PROVEN policy
Data Processing Addendum
Standard Article 28 DPA form for merchant-controlled processing performed by the installed PROVEN application where PROVEN acts as processor.
1. Parties
This DPA applies between the merchant using the installed PROVEN app, as controller for data it controls, and the PROVEN operator identified in the Legal section, as processor where processing is performed solely on the merchant’s behalf.
2. Subject and duration
PROVEN processes data needed to provide the installed app during the merchant relationship and for limited periods needed to close the service, meet legal obligations and protect rights.
3. Nature and purpose
Processing may include reading catalog data, detecting issues, preparing remediation, publishing approved changes, verifying results, audit and related technical support.
4. Data and data subjects
Data may include information about authorized store users and personal data that appears incidentally in catalog content supplied by the merchant. Current catalog-quality functions do not require customer or order data by default.
5. Merchant instructions
PROVEN processes merchant-controlled data only to provide requested services and according to documented instructions expressed through configuration, use of features and applicable contractual terms, unless law requires otherwise.
6. PROVEN obligations
PROVEN maintains confidentiality, applies appropriate security measures, limits access to people and systems that need it, reasonably assists the merchant with data-subject requests and informs the merchant of relevant incidents as required by applicable law.
7. Subprocessors
PROVEN may use providers listed in the Subprocessors Policy and remains responsible for imposing relevant data-protection obligations on providers that process data on its behalf.
8. Transfers
International transfers use mechanisms recognized by applicable law, including Standard Contractual Clauses where required.
9. Deletion or return
After service termination and subject to legal obligations, PROVEN deletes or de-identifies merchant-controlled data according to the app lifecycle and Data Retention Policy.
10. Audit information
On reasonable request, PROVEN can provide information necessary to demonstrate compliance with this DPA while protecting security, confidentiality and information belonging to other customers.