Each Party shall implement adequate technical and organizational measures in line with Article 32 of the GDPR.

6.2 Controller's Obligations

The Controller shall:

• Provide lawful instructions: Provide lawful, clear, and documented instructions for processing. Such instructions must fall within the scope of the Service defined in this DPA and may not extend or alter the Processor's role beyond the technical scope of the Service. The Processor shall not be obliged to comply with any instructions it reasonably believes may breach applicable law. The Controller shall indemnify the Processor against any claims resulting from unlawful instructions.
• Warrant lawful basis: Warrant that all Personal Data shared with or generated through the Service has been lawfully collected, that a valid lawful basis exists for each processing purpose, and that all required consents from End Visitors have been obtained, including specifically:
  
  • Consent for cookie and similar tracking technologies under the ePrivacy Directive Article 5(3);
  • Consent for session stitching and behavioral profiling;
  • Consent for cross-platform data sharing with each activated Partner;
  • Consent for personalization across channels;
  • Explicit consent under Article 9 GDPR where applicable (subject to the Article 9 approach set out in Section 4.5).
• Provide transparency to End Visitors: Inform End Visitors of the processing carried out by the Processor and any joint controllers, including providing information required under Articles 13 and 14 of the GDPR.
• Respond to Data Subject requests: Be responsible for responding to and managing data subject rights requests from End Visitors, with the Processor's reasonable assistance as described in Section 6.3.
• Audit rights: The Controller may audit the Processor's compliance with this DPA once per year, upon at least 30 days' prior written notice, and only during normal business hours. Additional audits shall be permitted only in case of a confirmed data breach or regulatory requirement. Audits shall be limited to the scope of data processing performed for the Controller, subject to confidentiality, and conducted at the Controller's expense. The Processor may satisfy audit requests by providing relevant certifications, audit reports from independent third parties, or other documentation reasonably sufficient to demonstrate compliance.

6.3 Processor's Obligations

The Processor shall:

• Process only on instructions: Process Personal Data solely as described in this DPA and on the Controller's documented instructions, in accordance with applicable data protection law and industry best practices.
• Confidentiality: Ensure that only authorized personnel bound by confidentiality obligations have access to Personal Data.
• Security: Implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as further described in Section 11.
• Breach notification: Notify the Controller of a personal data breach affecting the Controller's data without undue delay, and in any case within 48 hours of becoming aware, as further described in Section 12.
• Assistance with Data Subject requests: Provide reasonable assistance to the Controller in responding to data subject requests where such requests relate to processing activities carried out by the Processor and where the Controller lacks the technical means. Such assistance shall not include direct communication with data subjects unless explicitly agreed in writing.
• Assistance with DPIA and consultation: Provide reasonable assistance to the Controller in carrying out Data Protection Impact Assessments (Article 35 GDPR) and consultations with supervisory authorities (Article 36 GDPR), where applicable.
• Sub-processor management: Engage Sub-Processors only as permitted under this DPA (Section 9), and remain responsible for their performance.
• Partner Integration management: Maintain Joint Controller Arrangements with Partners as required by Article 26 of the GDPR.
• Return or deletion: Delete or return personal data after the end of the processing, as set out in Section 14.
• Demonstration of compliance: Provide information reasonably necessary to demonstrate compliance upon written request, subject to confidentiality and protection of proprietary information.
• Records of Processing: Upon written request, provide information required to maintain the Controller's records under Article 30(1) of the GDPR.

7. Consent and Data Subject Signals

7.1 The Processor will provide technical mechanisms for the Controller to manage End Visitor consent across processing purposes carried out through the Service, including:

• Granular per-purpose consent capture and storage;
• Real-time consent state checking before processing;
• Consent withdrawal handling;
• Audit trail of consent state changes.

