Data Processing Addendum

Effective date: 18 October 2026

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service (the “Agreement”) between MoreBasket Private Limited (“morebasket”, “we”, “us”, the “Processor”) and the customer that accepted the Agreement (“you”, the “Customer”). It applies automatically, without signature, whenever we process Customer Personal Data on your behalf and Data Protection Law applies to that processing. If you need a signed copy, write to admin@morebasket.com.

1. Definitions

Terms not defined here have the meaning given in the Agreement. In this DPA:

• “Customer Personal Data” means personal data that we process on your behalf in providing the Services, such as personal data about your Customers and the visitors to your Store (also called “Store Data” in our Privacy Policy), and personal data about your Authorized Users that you give us to administer your Store. It does not include personal data for which we are the controller, which is covered by our Privacy Policy.
• “Data Protection Law” means all laws on privacy and the protection of personal data that apply to the processing, including, where applicable, Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (the “FADP”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”) and other US state privacy laws, Brazil’s General Data Protection Law (LGPD), and India’s Digital Personal Data Protection Act 2023, each as amended.
• “controller”, “processor”, “data subject”, “personal data”, “processing”, “personal data breach” and “supervisory authority” have the meanings in the GDPR, and “service provider”, “sell”, “share” and “business purpose” have the meanings in the CCPA.
• “Subprocessor” means a third party that we engage to process Customer Personal Data.
• “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0.

2. Roles and scope

2.1. Roles. For Customer Personal Data, you are the controller (or, if you process it on behalf of another controller, the processor), and we are your processor (or your subprocessor). Each party will comply with the Data Protection Law that applies to it.

2.2. Details of the processing. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are in Annex 1.

2.3. Your responsibilities. You are responsible for (a) the lawfulness of your processing and of your instructions to us, including having a legal basis for collecting and using Customer Personal Data and for the transfer of it to us; (b) giving data subjects the information and choices that the law requires, including notice of the processors you use; and (c) the accuracy and quality of the Customer Personal Data and how you acquired it.

3. Our obligations as your processor

We will:

3.1. Instructions. Process Customer Personal Data only on your documented instructions, which are the Agreement, this DPA, your configuration and use of the Services, and any further written instructions you give that are consistent with them, unless the law requires otherwise (in which case we will tell you before processing, unless the law prohibits it). We will tell you if we think an instruction breaks Data Protection Law, and we may suspend the relevant processing until you confirm or change it.

3.2. Purpose limitation. Not process Customer Personal Data for any purpose other than the business purposes in Annex 1, including not for our own purposes except as Data Protection Law allows a processor to (for example, for security, fraud prevention, legal compliance and to provide, maintain and improve the Services using de-identified or aggregated data that does not identify you or any individual).

3.3. Confidentiality. Make sure that people we authorise to process Customer Personal Data are bound by confidentiality duties, and that access is limited to those who need it.

3.4. Security. Implement and maintain the technical and organisational measures in Annex 2, and keep them appropriate to the risk, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing. We may update the measures if the level of security is not reduced.

3.5. Subprocessors. Engage Subprocessors only under section 5.

3.6. Assisting you with data subjects. Taking into account the nature of the processing, give you the tools in the Services, and reasonable additional help, to respond to requests from data subjects to exercise their rights. If a data subject asks us directly about Customer Personal Data, we will tell them to contact you (we may identify you to them) and will pass the request to you promptly, and will not respond except to say that, unless the law requires otherwise.

3.7. Assisting with compliance. Taking into account the nature of the processing and the information we have, give you reasonable help with your obligations about security, personal data breaches, data protection impact assessments and prior consultation with supervisory authorities. We may charge reasonable costs for help that goes beyond what the Services provide in the ordinary course.

3.8. Return and deletion. At your choice, delete or return Customer Personal Data as section 8 sets out.

3.9. Records and audits. Make available to you the information needed to show our compliance with this DPA and allow for audits as section 9 sets out. We will keep records of our processing activities as the law requires.

4. Personal data breaches

4.1. We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

4.2. Our notice will describe, as far as we know, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose. We will update you as we learn more, and cooperate with you and take reasonable steps to contain and fix the breach.

4.3. A notice or response by us is not an admission of fault or liability. You are responsible for deciding whether to notify supervisory authorities and data subjects, unless the law requires us to.

5. Subprocessors

5.1. General authorisation. You authorise us to engage the Subprocessors listed at Subprocessors and our affiliates as Subprocessors.

5.2. Changes. We will tell you at least 30 days before a new Subprocessor starts processing Customer Personal Data, or an existing one is replaced, by updating the list and by email or a notice in the Services to those who have subscribed to updates. You can object on reasonable data-protection grounds by writing to admin@morebasket.com within that period. We will then work with you in good faith to resolve it, for example by offering a way to avoid using the Subprocessor for you. If we cannot, you may terminate the affected Services on written notice and we will refund prepaid fees for the unused part of the term.

