SLATE

Data Processing Agreement

Processing terms for Customer Personal Data handled through the Slate Service

Effective date: August 30, 2026
Last updated: August 30, 2026
Version: 1.0

Contents

1. Scope, parties, and acceptance

2. Definitions and roles

3. Customer instructions and responsibilities

4. Slate processing obligations

5. Confidentiality

6. Security

7. Subprocessors

8. Data-subject and privacy-request assistance

9. Security incidents

10. Impact assessments and regulatory consultations

11. Compliance information and audits

12. Return, deletion, and termination

13. International transfers

14. United States state privacy terms

15. Liability, precedence, and governing law

16. Changes and notices

Schedule 1. Processing details

Schedule 2. Technical and organizational measures

Schedule 3. Authorized subprocessors and processing locations

Schedule 4. International transfer terms

1. Scope, parties, and acceptance

1.1 Parties

This Data Processing Agreement (the “DPA”) is between Slate Data LLC, a Massachusetts limited liability company with a mailing address at 333 Ricciuti Drive #1404, Quincy, Massachusetts 02169, United States (“Slate”), and the Customer identified through a Slate account, subscription, order, or other agreement governing use of the Service (“Customer”).

1.2 Incorporation and acceptance

This DPA forms part of and is incorporated by reference into the Slate Terms of Service and any Order Document that incorporates those Terms (collectively, the “Agreement”). It applies when Slate processes Customer Personal Data on Customer's behalf. An authorized person accepts this DPA for Customer by creating a Slate account, accepting an invitation, placing an order, or accessing or using the Service after receiving notice that the DPA is incorporated into the Terms. No separate signature or checkbox is required unless the parties agree otherwise in writing.

1.3 Duration

This DPA begins when Customer accepts the Agreement and remains in effect until Slate has completed processing and deletion of Customer Personal Data as required by this DPA.

2. Definitions and roles

2.1 Definitions

“Applicable Data Protection Law” means privacy, data-protection, and data-security law applicable to Slate's processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR, UK GDPR, Swiss Federal Act on Data Protection, California Consumer Privacy Act and its implementing regulations, and comparable United States state privacy laws. “Customer Personal Data” means Personal Data contained in Customer Data that Slate processes on Customer's behalf. “GDPR” means Regulation (EU) 2016/679. “Personal Data,” “Personal Data Breach,” “process,” “processor,” “controller,” “service provider,” “contractor,” “sell,” and “share” have the meanings given by Applicable Data Protection Law. “Service” and “Customer Data” have the meanings given in the Terms.

2.2 Roles

Customer is the controller or business for Customer Personal Data, and Slate is Customer's processor, service provider, or contractor. If Customer processes Personal Data for another controller, Customer is a processor and appoints Slate as its subprocessor. Each party remains independently responsible for the Personal Data it controls for its own purposes. Slate acts as an independent controller or business for account administration, billing, security, legal compliance, service management, and Slate's own website and marketing activities; those activities are governed by Slate's Privacy Policy rather than this DPA.

3. Customer instructions and responsibilities

3.1 Documented instructions

The Agreement, Customer's configuration and authorized use of the Service, Customer's connected-platform permissions, and Customer's written requests through authenticated Service or support channels constitute Customer's documented instructions. Customer instructs Slate to process Customer Personal Data only to provide, secure, support, maintain, and improve the configured Service; perform imports, normalization, joins, rules, reporting, exports, privacy requests, deletion, and recovery; and comply with law and platform obligations applicable to the Service.

3.2 Lawful instructions

Customer will provide only lawful instructions and will maintain all notices, consents, permissions, legal bases, and platform authority required to collect Customer Personal Data and instruct Slate to process it. Customer is responsible for the accuracy, quality, and legality of Customer Personal Data and for configuring the Service in a manner consistent with Applicable Data Protection Law. Slate will promptly inform Customer if, in Slate's reasonable opinion, an instruction infringes Applicable Data Protection Law, and Slate may suspend the affected processing until the parties resolve the issue.

