Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the PrintKit Anywhere Terms of Service between Big Chato's Apparel LLC ("PrintKit Anywhere," "Processor," "we") and the merchant ("you," "Controller") who registers for PrintKit Anywhere. It governs our processing of personal data on your behalf and reflects our obligations under applicable data-protection law (including the GDPR/UK GDPR and US state privacy laws, where they apply).

Where this DPA and the Privacy Policy differ on data-processing specifics, this DPA controls for the processing of personal data carried out on your behalf.

1. Roles

You are the Controller of the customer (end-shopper) personal data processed through your embedded builders. PrintKit Anywhere is the Processor, acting only on your documented instructions (which include your configuration choices in the app and these terms). For your own merchant account and billing data, Big Chato's Apparel is an independent controller for the purpose of providing and billing the Service.

2. Subject matter, duration, nature, and purpose

• Subject matter: providing the PrintKit Anywhere design-builder and quote-capture service.
• Duration: for as long as your account is active, plus the retention windows in Section 6.
• Nature and purpose: to generate production print files and your work ticket, capture custom-design orders as quotes in your dashboard, and (where enabled) let customers save/resume designs. Personal data is never used for marketing, advertising, resale, profiling, or model training.

3. Categories of data subjects and personal data

• Data subjects: your customers (end shoppers) who use your embedded builders.
• Personal data processed:
  • Customer name — shown on your work ticket and quote.
  • Customer contact email — captured with the order/quote so you can follow up.
  • Order/quote data — quote number and line items (product, quantity, options).
  • Design data — the customer's design state and uploaded artwork, and, where the save/resume feature is used, a retrieval key.
• Not processed: the Service does not collect customer phone numbers or shipping/billing addresses through the builder, and never processes payment-card data (the Service takes no payment from your customers).

4. Sub-processors

You authorize PrintKit Anywhere to use the following sub-processors:

We will inform you of any intended addition or replacement of a sub-processor before it begins processing your data, giving you a reasonable opportunity to object. We impose data-protection obligations on our sub-processors substantially equivalent to those in this DPA and remain responsible for their performance.

5. Security measures

PrintKit Anywhere maintains technical and organizational measures appropriate to the risk, including:

• Encryption in transit — all traffic over HTTPS/TLS.
• Encryption at rest — customer design state and uploaded artwork encrypted with AES-256-GCM using per-shop envelope encryption; each shop's data key is stored wrapped by a master key held only in the server environment, never in the database or source control.
• Crypto-shredding — deleting a shop's wrapped key renders that shop's ciphertext permanently unreadable.
• Hashed lookup tokens — saved-design and quote tokens stored only as SHA-256 hashes.
• Hashed passwords — merchant passwords stored only as salted scrypt hashes.
• Multi-tenant isolation — each merchant's data scoped to its own records in code.
• Least-privilege access — production access limited to authorized personnel via SSH-key authentication; decryption gated by the master key.
• Encrypted backups — automated backups of app data with a documented restore procedure.
• Data minimization — only name, email, order id, line items, and design data are taken from the order.

6. Retention and deletion

• Saved customer designs and artwork are retained only as needed and, where the auto-purge feature is enabled, are deleted after the retention window you select (7, 30, or 90 days; default 30), enforced by an automated job.
• Order/quote records and shop configuration are retained while your account is active.
• On account closure, we delete your shop's records — configuration, designs, artwork, order/quote logs, session rows, and the shop's encryption key (crypto-shredding).

7. Data subject requests

PrintKit Anywhere will assist you, taking into account the nature of the processing, in responding to data-subject requests (access, correction, deletion, portability, objection) that you receive directly from your customers. Requests may be sent to support@printkit.tech and are recorded in an internal audit log. We will action deletion requests you forward to us and will not respond to your customers directly except as you instruct or as required by law.

8. Personal data breach

PrintKit Anywhere maintains a written incident-response practice. In the event of a personal data breach affecting your data, we will notify you without undue delay after becoming aware (target: within 72 hours), with the information reasonably available to help you meet your own notification obligations. Contact for incident matters: support@printkit.tech.

9. International transfers

PrintKit Anywhere hosts data in the United States. Where you are subject to EU or UK data-transfer rules and personal data is transferred outside the EEA or the UK, the parties incorporate by reference the EU Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (Controller-to-Processor), with you acting as data exporter and PrintKit Anywhere as data importer. For transfers subject to UK law, the parties incorporate the UK Information Commissioner's International Data Transfer Addendum to the EU SCCs. For transfers subject to Swiss law, the EU SCCs apply with the amendments necessary under the Swiss Federal Act on Data Protection. Where the Clauses conflict with any other term of this DPA, the Clauses prevail with respect to the transfer they govern.

10. Audit and cooperation

PrintKit Anywhere will make available to you information reasonably necessary to demonstrate compliance with this DPA and will cooperate with reasonable audit requests, subject to confidentiality and without compromising other merchants' data or the Service's security.

11. Return and deletion on termination

On termination, PrintKit Anywhere deletes your personal data as described in Section 6, unless retention is required by law. You are responsible for exporting any order/quote data you wish to keep before closing your account.

12. Contact

Big Chato's Apparel LLC — Reva, Virginia, USA
Data-protection contact: support@printkit.tech