Data Processing Addendum

Version 1.2, 26 Oct 2026

Effective date: 27 October 2026. Last materially changed: 26 October 2026.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Sloan Software LLC, trading as Box Boss Repricer ("Provider") and the customer ("Customer"). It governs Provider's processing of Customer Data in providing the Service.

1. Definitions

• Customer Data: all data Provider fetches from Amazon with Customer's authorization or that Customer enters into the Service, including Amazon Information as defined in the DPP.
• Customer Personal Data: any Customer Data that identifies or could identify a natural person, such as Customer's own staff's details.
• Data Protection Law: the laws that apply to a party's processing, which may include the CCPA/CPRA and other US state privacy laws, the UK GDPR and Data Protection Act 2018, and the EU GDPR.
• Amazon Policies: the Amazon Solution Provider Portal Agreement, DPP and AUP as updated from time to time.
• Sub-processor: a third party Provider uses to process Customer Personal Data.
• Security Incident: any actual or reasonably suspected unauthorized access to, or loss, disclosure or alteration of, Customer Data.

2. Roles and instructions

2.1 Customer is the business / controller of Customer Personal Data and Provider is its service provider / processor. For Amazon Information, Customer is the Amazon selling partner that authorized Provider's application.

2.2 Provider processes Customer Data only (a) to provide the Service as described in the Terms and in Annex I, (b) on Customer's documented instructions given through the Service's settings or in writing, and (c) as Amazon Policies and the law require. Provider will tell Customer if it believes an instruction breaches Data Protection Law or Amazon Policies.

2.3 Purpose limits that cannot be changed by instruction. Provider will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with Customer; combine it with personal data from any other source except as the CCPA permits a service provider to; aggregate Customer Data with any other customer's data, or use any other customer's data to set Customer's prices (AUP 4.4, 4.6); use Customer Data to train or improve any artificial-intelligence or machine-learning model; use buyer personal data for anything other than merchant-fulfilled shipping, tax or legal purposes (AUP 4.1); or represent or speak on Amazon's behalf to any regulator or customer (DPP 1.6.3). Provider certifies that it understands these restrictions and will comply with them.

2.4 Provider will tell Customer promptly if it decides it can no longer meet its obligations under this DPA, and Customer may then suspend processing or terminate.

3. Confidentiality and staff

Provider limits access to Customer Data to the people who need it to provide the Service, binds them to confidentiality, logs every access to a customer's data, and shows Customer the access log for its account on request.

4. Security

Provider will maintain the technical and organizational measures in Annex II, which include: encryption in transit and at rest for Amazon credentials and tokens; multi-factor authentication offered and strongly recommended on all customer logins, and required on all staff logins; a web application firewall; one database and one process per customer; access logging; backups in a second region, restore-tested; a 15-minute screen lock on staff devices, and no Customer Data kept on staff devices; a written incident-response plan with a named incident contact; and annual review of sub-processors (DPP 1.1, 1.6, 2.8). Provider will not reduce the overall level of protection during the term.

5. Sub-processors

5.1 Customer authorizes the Sub-processors in Annex III. Provider will give Customer at least 30 days' notice by email before adding or replacing one; Customer may object in writing on reasonable data-protection grounds, and if the parties cannot resolve the objection Customer may terminate the affected Service with a pro rata refund of prepaid fees.

5.2 Provider binds each Sub-processor to data-protection terms no less protective than this DPA and remains responsible for its performance.

6. Security Incidents

6.1 Provider will notify Customer of a Security Incident affecting Customer Data without undue delay and in any case within 72 hours of becoming aware, with the information Customer needs to meet its own notification duties, and will update as facts emerge.

6.2 Where Amazon Information is involved Provider will also notify Amazon within 24 hours of detection as the DPP requires (DPP 1.6.3), and will cooperate with Amazon's and Customer's investigations.

6.3 Notification is not an admission of fault.

7. Assistance with data-subject requests and assessments

7.1 Provider will forward to Customer, within 5 business days, any request it receives from a data subject about Customer Personal Data, and will help Customer respond, including by deleting or exporting the data concerned.

