Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

Inovacijų dialogas, MB, a company incorporated in Lithuania (company registration number 306672068, VAT number LT100016637613), with registered address at P. Vileišio g. 15-25, LT-10306 Vilnius, Lithuania, operating the Vantemo platform ("Processor", "Vantemo")

and

the merchant entity or individual that has accepted this DPA by checking the acceptance box during registration or account setup ("Controller", "Merchant").

Together referred to as the "Parties".

For the DPA version history, see the DPA Changelog.

Recitals

(A) The Controller operates an online store using the Vantemo platform and, in doing so, collects and processes personal data of its end-customers.

(B) The Processor provides the technical infrastructure and software through which the Controller's online store operates, and in doing so processes personal data on behalf of and under the instructions of the Controller.

(C) The Parties wish to set out in this DPA the terms under which the Processor will process personal data on behalf of the Controller, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR").

(D) This DPA forms part of, and is incorporated into, the Terms of Service between the Parties. In the event of conflict between this DPA and the Terms of Service on matters of data protection, this DPA shall prevail.

Article 1 — Definitions

1.1 The following terms have the meanings given to them in the GDPR: "personal data", "processing", "data subject", "controller", "processor", "personal data breach", "supervisory authority", "special categories of personal data".

1.2 "Applicable Data Protection Law" means the GDPR together with any national implementing legislation in the country of establishment of either Party, and any other applicable data protection laws and regulations as amended from time to time.

1.3 "Controller Personal Data" means personal data processed by the Processor under this DPA on behalf of the Controller, as further described in Annex A.

1.4 "Services" means the Vantemo e-commerce platform and all related features and services provided under the Terms of Service.

1.5 "Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data transmitted, stored, or otherwise processed by the Processor.

1.6 "Sub-processor" means any third party engaged by the Processor to process Controller Personal Data on the Processor's behalf.

Article 2 — Scope and Purpose

2.1 This DPA applies to the processing of Controller Personal Data by the Processor in connection with providing the Services to the Controller.

2.2 The details of the processing are set out in Annex A, including the subject matter, nature and purpose of processing, data subject categories, and personal data categories.

2.3 Nothing in this DPA relieves the Controller of its own obligations as a Data Controller under Applicable Data Protection Law.

Article 3 — Controller Obligations

3.1 Lawful basis. The Controller confirms that it has a valid lawful basis under Applicable Data Protection Law for each processing activity it instructs the Processor to carry out, and that all processing instructions it provides are lawful.

3.2 Instructions. The Controller's instructions to the Processor are set out in this DPA and the Terms of Service, supplemented by any written instructions provided from time to time. The Controller shall not instruct the Processor to process Controller Personal Data in a manner that would violate Applicable Data Protection Law.

3.3 Privacy notices. The Controller is responsible for providing appropriate privacy notices to its end-customers, obtaining any required consents, and maintaining records of processing activities as required by GDPR Art. 30.

3.4 Special categories. The Controller shall not use the Services to process special categories of personal data (GDPR Art. 9) without prior written agreement with the Processor setting out the additional measures to be implemented. The Processor does not accept special category data by default and is not liable for any special category data submitted without such agreement.

Article 4 — Processor Obligations

4.1 Processing on instructions only. The Processor shall process Controller Personal Data only on the documented instructions of the Controller, as set out in this DPA and the Terms of Service, unless required to do so by EU or member state law applicable to the Processor. In such case, the Processor shall inform the Controller before processing, unless that law prohibits such information.

4.2 Confidentiality. The Processor shall ensure that persons authorised to process the Controller Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Security. The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as further described in Annex C and Article 32 GDPR.

4.4 Sub-processors. The Processor shall engage sub-processors only in accordance with Article 5 of this DPA.

4.5 Data subject rights. The Processor shall assist the Controller in fulfilling its obligations to respond to data subject requests in accordance with Article 8.

4.6 Deletion and return. The Processor shall delete or return Controller Personal Data on termination in accordance with Article 9.

4.7 Audit. The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Article, and allow for and contribute to audits in accordance with Article 10.

4.8 Notification of unlawful instructions. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law.

Article 5 — Sub-processors

5.1 General authorisation. The Controller grants the Processor general authorisation to engage sub-processors, subject to the conditions in this Article. The current list of approved sub-processors is available at vantemo.com/sub-processors and in Annex B of this DPA.

