Data Processing Agreement

Published: 15 September 2026

Version 2.0 — published 15 September 2026. Supersedes version 1.0 (5 August 2026) and applies to each Merchant from acceptance. Later versions take effect as Clause 21 provides.

This DPA takes effect for a merchant when incorporated into the Master Services Agreement at installation.

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Master Services Agreement ("MSA") between the parties. It governs the Processing of Shopper Personal Data by OBSESSION ECOMMERCE DATA TOOLS LTD on behalf of the Merchant in connection with the OB Session Personalization Shopify application. Capitalised terms not defined here have the meaning given in the MSA.

Parties

(1) Processor: OBSESSION ECOMMERCE DATA TOOLS LTD, a company registered in Cyprus with registration number HE 496073, registered office at Nikola Tsadioti, Pearl Park Block 6, Apartment 115, 8035 Paphos, Cyprus ("Processor", "OB Session", "we"); and

(2) Controller: the merchant that installs the OB Session application ("Merchant", "Controller", "you"), identified in the MSA / order form.

Effective Date: the date the Merchant installs the App or the MSA effective date, whichever is earlier.

Background

A. The Merchant operates a Shopify storefront (the "Store") and has installed the OB Session application (the "Service") — a behavioural recommendation engine that personalizes product recommendations, provides analytics and A/B testing, and attributes resulting orders.

B. In providing the Service, OB Session Processes Personal Data relating to visitors and shoppers on the Store ("Shoppers") on the Merchant's behalf.

C. In respect of that Shopper Personal Data, the Merchant is the Controller and OB Session is the Processor. This DPA sets out the terms required by Article 28(3) GDPR.

D. This DPA does not govern OB Session's Processing of the Merchant's own account-contact data (e.g. the shop owner's name and email received on install), for which OB Session is an independent controller under its Privacy Policy.

1. Definitions

"Applicable Data Protection Law" — all laws applicable to the Processing, including the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, and US state privacy laws including the CCPA/CPRA.

"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Supervisory Authority" — as defined in the GDPR.

"Special Category Data" — the special categories of personal data under Article 9 GDPR: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership; and genetic data, biometric data used to uniquely identify a person, data concerning health, and data concerning a person's sex life or sexual orientation. Comparable data is treated as "sensitive personal information" or "sensitive data" under US state privacy laws (e.g. CCPA/CPRA).

"EU SCCs" — the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914.

"Restricted Transfer" — a transfer of Personal Data to a country without an adequacy decision under Applicable Data Protection Law.

"Shopper Personal Data" — the Personal Data of Shoppers Processed by OB Session on the Merchant's behalf, as described in Annex 1.

"Sub-processor" — a third party engaged by OB Session to Process Shopper Personal Data.

"UK Addendum" — the ICO's International Data Transfer Addendum to the EU SCCs (version B1.0).

The Annexes form part of this DPA.

2. Roles and scope

2.1 In respect of Shopper Personal Data, the Merchant is the Controller and OB Session is the Processor. Each party complies with its obligations under Applicable Data Protection Law.

2.2 The subject-matter, duration, nature and purpose of the Processing, the categories of Data Subjects, and the types of Personal Data are set out in Annex 1.

2.3 Pseudonymous, minimised. The Service is designed to Process only pseudonymous Personal Data. It does not Process directly-identifying information (names, emails, phone numbers, addresses) or payment or credential data, and it is not designed to Process Special Category Data, subject to the assessment and exclusions in Clause 14. OB Session does not request or store any customer-identifying field, and does not retrieve the Merchant's customer records. The Service does associate a pseudonymous visitor identifier with an order ID where an order is attributed to a recommendation (Annex 1); that association is Shopper Personal Data and is Processed under this DPA. The categories Processed are in Annex 1.

3. Processing instructions

3.1 Documented instructions. OB Session Processes Shopper Personal Data only on the Merchant's documented instructions, including with regard to transfers of Personal Data to a third country. Those instructions are constituted by the MSA, this DPA, any Order Form, and the Service configuration recorded for the Store in the App admin — which forms part of Annex 1 for that Merchant — unless OB Session is required to Process by law (in which case it informs the Merchant first, unless legally prohibited).

