Data Processing Agreement

This document has been updated on November 3rd 2026.

Between: Nembol Inc. (“Processor,” “Nembol,” “we”) and the User entering into Nembol’s Terms of Use (“Controller,” “User,” “you”), collectively the “Parties.”

This Data Processing Agreement (“DPA”) is incorporated into and forms part of Nembol’s Terms of Use and applies wherever Nembol processes Personal Data on the User’s behalf as part of the Services, including in particular buyer and order data received through e-commerce and social channels the User connects to Nembol.

This DPA has two parts. Part A (Sections 1 to 11 below) applies to every User, including Referral Customers who pay Nembol directly. Part B applies in addition where a Partner purchases the Services from Nembol for resale to its own customers and Nembol processes personal data of those customers as a sub-processor.

Order of Precedence: In the event of any conflict or inconsistency between this DPA and the Terms of Use or the Partner Terms with respect to the processing of Personal Data, the terms of this DPA shall prevail to the extent of the conflict. For personal data processed under Part B, Part B prevails over Part A to the extent of any conflict.

Part A. Users as Controllers

1. Definitions

Terms such as “Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” “Personal Data Breach,” and “Supervisory Authority” have the meanings given to them in the GDPR, UK GDPR, and Swiss FADP, as applicable (“Data Protection Laws”).

2. Subject matter and duration

Nembol processes Personal Data on the User’s behalf for the duration of the User’s subscription to the Services, and thereafter only as necessary to comply with the deletion/return obligations in Section 9.

3. Nature and purpose of processing

Nembol processes Personal Data to provide the Services to the User, specifically: receiving, storing, and displaying order and buyer data transmitted by e-commerce and social channels the User connects to Nembol; enabling the User to view, manage, and fulfill orders; and related technical support functions the User requests.

4. Categories of data subjects

Customers and buyers of the User who place orders through e-commerce or social channels connected to Nembol.

5. Types of personal data

The specific categories of Personal Data processed depend on which e-commerce or social channel the User connects to Nembol, and the level of access and data-sharing authorization the User has granted Nembol within that channel’s own settings. Depending on these factors, the Personal Data processed may include some or all of the following: order data, products ordered, and buyer contact and delivery details such as name, address, email address, and phone number. Nembol processes only the data categories that the connected channel actually makes available to Nembol for a given User and order.

6. Nembol’s obligations as processor

Nembol shall:

6.1 Process only on instructions. Process Personal Data only on the User’s documented instructions, including with regard to transfers to a third country, unless required to do otherwise by applicable law, in which case Nembol will inform the User of that legal requirement before processing, unless prohibited from doing so. For the purposes of this DPA, the User’s documented instructions consist of: (i) this DPA and the Terms of Use; and (ii) the User’s configuration of the Services, including the connection of e-commerce or social channels and any associated data-sharing settings, each as may be updated by the User from time to time.

6.2 Confidentiality. Ensure that any person authorized to process the Personal Data is subject to a duty of confidentiality, whether contractual or statutory.

6.3 Security. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing, in accordance with Article 32 GDPR.

6.4 Sub-processors. Not engage another processor (“sub-processor”) without the User’s authorization. The User hereby grants Nembol general written authorization to engage sub-processors performing the categories of functions described in Section 7, the specific identities of which are available to Users as set out in that Section. Nembol will notify Users of the specific identity of any new or replacement sub-processor, giving the User the opportunity to object on reasonable data protection grounds within 14 days of such notice. If the User reasonably objects, Nembol will work with the User in good faith to address the objection, which may include providing an alternative sub-processor or not proceeding with the intended change. If the Parties are unable to reach a resolution within a reasonable time, the User may terminate the Services affected by the objected-to sub-processor, without penalty for the portion of the Services so affected. Where Nembol engages a sub-processor, it shall impose data protection obligations on that sub-processor equivalent to those set out in this DPA, and shall remain fully liable to the User for the sub-processor’s performance.

6.5 Assistance with Data Subject rights. Taking into account the nature of the processing, assist the User by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the User’s obligation to respond to requests for exercising Data Subjects’ rights under Data Protection Laws.

6.6 Assistance with compliance. Assist the User in ensuring compliance with its obligations under Articles 32–36 GDPR (security of processing, breach notification, data protection impact assessments, and prior consultation with a Supervisory Authority), taking into account the nature of processing and the information available to Nembol.