5.2 Change notification. Before engaging a new sub-processor or making a material change to an existing sub-processor arrangement, the Processor shall provide the Controller with at least 30 days' advance written notice by email.

5.3 Right to object. The Controller may object to the addition of a new sub-processor within 30 days of receiving the notice. An objection must be made in writing to [email protected] and must set out the reasonable grounds for the objection. The Parties shall negotiate in good faith to resolve the objection. If the objection cannot be resolved, the Controller may terminate the relevant Services without penalty.

5.4 Flow-down obligations. The Processor shall impose data protection obligations on each sub-processor that are equivalent to those set out in this DPA. The Processor remains fully liable to the Controller for the acts and omissions of its sub-processors.

5.5 Existing sub-processors. The sub-processors listed in Annex B are approved as of the DPA effective date.

Article 6 — Security of Processing

6.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate:

• the pseudonymisation and encryption of personal data;
• the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
• the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
• a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

The specific measures implemented are described in Annex C.

Article 7 — Personal Data Breach

7.1 Processor notification. In the event of a Security Incident affecting Controller Personal Data, the Processor shall notify the Controller without undue delay and in any event within 48 hours of becoming aware of the Security Incident.

7.2 Content of notification. The notification shall include, to the extent known at the time: (a) the nature of the Security Incident, including categories and approximate number of data subjects and records affected; (b) the Processor's privacy contact ([email protected]); (c) likely consequences of the Security Incident; (d) measures taken or proposed to address the incident and mitigate its effects.

7.3 Staged notification. Where all required information is not available at the time of initial notification, the Processor shall provide the information in stages as it becomes available, without further undue delay.

7.4 Controller's responsibility. The Controller (as Data Controller) is solely responsible for: (a) assessing whether the Security Incident must be reported to the relevant supervisory authority under Art. 33 GDPR within 72 hours — the Controller acknowledges that the 72-hour clock begins from the moment the Controller becomes aware of the incident, which may coincide with receipt of the Processor's notification; (b) communicating the incident to affected data subjects where required under Art. 34 GDPR; (c) all related decisions and actions vis-à-vis the supervisory authority and data subjects. The Processor's lead supervisory authority is the State Data Protection Inspectorate (VDAI), A. Juozapavičiaus g. 6, LT-09310 Vilnius ([email protected]).

7.5 Cooperation. The Processor shall cooperate fully with the Controller in investigating, mitigating, and remediating any Security Incident.

7.6 No acknowledgement of fault. The Processor's notification of a Security Incident shall not constitute an acknowledgement of fault or liability.

Article 8 — Data Subject Rights

8.1 Assistance. The Processor shall assist the Controller, by appropriate technical and organisational measures, in fulfilling the Controller's obligations to respond to requests from data subjects exercising their rights under Chapter III GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).

8.2 Passing on requests. If the Processor receives a data subject request directly from an end-customer relating to Controller Personal Data, the Processor shall: (a) notify the Controller without undue delay; (b) not respond to the data subject directly, except to acknowledge receipt and to direct the data subject to the Controller; and (c) reasonably cooperate with the Controller to assist in its response.

8.3 Timeline for assistance. The Processor shall provide assistance requested under Article 8.1 within 10 business days of receiving the Controller's written request, or such shorter period as is necessary to enable the Controller to meet its obligations under Art. 12 GDPR (one month from the data subject's request).

8.4 Costs. The Processor may charge a reasonable fee for assistance under this Article where such assistance requires significant effort beyond the standard functionality of the Services.

Article 9 — Deletion and Return of Personal Data

9.1 On termination. On termination of the Terms of Service for any reason, or on written request from the Controller, the Processor shall, at the Controller's election: (a) return to the Controller a copy of all Controller Personal Data in a machine-readable format; or (b) securely delete all Controller Personal Data and certify such deletion in writing.

9.2 Timeline. The Processor shall complete the return or deletion within 30 days of the termination date or request.

9.3 Legal retention exception. Notwithstanding Article 9.1, the Processor may retain Controller Personal Data to the extent, and for the period, required by applicable EU or member state law (including Lithuanian accounting law requiring 10-year retention of financial records). Such retained data shall be anonymised to the extent possible and processed for no other purpose.