7.2 Provider will give Customer reasonable assistance with data-protection impact assessments and regulator consultations that concern the Service, at no charge unless the request is excessive.

8. Retention and deletion

8.1 Buyer personal data. Provider does not request buyer personal data. If any reaches it, Provider deletes it no later than 30 days after order delivery (DPP 2.1).

8.2 Other Amazon Information: market observations (offers and prices seen) up to 90 days (detail emptied after 14 days); working decisions 35 days; each price sent with its rule 12 months; access logs 13 months (395 days); daily profit and sales totals while Customer subscribes, because Customer asks the Service to show that history (Provider's documented necessity under DPP 1.7); in each case unless the law requires longer.

8.3 On termination or at Customer's request, Provider deletes all Customer Data within 30 days (DPP 1.7) and sends Customer a copy on request during those 30 days, except the free-trial record (a one-way, keyed fingerprint derived from Customer's Amazon seller ID, not the seller ID itself, kept only to give each selling account one trial; see the Privacy Policy) and records the law requires (8.4), and confirms deletion in writing on request. Backups are purged on their normal cycle, no later than 60 days, and are not restored except for disaster recovery.

8.4 Provider may keep data the law requires it to keep (for example invoices for tax), under this DPA, and deletes it when the requirement ends.

9. Audits and Amazon's rights

9.1 Once a year, and after a Security Incident, Customer may ask Provider for written answers to a reasonable security questionnaire and copies of any third-party assessment Provider holds.

9.2 Amazon may audit Provider's handling of Amazon Information under the Amazon Policies (DPP 3); Customer agrees that Provider may disclose Customer Data to Amazon for that purpose and will cooperate where asked.

9.3 If a questionnaire does not resolve a reasonable concern, Customer may conduct an audit, on 30 days' notice, during business hours, no more than once a year, at its own cost, by itself or an independent auditor under confidentiality, without disrupting the Service or exposing other customers' data (which is in separate databases and processes).

10. International transfers

10.1 Customer Data is stored in the United States. Provider is operated from the United Kingdom.

10.2 Where Data Protection Law treats a transfer under this DPA as a restricted transfer from the UK, the UK International Data Transfer Agreement (ICO, version B1.0) is incorporated with the parties, data and measures in Annexes I-II; where from the EEA, the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) or Module Three (processor to sub-processor) as applicable, are incorporated, with the Annexes below as their annexes, Ireland as the competent supervisory authority and Irish law governing the clauses. This section applies only where such a transfer actually occurs.

11. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms. Nothing here limits a party's liability to data subjects or regulators where the law does not allow it.

12. Conflicts, term

This DPA prevails over the Terms where they conflict on data protection, and the Standard Contractual Clauses or the IDTA prevail over this DPA where incorporated. It lasts as long as Provider holds Customer Data.

Annex I. Processing details

Annex II. Technical and organizational measures

Encryption in transit (TLS 1.2+) and at rest for credentials and tokens; multi-factor authentication offered and strongly recommended on every customer login, and required on every staff login; Cloudflare web application firewall and rate limiting; one database file and one engine process per customer, with no code path that reads two customers' data; per-login access with least privilege (no shared logins), access logging retained 13 months (395 days); encrypted backups to a second region, restore-tested monthly; staff devices with a 15-minute screen lock, holding no Customer Data; patching of critical vulnerabilities within 7 days and of high-severity ones within 30 days; a written incident-response plan with a named incident-management contact; annual sub-processor review; a kill switch that stops all pushes fleet-wide; penetration test before the public Appstore listing and then annually.

Annex III. Sub-processors

Annex IV. CCPA service-provider terms (where the CCPA applies)

Provider is a service provider. Provider will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in Annex I, will not combine it with personal data from other sources except as permitted, will comply with the CCPA and give the same level of protection it requires, will notify Customer if it can no longer meet its obligations, and grants Customer the right to take reasonable steps to stop and remediate unauthorized use. Provider certifies that it understands these restrictions.