This Data Processing Addendum ("DPA") forms part of the applicable Master Services Agreement ("Agreement") between BelaStem, Inc. ("BelaStem") and Customer.
This DPA governs BelaStem's processing of Customer Data in connection with the StemTrackr™ platform, BelaStem Marketplace, Ask Rosie™, related APIs, integrations, operational workflows, and associated services.
1. Definitions
"Customer Data" means data, content, records, customer information, operational information, product information, shipment information, transaction information, and related materials submitted to the platform by Customer or on Customer's behalf.
"Processing" means collection, storage, organization, use, transfer, transmission, or other handling of Customer Data.
2. Customer Ownership of Data
Customer retains ownership of Customer Data. BelaStem processes Customer Data solely for purposes of:
- Providing the services
- Operating the platform
- Facilitating integrations
- Supporting Marketplace functionality
- Providing customer support
- Improving platform functionality
- Maintaining security and operational integrity
3. Customer Responsibilities
Customer represents and warrants that:
- Customer has the necessary rights and permissions to provide Customer Data to BelaStem
- Customer will comply with applicable privacy, export, labor, tax, and data protection laws
- Customer is responsible for the accuracy and legality of Customer Data
Customer remains responsible for:
- Communications with its customers
- Notices and consents required under applicable law
- Lawful use of Customer Data
4. BelaStem Responsibilities
BelaStem agrees to:
- Process Customer Data only as reasonably necessary to provide the services
- Implement commercially reasonable administrative, technical, and organizational safeguards
- Limit internal access to Customer Data to authorized personnel and service providers
- Maintain reasonable safeguards against unauthorized access, disclosure, or misuse
5. Subprocessors and Third-Party Providers
Customer acknowledges that BelaStem may utilize third-party providers and subprocessors in connection with the services, including:
- Cloud hosting providers
- Payment processors
- Shipping providers
- API providers
- Customer support tools
- Analytics providers
- AI and operational service providers
BelaStem shall take commercially reasonable steps to work with reputable providers appropriate for the nature of the services.
6. International Data Transfers
Customer acknowledges and agrees that:
- Customer Data may be transferred to and processed in the United States and other jurisdictions
- BelaStem may utilize infrastructure and service providers located outside Customer's country of residence
- International data transfers may occur as reasonably necessary to provide the services
Customer consents to such transfers and processing activities.
7. Confidentiality
BelaStem shall take commercially reasonable measures to ensure that personnel with access to Customer Data are subject to appropriate confidentiality obligations.
8. Data Retention and Deletion
During the term of the Agreement, BelaStem may retain Customer Data as reasonably necessary to provide the services. Upon termination of the Agreement, BelaStem may retain limited data:
- As required by law
- For legitimate operational or security purposes
- For backup and archival purposes
- As otherwise permitted under the Agreement
Customer may request export of Customer Data in a commercially reasonable format subject to the Agreement.
9. Security Incidents
In the event BelaStem becomes aware of a confirmed unauthorized access to Customer Data resulting from a security incident affecting BelaStem systems, BelaStem shall take commercially reasonable steps to:
- Investigate the incident
- Mitigate the effects
- Provide notice when reasonably appropriate under the circumstances
10. Limitation of Liability
This DPA is subject to the limitations of liability and disclaimer provisions contained in the applicable Agreement.
11. Order of Precedence
In the event of conflict between this DPA and the Agreement, the Agreement shall control unless expressly stated otherwise.
12. Modifications
BelaStem may update this DPA from time to time to reflect operational, legal, security, or regulatory changes. Continued use of the services following updates constitutes acceptance of the revised DPA.