9.4 Sub-processor deletion. The Processor shall procure that all sub-processors delete or return Controller Personal Data in accordance with this Article.

Article 10 — Audit Rights

10.1 Information. The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations in this DPA and Art. 28 GDPR.

10.2 Audit. The Processor shall allow for, and contribute to, audits and inspections conducted by the Controller or an auditor mandated by the Controller, provided that: (a) the Controller provides at least 30 days' advance written notice; (b) audits are conducted during normal business hours with minimal disruption; (c) the auditor is subject to confidentiality obligations; (d) no more than one audit per 12-month period is conducted unless a Security Incident has occurred.

10.3 Costs. The Controller shall bear all costs of the audit unless the audit reveals material non-compliance by the Processor, in which case the Processor shall bear reasonable audit costs.

Article 11 — Liability

11.1 Each Party's liability to the other under or in connection with this DPA shall be subject to the same limitations and exclusions of liability as set out in the Terms of Service, unless otherwise stated in this Article.

11.2 Processor liability. The Processor shall be liable to the Controller for damages caused by processing in breach of this DPA where the Processor has not complied with its obligations under Applicable Data Protection Law or under this DPA that are specifically directed to the Processor.

11.3 Controller liability. The Controller shall be liable to the Processor for damages caused by processing in breach of this DPA or Applicable Data Protection Law where the Controller has acted outside or contrary to its lawful instructions under this DPA, or where the damage was caused by the Controller's failure to fulfil its obligations as a Controller.

11.4 Indemnity. The Controller shall indemnify and hold harmless the Processor against regulatory fines, penalties, claims, damages, costs, and expenses arising from: (a) the Controller's failure to have a lawful basis for processing; (b) the Controller's breach of its obligations under Article 3; (c) any inaccurate, incomplete, or unlawful data submitted by the Controller to the Services.

11.5 Regulatory fines. Where a supervisory authority imposes a fine, each Party shall bear responsibility for its own failures. The Processor shall not be liable for fines arising from the Controller's failures, and vice versa.

11.6 Cap on liability. The Processor's total liability to the Controller under this DPA shall not exceed the total fees paid by the Controller to Vantemo in the 12 months immediately preceding the event giving rise to the claim.

11.7 Exclusions. Nothing in this DPA limits either Party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be limited by applicable law.

Article 12 — Term and Termination

12.1 Term. This DPA is effective from the date the Controller accepts it (by checking the acceptance box during registration) and remains in force until the Terms of Service terminate.

12.2 Effect of termination. On termination, the Processor's obligations to process Controller Personal Data under this DPA cease, subject to Article 9 and Article 12.3.

12.3 Survival. Articles 1, 9, 10 (for 12 months post-termination), 11, and 13 survive termination.

Article 13 — General Provisions

13.1 Entire agreement. This DPA, together with its Annexes, any supplemental addendums or schedules presented and accepted by the Controller during feature onboarding (including without limitation the BYOD DPA Addendum), and the Terms of Service, constitutes the entire agreement between the Parties with respect to the subject matter hereof.

13.2 Amendments. The Processor may amend this DPA by providing the Controller with at least 30 days' advance written notice. For amendments that materially increase the Controller's obligations or materially reduce the Processor's obligations, the Controller may terminate the Terms of Service without penalty within 30 days of the amendment taking effect. See the DPA Changelog for all versions.

13.3 Severability. If any provision of this DPA is found to be invalid or unenforceable, that provision shall be modified to the minimum extent necessary, and the remaining provisions shall continue in full force.

13.4 Governing law. This DPA is governed by the laws of the Republic of Lithuania, without regard to conflict of law principles.

13.5 Jurisdiction. Disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of Vilnius, Lithuania, except that either Party may seek interim injunctive relief in any court of competent jurisdiction.

13.6 Language. This DPA is drafted in English. In the event of any inconsistency between the English version and any translation, the English version shall prevail.

Article 14 — International Data Transfers

14.1 Primary processing location. The Processor processes Controller Personal Data on servers located within the European Union (Lithuania). No international transfer of Controller Personal Data to third countries occurs through the Processor's own infrastructure. Transactional and marketing email is processed by Amazon SES in the AWS eu-north-1 region (Stockholm, Sweden), which is within the EEA; this is an intra-EEA transfer that does not require a Chapter V safeguard.