Processing activities that depend on such consent mechanisms - including profiling, cross-platform data sharing, and personalization - shall not be activated for a Controller until the applicable consent infrastructure is operational. The Processor relies on the consent state signals transmitted by the Controller and does not independently verify the existence, validity, or scope of the underlying End Visitor consent; such verification remains the Controller's sole responsibility as set out in Section 6.2.

7.2 The Controller is responsible for implementing and maintaining its consent management on its own website (including consent banners and granular consent options) and for transmitting the consent state to the Service in accordance with the documentation provided by the Processor.

7.3 The Processor shall not initiate processing that requires consent (such as behavioral profiling, cross-platform data sharing, or personalization) before receiving a valid consent signal from the Controller.

7.4 The Processor shall distinguish between the following data subject signals and respond appropriately:

• Channel unsubscribe (e.g., email opt-out): cessation of communications via the specific channel, with possible continued profile use for other channels where consent remains valid;
• Withdrawal of consent for a specific purpose: cessation of that purpose's processing across all channels;
• Objection to profiling for direct marketing under Article 21(2) GDPR: absolute cessation of all profile-driven direct marketing processing;
• Right to erasure (Article 17 GDPR): deletion of profile and underlying data subject to applicable retention obligations.

7.5 Signals received by the Processor (including via Partner Integrations) shall be propagated to the relevant Partners and Sub-Processors in a timely manner. The Controller shall ensure that signals received on its own systems are transmitted to the Processor.

8. Joint Controllership with Partners

8.1 Where a Partner Integration results in joint controllership between the Processor and a Partner under Article 26 of the GDPR, the Processor will enter into a Joint Controller Arrangement with the Partner, before the relevant Partner Integration is activated, setting out the respective responsibilities of the joint controllers.

8.2 The essence of each Joint Controller Arrangement is made available to data subjects through the Privacy Policy and through the Partner's own privacy notice.

8.3 Under the Joint Controller Arrangement, the Processor and the Partner allocate responsibilities for:

• Information to data subjects (Articles 13 and 14 GDPR);
• Responding to data subject rights requests;
• Data breach notification (Articles 33 and 34 GDPR);
• Security measures appropriate to the joint processing;
• Records of joint processing activities.

8.4 The Controller acknowledges that:

• Activating a Partner Integration may bring the joint controller relationship into effect for processing of the Controller's End Visitor data;
• Data subjects may exercise their rights against either the Processor or the Partner regardless of the internal allocation of responsibilities;
• The Controller remains the controller of the End Visitor relationship and retains ultimate responsibility for the lawful basis of the processing.

8.5 The Processor shall not enter into Joint Controller Arrangements with Partners on terms that conflict with the Controller's obligations under applicable law.

9. Sub-Processors

9.1 The Processor may engage Sub-Processors to support the delivery and operation of the BRADcommerce Service, including for infrastructure and hosting, artificial intelligence services, analytics, support and internal collaboration tools, and related functionalities.

9.2 A list of current authorized Sub-Processors is maintained in Appendix A to this DPA. The Controller hereby authorizes use of the listed Sub-Processors.

9.3 The Processor shall notify the Controller in writing at least 15 calendar days before appointing any new or replacement Sub-Processor. Notification shall be made via the Controller's account dashboard, by email, or by publication of an updated Appendix A.

9.4 The Controller may object to a new Sub-Processor only on reasonable, documented grounds relating to data protection. If such objection is not raised within the notice period, the new Sub-Processor shall be deemed accepted. If an objection is raised, the Parties shall cooperate in good faith to find a suitable solution. If no agreement is reached, the Controller may terminate the affected Service in writing, with 30 days' notice.

9.5 The Processor shall enter into a written agreement with each Sub-Processor that imposes obligations substantially equivalent to those in this DPA, especially ensuring compliance with Article 28 of the GDPR.

9.6 The Processor shall remain fully liable for the acts and omissions of its Sub-Processors to the same extent it would be liable if it performed the relevant processing itself.