3.2 Merchant responsibilities. The Merchant warrants that: (a) it has a valid lawful basis and has provided all notices and obtained all consents required for the Processing — including any consent required for the Service to set or read identifiers on a Shopper's device, configured through the Merchant's consent framework; (b) its instructions comply with Applicable Data Protection Law; and (c) it is responsible for the accuracy and legality of the data and the means by which it was obtained.

3.3 Unlawful instructions. OB Session informs the Merchant without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected Processing until the instruction is confirmed or amended.

3.4 Consent gating. The Service collects Shopper Personal Data from the Store's pages only where Shopify's Customer Privacy API reports that the processing is permitted for that Shopper. That signal reflects the Store's own customer privacy settings: in a region the Merchant has configured to require consent, the API reports that non-essential processing is not permitted until the Shopper gives consent; in a region not so configured, it reports that processing is permitted by default. Where the Customer Privacy API is unavailable or returns no signal, the Service does not collect. Order records are read through Shopify's Admin API rather than from the storefront and are not gated by this signal; they are read for every order the Store receives while the App is installed (Annex 1).

Withdrawal. Where the consent signal for a Shopper changes so that processing is no longer permitted, the Service stops collecting for that Shopper and ceases to set or read its identifiers. Records already collected expire under Annex 4 and are deleted earlier on the Merchant's instruction under Clause 8.4.

The Merchant's settings. Configuring the Store's customer privacy settings — including which regions require consent and how consent is collected — and disclosing the Processing in the Store's own privacy notice, are the Merchant's responsibilities as Controller (Clause 3.2).

3.5 Duration of collection. Collection of Shopper Personal Data runs for as long as the App is installed and the OB Session storefront extension is enabled in the Store's theme, subject to Clause 3.4. It is not conditional on recommendations being served: where the Merchant switches a recommendation surface off in the App, that surface stops serving to Shoppers, and collection continues. Disabling the OB Session storefront extension in the Store's theme stops all storefront collection; order records continue to be read through the Admin API until the App is uninstalled. Uninstalling the App stops all collection (Clause 12).

3.6 Model development. The Merchant instructs OB Session to use Shopper Personal Data, including order records, to develop, train, evaluate and improve the models underlying the Service — including models trained on data from more than one store and used to serve merchants generally. OB Session does so subject to Clause 9.5 of the MSA: no other merchant has access to or visibility of the Merchant's data, and no model serving another merchant reproduces or exposes the Merchant's catalog, products or Shoppers. This Processing remains subject to this DPA, including the retention schedule in Annex 4. Where a Merchant does not wish its data to be used in models serving other merchants, the Parties may agree that in an Order Form, which prevails over this Clause for that Merchant.

4. Confidentiality

OB Session ensures that persons authorised to Process Shopper Personal Data are bound by confidentiality and that access is limited, on a least-privilege basis, to personnel who require it.

5. Security

Taking into account the state of the art and the risk, OB Session implements and maintains the technical and organisational measures in Annex 2 (Article 32 GDPR). OB Session may update those measures provided the overall level of security is not materially reduced, and will notify the Merchant of any material change.

6. Sub-processors

6.1 General authorisation. The Merchant authorises OB Session to engage the Sub-processors listed in Annex 3.

6.2 Flow-down and liability. OB Session imposes data-protection obligations on each Sub-processor no less protective than this DPA, and remains fully liable to the Merchant for each Sub-processor's performance.

6.3 Changes. OB Session gives the Merchant at least 30 days' prior notice of any intended addition or replacement of a Sub-processor, by email to the Merchant's notice contact and by publishing an updated version of this DPA with a revised Annex 3. The Merchant may object on reasonable, documented data-protection grounds; if the parties cannot resolve the objection, the Merchant may, as its sole remedy, terminate the affected part of the Service without penalty.

7. International transfers

7.1 OB Session is EEA-established. OB Session is established in the European Economic Area (Cyprus). The Merchant's engagement of OB Session as Processor does not, of itself, involve a transfer of Personal Data to a third country.