14.2 Sub-processor transfers. Certain approved sub-processors (listed in Annex B) are located in, or transfer data to, countries outside the European Economic Area, including the United States. Where such transfers occur, the Processor ensures that adequate safeguards are in place in accordance with Chapter V GDPR.

14.3 Transfer mechanisms. The following mechanisms are used to protect personal data transferred to third countries:

Amazon Web Services (SES) email processing runs in the AWS eu-north-1 region (Stockholm, Sweden) and is therefore an intra-EEA transfer, not a third-country transfer; it is listed in Annex B for completeness but requires no Chapter V transfer mechanism.

14.4 SCC incorporation. Where Standard Contractual Clauses are used, the relevant module of the SCCs adopted by the European Commission (Commission Implementing Decision 2021/914) is incorporated by reference into the sub-processor agreements (for several sub-processors this occurs through the provider's own published data processing terms, which the Controller enters into by using the Services). The Processor relies on Standard Contractual Clauses and/or EU-US Data Privacy Framework certification for its US sub-processors and will provide the applicable transfer documentation on request to [email protected]. The Processor last verified the current DPF participation status of its US sub-processors on 8 July 2026 against the official Data Privacy Framework list (dataprivacyframework.gov): Stripe, Cloudflare, Amazon Web Services (via its parent's certification), Twilio, Sentry, and Google are active participants, while OpenAI and Anthropic are not DPF-certified and rely on Standard Contractual Clauses. Because SCCs are incorporated for every US sub-processor in addition to any DPF certification, the SCCs operate as a self-executing fallback: if the EU-US Data Privacy Framework adequacy decision is suspended, withdrawn, or invalidated, transfers continue to be governed by the SCCs without any need to re-paper the sub-processor agreements.

14.5 Transfer Impact Assessments. Where the Processor relies on Standard Contractual Clauses as the sole transfer mechanism for a third-country sub-processor, it conducts a Transfer Impact Assessment in accordance with EDPB Recommendations 01/2020. Assessments for the AI/LLM sub-processors relying solely on Standard Contractual Clauses (Anthropic and OpenAI) are in progress. Copies of completed assessments are available on request.

14.6 Change notification. If the Processor adds a new sub-processor involving an international transfer, the Controller will be notified in accordance with Article 5.2 (30-day advance notice).

14.7 International governmental access (EU Data Act). In addition to the GDPR transfer safeguards in this Article, the information required under Article 28 of the EU Data Act (Regulation (EU) 2023/2854) — namely the jurisdiction to which the ICT infrastructure deployed for the Services is subject, and a general description of the technical, organisational and contractual measures the Processor adopts to prevent unlawful international governmental access to, or transfer of, non-personal data held in the Union — is published and kept up to date at vantemo.com/data-jurisdiction. That page forms part of this DPA by reference, satisfying Article 28(2) of the EU Data Act.

Annex A — Details of Processing

A.1 Subject matter

The Processor processes personal data in connection with operating the Controller's online store on the Vantemo platform, including order management, payment processing, customer communications, and storefront delivery.

A.2 Nature and purpose

A.3 Duration

For the duration of the Terms of Service, and thereafter in accordance with Article 9.

A.4 Categories of data subjects

• End-customers of the Controller's online store
• Visitors to the Controller's storefront (non-purchasing)

A.5 Categories of personal data

The Controller determines which specific data it collects. The Processor processes whatever data the Controller's store configuration directs it to collect.

A.6 Special categories

None are processed by default. Processing of special categories requires prior written agreement under Article 3.4.

A.7 Processing location

Controller Personal Data is processed on servers located within the European Union. Sub-processors may process data in other jurisdictions as listed at vantemo.com/sub-processors.

A.8 Platform-set storefront cookies

In addition to any cookies the Controller configures, the Processor sets a limited set of cookies on the Controller's storefront that the Controller must account for in its own storefront cookie and consent notices:

• customer_session — end-customer login/authentication (strictly necessary);
• _fbc — a Meta click-attribution identifier, set only after the end-customer has recorded advertising-tracking consent and only where the Controller has configured a Meta pixel;
• vf_s — a short-lived checkout session cookie used for fraud and abuse prevention, where enabled.

