Data Processing Agreement

under Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR")

between

• the Merchant: the business that has accepted the Clawzia Terms of Service (the "Controller"), and
• KELHOS BRAND LLC, 8206 Louisiana Blvd NE, Ste A #7751, Albuquerque, NM 87113, USA, registered with the New Mexico Secretary of State under Entity ID 0008062576 ("Clawzia", the "Processor"). Clawzia is established in the United States. As at 29 September 2026 (the date of this version) it has not appointed a representative in the European Union under Art. 27 GDPR; see section A1 of the Privacy Policy (external link).

This Data Processing Agreement ("DPA") forms part of the Clawzia Terms of Service ("Terms"). It is concluded when the Merchant accepts the Terms and this DPA when creating an account or, for an account that already exists, when it accepts this version in the dashboard. The Merchant can request a copy signed by Clawzia at contact@clawzia.com.

Terms used in this DPA, such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority", have the meaning given in the GDPR.

1. Subject matter and duration

1.1 Clawzia provides the Merchant with an online withdrawal function for its online shops and the optional modules the Merchant switches on (the "Service"), as described in the Terms. In doing so, Clawzia processes personal data of the Merchant's consumers and website visitors on behalf of the Merchant.

1.2 This DPA applies for as long as Clawzia processes personal data on behalf of the Merchant. It continues after the end of the Terms until the data has been deleted or returned under section 11.

2. Nature and purpose of the processing

2.1 Clawzia processes personal data on behalf of the Merchant to:

1. deliver the widget and its settings to the browsers of visitors of the Merchant's websites;
2. receive and record withdrawal statements that consumers submit through the Merchant's widget or hosted form (declaration and separate confirmation) and, if the Merchant has switched on the subscription cancellation module, declarations by which consumers terminate continuing contracts ("cancellation declarations", submitted on one confirmation page);
3. show the consumer the confirmation and send an acknowledgement email with the content of the statement and the date, time and time zone of its submission (for cancellation declarations also the requested end of the contract and a copy for download). For every confirmed statement or declaration, on every plan, the record, the audit entry, the receipt and the acknowledgement email are always created and cannot be switched off in the Service;
4. notify the Merchant and make the records available in the Merchant's dashboard and exports;
5. issue receipts that can be verified publicly without showing personal data;
6. hold acknowledgement emails to consumers, and in rare cases notification emails to a Merchant notification address that is not one of the Merchant's sign-in addresses, for review by Clawzia staff when anti-abuse limits are reached, so that the withdrawal function cannot be used to send emails to other people (staff see only the recipient's domain, never the subject or the content). A held email is released after the review. The statement, the audit entry, the receipt and the record in the Merchant's dashboard are not affected;
7. store, back up and delete the data according to this DPA;
8. if the Merchant orders installation by Clawzia, install the Widget in the Merchant's website or shop system. Any access to personal data of the shop's customers during the installation is incidental and limited to what the installation needs; Clawzia does not copy, export or otherwise use that data.

2.2 The categories of data, the data subjects and further details are set out in Annex 1.

2.3 Platform security (Clawzia as controller). Clawzia also processes technical request data to secure and protect the Service and all its customers against abuse: the IP address, browser information, time and path of requests in web server logs, keyed hashes of IP addresses and email addresses in rate-limiting counters, and application log lines about rejected cancellation attempts. For this processing Clawzia decides on purposes and means itself and acts as an independent controller under Art. 6(1)(f) GDPR. It is described in the Privacy Policy (Part A, "Platform security and abuse protection"), and this DPA does not apply to it. The keyed hash of the IP network that is stored with a withdrawal statement or cancellation declaration as evidence, and the audit entry of its confirmation, remain processing on behalf of the Merchant under this DPA.

3. Responsibilities of the Merchant

3.1 The Merchant is the controller. It is responsible for the lawfulness of the processing, for informing consumers (including that Clawzia processes their data on its behalf) and for answering data subject requests.

3.2 The Merchant is responsible for the accuracy of its configuration in the dashboard, including the retention period it chooses.

4. Instructions

4.1 Clawzia processes personal data only on documented instructions from the Merchant, including with regard to transfers to third countries, unless Union or Member State law to which Clawzia is subject requires otherwise. In that case, Clawzia informs the Merchant of that legal requirement before processing, unless that law prohibits such information.

4.2 The Terms, this DPA and the settings the Merchant chooses in the dashboard are the Merchant's documented instructions. Further instructions must be given in writing (email is sufficient) and must be compatible with the Service. The Merchant also instructs Clawzia to create aggregated statistics that do not identify any person, to operate and improve the Service.

