This Data Processing Addendum ("DPA") forms part of the Terms of Service between Winning Technologies Ltd ("Winning", "Processor", "we", "us") and the customer or user accepting the Terms ("Customer", "Controller", "you") for the use of the Winning platform.
This DPA applies only where Winning processes Personal Data on behalf of Customer as a Processor or Sub-processor under Data Protection Laws, including the GDPR, UK GDPR, Swiss data protection law, or other equivalent privacy laws.
If there is a conflict between this DPA and the Terms of Service regarding Processing of Customer Personal Data, this DPA controls.
1. Definitions
For this DPA:
- Customer Personal Data means Personal Data processed by Winning on behalf of Customer through the Winning platform.
- Data Protection Laws means all laws applicable to the Processing of Personal Data under this DPA, including GDPR, UK GDPR, Swiss FADP, and applicable UAE/DIFC data protection laws where relevant.
- GDPR means Regulation (EU) 2016/679.
- Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach, and Sub-processor have the meanings given in applicable Data Protection Laws.
- Services means the Winning platform and related services provided by Winning under the Terms.
- Standard Contractual Clauses or SCCs means the European Commission standard contractual clauses for international transfers, as updated or replaced from time to time.
2. Roles of the Parties
For Customer Personal Data:
- Customer is the Controller, or Processor acting on behalf of another Controller.
- Winning is the Processor, or Sub-processor where Customer is itself a Processor.
Customer determines the purposes and means of Processing Customer Personal Data. Winning processes Customer Personal Data only to provide, secure, support, and improve the Services in accordance with Customer's documented instructions.
Customer is responsible for ensuring that:
- it has a lawful basis to collect, use, share, and process Customer Personal Data;
- it has provided all required privacy notices to Data Subjects;
- it has obtained any required consents, including for marketing, cookies, tracking, or platform integrations;
- its instructions to Winning comply with Data Protection Laws;
- Customer Personal Data submitted to the Services is accurate, relevant, and limited to what is necessary.
3. Customer Instructions
Customer instructs Winning to process Customer Personal Data:
- to provide the Services;
- to operate AI workflows requested or approved by Customer;
- to connect, read, analyze, generate, optimize, or update e-commerce store assets and business data;
- to provide support, debugging, security, and maintenance;
- as otherwise documented in the Terms, this DPA, the Privacy Policy, or Customer's use of the Services.
Winning will not process Customer Personal Data for other purposes unless required by law. If Winning is legally required to process Customer Personal Data outside Customer's instructions, Winning will notify Customer before doing so unless the law prohibits such notice.
Winning will promptly inform Customer if, in Winning's opinion, an instruction infringes Data Protection Laws.
4. Details of Processing
The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects are described below.
4.1 Subject Matter
Processing of Customer Personal Data submitted to, connected to, generated by, or accessed through the platform for AI-assisted e-commerce business creation, store generation, advertising creative generation, business memory, and growth analysis.
4.2 Duration
For the term of the Customer account, subscription, connected integration, or other period during which Winning provides the Services, unless earlier deleted by Customer or retained as required by law.
4.3 Nature and Purpose
Winning may collect, receive, host, store, access, retrieve, analyze, transmit, transform, generate, delete, and otherwise process Customer Personal Data to:
- provide platform workflows and platform features;
- generate store copy, brand assets, product research, ad concepts, and business outputs;
- analyze store performance and recommend next actions;
- synchronize with Shopify or other authorized integrations;
- secure and maintain the platform;
- respond to support requests;
- comply with Customer's documented instructions.
4.4 Categories of Data Subjects
Customer Personal Data may relate to:
- Customer's end customers;
- store visitors;
- leads and prospects;
- newsletter subscribers;
- abandoned cart or checkout users;
- product reviewers;
- Customer's employees, contractors, founders, or team members;
- business contacts included in Customer-provided materials.
4.5 Categories of Personal Data
Customer Personal Data may include:
- names;
- email addresses;
- phone numbers;
- billing and shipping addresses;
- order details;
- product purchase history;
- cart and checkout events;
- customer support or review content;
- marketing consent status;
- IP addresses and device data;
- store analytics and usage events;
- business context and notes submitted by Customer;
- AI prompts, instructions, and generated outputs containing Personal Data.
4.6 Sensitive Data
Customer must not submit special categories of Personal Data, criminal offense data, government identifiers, payment card numbers, health data, or other sensitive data unless expressly agreed in writing and lawfully permitted.
5. Confidentiality
Winning will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations or appropriate statutory duties of confidentiality.
Winning will limit access to Customer Personal Data to personnel, contractors, and Sub-processors who need access to provide, secure, support, or maintain the Services.
6. Security Measures
Winning will implement appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
Current measures include, as applicable:
- encryption in transit using TLS;
- encryption at rest where supported by infrastructure providers;
- logical separation between customer workspaces;
- access controls and least-privilege permissions;
- administrative MFA where available;
- secure storage of integration tokens and credentials;
- logging of security-relevant activity;
- backup and recovery procedures;
- limited production access for support and engineering;
- vendor due diligence for material Sub-processors;
- incident response procedures;
- deletion or anonymization processes for account closure and data rights requests.