3.3 Prohibited and sensitive data

Customer will not submit protected health information, complete payment-card data, government identifiers, children's data, biometric data, precise geolocation, special-category data, criminal-offense data, or similarly regulated information unless Slate expressly authorizes that processing in a signed Order Document and the required contractual, security, and product controls are active.

4. Slate processing obligations

Slate will process Customer Personal Data only on Customer's documented instructions and as necessary to perform the Agreement. Slate will not determine materially different purposes or means of processing Customer Personal Data. If law requires Slate to process Customer Personal Data outside Customer's instructions, Slate will notify Customer before that processing unless the law prohibits notice on important public-interest grounds.

Slate will comply with obligations directly applicable to processors, service providers, and contractors; maintain records required for its processing; cooperate with competent supervisory authorities as legally required; and provide Customer the reasonable assistance described in this DPA. Slate will not sell or share Customer Personal Data, use it for cross-context behavioral advertising, use it to advertise Slate, combine it with Personal Data received from another customer or collected from Slate's own interaction with a person except as expressly permitted by Applicable Data Protection Law, or use it to train a general-purpose artificial-intelligence model.

5. Confidentiality

Slate will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality duties and receive access only as needed for their responsibilities. Slate will limit human access to Customer Personal Data to authorized personnel performing support, security, incident response, legal compliance, or other necessary Service functions. Confidentiality obligations survive the end of access and termination of the Agreement.

6. Security

Taking into account the state of the art, implementation cost, the nature, scope, context, and purposes of processing, and the risk to individuals, Slate will maintain appropriate administrative, technical, and organizational safeguards designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access. The measures in Schedule 2 form part of this DPA.

Slate may update its safeguards as technology and risk change, provided an update does not materially reduce the overall protection of Customer Personal Data. No security measure eliminates all risk, and this DPA does not constitute a guarantee that a security incident will never occur.

7. Subprocessors

7.1 General authorization

Customer gives Slate general written authorization to engage the subprocessors listed in Schedule 3 and future subprocessors selected under this Section. Slate will conduct reasonable diligence and enter into a written agreement with each subprocessor that processes Customer Personal Data, requiring data-protection obligations appropriate to the services and no less protective in material respects than Slate's applicable obligations under this DPA. Slate remains responsible for each subprocessor's performance of those obligations to the extent required by Applicable Data Protection Law.

7.2 Notice and objection

Slate will give Customer at least 30 days' advance notice before authorizing a new subprocessor to process Customer Personal Data by updating the online subprocessor schedule and sending notice to the account owner or administrator email address. Customer may object within 15 days after notice, solely on reasonable, documented data-protection grounds. The parties will work in good faith to address a timely objection. If Slate cannot provide a commercially reasonable alternative within 30 days, Customer may terminate only the affected Service without penalty by written notice, and Slate will refund prepaid fees for the terminated Service covering the period after termination. Failure to object within the 15-day period constitutes authorization.

7.3 Customer-directed platforms

A platform that Customer selects and authorizes as a data source or export destination is not Slate's subprocessor for that Customer-directed relationship. Shopify is Customer's merchant platform and data source. Google Sheets and similar destinations are Customer-directed export destinations. Customer is responsible for the platform account, authorization, destination access, and copies retained outside Slate.

8. Data-subject and privacy-request assistance

Customer is responsible for responding to requests concerning Customer Personal Data. Taking into account the nature of processing, Slate will provide available self-service tools and reasonable assistance to help Customer respond to access, portability, correction, deletion, restriction, objection, opt-out, and appeal requests required by Applicable Data Protection Law. If Slate receives a request directly and can identify the applicable Customer, Slate will refer the requester to Customer or notify Customer and will not independently disclose Customer Personal Data unless Customer instructs Slate or law requires disclosure.

Customer is responsible for authenticating requesters and authorized agents and for delivering the customer-facing response. Slate may require Customer to use secure, authenticated channels and provide information reasonably necessary to identify the applicable organization, source account, and request scope. Assistance beyond standard Service functionality may be subject to reasonable fees based on Slate's actual cost when permitted by law and agreed in advance.