5.3. Flow-down and liability. We will impose on each Subprocessor, in writing, data-protection obligations that are no less protective than those in this DPA, and we remain responsible to you for each Subprocessor’s performance of them, subject to the Agreement.

5.4. Providers you choose. This section does not apply to third-party services that you choose to connect to your Store (for example your own payment, shipping or sales-channel accounts). They are independent of us and act under your instructions and their own terms.

6. International transfers

6.1. Where we process. We and our Subprocessors may process Customer Personal Data in the United States and in other countries where we or they operate, as the list of Subprocessors shows.

6.2. European Economic Area. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree that the SCCs apply and are incorporated by reference, completed as follows: (a) Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor, with you as “data exporter” and us as “data importer”; (b) the optional docking clause (Clause 7) applies; (c) in Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 5.2; (d) the optional language in Clause 11 does not apply; (e) in Clause 17, the SCCs are governed by the law of the EU Member State in which the data exporter is established, or if there is none, the law of Ireland; (f) in Clause 18, the courts of that Member State, or Ireland, have jurisdiction; (g) Annex I.A is completed with the parties’ details in the Agreement, Annex I.B is Annex 1 to this DPA, and Annex I.C is the supervisory authority competent for the data exporter; and (h) Annex II is Annex 2 to this DPA, and Annex III is the list of Subprocessors.

6.3. United Kingdom. Where Customer Personal Data subject to the UK GDPR is transferred to a country without UK adequacy regulations, the SCCs apply as in section 6.2, as amended by the UK Addendum. The tables of the UK Addendum are completed with the information in this DPA: the parties and their details are those in the Agreement; the selected SCCs, modules and clauses are those in section 6.2; the appendix information is in Annexes 1 to 3; and, in Table 4, neither party may end the UK Addendum when the approved addendum changes. The start date is the effective date of this DPA.

6.4. Switzerland. For transfers subject to the FADP, the SCCs apply as in section 6.2, with references to the GDPR read as references to the FADP, references to “Member State” read to include Switzerland so that data subjects in Switzerland may sue in their habitual residence, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

6.5. Data Privacy Framework. Where a Subprocessor is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, we may rely on that certification for transfers to it in addition to the SCCs.

6.6. Other countries. If Data Protection Law of another country requires specific transfer terms, the parties will cooperate in good faith to put them in place.

6.7. Alternative mechanism. If a transfer mechanism in this section is invalidated or replaced, the parties will work together to adopt a valid one.

6.8. Government access. We will not disclose Customer Personal Data to a public authority unless the law requires. If we receive a legally binding request, we will, unless prohibited, tell you promptly, challenge the request where there are reasonable grounds to do so, and disclose only what is strictly necessary. We will provide the information in Annex 2 on the measures that protect Customer Personal Data against such access.

7. CCPA and other US state laws

To the extent that the CCPA or another US state privacy law applies to Customer Personal Data, you and we agree that we act as your “service provider” or “processor”, and that we will not (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes specified in this DPA and the Agreement, or outside the direct business relationship between us, or for any commercial purpose other than those business purposes, except as the law allows; (c) combine it with personal data that we receive from or on behalf of another party, or collect from our own interactions with the data subject, except as the law allows; or (d) attempt to re-identify de-identified data. We will comply with the law that applies to us and give the same level of privacy protection that it requires, and will tell you if we determine that we can no longer meet our obligations. You may take reasonable and appropriate steps to stop and remediate unauthorised use, and to ensure that we use Customer Personal Data consistently with your obligations, as sections 3 and 9 provide. We certify that we understand these restrictions.

8. Return and deletion

8.1. Throughout the term, you can access and export Customer Personal Data using the Services.

8.2. For 30 days after the Agreement ends, or earlier if you ask, you may export Customer Personal Data, and we will then delete it. After the Agreement ends we will delete Customer Personal Data from our active systems within 90 days, and from backups when those backups are overwritten in the ordinary cycle, and in any case within a further 35 days, except where the law requires us to keep it, in which case we will protect it and process it only for that purpose.

8.3. On request, we will confirm the deletion in writing.

9. Information and audits

9.1. Information. We will give you, on request and not more than once a year, the information reasonably needed to show our compliance with this DPA, such as answers to a reasonable security questionnaire and summaries of independent assessments or reports that we have.

9.2. Audits. If the information in section 9.1 does not reasonably answer your questions, or if a supervisory authority requires it, you may carry out an audit of our relevant processing, once a year (or more often if the law requires or after a personal data breach), by giving us at least 30 days’ written notice, with a scope and plan agreed in advance, during business hours, in a way that does not unreasonably disrupt our operations or compromise the security or confidentiality of our other customers’ data, using an independent auditor bound by confidentiality, and at your cost. You will give us a copy of the audit report, which is our Confidential Information.