6.7 Personal Data Breach notification. Notify the User without undue delay, and where feasible within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA, providing information reasonably available to Nembol to assist the User in meeting its own breach notification obligations under applicable Data Protection Laws.

6.8 Deletion or return of data. At the User’s choice, delete or return all Personal Data to the User after the end of the provision of the Services, and delete existing copies unless applicable law requires storage of the Personal Data.

6.9 Audits and information. Make available to the User, on reasonable request and no more than once per calendar year, documentation reasonably necessary to demonstrate compliance with this DPA — such as summaries of technical and organizational measures, relevant certifications held by Nembol or its sub-processors (e.g., ISO 27001, SOC 2, or equivalent), and responses to reasonable written security questionnaires. Where such documentation does not reasonably address the User’s compliance concerns, or following a Personal Data Breach or a binding request from a Supervisory Authority, Nembol shall additionally allow for and contribute to an on-site or remote audit, including inspection, conducted by the User or an auditor mandated by the User, subject to: (i) at least 30 days’ prior written notice; (ii) reasonable confidentiality safeguards; (iii) the audit being conducted during business hours in a manner that minimizes disruption to Nembol’s operations; and (iv) the User bearing its own costs of the audit, unless the audit reveals a material breach of this DPA by Nembol, in which case Nembol shall bear its reasonable costs of cooperation.

7. Current sub-processors

Nembol engages the sub-processors necessary to provide the Services, including for hosting/infrastructure, customer support tooling, email deliverability, product analytics, and bot/security protection. A current list identifying Nembol’s specific sub-processors, including their function and location, is available to Users upon request at hello@nembol.co.uk. Nembol will provide any notice required under this DPA, including notice of a new or replacement sub-processor as described in Section 6.4, by email to the User’s registered account email address, and, where technically feasible, by an additional in-app notification. Notice periods (including the objection period in Section 6.4) run from the date such email notice is sent.

8. International transfers

Where Nembol or a sub-processor transfers Personal Data outside the EU/EEA, UK, or Switzerland, Nembol shall ensure such transfer is subject to appropriate safeguards under Data Protection Laws, such as Standard Contractual Clauses, an adequacy decision, or, where applicable, a recognized certification framework such as the EU-U.S. Data Privacy Framework (once Nembol’s certification is confirmed by the U.S. Department of Commerce). For example, Nembol’s sub-processor Cloudflare, Inc. (used for bot protection) maintains recognized safeguards, such as Standard Contractual Clauses or a certification framework, for transfers of Personal Data outside the EU/EEA, UK, and Switzerland.

9. Return or deletion of data at termination

Upon termination or expiry of the User’s subscription, Nembol shall, per Section 6.8 and the retention periods set out in Nembol’s Privacy Policy, delete or anonymize Personal Data within the periods specified there, except for data Nembol is required to retain by law.

10. Liability

Each Party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Use.

11. Governing Law

This DPA is governed by the same governing law and jurisdiction provisions set out in the Terms of Use.

Part B. Partners and sub-processing

B1. Application and roles

Part B applies where a Partner purchases the Services from Nembol for its own customers (“Reseller Customers”, as defined in the Partner Terms) and Nembol processes personal data of those customers’ buyers through the API and the Reseller Customer’s Customer ID (“Partner Data”).

Part B does not apply to Referral Customers; for them Part A applies directly.

• The Reseller Customer is the controller of Partner Data.
• The Partner acts as processor on behalf of its Reseller Customers or, where the Partner itself determines the purposes and means of processing, as controller.
• Nembol acts as sub-processor of the Partner (or processor, where the Partner is the controller) and processes Partner Data only as set out in this DPA.

In Part B, “Controller” means the Reseller Customer or, where the Partner is the controller, the Partner, and “instructions” means the Partner’s documented instructions given in accordance with B2.

B2. Instructions

Section 6.1 of Part A applies with the Partner as the instructing party. The Partner’s documented instructions consist of: (i) this DPA and the Partner Terms; and (ii) the Partner’s use and configuration of the API and of the Customer ID, including the Channels connected and the data-sharing settings. The Partner warrants that its instructions are lawful and are consistent with the instructions the Controller has given to the Partner.

