Data processing agreement

Version 2026-11-02. This agreement is part of the Terms of service and is accepted with them. It governs, under Law L/2016/037/AN of the Republic of Guinea on cybersecurity and personal data protection, the processing of personal data that Sarif carries out on behalf of the Merchant.

1. Parties and purpose

• Controller: the Merchant who owns the account.
• Processor: SARIF DIGITAL SOLUTION, RCCM GN.TCC.2026.4.04097, Conakry, République de Guinée ("Sarif").

Sarif processes the personal data that the Merchant adds to the platform or that its customers provide in its store, solely to provide the Service.

2. Data and data subjects

• Data subjects: the Merchant’s customers and prospects, store visitors, people who contact it, subscribers and team members.
• Data: identification and contact details (name, email, phone), shipping and billing addresses, orders, payments (without full card data, which the payment provider handles), reviews, messages and aggregated technical browsing data.
• Operations: collection, recording, storage, consultation, modification, sending transactional emails, export and erasure.

3. Duration

For as long as the Merchant’s account is active. At the end, Sarif keeps the data for 30 days so the Merchant can export it and then deletes it, unless the law requires it to be kept, in which case it remains blocked.

4. Sarif’s obligations

Sarif undertakes to:

• Process the data only on the Merchant’s documented instructions, which result from using the platform and these terms, and to inform the Merchant if an instruction appears to infringe the law.
• Not use the data for its own purposes or disclose it to third parties, except to the listed sub-processors or where required by law.
• Ensure that authorised personnel are bound by confidentiality.
• Apply the security measures in section 6.
• Help the Merchant respond to data subject requests by providing tools to view, correct, export and delete data.
• Notify the Merchant without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting its data, with the information available.
• Assist the Merchant, where relevant, with impact assessments and consultations with the supervisory authority.
• Make available the information needed to demonstrate compliance with this agreement and allow reasonable audits, with prior notice and at the Merchant’s expense.

5. Sub-processors

The Merchant gives Sarif general authorisation to engage sub-processors for the following activities:

• Cloud infrastructure: database, authentication and file hosting.
• Network and security: content delivery, attack protection and custom domains.
• Sending transactional emails.

The up-to-date list of sub-processors, with their identity and location, is available to the Merchant and will be provided on request at contact@sarif.es. Sarif will give advance notice of any change to this list so the Merchant can object, will impose the same data protection obligations on sub-processors and will require an adequate level of protection when they process data outside Guinea.

The payment provider connected by the Merchant (for example PayPal) is not a Sarif sub-processor: the Merchant contracts it directly and it acts as an independent controller.

6. Security measures

• Encryption of communications (HTTPS/TLS) and passwords.
• Isolation of each store’s data through row-level security policies in the database and role-based access control (owner, admin, staff).
• Keys and secrets kept server-side only.
• Regular backups.
• Logging of relevant actions on orders and accounts.
• Periodic review of the measures.

7. Merchant’s obligations

• Inform its customers and obtain their consent where required, publishing its own privacy policy.
• Ensure the data it adds is lawful and adequate.
• Configure and use the platform in compliance with the law (for example, for marketing communications).

8. International transfers

Sarif is established in the Republic of Guinea. Some sub-processors may process data on servers located outside Guinea; in that case Sarif contractually requires adequate protection safeguards and applies technical measures such as encryption. If the Merchant is subject to another country’s data protection rules, they can ask at contact@sarif.es for the information they need to comply.

9. Liability

Each party is liable for its own breaches of data protection law. If Sarif processes the data for other purposes or breaches this agreement, it will be considered the controller of that processing.