9.7 Any international transfer of personal data by a Sub-Processor outside the European Economic Area shall comply with applicable data protection laws, including appropriate safeguards such as Standard Contractual Clauses or adequacy decisions under Chapter V of the GDPR.

9.8 Partners are not Sub-Processors of the Processor. The Controller's relationship with each Partner is governed by the Controller's separate agreement with the Partner. Joint controllership arrangements with Partners are governed by the Joint Controller Arrangement as described in Section 8.

10. International Transfers

10.1 The Processor aims to host and process personal data within the European Economic Area where technically and operationally feasible. The primary hosting infrastructure is located in Frankfurt, Germany.

10.2 Where personal data is transferred to a country outside the EEA, the Processor shall ensure that appropriate safeguards are in place under Chapter V of the GDPR, including:

• Adequacy decisions by the European Commission, where applicable;
• Standard Contractual Clauses (SCCs) adopted by the European Commission;
• Supplementary measures (technical, contractual, or organizational) following a Transfer Impact Assessment where required.

The applicable Standard Contractual Clauses are incorporated into this DPA by reference and are available to the Controller upon written request.

10.3 The locations of Sub-Processors and any transfer mechanisms in place are documented in Appendix A.

11. Security Measures

The Processor shall implement appropriate technical and organizational measures to protect personal data, as required under Article 32 of the GDPR. These include, where applicable:

• Encryption of data in transit (TLS 1.2 or higher) and at rest;
• Access controls based on the principle of least privilege;
• Multi-factor authentication for administrative access;
• Activity logging and security monitoring;
• Regular system updates, vulnerability scanning, and patch management;
• Pseudonymization or anonymization where feasible;
• Network segregation and protection;
• Backup and disaster recovery procedures;
• Employee training on data protection and security;
• Incident response procedures.

The Processor's access controls and confidentiality obligations regarding personnel are set out in Section 13.

A more detailed description of the security measures may be provided upon written request, subject to confidentiality obligations and limitations to protect the security of the Service.

12. Personal Data Breaches

12.1 The Processor shall notify the Controller of a personal data breach affecting the Controller's data without undue delay, and in any case within 48 hours of becoming aware of the breach.

12.2 The notification shall include, to the extent available:

• A description of the nature of the breach;
• The categories and approximate number of data subjects and data records affected;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach and mitigate its effects;
• Contact details for further inquiries.

12.3 Where complete information cannot be provided within 48 hours, the Processor shall provide the available details and supplement the notification as soon as further information becomes available.

12.4 The Processor shall cooperate fully with the Controller to support compliance with the Controller's obligations under Articles 33 and 34 of the GDPR, including assisting with communications to supervisory authorities and affected data subjects where required.

12.5 Where the breach involves a Partner with whom the Processor is a joint controller, the Processor and the Partner shall coordinate on breach handling in accordance with the relevant Joint Controller Arrangement.

13. Confidentiality and Authorized Access

Confidentiality: Each Party shall treat all personal data and other confidential information as strictly confidential and shall not disclose it to third parties without prior written consent, unless required by law.

Authorized Access: The Processor shall ensure that only authorized personnel with a need-to-know basis have access to personal data, and that they are subject to confidentiality obligations.

Survival: The confidentiality obligations under this clause shall survive the termination of this DPA.

14. Return or Deletion of Data

14.1 Upon termination or expiry of the Controller's subscription to the Service, the Processor shall, at the Controller's choice, either return or securely delete all personal data processed on behalf of the Controller, unless applicable law requires longer retention.

14.2 Unless otherwise agreed in writing, the Processor shall retain the data for up to ninety (90) days after termination for the specific purposes of potential reactivation, audit, or legal defense. Such retention shall be limited and proportionate to those purposes. During the retention period, data shall be held in a restricted-access state, save for the Controller's ability to export available Client Data in accordance with Section 5.6 of the Terms. After this period, all personal data shall be securely and irreversibly deleted.