9.3. Nothing in this section limits the rights of the supervisory authority or the rights of data subjects under the SCCs.

10. Liability and general terms

10.1. Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions in the Agreement, except that nothing limits liability that cannot be limited by law, and nothing limits a data subject’s rights under the SCCs, including liability to them under Clause 12 of the SCCs.

10.2. If there is a conflict between this DPA and the Agreement about the processing of Customer Personal Data, this DPA prevails. If there is a conflict between the SCCs (or the UK Addendum) and this DPA or the Agreement, the SCCs (or the UK Addendum) prevail.

10.3. This DPA lasts as long as we process Customer Personal Data. We may update it to reflect changes in Data Protection Law or in the Services, giving notice as the Agreement provides.

10.4. Notices under this DPA to us: admin@morebasket.com. Our data protection contact: Sathish, Privacy Lead, admin@morebasket.com.

---

Annex 1: Details of the processing

A. Parties. Data exporter (controller): the Customer, with the details in its account. Data importer (processor): MoreBasket Private Limited, Ozone Techno Park, 24, Rajiv Gandhi Salai, Navalur, Chennai, Tamil Nadu 600130, India, contact admin@morebasket.com.

B. Subject matter and nature of the processing. Hosting, storing, retrieving, displaying, transmitting, analysing, translating, organising and otherwise processing personal data as needed to provide an online-store platform, including order management, inventory, customer management, payments and shipping integrations, selling channels and AI features, as instructed by the Customer.

C. Purpose. To provide the Services to the Customer under the Agreement, and to meet the Customer’s instructions.

D. Duration. The term of the Agreement, plus the return and deletion period in section 8.

E. Categories of data subjects. The Customer’s customers and prospective customers; visitors to the Customer’s Store; the Customer’s Authorized Users, suppliers and other business contacts, where the Customer enters their data in the Services.

F. Types of personal data. Identity and contact details (name, email address, telephone number, postal and billing and delivery addresses); account and order information (order contents, prices, dates, status, customer notes, returns, refunds); payment-related data (payment method type, last four digits, and status, but not full card numbers, which are held by the payment provider); customer group and preference information; communications with the Customer (such as order emails and review replies); reviews and ratings the data subject submits; technical data (IP address, device and browser information, usage data); and anything else the Customer chooses to enter into free-text fields.

G. Special categories of data. None intended. The Customer must not use the Services to process special categories of data, or data about criminal convictions, unless the law allows and the Customer has told us first in writing.

H. Frequency of transfer. Continuous, as the Services are used.

I. Retention. As in section 8.

J. Competent supervisory authority. The authority that is competent for the data exporter under Clause 13 of the SCCs.

Annex 2: Technical and organisational measures

We maintain measures that are at least equivalent to the following. We describe them in summary, and we do not claim any specific external certification.

1. Isolation of each Store’s data. Each Store’s products, customers, orders, payment credentials and files are logically separated from every other Store’s, using row-level isolation in the database, per-Store keys and credentials, and a per-Store prefix for stored files.
2. Encryption. Data is encrypted in transit using current industry-standard transport-layer encryption. Data at rest is held by infrastructure providers that encrypt stored data. Passwords are stored only as salted hashes.
3. Access control. Access to systems and to Customer Personal Data is granted on the principle of least privilege and the need to know, with individual accounts, strong authentication for administrative access, role-based permissions, and prompt removal when a person leaves or changes role. Customers’ administrators can manage roles for their own users.
4. Personnel. Staff who may access Customer Personal Data are bound by confidentiality obligations and receive security and privacy training.
5. Logging and monitoring. We log access to production systems and administrative actions and monitor for suspicious activity and failures.
6. Vulnerability and change management. We apply security updates to systems and dependencies, review code changes before they are released, keep development and production separate, and do not use real Customer Personal Data in development except where needed to resolve an issue.
7. Resilience and backup. We keep backups of production data, test our ability to restore them, and design the Services to recover from failures.
8. Incident response. We have a procedure to detect, assess, escalate, contain, notify and learn from security incidents, with the notification commitments in section 4.
9. Subprocessor management. We assess Subprocessors for security and data-protection practices before engaging them, and we bind them by contract.
10. Data minimisation and deletion. We collect and keep only what is needed for the Services, and we delete or return Customer Personal Data as section 8 describes.
11. Physical security. Our processing happens in the facilities of our infrastructure providers, which maintain physical access controls. We rely on them for physical security of the data centres.
12. Transfers. We assess the risks of international transfers and apply the safeguards in section 6.

Annex 3: Subprocessors

The list of Subprocessors is maintained at Subprocessors, and is incorporated into this DPA.