Data Processing Addendum

This is the plain-English version of our Data Processing Addendum ("DPA") between you (as data controller) and Shape Your Brand LLC (as processor) when you use SelloWise. A signed, counter-signable version is available on request from legal@shapeyourbrand.com.

1. Roles

You determine why and how personal data of your buyers, teammates, and contacts is processed. We process that data on your instructions to run SelloWise.

2. Scope

• Subject matter — providing the SelloWise service.
• Duration — while your account is active + retention windows.
• Categories of data — account, profile, content, usage.
• Data subjects — you, your teammates, and any people you reference in your content.

3. International transfers

We rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where required. Our subprocessors that receive EU/UK data are bound by equivalent safeguards.

4. Security

• Encryption in transit (HTTPS/TLS).
• Encryption at rest for the database and backups.
• Role-based access controls and row-level security.
• Least-privilege access to production systems.
• Regular dependency and security scans.

5. Subprocessors

Our current subprocessors are listed on the Subprocessors page. You authorise us to use them. If you want advance notice of changes, email privacy@shapeyourbrand.com.

6. Breach notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and provide the information you reasonably need to meet your own notification obligations.

7. Assistance

We will help you (at your reasonable request) respond to data subject rights requests and complete DPIAs, using the tools available in the app.

8. Deletion on termination

When you close your account, we delete your data from live systems within 30 days and from encrypted backups on a rolling 90-day window, except where we must keep records to comply with the law.