14.3 If the Controller requests earlier deletion or data return, the Processor shall fulfill such request within 30 days, provided no legal obligation prevents it.

14.4 Where personal data has been transmitted to Partners through Partner Integrations, the deletion of data on the Processor's systems does not automatically result in deletion of data held by Partners. The Controller is responsible for ensuring deletion at the Partner level where required.

14.5 Deletion shall be carried out using appropriate technical means, and confirmation shall be provided to the Controller upon written request.

15. Data Processing Principles

Processing under this DPA shall follow the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

16. Disclaimer of Liability

Except as set out in this Section, the Processor's liability under this DPA shall be subject to the limitations set out in the General Terms and Conditions of Service.

The Controller remains solely and fully responsible for:

• The lawfulness of personal data provided to the Service;
• The accuracy and quality of such data;
• The lawfulness of processing purposes and instructions given to the Processor;
• The existence and validity of consents obtained from End Visitors;
• The Controller's own compliance with the GDPR, the ePrivacy Directive, and applicable national laws.

The Processor shall not be liable for any processing performed in accordance with the Controller's instructions.

The Controller shall indemnify and hold harmless the Processor against any third-party claims, regulatory actions, fines, or damages arising out of:

• Unlawful or inaccurate data supplied by the Controller;
• Instructions that violate applicable law;
• The Controller's breach of GDPR, the ePrivacy Directive, or this DPA;
• The Controller's failure to obtain required consents from End Visitors.

Where the Processor engages a Sub-Processor, it shall ensure compliance with GDPR Article 28 requirements. The Processor shall be liable for Sub-Processors to the extent required by GDPR.

In respect of joint controllership with Partners, liability is allocated as set out in the relevant Joint Controller Arrangement. Notwithstanding such allocation, joint controllers are jointly and severally liable to data subjects under Article 82(4) GDPR; the internal allocation governs recourse between joint controllers.

Limitation of Liability: The Processor's total cumulative liability under this DPA shall be subject to, and shall count towards, the aggregate liability cap set out in Section 13.6 of the Terms.

17. Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws of the Republic of Lithuania. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of the Republic of Lithuania, unless otherwise agreed by the Parties in writing.

18. Miscellaneous

18.1 If any provision of this DPA is found to be invalid or unenforceable, the remainder shall remain valid and enforceable.

18.2 This DPA may only be amended by a written agreement signed or confirmed by both Parties, or by publication of an updated version on the BRADcommerce website where the amendment is required by law or operational necessity, with appropriate notice to Controllers.

18.3 This DPA becomes effective upon acceptance of the BRADcommerce General Terms and Conditions of Service or upon mutual signature, as applicable.

18.4 No partnership, joint venture, or agency is created by this DPA.

19. Contact Information

For any questions or concerns regarding this Data Processing Agreement, please contact:

• Email: support@bradcommerce.com
• Address: K. Donelaičio g. 62-522, LT-44248 Kaunas, Lithuania
• Company Code: 300117946

Appendix A – Authorized Sub-Processors

Last updated: October 8, 2026

This Appendix forms an integral part of the Data Processing Agreement (DPA) between the Controller and UAB Invertus (Processor). It consists of two parts:

• Part 1 lists the Sub-Processors that process personal data on behalf of the Controller in connection with the Service. The Controller authorizes the use of these Sub-Processors in accordance with Section 9.
• Part 2 lists service providers engaged by BRADcommerce for its own purposes as an independent controller, as described in Section 2.3 and the Privacy Policy. These providers do not process Client Data on behalf of the Controller and are listed for transparency only. Sections 9.3 and 9.4 do not apply to Part 2.

Part 1 – Sub-Processors (processing Client Data on behalf of the Controller)

All Sub-Processors listed in this Part are bound by written agreements imposing data protection obligations substantially equivalent to those set out in this DPA, in compliance with Article 28 of the GDPR.

Part 2 – Service Providers Engaged by BRADcommerce as an Independent Controller (for information only)