Data Processing Agreement

This Data Processing Agreement (the “Agreement”) forms an integral part of Tama’s Terms of Service. It applies whenever Tama processes personal data on behalf of the Merchant. By accepting the Terms of Service, the Merchant accepts this Agreement. No separate signature is required.

This Agreement formalises commitments already applicable under section 8 of the Terms of Service. It applies to all processing carried out by Tama on behalf of the Merchant, including processing carried out before its publication.

1. Parties and Definitions

“Tama”:

Tama Digital, Inc., a Delaware corporation with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

“Merchant”:

The individual or entity using the Services to operate its business.

“Merchant Data”:

The personal data Tama processes on behalf of the Merchant, including that of its end customers.

The terms controller, processor, processing and data subject have the meaning given to them by applicable data protection law.

2. Roles of the Parties

The Merchant is the controller of the Merchant Data. The Merchant determines the purposes and means of processing, ensures it has a legal basis to collect the data, informs its customers, and completes any formalities required by its own data protection authority.

Tama acts as processor for that data. Tama processes it only on the Merchant’s instructions.

Tama acts as controller for data relating to its own relationship with the Merchant, including user accounts, billing and support, which is governed by our Privacy Policy.

3. Description of the Processing

Subject matter:

The provision of the Services subscribed to by the Merchant.

Duration:

The term of the contract, extended by the periods set out in section 11.

Data subjects:

The Merchant’s end customers, delivery recipients, affiliates and team members.

Categories of data:

Identity and contact details, the customer’s tax identification number where given, delivery addresses and location, order content and history, payment statuses and references, messaging exchanges, uploaded files, connection data.

Purposes:

Hosting the store, processing orders, collecting payments, standardized invoicing with Benin’s DGI for Benin accounts, notifying customers, managing deliveries, sales analytics, support.

Tama does not process full payment card data; card details are entered with the payment providers.

4. Instructions

Tama processes Merchant Data in accordance with the Merchant’s documented instructions, which arise from the contract, from the Merchant’s use of the Services’ features, and from any additional written instruction. Tama informs the Merchant if an instruction appears to it to infringe applicable law.

Tama does not use Merchant Data for its own purposes, does not sell it, does not rent it, and does not share it with other merchants.

5. Confidentiality

Tama ensures that persons authorised to access Merchant Data are bound by a duty of confidentiality and access it only as necessary to operate, maintain or support the Services.

6. Security

Tama implements appropriate technical and organisational measures, including encryption of communications, isolation of data per merchant account, role-based access control, account authentication, logging of sensitive actions, regular backups and incident monitoring.

7. Sub-processors

The Merchant authorises Tama to engage the sub-processors listed in the annex to this Agreement. Tama imposes on them, by contract, data protection obligations equivalent to those in this Agreement, and remains responsible for their performance.

Tama informs the Merchant of any addition or replacement of a sub-processor with thirty (30) days’ notice. The Merchant may object on legitimate data protection grounds; failing agreement, it may terminate the affected Services without penalty.

8. International Transfers

Merchant Data is hosted in Amsterdam, the Netherlands. Uploaded files are stored with Amazon Web Services in the Eastern United States region. Other sub-processors may process data from other countries, as set out in the annex.

These transfers are made under contractual confidentiality and security commitments. It is for the Merchant to disclose them in the information it provides to its own customers and, where applicable, in its filings with its data protection authority.

9. Assistance to the Merchant

Tama assists the Merchant, to a reasonable extent and taking into account the nature of the processing:

• by providing the features needed to view, correct, export and delete its customers’ data;
• by responding to requests it sends to Tama where a data subject exercises their rights and the Merchant cannot respond alone;
• by providing the information needed to demonstrate compliance with its obligations.

Where a data subject contacts Tama directly, Tama refers them to the Merchant.

10. Data Breach

Tama notifies the Merchant of any breach affecting Merchant Data without undue delay after becoming aware of it. The notification describes the nature of the breach, the categories and approximate volume of data concerned, the likely consequences and the measures taken.

It is for the Merchant, as controller, to make the notifications required of it to its data protection authority and, where applicable, to the data subjects.

11. Return and Deletion

Throughout the term of the contract, the Merchant may export its orders, customers and affiliates in CSV format from its dashboard at any time.

On termination, the Merchant has thirty (30) days to carry out its exports. After that period, and at the Merchant’s written request, Tama deletes the Merchant Data within ninety (90) days, except for data Tama is legally required to retain, in particular transaction and billing records, and data held in backups, which is deleted at the end of its rotation cycle.

12. Liability

Each party is answerable for its own failures. Tama is liable for damage caused by processing only where it has not complied with the obligations specifically imposed on processors, or where it has acted outside or contrary to the Merchant’s lawful instructions.

13. Term and Changes

This Agreement takes effect upon acceptance of the Terms of Service and remains in force for as long as Tama processes Merchant Data.

Tama may amend it to reflect legal, technical or organisational developments. Any material change is notified to the Merchant thirty (30) days before it takes effect. The applicable version, and its date, appear at the top of this document.