8.1 Shopify requests

For a verified Shopify customers/data_request, Slate prepares a protected export of the Shopify-derived data stored for the identified customer and provides it to the verified merchant administrator; the merchant authenticates the requester and provides the customer-facing response. A verified customers/redact request immediately hard-deletes the exact customer-linked records, and a verified shop/redact request immediately purges the exact shop. Slate processes each request only within the authenticated merchant, organization, shop, and customer scope.

9. Security incidents

Slate will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. Notice will be sent to the account owner or administrator email address and will include, as information becomes reasonably available, the nature of the breach; affected data and individuals; likely consequences; measures taken or proposed to contain, investigate, remediate, and mitigate the breach; and a contact for follow-up. Slate may provide information in phases and will not delay initial notice solely because every detail is unavailable.

Slate will take reasonable steps to contain, investigate, mitigate, and remediate the breach; preserve relevant evidence; and reasonably assist Customer with legally required notifications. Slate's notice or response is not an admission of fault or liability. Customer is responsible for determining whether to notify regulators or individuals unless law assigns that duty directly to Slate. “Personal Data Breach” does not include an unsuccessful attempt that does not compromise Customer Personal Data, such as a blocked scan, unsuccessful login attempt, or denied network attack.

10. Impact assessments and regulatory consultations

Taking into account the nature of processing and information available to Slate, Slate will provide reasonable information and assistance for Customer's data-protection impact assessments, risk assessments, cybersecurity audits, automated-decision assessments, and prior consultations with a regulator when required by Applicable Data Protection Law for Customer's use of the Service. Customer remains responsible for determining whether an assessment or consultation is required and for its content and submission. Extraordinary assistance may be subject to reasonable fees agreed in advance.

11. Compliance information and audits

11.1 Information

Upon reasonable written request, Slate will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant summaries of security measures, subprocessor information, and independent assessment or certification materials that Slate has and may lawfully disclose. Slate may protect confidential, privileged, security-sensitive, and other customers' information and may provide materials under confidentiality restrictions.

11.2 Audit procedure

If the information provided under Section 11.1 is insufficient to satisfy a requirement under Applicable Data Protection Law, Customer may conduct one audit in any 12-month period through an independent auditor that is not Slate's competitor, gives at least 30 days' notice, signs reasonable confidentiality terms, follows Slate's security and safety requirements, and conducts the audit during normal business hours without disrupting the Service. Additional audits are permitted after a confirmed Personal Data Breach affecting Customer Personal Data or when a competent regulator requires one.

The audit must be limited to systems and records relevant to Customer Personal Data and may not expose another customer's data, penetration-test production systems, access source code or credentials, or compromise Slate's security. Customer bears its audit costs and Slate's reasonable costs for extraordinary assistance unless the audit identifies a material breach of this DPA by Slate, in which case Slate will bear its reasonable assistance costs. Customer will promptly provide Slate the audit report and allow Slate a reasonable opportunity to address substantiated findings.

12. Return, deletion, and termination

12.1 During the Service

Customer may use available export functionality to retrieve Customer Data during the term. Customer is responsible for exporting needed data before termination and for securing and deleting copies sent to Customer-directed destinations.

12.2 General termination

After termination or account closure, Slate will delete or render inaccessible Customer Personal Data in active production systems within 30 days, unless Customer requests return through available export functionality before access ends or law requires limited retention. Slate will delete or irreversibly anonymize account and organization profile records within 90 days, except for minimum records retained under a separate lawful security, audit, accounting, dispute, or legal schedule.

12.3 Shopify deletion

A verified Shopify app uninstall or administrator disconnect immediately clears reusable credentials and stops synchronization, then deletes the disconnected shop's Slate data within 48 hours unless the same connection is restored first. Verified Shopify customer and shop redaction requests are processed immediately. These Shopify-specific periods control over the general period in Section 12.2.

12.4 Backups and restoration

Customer Personal Data in protected backups and database-recovery history will expire within 30 days. Until expiration, backup data remains protected, is not returned to ordinary use, and is processed only for disaster recovery, security, or legal obligations. Slate will restore historical data only into an isolated environment, replay applicable deletion tombstones, verify deleted data remains absent, and keep the restoration isolated if replay or verification fails.

