# Merchant data-processing agreement Proposed processing terms and the information required to execute a Datool merchant agreement. **Proposed agreement, version 25 October 2026.** This document is available for review; publishing or reading it does not execute a contract. Contact **[vini@vinipace.com](mailto:vini@vinipace.com)** to complete the merchant schedule and accept the agreement in writing. Do not rely on this proposal as an already executed DPA. ## Parties and processing schedule [#parties-and-processing-schedule] The service provider is **Vinicius Pacheco Furtado, operating Datool in Rio de Janeiro, Brazil**. The merchant is the legal person identified in the written acceptance. The merchant is the controller, or an authorized processor acting for its controller; Datool processes merchant personal data on its behalf. The schedule agreed with each merchant must identify the service term, enabled features, data subjects, data categories, retention/deletion instructions, subprocessors, locations and any required international-transfer mechanism. Processing ordinarily includes receiving, storing, retrieving, transmitting and deleting support conversations, contact and order information, uploaded knowledge and associated agent execution records to provide the merchant's configured customer service. Subjects may include the merchant's customers, prospective customers and authorized personnel. The merchant must not instruct processing outside the agreed scope. Datool's independent account administration, payment, legal and security purposes are described in the [privacy policy](/docs/privacy). ## Instructions and confidentiality [#instructions-and-confidentiality] Datool will process merchant personal data only under the merchant's documented instructions, including this agreement and authorized feature configuration, unless applicable law requires otherwise. Where permitted, Datool will inform the merchant of a conflicting legal requirement before processing. Datool will inform the merchant if an instruction appears to violate applicable data-protection law. Datool will not sell the data, use it for advertising, or train its own AI models with it. Access will be limited to authorized people who need it for the agreed service and are subject to confidentiality obligations. The merchant is responsible for lawful collection, notices, permissions, its users' access and instructions, and its selection of suitable features and providers. ## Security and incidents [#security-and-incidents] Datool will implement measures appropriate to the agreed processing and risk and will document the applicable safeguards in the merchant schedule. That schedule must distinguish verified deployed controls from planned work. HTTPS, permission checks and credential encryption do not establish encryption of all stored data or backups. This agreement does not certify Datool under SOC 2 or promise a recovery time that has not been agreed and verified. Datool will notify the merchant without undue delay after becoming aware of a personal-data breach affecting merchant data, provide available information about the incident and mitigation, and supplement it as facts become available. Datool will assist the merchant with applicable notification, assessment and consultation obligations, taking account of the processing and information available to Datool. ## Subprocessors and transfers [#subprocessors-and-transfers] The merchant must authorize the applicable provider schedule before processing under this agreement. Datool will impose appropriate contractual data-protection obligations on subprocessors and remain responsible for their performance of those obligations. The [provider register](/docs/subprocessors) identifies infrastructure and optional connections; it does not show that every listed provider is used by every merchant. The advance-notice period and objection procedure for changes to subprocessors must be agreed in the merchant schedule before this proposal is executed. Datool will not treat a merchant's silence about this unfinished schedule as consent. If a justified objection cannot be resolved, the parties must agree an alternative or stop the affected processing and address return or deletion. The parties must identify and implement any required lawful transfer mechanism before a restricted international transfer. A link to a provider's terms is not a substitute for completing applicable transfer clauses, annexes or assessments. No EU-only, Brazil-only or other exclusive residency commitment is implied. ## Individual requests, return and deletion [#individual-requests-return-and-deletion] Datool will assist with requests to exercise data-protection rights and forward requests concerning merchant-controlled data to the merchant, except where law requires a direct response. Assistance and identity verification will be proportionate to the request and the information available. At the merchant's choice when processing ends, Datool will return or delete merchant personal data and remove remaining copies, except where law requires retention. The merchant schedule must set the supported completion period, export format, backup handling and verification process. Retained exceptions remain protected and restricted to their lawful purpose. Current [retention behavior](/docs/retention) does not supply a universal automatic deletion deadline. ## Evidence and acceptance [#evidence-and-acceptance] Datool will make information necessary to demonstrate the agreed obligations available and allow reasonable audits or inspections, with safeguards for other customers' information and service security. An audit report from a hosting provider is not a Datool audit report. For execution, both parties must record their legal identities, authorized contacts, date and acceptance of this version and the completed merchant schedule. This proposal does not replace mandatory law or establish that all requirements for a particular jurisdiction or Shopify review have been met.