7.2 Hosting and the AWS transfer. The Service is hosted on Amazon Web Services. The default region is the United States (us-east-1); hosting in an AWS region in the European Union is available on request and, where agreed, is recorded in the Service configuration for the Store (Clause 3.1). OB Session contracts with Amazon Web Services EMEA SARL, which is established in the EEA, so OB Session's engagement of AWS is not itself a Restricted Transfer. Where the Service runs in a US region, the Restricted Transfer is the onward transfer from Amazon Web Services EMEA SARL to Amazon Web Services, Inc., governed by the AWS data processing agreement and relying on AWS's certification to the EU-US Data Privacy Framework (with the UK Extension for UK Data Subjects) and/or the EU SCCs with the UK Addendum, as set out in Annex 5. OB Session instructs that hosting and remains liable to the Merchant for AWS's Processing under Clause 6.2. If the adequacy decision for the EU-US Data Privacy Framework ceases to apply, OB Session will, within 30 days, either migrate the affected Processing to an AWS region in the European Union or confirm to the Merchant the alternative transfer safeguard on which it relies.

7.3 EU/EEA residency. Where Shopper Personal Data is hosted in an AWS region in the EU, no transfer to a third country occurs.

8. Data subject rights assistance

8.1 Taking into account the nature of the Processing, OB Session assists the Merchant, by appropriate measures and insofar as possible, in responding to Shopper requests under Chapter III GDPR. If OB Session receives a request directly from a Shopper, it forwards it to the Merchant and does not respond itself (beyond confirming the Merchant is the Controller).

8.2 Mandatory Shopify webhooks. OB Session subscribes to and honours the mandatory compliance webhooks:

  • shop/redact — within 30 days of app uninstallation, OB Session deletes all of the Merchant's data across all systems, subject only to records OB Session is required by law to retain (Annex 4), with deletion propagating to backups as Annex 4 provides;
  • customers/redact — OB Session deletes the order records identified by the order IDs in the request, together with the attribution records linking those orders to a pseudonymous visitor identifier, except that where an order record is the evidential basis of a Fee charged to the Merchant the financial fields are retained as Annex 4 provides. Where the Merchant instructs it to do so, OB Session also deletes the behavioural records associated with that identifier (Clause 8.4); otherwise those records expire under the retention schedule (Annex 4);
  • customers/data_request — OB Session responds within the timeframe Shopify requires. It holds no customer-identifying fields, so it cannot locate records from a name or an email address; where the request identifies specific orders it returns the order-level records it holds for those order IDs, and, on the Merchant's instruction, the behavioural records associated with the pseudonymous identifier linked to those orders (Clause 8.4).

8.3 Identification (Articles 11 and 28(3)(e) GDPR). OB Session holds no customer-identifying field and cannot, from its own records alone, connect Shopper Personal Data to a named individual. It is not obliged to acquire, maintain or Process additional information solely to identify a Data Subject. That limitation is about the information OB Session holds, not about its willingness to assist: where the Merchant, or a Data Subject under Article 11(2) GDPR, supplies an order ID or a pseudonymous visitor identifier, OB Session can locate the associated records and will act on them under Clause 8.4.

8.4 Export and deletion by identifier. On the Merchant's written instruction, and within 30 days, OB Session exports or deletes the Shopper Personal Data associated with an order ID or a pseudonymous visitor identifier supplied by the Merchant, and confirms in writing when it has done so. Exports are provided in a structured, commonly used, machine-readable format.

9. Assistance with security, breach and impact assessments

Taking into account the nature of Processing and the information available to it, OB Session assists the Merchant in complying with its obligations under Articles 32 to 36 GDPR (security, breach notification and communication, data protection impact assessments, and prior consultation).

10. Personal Data Breach

10.1 OB Session notifies the Merchant without undue delay after becoming aware of a Personal Data Breach affecting Shopper Personal Data, and in any event both within 72 hours and in sufficient time to allow the Merchant to meet its own obligation under Article 33(1) GDPR.

