Data Processing Agreement

1. Definitions

• "Controller" means the Merchant who determines the purposes and means of processing Personal Data through the Tapmerce Service.
• "Processor" means Tapmerce (operated by Eiad Oraby), which processes Personal Data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person processed through the Service.
• "Sub-processor" means any third party engaged by Tapmerce to process Personal Data on behalf of the Controller.
• "Data Subject" means the identified or identifiable person to whom Personal Data relates (i.e., the Merchant's customers).

2. Scope and Purpose

This DPA applies to the processing of Personal Data by Tapmerce on behalf of the Merchant in connection with providing the Service. The categories of Personal Data and purposes of processing are:

3. Obligations of the Processor

Tapmerce shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational measures to ensure security of processing
• Not engage another processor (sub-processor) without prior written authorization of the Controller
• Assist the Controller in responding to Data Subject requests
• Delete or return all Personal Data upon termination of the Service, at the Controller's choice
• Make available all information necessary to demonstrate compliance and allow for audits

4. Security Measures

Tapmerce implements the following security measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Access controls with role-based permissions
• Regular security audits and penetration testing
• Incident response procedures with 72-hour breach notification
• Employee security training
• Secure development practices (code review, automated testing)
• Database backups with encryption
• Network monitoring and intrusion detection

5. Sub-processors

Tapmerce uses the following sub-processors:

We will notify you at least 30 days before adding or replacing a sub-processor. You may object to a new sub-processor within 14 days of notification.

6. International Transfers

Where Personal Data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on an adequacy decision.

7. Data Breach Notification

In the event of a Personal Data breach, Tapmerce will notify the Controller without undue delay and within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, categories and number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.

8. Data Subject Rights

Tapmerce will assist the Controller in fulfilling its obligation to respond to requests from Data Subjects exercising their rights under GDPR (access, rectification, erasure, restriction, portability, objection). We will respond to such requests within 10 business days.

9. Term and Termination

This DPA shall remain in effect for the duration of the Service agreement. Upon termination, Tapmerce will delete all Personal Data within 90 days, unless retention is required by applicable law. The Controller may request a copy of all Personal Data before deletion.

10. Contact

For DPA-related inquiries or to request execution of this agreement:
Email: [email protected]