A.9 Retention of specific processor-side records

Most Controller Personal Data is retained for the duration of the Terms of Service and deleted or returned under Article 9. The following processor-side records have their own retention basis:

• SMS message records. SMS records, including the end-customer phone number, are retained to evidence delivery and for billing reconciliation. The raw phone number is automatically anonymised (set to null) 90 days after the message is sent; the non-identifying billing metadata (credit cost, the Twilio message identifier, destination country, and timestamps) is retained for accounting and reconciliation. Because the Twilio message identifier is retained and points into Twilio's own message logs, Twilio's own retention (under its sub-processor DPA), rather than Vantemo's 90-day local anonymisation, is the erasure boundary for the number itself.
• End-customer erasure-accountability record. Where an end-customer exercises their right to erasure on the Controller's storefront, the Processor anonymises the end-customer's records and writes a minimal accountability record — an administrative audit-log entry keyed to the internal customer identifier and the erasure event only — to evidence that the erasure was carried out (GDPR Article 5(2) accountability). This record does not retain the erased email address or any other raw personal data, and the internal identifier no longer maps to an identifiable person once the underlying records are erased. The accountability record is itself an administrative-action audit record and is subject to the audit-log retention window described in Annex C.5.

Annex B — Approved Sub-processors

The following sub-processors are approved as of the DPA effective date. The Controller is deemed to have approved this list by accepting this DPA at signup. The always-current list is maintained at vantemo.com/sub-processors.

The AI/LLM sub-processors (Anthropic, OpenAI, Google, DeepL) process only the store content and, where the AI assistant's tools are used, the end-customer records the Controller directs it to access. No Controller Personal Data is used to train the sub-processors' models — see Article 2.3.

Each first-tier sub-processor engages its own sub-processors (for example, cloud-hosting or telecommunications carriers). In accordance with EDPB Opinion 22/2024 (adopted 7 October 2024), the Processor maintains, and will provide on request, the identity and location of the sub-processors in this downstream chain. Additions or replacements at the first tier are notified at least 30 days in advance (Article 5.3).

Annex C — Technical and Organisational Security Measures

C.1 Data in transit

All data transmitted between end-users, merchants, and Vantemo servers is encrypted using TLS 1.2 or higher. All endpoints are HTTPS-only; HTTP requests are automatically redirected to HTTPS.

C.2 Data at rest

Sensitive fields (API tokens, access tokens, secrets) are encrypted at rest. Passwords are stored only as salted, adaptive one-way hashes — Argon2id (OWASP-recommended parameters) for storefront end-customer accounts, and bcrypt (cost factor 12) for merchant and administrator accounts. Plaintext passwords are never stored or logged.

C.3 Access controls

• Access to production systems is restricted to authorised personnel only
• Two-factor authentication (TOTP) is available as an opt-in for merchant accounts
• Principle of least privilege: personnel have access only to what is needed for their role
• Access is reviewed and revoked promptly on personnel changes

C.4 Authentication and session security

• Admin sessions use httpOnly, Secure, SameSite=Strict cookies
• Session tokens are stored in Redis with a fixed TTL
• Brute-force protection and rate limiting on all authentication endpoints
• Automatic session invalidation on logout and after periods of inactivity

C.5 Audit logging

Administrative actions are recorded in an audit log with timestamp, actor identity, and IP address. The email delivery audit trail is retained for 12 months. Other administrative-action audit records are retained for a maximum of 12 months and are then automatically purged, except records placed under a legal hold for an active investigation, dispute, or regulatory request, which are retained until the hold is lifted.

C.6 Vulnerability management

• Dependencies are monitored for known vulnerabilities
• Security patches are applied on a risk-prioritised basis
• Regular security reviews are conducted internally

C.7 Incident response

The Processor maintains an internal incident response procedure. On discovery of a Security Incident, the Processor will: contain the incident, assess its scope and impact, notify the Controller in accordance with Article 7, and remediate the root cause.

C.8 Business continuity

The Processor maintains regular backups of all Controller Personal Data. Backups are encrypted and stored separately from primary data. Recovery procedures are tested periodically.

Contact [email protected] with questions about this DPA.