10.2 The notification describes, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. OB Session cooperates so the Merchant can meet its Article 33/34 obligations. Notification is not an admission of fault.

11. Audits

11.1 OB Session makes available to the Merchant all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Merchant or by another auditor mandated by the Merchant, subject to this Clause.

11.2 Documentation first. In the first instance OB Session satisfies a request under Clause 11.1 by providing its security-questionnaire responses, its policies, the description of its measures in Annex 2, and the certifications held by its Sub-processor in respect of the infrastructure on which the Service runs. OB Session is not itself certified to SOC 2 or ISO 27001; its Sub-processor's certifications cover the infrastructure layer only and are not a substitute for the measures for which OB Session is responsible.

11.3 Audit. Where that documentation does not enable the Merchant to verify compliance, the Merchant, or an auditor it mandates, may audit OB Session — no more than once per 12 months (except following a Personal Data Breach or where a Supervisory Authority requires it), on 30 days' notice, under confidentiality, and at the Merchant's cost unless a material non-compliance is found. Because OB Session operates no premises at which Shopper Personal Data is hosted or accessed other than the remote working locations of its personnel, audits are conducted remotely — by video, screen-share and interview, including of the systems, access controls, retention jobs and consent-gating logic for which OB Session is responsible. Where a Supervisory Authority requires an on-site element, OB Session cooperates. Nothing in this Clause limits a Supervisory Authority's rights.

12. Retention, deletion and return

12.1 During the term. Shopper Personal Data is retained per the schedule in Annex 4.

12.2 On termination. On expiry or termination, OB Session, at the Merchant's choice, deletes or returns all Shopper Personal Data and deletes existing copies within 30 days — with deletion propagating to backups as Annex 4 provides — unless retention is required by law. Any return is provided in a structured, commonly used, machine-readable format. Uninstalling the App triggers shop/redact and deletion (Clause 8.2), so a Merchant that wants its data returned should request the return before uninstalling; on request, OB Session will confirm deletion in writing.

12.3 Aggregated/anonymised data. Data rendered aggregated or anonymous such that it can no longer be linked to any device or Shopper is not Personal Data and may be retained and used to develop, maintain, and improve the Service. OB Session does not attempt to re-identify such data.

13. US state law — service provider

In respect of Shopper Personal Data relating to US residents, OB Session acts as a "service provider" under the CCPA/CPRA (and an equivalent role under comparable state laws). OB Session: (a) Processes the data only for the business purposes set out in this DPA and the MSA, and not for its own commercial purposes; (b) does not "sell" or "share" the data; (c) does not retain, use, or disclose the data outside the direct business relationship with the Merchant; and (d) certifies that it understands and will comply with these restrictions. OB Session may retain and use de-identified data in accordance with Clause 12.3; it does not attempt to re-identify de-identified data.

14. Special Category Data

14.1 The Service is not designed to Process Special Category Data. The Parties acknowledge that the data Processed — including the products and collections a Shopper views, and store search terms — could reveal Special Category Data in a store whose catalogue includes goods that disclose health, religious or philosophical beliefs, or sex life or sexual orientation.

14.2 Notification and exclusion. The Merchant tells OB Session before setup if any page, collection or placement in the Store would cause Special Category Data to be Processed, and tells OB Session if its catalogue changes such that this becomes the case. The Parties then agree in writing not to run the Service on that page, collection or placement, and OB Session does not do so.

14.3 The Merchant remains responsible, as Controller, for establishing any condition required under Article 9 GDPR where Special Category Data is nonetheless in scope. On becoming aware that Special Category Data is being Processed outside the agreed exclusions, OB Session notifies the Merchant without undue delay, and may suspend the affected Processing.

15. Liability

15.1 Each party's liability under this DPA is subject to the exclusions and limitations of liability in the MSA. If, when a liability arises, no MSA containing an aggregate liability cap is in force, each party's aggregate liability under this DPA shall not exceed the fees paid or payable for the Service in the 12 months preceding the event giving rise to the liability.