4.3 Clawzia informs the Merchant immediately if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

4.4 Except for the platform security processing in section 2.3 and the aggregated statistics in section 4.2, Clawzia does not use the personal data for its own purposes. In particular, it does not use it for marketing and does not sell it.

5. Confidentiality

Clawzia ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only on the Merchant's instructions (Art. 29 GDPR). Access is limited to persons who need it to provide, maintain or support the Service.

6. Security of processing

6.1 Clawzia implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR). The measures are described in Annex 2.

6.2 Clawzia may update the measures as technology develops, provided that the overall level of security is not reduced.

7. Sub-processors

7.1 The Merchant gives Clawzia general written authorisation to engage sub-processors. The sub-processors engaged at the time this DPA is concluded are listed in Annex 3 and are approved.

7.2 Clawzia informs the Merchant of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the account owner.

7.3 The Merchant may object to the change on reasonable grounds relating to data protection within that period. Clawzia and the Merchant will then try to find a solution in good faith. If no solution is found, the Merchant may terminate the affected part of the Service before the change takes effect, and Clawzia refunds any fees paid in advance for the period after termination. Clawzia makes the refund itself, through its payment provider or by bank transfer.

7.4 Clawzia has the email delivery provider bound by that provider's data processing addendum (see Annex 3), which contains data protection obligations for the processing of personal data on behalf of its customers (Art. 28(4) GDPR). The hosting provider supplies only the virtual server, under its standard hosting terms. No separate data processing agreement has been concluded with the hosting provider. The data on the server is protected by Clawzia's own technical measures (access control, encrypted connections and encrypted backups; see Annex 2). Clawzia remains fully liable to the Merchant for the performance of its sub-processors' obligations.

8. Assistance with data subject rights

8.1 Taking into account the nature of the processing, Clawzia assists the Merchant with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR.

8.2 The dashboard lets the Merchant view and export records (CSV and PDF) and add internal notes. Because a receipt proves the content of a statement at the time it was submitted, stored statements are not edited in the dashboard; a correction is recorded as a note. If a data subject exercises the right to rectification or erasure, the Merchant can instruct Clawzia to correct or delete a record. Clawzia carries out the instruction without undue delay and in any case within 30 days. Deleting a record also deletes its receipt, so that the public verification page then answers "not found". Where the dashboard does not offer a function the Merchant needs to fulfil a request, Clawzia assists on request.

8.3 If a data subject contacts Clawzia directly about data processed on behalf of the Merchant, Clawzia forwards the request to the Merchant without undue delay and does not respond on the merits itself, unless the Merchant instructs it to do so.

9. Assistance with the Merchant's other obligations

Taking into account the nature of the processing and the information available to it, Clawzia assists the Merchant in ensuring compliance with Articles 32 to 36 GDPR (security of processing, notification of personal data breaches, communication to data subjects, data protection impact assessments and prior consultation), in particular by providing the information described in this DPA and in its annexes.

10. Personal data breaches

10.1 Clawzia notifies the Merchant without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Merchant. Clawzia aims to notify within 48 hours.

10.2 The notification contains, as far as available at that time, the information listed in Art. 33(3) GDPR: the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; the name and contact details of a contact point; the likely consequences; and the measures taken or proposed. Information that is not yet available is provided in phases without undue further delay.

10.3 Clawzia takes the measures necessary to secure the data and to limit possible adverse effects, and supports the Merchant so that it can meet its own obligations under Articles 33 and 34 GDPR.

10.4 A notification under this section is not an acknowledgement of fault or liability.

11. Deletion and return at the end of the Service

11.1 During the term, the Merchant can export its withdrawal records at any time. After the end of the Service, the Merchant can still export them for 30 days. If the Merchant cannot do that in the dashboard, Clawzia sends the export by email to the account owner on request.

11.2 After that period, Clawzia deletes the personal data processed on behalf of the Merchant within 30 days, unless Union or Member State law requires Clawzia to store it. On request, Clawzia confirms the deletion in writing.

11.3 Data in encrypted backups is not deleted individually. It is deleted when the backup copies expire on their rolling schedule (14 daily and 8 weekly copies; no copy is kept longer than 56 days, see Annex 2). Until then, the backups remain protected by this DPA and are not used except to restore the Service.

11.4 During the term, records are deleted automatically at the end of the retention period chosen by the Merchant (12, 24, 36, 60 or 120 months after confirmation; default: 36 months, that is 3 years). Cancellation declarations follow the same period.

12. Information and audits

12.1 Clawzia makes available to the Merchant all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA, its annexes, the list of sub-processors and, where available, summaries of security reviews.

