Data Processing Addendum
Where we act as your processor, these are the terms — already in force, nothing to sign.
- Version
- 1.0
- Effective
Draft — pending legal review
This document is published in draft while it is reviewed by counsel. It is not yet binding and may change before the Launch Program opens. Questions: support@inspic.io.
This addendum forms part of the Terms of Service and takes effect automatically when you create a Inspicio account. There is nothing to countersign. If your counsel needs a signed copy on our paper, write to privacy@inspic.io.
It applies where we process personal data on your behalf and under your instructions — as your processor. Where we decide why and how data is processed, such as for your own account and billing records, we act as controller and the Privacy Policy governs instead.
1. Scope
| Detail | |
|---|---|
| Subject matter | Providing the Inspicio seller intelligence platform. |
| Duration | For as long as your account is open, plus the retention periods in the Privacy Policy. |
| Nature and purpose | Storage, retrieval, analysis, aggregation, estimation, and AI-assisted generation of listing and pricing suggestions. |
| Types of personal data | Names and business contact details of your team members and any individuals recorded in your supplier records; account metadata from your connected Amazon selling account. |
| Categories of data subject | Your employees and collaborators; your supplier contacts. |
| Special categories | None. Do not put special-category data into the product. |
Buyer personal data from Amazon orders is deliberately out of scope. We discard it during processing and never write it to storage, so it is not held on your behalf. See the Privacy Policy, section 3.
2. Our obligations
- We process personal data only on your documented instructions, which the Terms of Service and your use of the product constitute. If we are legally compelled to process otherwise, we will tell you first unless the law forbids it.
- Everyone with access is bound by confidentiality obligations.
- We apply the technical and organisational measures in section 4.
- We engage sub-processors only under section 3.
- We help you respond to data-subject requests, using the product's own export and deletion features where those are sufficient.
- We help you with data protection impact assessments and with breach notification, so far as is reasonable given what we know.
- On termination we delete or return the data as set out in the Privacy Policy.
- We make available the information you need to verify our compliance, and we will answer a reasonable security questionnaire once a year.
3. Sub-processors
You give general authorisation for us to engage the sub-processors listed in section 4 of the Privacy Policy. Each is bound by terms no less protective than these.
We will give at least 30 days' notice before adding or replacing one. If you object on reasonable data-protection grounds, write to privacy@inspic.io within that window and we will work to resolve it; if we cannot, you may terminate the affected part of the service without penalty.
4. Security measures
- Encryption in transit (TLS) for all traffic, and encryption at rest for credentials.
- Tenant isolation enforced at the database layer by row-level security, not by application code.
- Role-based access control within each workspace, and individually credentialed, logged access to production by staff.
- Passwords stored only as salted hashes; session tokens short-lived and rotated.
- Audit logging of administrative actions.
- Backups, with restore tested periodically.
- Separation of development, test and production environments.
5. Personal data breach
We will notify you without undue delay, and in any event within 48 hours of becoming aware of a breach affecting personal data we process for you. The notice will describe what happened, what data was affected, what we have done, and what we recommend you do.
6. International transfers
Where a sub-processor is outside Egypt or, for GDPR-governed data, outside the EEA, we rely on Standard Contractual Clauses or an equivalent mechanism recognised under Law 151 of 2020. Details of the mechanism covering a given transfer are available on request.
7. Liability
Liability under this addendum is subject to the limitations in the Terms of Service.