(DPA)
1. PURPOSE
This Data Processing Agreement (“DPA”) governs the processing of personal data by Infee on behalf of Merchants in connection with the use of the Infee Platform.
This DPA forms an integral part of the Master Terms of Use and Merchant Agreement.
2. DEFINITIONS
- “Controller” means the Merchant.
- “Processor” means Infee.
- “Personal Data” means any information relating to an identified or identifiable natural person as defined under GDPR.
3. SUBJECT MATTER OF PROCESSING
Infee processes Personal Data solely for:
- affiliate tracking,
- attribution of transactions,
- commission calculation,
- fraud prevention,
- reporting.
4. CATEGORIES OF DATA PROCESSED
Depending on Merchant configuration, data may include:
- order identifiers,
- order value,
- product list,
- transaction timestamps,
- referral identifiers,
- technical tracking data (IP, user agent).
Infee does not determine the purposes of customer data processing within the Merchant’s store.
5. OBLIGATIONS OF INFEE (PROCESSOR)
Infee shall:
- process data only on documented instructions of the Merchant,
- implement appropriate technical and organizational security measures,
- ensure confidentiality,
- assist the Merchant in responding to data subject requests where applicable,
- notify the Merchant without undue delay in case of data breach affecting processed data.
6. OBLIGATIONS OF THE MERCHANT (CONTROLLER)
The Merchant warrants that:
- it lawfully collects customer data,
- it provides proper privacy notices,
- it implements lawful cookie consent mechanisms,
- it transmits data to Infee lawfully,
- it maintains accurate and complete webhook/API integration.
7. INTEGRATION INTEGRITY & AUTOMATED
SUSPENSION
To ensure attribution accuracy and prevent misuse, Infee may continuously monitor the operational status of tracking integrations, including webhook or API connectivity.
If the integration:
- is disabled,
- becomes inactive,
- fails to transmit required transaction data,
- is altered in a manner affecting attribution, Infee may automatically:
- mark the Merchant store as inactive,
- suspend campaign visibility,
- deactivate affiliate links,
- pause commission accrual.
Such suspension remains in effect until integration integrity is restored.
Infee shall not be liable for lost commissions or campaign interruption resulting from integration failure.
8. SUBPROCESSORS
Infee may engage subprocessors for:
- hosting infrastructure,
- database management,
- payment processing,
- monitoring and fraud detection.
Infee ensures that subprocessors are bound by data protection obligations equivalent to this DPA.
9. INTERNATIONAL TRANSFERS
Where personal data is transferred outside the EEA, appropriate safeguards are implemented, including Standard Contractual Clauses where required.
10. DATA RETENTION
Personal data shall be retained only as long as necessary for:
- contractual purposes,
- legal compliance,
- dispute resolution.
11. LIABILITY
Each party’s liability under this DPA shall be subject to the limitation of liability provisions defined in the Master Terms of Use.
12. DURATION
This DPA remains in force for the duration of the Merchant’s use of the Platform.