12.5 Legal retention

Slate may retain only the minimum Customer Personal Data required by law or reasonably necessary to establish, exercise, or defend legal claims. Retained data will be segregated or otherwise restricted from ordinary product use, remain protected by this DPA, and be deleted when the retention basis ends. This exception does not permit continued retention of Shopify credentials, raw Shopify customer records, direct customer identifiers, shop domains, attribution URLs, or webhook payloads after a mandatory Shopify deletion.

13. International transfers

Customer authorizes Slate and its authorized subprocessors to process Customer Personal Data in the United States and the other locations identified in Schedule 3. Slate will use a transfer mechanism recognized by Applicable Data Protection Law for a restricted transfer, including adequacy regulations, a participating recipient's valid Data Privacy Framework certification, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard.

For transfers from the EEA, United Kingdom, or Switzerland to Slate where a recognized transfer safeguard is required, Schedule 4 applies automatically. Each party will reasonably cooperate with a required transfer-risk assessment and supplementary measures. Customer will not instruct Slate to make a transfer that would violate Applicable Data Protection Law.

14. United States state privacy terms

To the extent Customer Personal Data is protected by a United States state privacy law, Slate acts as Customer's service provider, contractor, or processor. The specific business purposes for processing are providing the configured data-ingestion, normalization, reporting, governance, export, support, security, privacy-request, deletion, and recovery functions described in the Agreement and Schedule 1. Customer makes Customer Personal Data available to Slate only for those limited and specified purposes.

Slate will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship with Customer or for a purpose other than the limited purposes stated above, except as permitted by law; or combine it with Personal Data received from another person or collected from Slate's own interaction with an individual except as permitted by law. Slate will provide the same level of privacy protection required of a service provider or contractor, implement reasonable security procedures, assist with consumer requests and required assessments, notify Customer if Slate determines it can no longer meet these obligations, and allow Customer to take reasonable and appropriate steps to verify, stop, and remediate unauthorized use. Slate certifies that it understands and will comply with these restrictions.

15. Liability, precedence, and governing law

15.1 Liability

Each party remains responsible for its own acts and omissions and for obligations assigned to it by Applicable Data Protection Law. Claims arising from this DPA are subject to the exclusions, limitations, procedures, and aggregate liability cap in the Agreement, and all claims under the Agreement and this DPA are combined when applying that cap, except to the extent Applicable Data Protection Law prohibits a limitation.

15.2 Order of precedence

If documents conflict: (1) the EU Standard Contractual Clauses or UK Addendum controls for a restricted transfer to the extent of the conflict; (2) a signed Order Document controls only if it expressly identifies the DPA provision it overrides; (3) this DPA controls over the Terms for the processing of Customer Personal Data; and (4) the Terms control for all other matters. The Privacy Policy does not override this DPA or the Terms.

15.3 Governing law and venue

The governing-law and venue provisions in the Terms apply to this DPA, except where Applicable Data Protection Law or the transfer clauses in Schedule 4 require another law, supervisory authority, or forum.

16. Changes and notices

Slate may update this DPA to reflect changes in law, subprocessors, security, or the Service. Slate will post the updated version and effective date and will provide the account owner or administrator at least 30 days' advance email and prominent in-Service notice of a material change that adversely affects Customer's rights. A shorter period may apply when a change is required by law, regulation, security, or a platform obligation and advance notice is not reasonably practical; Slate will provide notice as soon as practical.

Continued use of the Service on or after the stated effective date constitutes acceptance of the updated DPA. If Customer does not agree, Customer must stop using the affected Service and terminate before the effective date. Formal notices and privacy or security communications to Slate must be sent to legal@slatedata.app or delivered as provided in the Terms.