15.2 Nothing limits liability that cannot be limited under Applicable Data Protection Law, including liability to Data Subjects under Article 82 GDPR.

16. Term

This DPA takes effect on the Effective Date and continues while OB Session Processes Shopper Personal Data on the Merchant's behalf. Clauses that by their nature should survive (including Clauses 12, 13 and 15) survive termination.

17. Order of precedence

In a conflict between this DPA and the MSA, this DPA prevails on the Processing of Shopper Personal Data. Where a Service configuration is recorded for the Store under Clause 3.1, or an Order Form records a different configuration, that record prevails over the default configuration described in Annex 1 for that Merchant. The cross-border-transfer safeguards for the AWS transfer are those in OB Session's agreement with AWS (Clause 7 / Annex 5).

18. Governing law

This DPA is governed by the laws of the Republic of Cyprus, and the courts of Cyprus have exclusive jurisdiction, save where Applicable Data Protection Law or the EU SCCs require otherwise.

19. Notices

Data-protection notices to OB Session — including legal and DPA correspondence, security and sub-processor inquiries, and data-subject and privacy matters — go to legal@ob-session.com. Notices to the Merchant: the contact associated with the Store / Shopify record (MSA Clause 21.2).

20. General

20.1 This DPA, with the MSA and its Annexes, is the entire agreement on the Processing of Shopper Personal Data.

20.2 This DPA may be executed electronically (including by click-acceptance on installation) and in counterparts.

21. Variation

21.1 OB Session may update this DPA on 30 days' notice given both in the app admin and by email to the Merchant's notice contact. The notice identifies the changes. Where a change materially reduces the protection given to Shopper Personal Data, or materially expands the categories of data Processed or the retention applied to them, the Merchant may object within the notice period; if the Parties cannot resolve the objection, the Merchant may terminate the Service without penalty and OB Session deletes the Shopper Personal Data under Clause 12.2.

21.2 A Service configuration recorded for the Store under Clause 3.1, or recorded in an Order Form, is varied only by written agreement between the Parties.

Acceptance

This DPA requires no handwritten signature. It is incorporated into the Master Services Agreement and is accepted by the Merchant electronically, together with the MSA, when the Merchant accepts those agreements in the OB Session app (Clause 20.2). OB Session accepts by making the Service available to the Merchant.

OB Session records the accepting Merchant, the version of this DPA accepted, and the date and time of acceptance; that record is available to the Merchant in the app admin and is the evidence of execution for the purposes of this DPA.

Annex 1 — Details of the Processing

Subject matter: provision of the OB Session behavioural recommendation Service on the Merchant's Store, including building and operating the recommendation models serving the Merchant's Store, generating and serving personalized recommendations, attributing resulting orders, and measuring performance through analytics and A/B testing.

Duration: the term of the Merchant's use of the Service, plus the deletion periods in Clause 12 / Annex 4.

Nature and purpose: automated collection and analysis of pseudonymous behavioural signals to build and operate the recommendation models serving the Merchant's Store — including, where one is trained, a machine-learning model specific to that Store — to generate and serve personalized recommendations, and then to measure their performance through analytics and A/B testing; the development, training, evaluation and improvement of the models underlying the Service, including models trained on data from more than one store (Clause 3.6); and the derivation of aggregated, de-identified statistics that are no longer Personal Data (Clause 12.3). No automated decision-making producing legal or similarly significant effects (Article 22 GDPR) is performed.

Categories of Data Subjects: visitors to, and shoppers on, the Store for whom the Customer Privacy API reports that processing is permitted (Clause 3.4), and shoppers whose orders are read through the Admin API.

Place of Processing: AWS regions in the United States (default: us-east-1) or, where agreed and recorded in the Service configuration for the Store, in the European Union. See Clause 7 and Annex 5.

Categories of Shopper Personal Data:

  • Pseudonymous identifiers — randomly generated identifiers distinguishing the visitor, the session, and the parts of the page involved in an interaction; never linked to a customer account; scoped to a single store.

  • Interaction and behavioral signals — page/product views, clicks, hovers, scrolling, cursor movement, product-card visibility, viewport dimensions, add-to-cart/remove actions.