Customer acknowledges that security measures may evolve over time, provided they do not materially reduce the overall protection of Customer Personal Data.
7. Sub-processors
Customer gives Winning general written authorization to engage Sub-processors to provide the Services.
Winning will:
- maintain an up-to-date list of material Sub-processors;
- enter into written agreements with Sub-processors imposing data protection obligations substantially equivalent to those in this DPA;
- remain responsible for Sub-processors' performance of their data protection obligations;
- provide notice of material changes to Sub-processors where required by Data Protection Laws or commercially reasonable for the Services.
Customer may object to a new Sub-processor on reasonable data protection grounds within 30 days after notice. If the parties cannot resolve the objection, Customer may stop using the affected part of the Services or terminate the affected Services, subject to the Terms.
The current operational Sub-processor list is maintained in the DPA Suppliers Register.
8. International Transfers
Customer authorizes Winning and its Sub-processors to process Customer Personal Data outside the EEA, UK, Switzerland, and Customer's country where necessary to provide the Services.
Where required, Winning will use appropriate transfer mechanisms, such as:
- SCCs;
- UK International Data Transfer Addendum or equivalent UK transfer mechanism;
- Swiss amendments or safeguards where applicable;
- adequacy decisions;
- other lawful transfer mechanisms recognized by applicable Data Protection Laws.
If SCCs are required, the parties agree that:
- Module Two applies where Customer is Controller and Winning is Processor;
- Module Three applies where Customer is Processor and Winning is Sub-processor;
- Customer is the data exporter and Winning is the data importer unless the facts require otherwise;
- the annexes to the SCCs are deemed completed by the information in this DPA, the Privacy Policy, and the Sub-processor list.
9. Data Subject Requests
Winning will assist Customer, taking into account the nature of the Processing, in responding to Data Subject requests under Data Protection Laws.
If Winning receives a request directly from a Data Subject relating to Customer Personal Data, Winning will not respond substantively unless authorized by Customer or required by law. Winning may direct the Data Subject to Customer.
Customer is responsible for responding to Data Subject requests as Controller. Winning may charge reasonable fees for excessive, complex, or out-of-scope assistance, unless prohibited by law.
10. Assistance With Compliance
Taking into account the nature of Processing and information available to Winning, Winning will provide reasonable assistance to Customer with:
- security obligations;
- Personal Data Breach response;
- data protection impact assessments;
- prior consultation with supervisory authorities where required;
- audits or information requests reasonably needed to demonstrate compliance.
This assistance is limited to Customer Personal Data processed by Winning under this DPA.
11. Personal Data Breach
Winning will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
The notice will include, where available:
- a description of the breach;
- categories and approximate number of affected Data Subjects and records;
- likely consequences;
- measures taken or proposed to address the breach;
- contact point for follow-up.
Winning's notification is not an admission of fault or liability. Customer is responsible for determining whether notification to Data Subjects or authorities is required.
12. Deletion or Return
Upon termination of the Services, account closure, or written request, Winning will delete or return Customer Personal Data, unless retention is required by law or permitted under the Terms.
Winning may retain:
- billing, tax, and accounting records;
- security logs needed for fraud, abuse, or incident investigation;
- records necessary for legal claims or compliance;
- anonymized or aggregated data that no longer identifies Customer or Data Subjects;
- backup copies until overwritten through normal backup rotation.
Customer is responsible for exporting Customer Personal Data before terminating the Services if Customer requires a copy.
13. Audits and Information Rights
Winning will make available information reasonably necessary to demonstrate compliance with this DPA.
Customer may request an audit no more than once per year, unless a Personal Data Breach or regulatory requirement justifies an additional audit. Audits must:
- be limited to Processing of Customer Personal Data;
- be conducted during normal business hours;
- be subject to reasonable confidentiality and security requirements;
- avoid disruption to Winning's operations;
- avoid access to other customers' data;
- be performed by an independent auditor where reasonably required.
Winning may satisfy audit requests by providing security reports, policies, certifications, summaries, or questionnaire responses where appropriate.
14. Customer Responsibilities for Integrations
Customer is responsible for:
- ensuring that any Shopify, Meta, Google, email, SMS, analytics, or other integration is lawfully configured;
- maintaining accurate privacy notices and cookie consent for Customer's own store or business;
- avoiding upload of unnecessary or sensitive data;
- honoring Data Subject rights requests received from Customer's own customers;
- ensuring that Customer's use of platform outputs complies with advertising, consumer protection, privacy, platform, and e-commerce laws.
Winning does not act as Customer's legal counsel or data protection officer.
15. Liability
The liability limitations in the Terms apply to this DPA unless prohibited by Data Protection Laws.
Nothing in this DPA limits liability that cannot legally be limited under applicable law.
16. Governing Law
This DPA is governed by the same law and jurisdiction as the Terms, except where Data Protection Laws require otherwise.
17. Contact
For DPA or privacy questions:
Winning Technologies Ltd
Innovation Hub Virtual Inventory, IH-00-VZ-01-FL-215, Level 1
Dubai International Financial Centre
Dubai, United Arab Emirates
Email: [email protected]
Legal: [email protected]