12.2 Clawzia allows for and contributes to audits, including inspections, conducted by the Merchant or by an auditor mandated by the Merchant. The auditor must be bound by confidentiality and must not be a competitor of Clawzia.

12.3 Unless a personal data breach or a request from a supervisory authority makes it necessary, audits take place at most once per calendar year, with at least 30 days' notice, during normal business hours and without disrupting the operation of the Service or access to other customers' data. Where possible, an audit is carried out remotely, on the basis of documents and video calls. Each party bears its own costs.

12.4 Clawzia maintains a record of processing activities carried out on behalf of controllers (Art. 30(2) GDPR).

13. Transfers to third countries

13.1 Clawzia is established in the United States, and the Service is hosted in the location stated in Annex 1. Personal data that the Merchant has processed through the Service is therefore transferred from the Merchant to Clawzia outside the EU/EEA.

13.2 For this transfer, the Merchant and Clawzia conclude the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (transfer controller to processor) (the "SCCs"). The SCCs are incorporated into this DPA by reference and are concluded together with it. The Merchant is the data exporter and Clawzia is the data importer.

13.3 Where the Merchant itself acts as a processor on behalf of one of its own customers, for example an agency that operates the online shop of a client under the Agency plan, Module Three (transfer processor to processor) of the SCCs applies instead of Module Two to the personal data of that customer. The Merchant is then the data exporter, confirms that its customer has authorised the engagement of Clawzia and of the sub-processors in Annex 3, and passes on to Clawzia only instructions that its customer has given and that are compatible with this DPA. The choices in section 13.4 apply to both modules.

13.4 For the SCCs, the parties choose the following:

1. Clause 7 (docking clause) does not apply.
2. Clause 9(a): Option 2 (general written authorisation). The time period for informing the Merchant is the notice period in section 7.2 (30 days).
3. Clause 11(a): the optional wording does not apply.
4. Clause 13 and Annex I.C: the competent supervisory authority is the supervisory authority competent for the Merchant as data exporter.
5. Clause 17: Option 1; the SCCs are governed by the law of Ireland.
6. Clause 18(b): disputes arising from the SCCs are resolved by the courts of Ireland.
7. Annex I.A (list of parties): the parties named at the beginning of this DPA, with the contact details in Annex 1; Annex I.B (description of the transfer): Annex 1 of this DPA; Annex II (technical and organisational measures): Annex 2 of this DPA; Annex III (list of sub-processors): Annex 3 of this DPA.
8. By accepting the Terms and this DPA, each party is deemed to have signed the SCCs, including Annex I, as data exporter or data importer. The date of signature is the date of acceptance.

13.5 If the SCCs conflict with this DPA or the Terms, the SCCs prevail (Clause 5 of the SCCs).

13.6 Clawzia transfers personal data onward only to the sub-processors listed in Annex 3, on the terms described in section 7 (for the hosting provider, section 7.4 applies). The location and transfer mechanism of each sub-processor are stated in Annex 3.

13.7 Clawzia provides the Merchant with the information the Merchant needs for its assessment under Clause 14 of the SCCs. The following facts are relevant to that assessment. The data are contact and evidence data of consumers (name, email address, order reference, statement); no special categories are requested. Clawzia is a small private company and stores the data on one server in Buffalo, New York, United States. Connections to the Service use TLS, and backups are encrypted; the records themselves are stored so that Clawzia can process them for the Merchant. Clawzia will handle any request by a public authority for access to the data as required by Clause 15 of the SCCs, and will inform the Merchant as far as the law allows. In its assessment the Merchant may also take into account the findings of the European Commission on the level of protection of personal data in the United States in Commission Implementing Decision (EU) 2023/1795.

14. Liability

The liability of the parties towards data subjects is governed by Art. 82 GDPR. Between the parties, the limitations of liability in the Terms apply, to the extent permitted by the GDPR and other applicable law.

15. Precedence and final provisions

15.1 If this DPA conflicts with the Terms, this DPA prevails for matters of data protection.

15.2 Changes to this DPA are made in the same way as changes to the Terms, unless the change is required by law.

15.3 If a provision of this DPA is invalid, the rest remains valid.

15.4 This DPA is governed by the law of Ireland, the EU Member State whose law also governs the SCCs (section 13), even though the Terms are governed by other law (section 19 of the Terms). Disputes arising from the SCCs are resolved by the courts of Ireland (section 13.4); section 19.2 of the Terms applies to all other disputes under this DPA.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures (Art. 32 GDPR)

1. Data minimisation and privacy by design

• The withdrawal form asks only for the data needed for the statement: name, email address, order or contract reference, and optional items and message; the withdrawal form never asks for a reason.
• The subscription cancellation form asks only for the fields of its confirmation page: type of termination, name, contract identification, requested end of the contract and email address. It asks for a reason only for an extraordinary termination.
• The widget sets no cookies, uses no browser storage and loads nothing from third parties. It communicates only with the Clawzia service and without credentials; form data is sent only when the consumer submits the form.
• Free-text fields have length limits.
• Unconfirmed statements are deleted automatically; confirmed statements are deleted at the end of the retention period.
• The public receipt verification page shows no personal data.

