Data Processing Agreement

1. Purpose and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Merchant ("Controller") and Quick Commerce Technologies LLC ("Processor") and applies to personal data of shoppers, staff and drivers that Quick Commerce processes on the Merchant's behalf while operating the platform.

2. Roles of the parties

The Merchant is the data controller for its shoppers' personal data: it decides what products to sell, what customer data to collect, and how to use it for its own marketing. Quick Commerce is the data processor: it processes that data only to provide the platform, following the Merchant's documented instructions as reflected in the platform's configuration and these Terms.

3. Subject matter, duration and nature of processing

Processing consists of storing, organising, transmitting and displaying order, catalogue, customer account and delivery data for the duration of the Merchant's subscription, plus any post-termination retention period agreed in the Terms.

4. Categories of data subjects and data

• Shoppers: name, phone, email, delivery address, order history, payment status (not card numbers).
• Merchant staff: name, role, login activity.
• Drivers and pickers: name, phone, approximate/precise location during an active run, delivery proof.

5. Processor obligations

• Process personal data only on the Merchant's documented instructions.
• Ensure staff who access data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures.
• Assist the Merchant in responding to data subject requests and regulatory enquiries.
• Notify the Merchant without undue delay after becoming aware of a personal data breach.

6. Sub-processors

The Merchant authorises Quick Commerce to engage sub-processors to provide the platform — for example, cloud hosting, SMS/WhatsApp delivery, email delivery and payment gateway providers the Merchant itself connects. Quick Commerce remains responsible for sub-processors' compliance with data protection obligations equivalent to this DPA.

7. Security measures

Measures include encryption of data in transit, role-based access control scoped per store, logging of administrative access, and regular review of third-party integrations.

8. Audit rights

On reasonable written notice and no more than once per year, the Merchant may request information demonstrating compliance with this DPA. Quick Commerce may satisfy this by providing a summary of its security practices rather than an on-site audit, unless a regulator requires otherwise.

9. Return and deletion on termination

On termination of the Merchant's account, Quick Commerce will make catalogue and order data available for export for a reasonable period, and will delete or anonymise personal data thereafter, except where retention is required by law.

10. Governing law

This DPA is governed by the same law and jurisdiction as the Terms of Service.