SpecialShelf Data Processing Addendum (DPA)
Version 1.0
Last updated: 15 October 2026
This Addendum forms part of the Terms of Service between the Store ("you") and Agnostic AI (Pty) Ltd, trading as SpecialShelf ("we"). If it conflicts with the Terms on personal information, this Addendum prevails.
1. Definitions
- Customer Personal Information: personal information about your customers (shoppers) and your staff that we process for you in providing the Service — the "Store Data" that is personal information.
- Data Protection Laws: all laws on personal information that apply to the processing, including, where applicable, South Africa's Protection of Personal Information Act 4 of 2013 (POPIA), the California Consumer Privacy Act as amended (CCPA) and its regulations, and other US state comprehensive privacy laws.
- Security Compromise: reasonable grounds to believe Customer Personal Information has been accessed or acquired by an unauthorised person.
- Terms such as responsible party, operator, controller, processor, business, service provider, sell, share and business purpose have the meanings in the Data Protection Laws.
2. Roles
2.1 For Customer Personal Information, you are the responsible party / controller / business, and we are your operator / processor / service provider. We act only on your documented instructions, which are these Terms, this Addendum, and your use and configuration of the Service.
2.2 Information about your own account (your owners' and staff's names, emails and sign-in records) is also used by us as responsible party for running and securing our business, as our Privacy Policy describes.
3. Details of the processing
| Business purposes (the only purposes) | (1) recording and tracking your special orders and layaways; (2) creating, reading, updating and cancelling the related Square orders and invoices in your Square account; (3) sending order-status emails and texts to your customers on your behalf; (4) showing you reports, alerts and the Friday summary about your own orders; (5) exporting your data to you; (6) security, fraud prevention, troubleshooting and support for your account |
| Categories of data subjects | Your customers; your owners and staff |
| Categories of information | Customers: name, phone, email, order details (items, prices, dates), payment status from Square, text-consent records and opt-outs, messages sent and delivery status. Staff: name, email, role, actions taken. No card data, no government ID numbers, no special personal information is required — don't enter any |
| Duration | The term of your subscription, then deletion as in section 10 |
| Location | Our sub-processors, mainly in the United States (see the sub-processor list); we are in South Africa |
4. Our obligations
We will:
- Not sell or share Customer Personal Information (including for cross-context behavioural advertising).
- Not retain, use or disclose it for any purpose other than the business purposes above, including for any commercial purpose of our own or outside our direct business relationship with you, except as the Data Protection Laws permit service providers to do (such as complying with law or detecting security incidents).
- Not combine it with personal information we receive from or on behalf of anyone else, or that we collect ourselves, except as the Data Protection Laws allow.
- Keep it confidential and ensure everyone with access is bound by confidentiality and accesses it only as needed for the business purposes (POPIA s20).
- Comply with the Data Protection Laws that apply to us as your operator / service provider, and provide the same level of privacy protection they require of you.
- Notify you if we determine we can no longer meet our obligations under this Addendum or the Data Protection Laws, and, if so, let you take reasonable steps to stop and remediate unauthorised use, including suspending the processing and your cancellation with a pro-rata refund.
- Tell you if we believe an instruction from you infringes the Data Protection Laws.
5. Security (POPIA s19 and s21)
5.1 We maintain appropriate, reasonable technical and organisational measures to protect Customer Personal Information against loss, damage, unauthorised destruction and unlawful access or processing, having regard to generally accepted security practice. They currently include:
- encryption in transit (TLS) for all connections; Square tokens and texting registration details encrypted at rest with AES-256-GCM and versioned keys that can be rotated;
- database-level isolation between stores (row-level security on every store table), checked by automated tests;
- least-privilege access: production access limited to named people who need it; separate database roles for the application and for administration;
- signed and verified webhooks from Square, Paddle, Twilio and Resend;
- audit records of actions on orders;
- automatic deletion schedules (section 10);
- security headers and protections against framing and request forgery.
5.2 We identify reasonably foreseeable internal and external risks, review whether our safeguards are effective at least annually and after any significant change or incident, and update them.
6. Security Compromises
6.1 We will notify you immediately, and in any case within 72 hours, after we have reasonable grounds to believe a Security Compromise has occurred (POPIA s21(2)).
6.2 The notice will describe, as far as then known, what happened, the information and people affected, the likely consequences, what we have done and will do, and a contact person. We will update you as we learn more.
6.3 We will cooperate with you so you can meet your own duties to notify regulators and affected people (for example POPIA s22, US state breach-notification laws), and we will not notify your customers ourselves without your agreement unless the law requires it.
7. Sub-processors
7.1 You authorise us to use the sub-processors on our sub-processor list.
7.2 We bind each sub-processor by a written contract imposing data-protection obligations at least as protective as this Addendum, and remain responsible to you for its performance.
7.3 We give 30 days' notice of a new or replacement sub-processor by email to your owners and on the list. If you object on reasonable data-protection grounds, we will discuss it in good faith; if we cannot resolve it, you may cancel and receive a pro-rata refund of prepaid fees.
8. Requests from your customers
8.1 If we receive a request from one of your customers about their information (access, correction, deletion, objection, or similar), we will not answer it ourselves except to say we have passed it on, and we will forward it to you within 5 business days.
8.2 We will help you respond: you can find, correct and export a customer's records in the Service, and we will delete or anonymise a customer's records for you on your written instruction within 10 business days (a self-service deletion tool is planned).
9. Transfers
9.1 We may process Customer Personal Information in South Africa and in the countries of our sub-processors. Where POPIA section 72 applies to a transfer, we rely on binding agreements with each recipient that provide an adequate level of protection, including on onward transfer, and on the transfer being necessary to perform our agreement with you.
10. Return and deletion
10.1 You can export all Store Data at any time (Settings → Your data).
10.2 When your subscription is cancelled or your trial ends without a subscription, we keep Store Data read-only for 90 days so you can export it, then permanently delete it from the live system, including Customer Personal Information. During the pilot our database plan keeps no automatic backups, so deleted data is gone at once; if we add backups, deleted data leaves them as they expire.
10.3 During the subscription we delete message texts 90 days after sending, and raw data received from Square and webhooks after 30 days.
10.4 On your written request we will delete Customer Personal Information earlier, except where the law requires us to keep it.
11. Assurance and audits
11.1 On request (at most once every 12 months, or after a Security Compromise) we will answer your reasonable written questions about our compliance with this Addendum and provide a summary of our security measures and sub-processors.
11.2 If the Data Protection Laws require more, you may, at your own cost, on 30 days' notice and under confidentiality, have an independent assessor verify our compliance in a way that does not expose other stores' data or our security. We may charge reasonable costs for our time beyond one business day per year.
12. Liability
Each party's liability under this Addendum is subject to the limitations in the Terms of Service.
13. Term
This Addendum lasts as long as we process Customer Personal Information for you, and its obligations survive until deletion is complete.