Data Processing Agreement

Version of 23 October 2026

This Data Processing Agreement ("DPA") is between the merchant using AppSell ("Controller") and Importify Ltd, Haganah 40/3, Givatayim, Israel, provider of the AppSell service ("Processor"). It forms part of the terms under which the Controller uses AppSell (the "Service") and applies for as long as the Processor processes personal data for the Controller.

1. Scope and roles

1. Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in Regulation (EU) 2016/679 ("GDPR").
2. "Customer Personal Data" means the personal data of the Controller’s store visitors and shoppers that the Processor processes to provide the Service, as described in Annex 1.
3. The Controller is the controller of Customer Personal Data and the Processor is its processor.
4. Account, billing and contact data of the Controller itself is not covered by this DPA. The Processor handles it as a controller under the AppSell privacy policy.

2. Processor obligations

The Processor shall:

1. process Customer Personal Data only on the Controller’s documented instructions, including for transfers outside the EEA, unless the law requires otherwise, in which case it will inform the Controller first where the law allows. Installing and configuring the Service is the Controller’s instruction;
2. tell the Controller if it believes an instruction infringes data protection law;
3. ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
4. apply the security measures in Annex 2;
5. help the Controller, as far as reasonably possible, to respond to requests from individuals exercising their rights, and forward to the Controller any such request it receives directly;
6. help the Controller meet its obligations on security, breach notification and data protection impact assessments, taking into account the information available to the Processor;
7. not sell Customer Personal Data or use it for its own purposes.

3. Controller obligations

1. The Controller is responsible for having a lawful basis for the processing and for informing its own visitors and shoppers, including about the browser storage the Service uses, listed in Annex 4.
2. The Service is not designed for special categories of personal data (GDPR Article 9), and the Controller will not use it to process them.

4. Subprocessors

1. The Controller authorises the Processor to use the subprocessors listed in Annex 3.
2. The Processor will inform the Controller by email before adding or replacing a subprocessor. The Controller may object within 14 days. If the objection cannot be resolved, the Controller may stop using the Service.
3. The Processor binds each subprocessor to data protection obligations equivalent to this DPA and remains responsible for its performance.

5. International transfers

1. The Processor is established in Israel, which the European Commission recognises as providing adequate protection (Decision 2011/61/EU).
2. Customer Personal Data is hosted in the United States by the subprocessors in Annex 3. These transfers rely on the subprocessor’s certification under the EU-US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

6. Personal data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will share the information the Controller needs to meet its own obligations.

7. Information and audits

The Processor will make available the information needed to show compliance with this DPA. The Controller, or an independent auditor bound by confidentiality, may audit that compliance once a year on 30 days’ written notice, at the Controller’s cost and without unreasonably disrupting the Processor’s business.

8. Return and deletion

After the Controller stops using the Service, the Processor will delete or return Customer Personal Data, at the Controller’s choice, within 30 days of the Controller’s written request to support@appsell.io, unless the law requires it to be kept.

9. General

1. If this DPA conflicts with the terms that govern the Service, this DPA prevails on data protection matters.
2. Liability under this DPA is subject to the limits in the terms that govern the Service, except where the law does not allow liability to be limited.

Signed copies

This DPA applies to every merchant using AppSell without a signature. A merchant who needs a signed copy can request one at support@appsell.io.

Annex 1: Details of the processing

Item	Description
Purpose	Showing upsell, cross-sell and bundle offers on the Controller’s online store and reporting their results; counting the unique visitors who see the Service, to measure the Controller’s usage under its plan.
Duration	While AppSell is installed on the Controller’s store, and until deletion under section 8.
Individuals	Visitors and shoppers of the Controller’s store.
Personal data	A random visitor identifier stored in the browser; pages visited on the store; cart and checkout contents, totals and identifiers; IP address; order identifiers, products and amounts for orders that include an offer.
Special categories	None.

Annex 2: Security measures

• All traffic to and from the Service is encrypted in transit (HTTPS).
• The merchant dashboard requires an authenticated session.
• Database queries are parameterised to prevent injection.
• Server and database access is limited to two named administrators, over encrypted connections (SSH).
• The internal administration panel requires an additional one-time code.
• Application secrets are stored outside the publicly served directory.
• The application and database are backed up regularly.

Annex 3: Subprocessors

Subprocessor	Purpose	Data	Location
Cloudways Ltd	Managed hosting of the AppSell application and database	All data in Annex 1	Malta (EU)
DigitalOcean LLC	Cloud servers the application runs on	All data in Annex 1	United States (New York region)
OpenAI	AI-assisted funnel suggestions, when the Controller uses that feature	Store product catalogue and offer statistics; no shopper personal data	United States

Wix, Shopify and WooCommerce are the Controller’s own store platforms and are not subprocessors of AppSell.

Annex 4: Browser storage on the Controller’s store

The Service sets no cookies. It uses the visitor’s browser storage as follows.

Item	Type	Purpose	Kept for
appsell_track	Local storage	The random visitor identifier in Annex 1, used to count the unique visitors who see the Service. On Wix and Shopify stores, where the store’s consent banner asks the visitor, it is stored only if the visitor allows analytics; otherwise it is not stored and the visitor is not counted. Where no banner is set up or the visitor is not asked, it is stored without a consent check. On WooCommerce stores it is stored without a consent check.	30 days
Items starting with upsale_ or appsell_sc_shown_	Local storage	Make the offers work: products added to the cart, so matching offers can be shown; offers shown or used in that browser; and offer discounts to carry to the cart and checkout.	Until removed by the Service or cleared in the browser
Other items starting with appsell_	Session storage	Offer state during a single visit.	Until the browser tab is closed