  • Content and commerce context — products/collections viewed, cart contents and amounts, the placement where a recommendation was shown (e.g. a widget or the product-listing grid), and attributes of the merchant's catalog elements (titles, prices, labels).

  • Navigation and traffic context — page type, navigation path (path-only URLs; query strings are discarded, apart from pagination and filter state), referrer, campaign (UTM) parameters.

  • Search signals — store search terms.

  • Device and locale characteristics — user agent, language, time zone, platform, screen size.

  • Order records (billing, attribution and model training) — order ID, date, currency, amounts, line items (with product/variant references and attribution flags), and a test flag. No customer fields (name, email, phone, address, or Shopify customer ID) are requested or stored. These records are read through Shopify's Admin API and are not gated by the Customer Privacy API, which governs storefront collection only.

  • Attribution records — the association between a pseudonymous visitor identifier and an order ID where an order is attributed to a recommendation, used to compute the Attribution Fee and to measure performance.

From the above, the Service derives behavioural signals and product-recommendation inferences. Those derived signals are Shopper Personal Data and are retained and deleted as Annex 4 provides; the internal feature set is not itemised in this Agreement.

Derived statistics that are not Personal Data: aggregated statistics rendered anonymous to the standard in Clause 12.3, which contain no identifiers, no product references and no Merchant- or Shopper-identifiable information.

Identifier configuration (default). A persistent pseudonymous visitor identifier (first-party cookie and localStorage, retained up to 365 days on a rolling basis), together with a session identifier and a per-tab window identifier. The 365-day period is the period over which a returning visitor's earlier behaviour continues to improve the recommendations served to that visitor. It is reviewed annually.

Identifier configuration (alternatives). A shorter-lived configuration — a session-only identifier, or one cleared when the tab closes — may be agreed in writing with the Merchant. Where agreed, it is recorded in the Service configuration for the Store in the App admin, which forms part of this Annex 1 for that Merchant (Clause 3.1), and the first, third and sixth rows of Annex 4 shorten to the life of the session or the tab accordingly.

Excluded pages, collections and placements: as agreed in writing between the Parties under Clause 14.2, if any.

Special Category Data: not Processed, subject to the assessment and exclusions in Clause 14.

Frequency of transfer: continuous, for the duration of the Service.

Annex 2 — Technical and organisational measures

(These are the measures OB Session commits to contractually; a plain-language overview is published at ob-session.com/security.)

  • Consent gating — storefront collection runs only where Shopify's Customer Privacy API reports that the processing is permitted for that Shopper, and does not run where that signal is absent (Clause 3.4).
  • Pseudonymisation and minimisation by design — randomly generated identifiers; no customer-identifying fields requested; order queries restricted to financial and attribution fields; URLs recorded path-only.
  • Encryption — in transit (TLS) on all public endpoints and the event pipeline; at rest (AES-256) for databases, storage and backups.
  • Access control — least-privilege access restricted to personnel who require it; secrets managed via a managed secrets store; access events logged.
  • Tenant isolation — all data keyed by store; a model trained for one Merchant is never applied to another; shop-level purge deletes across all tables.
  • Resilience / fail-safe — if a recommendation cannot be served within the time limit, the Merchant's default content is served, so a Service interruption cannot break a page or checkout.
  • Operational security — environment separation between development and production; dependency management and patching.
  • Retention enforcement — deletion on a defined schedule per Annex 4.
  • Breach management — procedures to detect, investigate, mitigate and notify Personal Data Breaches per Clause 10.

Annex 3 — Sub-processors

Sub-processor Role / service Location Transfer mechanism
Amazon Web Services EMEA SARL (Luxembourg, EEA) Sole cloud-infrastructure provider. All OB Session Processing runs on AWS-native services — compute, object storage, database, managed streaming and managed machine learning. Default: United States (us-east-1). An AWS region in the European Union is available on request and, where agreed, is recorded in the Service configuration for the Store (Clause 3.1). Engaging AWS EMEA SARL is not itself a Restricted Transfer. For US hosting, the onward transfer to Amazon Web Services, Inc. relies on the EU-US Data Privacy Framework and/or the EU SCCs with the UK Addendum (Annex 5).