B3. Partner’s warranties and obligations

The Partner warrants and undertakes that it:
(a) has entered into an agreement with each Reseller Customer meeting Article 28 GDPR (or equivalent law) and containing the terms in Schedule A of the Partner Terms, before the Customer ID is activated;
(b) holds the Controller’s authorization for Nembol to act as sub-processor, including for the use of Nembol’s sub-processors and for transfers outside the EU/EEA, UK or Switzerland as described in Section 8 of Part A;
(c) has informed each Reseller Customer that Nembol Inc. (a Delaware, USA corporation) acts as sub-processor;
(d) will pass on to Nembol any objection or instruction of a Controller that concerns the processing, and will not act on behalf of a Controller without its authority; and
(e) will not send Nembol personal data that Nembol does not need for the Services, and will not instruct Nembol to process special categories of personal data.

B4. Sub-processors

Sections 6.4 and 7 of Part A apply. The Partner, on behalf of itself and the Controllers, gives Nembol the general authorization described there. Notice of new or replacement sub-processors is given by email to the Partner’s registered account email (and, where feasible, in the API developer notices), and the Partner is responsible for passing it on to its Reseller Customers. An objection must be made by the Partner within the period in Section 6.4 and on reasonable data-protection grounds. If it cannot be resolved, the Partner may deactivate the affected Customer IDs, without penalty for the part of the Services affected.

B5. Data subject requests

If Nembol receives a request from a data subject concerning Partner Data, it will not respond itself, except to direct the data subject to the Partner or to confirm receipt. Nembol will forward the request to the Partner within 5 business days. Section 6.5 of Part A applies to Nembol’s assistance to the Partner.

B6. Personal data breach

Section 6.7 of Part A applies, with notification to the Partner at its registered account email. The Partner is responsible for notifying the Controllers and, where it is the controller, the supervisory authority and affected individuals. Nembol will contact a Reseller Customer directly only where the law requires it, or in the cases set out in Section 8.3 of the Partner Terms. The Partner will notify Nembol without undue delay of any breach affecting Credentials, or data obtained through the API, that may affect Nembol’s systems or other Partners’ data.

B7. Audits

Section 6.9 of Part A applies, with these adjustments. Requests are made by the Partner (not by each Reseller Customer) and count once per calendar year for all of its Reseller Customers together. Nembol may satisfy a request by giving the Partner the documentation in Section 6.9, which the Partner may share with its Reseller Customers. A Reseller Customer or a supervisory authority may require a direct audit only where the law requires that Nembol allow it.

B8. Return and deletion

Section 6.8 and Section 9 of Part A apply. When a Customer ID is deactivated, or the Partner Terms end, Nembol will delete or anonymize the Partner Data within the retention periods in Nembol’s Privacy Policy, subject to Section 8.3 of the Partner Terms (continuity). Before deactivation, the Partner may export the Partner Data through the API. If a Reseller Customer moves to a direct plan with Nembol, Part A applies from that point.

B9. Data held by the Partner

Nembol’s obligations under this DPA relate to processing in Nembol’s own systems. Once Partner Data is delivered to the Partner or its systems (including through the API), the Partner is solely responsible for it, including for security, retention, and for its onward processing and sub-processors. Nembol is not responsible for how the Partner uses or stores that data.

B10. International transfers

Section 8 of Part A applies.

B11. Description of the processing (Part B)

• Subject matter and duration: provision of the Services for the Reseller Customer for as long as its Customer ID is active, and afterwards only as needed for B8.
• Nature and purpose: receiving, storing, synchronizing and displaying order and buyer data between the Reseller Customer’s Channels and the Partner’s systems through the API, and related technical support requested by the Partner.
• Data subjects: customers and buyers of the Reseller Customer.
• Types of personal data: as in Section 5 of Part A, depending on the Channels connected and the permissions granted.

B12. Liability

Each Party’s liability under Part B is subject to Section 10 of Part A and to the Partner Terms. The Partner is liable to Nembol for breach of B3 and indemnifies Nembol as set out in the Partner Terms.

B13. Governing Law

For Partner Data, Part B prevails over Part A to the extent of any conflict. In all other respects Part A applies, with “User” read as the Partner and “Controller” as defined in B1.