2. Pseudonymisation

• In the database and in the application's rate-limiting store, IP addresses are stored only as a keyed hash (HMAC-SHA256 with a secret key), truncated, and cannot be reversed without the key. The hash identifies the network (the IPv4 address, or the IPv6 /64 prefix), not a single device. The reverse proxy keeps full IP addresses briefly in memory for connection-level rate limits and writes them to its logs, which are deleted at most 15 days after they are written (section 2.3).
• Rate-limiting keys in the application's rate-limiting store are keyed hashes; email addresses and IP addresses are not stored there in plain form.
• Sign-in links, session tokens and confirmation tokens are stored only as hashes.

3. Encryption

• All connections to the Service use encrypted HTTPS (TLS). HTTP Strict Transport Security (HSTS) is enabled.
• Database backups are encrypted (AES-256) before they are stored. The key is kept separately from the backups.
• Stored replies for repeated requests (idempotency records), which can contain personal data, are encrypted with AES-256-GCM.
• Secrets (keys, passwords, API tokens) are kept outside the source code in a configuration file with restricted access and are never written to logs.

4. Access control

• Merchants sign in with one-time links sent by email (no passwords). Sessions use secure, HTTP-only cookies and expire after 30 days at the latest; sessions of Clawzia staff expire after 12 hours.
• Each merchant can access only the data of its own shops; this is checked on every request.
• Browsers can call the public API only from the domains the Merchant has allowed (CORS allowlist). Requests without an Origin header (for example from server-side scripts, which CORS cannot restrict) are accepted and recorded with the source "API"; all requests are subject to the same per-client and per-shop rate limits and input checks.
• The staff area is reachable only by signed-in staff accounts; everyone else receives a "not found" page.
• Administrative access to the server is restricted to authorised persons, uses SSH key authentication and a non-root user; the server firewall limits the rate of connection attempts.
• The database and the queue are not reachable from the internet; the application containers run on an internal network and are reachable only through the reverse proxy.

5. Integrity and logging

• All input is validated before it is stored.
• Actions of merchants and administrators (for example status changes) are recorded in an audit log with the actor and the time.
• Each confirmed statement receives a receipt with a cryptographic hash and a keyed signature, so that later changes to the stored statement can be detected.
• Security headers (Content Security Policy, HSTS and others) protect the web application.

6. Availability and resilience

• Services restart automatically after failures and are checked by health checks.
• Emails are retried with increasing delays; failed emails are kept and listed in the staff area.
• Public endpoints are protected by rate limits per client network and per shop, so that abuse of one shop does not stop the others.
• Nightly encrypted database backups are kept on a rolling schedule (14 daily and 8 weekly copies, and no copy older than 56 days) on the server. A restore test of the backups runs monthly.
• Operating system security updates are installed automatically. A scheduled health check covers, among other things, disk space and the age of the newest backup.
• If the widget cannot send a statement to the Service, it offers the consumer a pre-filled email to the Merchant's support address (if the Merchant has set one) and a link to the hosted form. If it cannot load its settings, it shows a link to the hosted form. During a complete outage of the Service, the hosted form may not be available either.

7. Regular testing and evaluation

• Automated tests run before each release.
• Dependencies are checked for known vulnerabilities, and the code repository is scanned for secrets.
• Internal security reviews are carried out from time to time and after relevant changes; the most recent one took place on 27 September 2026.

8. Organisational measures

• Persons with access to personal data are bound to confidentiality and receive access only as needed.
• Personal data breaches are handled as described in section 10 of this DPA.
• Sub-processors are selected with regard to their data protection and security measures and, where they offer a data processing agreement, are bound by it (see section 7).
• The location of hosting is stated in Annex 1; transfers outside the EU/EEA follow section 13.

Annex 3: Sub-processors

The current list of sub-processors, with their purpose, location and transfer mechanism, is published on our sub-processors page (external link) and forms part of this Annex. Changes are announced as described in section 7.

Clawzia is a technical tool and does not provide legal advice.