Schedule 1. Processing details

Schedule 2. Technical and organizational measures

• Identity and access: authenticated access, organization-scoped authorization, role-based permissions, administrator controls, least-privilege access, and restricted production access.
• Tenant isolation: server-side organization and source-account scoping for protected reads, writes, exports, workflows, privacy requests, and deletion.
• Encryption and secrets: encrypted transport, authenticated encryption for stored OAuth tokens and other protected credentials, managed secrets, token rotation and revocation handling, and no client exposure of reusable provider credentials.
• Data minimization: table-selected provider scopes, limited fields, direct Shopify customer contact-data exclusion, metadata-only logs and audits where applicable, and aggregate-only operational outputs where possible.
• Logging and audit: protected audit events for material reads, exports, changes, and administrative actions; value-free or allowlisted operational logs; and controls designed to prevent payloads, credentials, or unnecessary identifiers from entering logs.
• Application security: input validation, authentication and authorization checks, webhook signature verification, secure headers, dependency and change review, automated tests, controlled deployments, and remediation of identified vulnerabilities according to risk.
• Availability and recovery: managed hosting and database infrastructure, protected backup and recovery capabilities, a maximum 30-day backup/history window, isolated restoration, deletion-tombstone replay, verification before promotion, and fail-closed recovery when deletion replay cannot be completed.
• Incident response: escalation, containment, investigation, evidence preservation, remediation, recovery, and notification procedures appropriate to the incident.
• Personnel and vendors: confidentiality duties, need-to-know access, security responsibilities, vendor diligence, and written data-protection terms for subprocessors.
• Lifecycle controls: credential clearing and sync termination on disconnect, Customer Data deletion schedules, immediate verified Shopify redaction, 48-hour Shopify disconnect deletion, and deletion or isolation after restoration.

Schedule 3. Authorized subprocessors and processing locations

The following direct providers are authorized to support the Service. A provider processes Customer Personal Data under this DPA only to the extent that Customer's use of the Service sends such data to that provider. Providers used solely for Slate-controlled account or analytics data remain governed by Slate's Privacy Policy.

Schedule 4. International transfer terms

4.1 EU Standard Contractual Clauses

For a restricted transfer of Customer Personal Data governed by the GDPR, the standard contractual clauses in the Annex to European Commission Implementing Decision (EU) 2021/914 (“EU SCCs”) are incorporated by reference and completed as follows:

• Module Two applies when Customer is a controller and Slate is a processor; Module Three applies when Customer is a processor and Slate is a subprocessor.
• Clause 7, the optional docking clause, applies. In Clause 9, Option 2, general written authorization applies with the notice period in Section 7.2. The optional language in Clause 11 does not apply.
• For Clause 17, the laws of Ireland govern the EU SCCs. For Clause 18, disputes will be resolved by the courts of Ireland. The competent supervisory authority is determined under Clause 13.
• Customer is the data exporter, with the name, address, contact, role, and signature information associated with its Slate account or Order Document. Slate Data LLC is the data importer at 333 Ricciuti Drive #1404, Quincy, MA 02169, United States; contact legal@slatedata.app; role: processor or subprocessor. Acceptance of the Agreement constitutes signature as of its effective date.
• Schedule 1 supplies Annex I.B; Schedule 2 supplies Annex II; and Schedule 3 supplies Annex III. Transfers occur continuously or as initiated by Customer during the Agreement.

4.2 United Kingdom

For a restricted transfer governed by UK Data Protection Law, the then-current International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner is incorporated by reference. The parties and selections above complete its tables; neither party may terminate the Addendum solely because the Information Commissioner issues a revised approved addendum. The mandatory clauses of the UK Addendum control over conflicting terms.

4.3 Switzerland

For a restricted transfer governed by the Swiss Federal Act on Data Protection, the EU SCCs apply with references to the GDPR understood to include Swiss law, “Member State” interpreted to include Switzerland where necessary to permit data-subject rights, the Swiss Federal Data Protection and Information Commissioner as the competent authority to the extent required, and Swiss law and courts applying where the EU SCCs require them.

4.4 Conflicts and supplementary measures

The applicable EU SCCs or UK Addendum control over this DPA and the Agreement to the extent of a conflict concerning a restricted transfer. The parties will document a required transfer-risk assessment and implement supplementary technical, contractual, or organizational measures reasonably necessary for the transfer.