This Annex is the current Sub-processor list. It is published as part of this DPA at ob-session.com/legal/dpa, and changes to it are notified under Clause 6.3.

OB Session engages no other Sub-processor, and does not send Shopper Personal Data to any third-party or third-party-hosted model API. Individual AWS services are components of a single Sub-processor and are not listed separately.

Shopify is the platform on which the App runs and is an independent party with its own agreement with the Merchant; it is not a Sub-processor of OB Session.

This Annex concerns the Processing of Shopper Personal Data by the App only. Processors engaged for the ob-session.com marketing website are a separate matter and are described in the website privacy policy at ob-session.com/privacy.

Annex 4 — Retention schedule

Maximum periods. Where a shorter-lived identifier configuration has been agreed under Annex 1, the first, third and sixth rows shorten accordingly.

Data Retention
Recommendation state — the pseudonymous record of a visitor's activity used to personalize their visits, and the current cart Up to 365 days
Behavioural event data and A/B measurements, including A/B test assignments Up to 12 months (rolling)
Derived behavioural signals and product-recommendation inferences relating to a pseudonymous identifier Up to 365 days
Attribution records (pseudonymous visitor identifier ↔ order ID) Up to 12 months, and deleted on a customers/redact request for the order
Order records (billing, attribution and model training; no customer fields) Up to 24 months, or earlier on a customers/redact request. Where an order record is the evidential basis of a Fee charged to the Merchant, the financial fields are retained for the period required by applicable accounting and tax law
On-device identifiers (cookie / localStorage) Up to 365 days for the visitor identifier; the session identifier expires after 60 minutes of inactivity or with the session, and the per-tab identifier is cleared when the tab closes
On-device consent state and pending-event queue Consent state: until the Shopper's consent signal changes or the identifier expires. Pending-event queue: cleared when the events are sent, and discarded if not sent within 7 days
Infrastructure access logs (may contain IPs) Up to 30 days
Application access logs (records of access to Shopper Personal Data by OB Session personnel) Up to 12 months
Merchant catalog/config and model artefacts While installed; deleted on shop/redact

Deletion extends to backups on the next backup cycle, and in any event within 35 days of the deletion being actioned. All Merchant data is deleted on shop/redact following uninstallation. Aggregated or anonymised data may be retained (Clause 12.3). Where OB Session is required by law to retain a record beyond the period above, it retains only that record, only for as long as required, and informs the Merchant on request.

Annex 5 — Cross-border transfers

OB Session is established in the EEA (Cyprus), so the Merchant's engagement of OB Session as Processor is not itself a Restricted Transfer (EDPB Guidelines 05/2021). OB Session's Sub-processor, Amazon Web Services EMEA SARL, is also established in the EEA (Luxembourg), so the engagement of that Sub-processor is likewise not a Restricted Transfer.

A Restricted Transfer arises where Shopper Personal Data is hosted on AWS infrastructure in the United States, which is the default (Clause 7.2). It takes the form of an onward transfer from Amazon Web Services EMEA SARL to Amazon Web Services, Inc. OB Session is the party instructing that hosting and remains fully liable to the Merchant for it (Clause 6.2). The transfer is governed by OB Session's data processing agreement with AWS and relies on:

  • AWS's certification to the EU-US Data Privacy Framework — and the UK Extension for UK Data Subjects (AWS is also certified to the Swiss-US DPF); and/or
  • the EU SCCs (Commission Implementing Decision (EU) 2021/914), Module Three (Processor-to-Processor), with the UK Addendum (B1.0) where UK Data Subjects are in scope, as incorporated into the AWS agreement.

Where Shopper Personal Data is hosted in an AWS region in the EU (Clause 7.3), no such transfer occurs. OB Session provides a copy of the relevant transfer instrument on request at legal@ob-session.com. If the adequacy decision for the EU-US Data Privacy Framework ceases to apply, Clause 7.2 applies.