Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") applies where your use of Picklett, operated by [Administrator to configure: registered legal entity name], causes Picklett to process personal data relating to visitors to your website ("shopper data") on your behalf. It supplements the Terms of Service and takes effect automatically when you use Picklett to publish or embed a product finder.

• You are the controller (or business) for shopper data collected through your finders. You decide what to collect and why.
• Picklett is the processor (or service provider) for that data and acts only on your instructions.
• Picklett is the controller of its own merchant account data — your email address, profile, plan and usage — which is covered by the Privacy Policy rather than this DPA.

2. Details of the processing

• Subject matter — providing the Picklett product finder service to you.
• Duration — for as long as your account is active, plus the retention periods described in the Privacy Policy.
• Nature and purpose — hosting your finder, generating recommendations from your rules, recording finder interaction events, and reporting analytics to you.
• Categories of data subjects — visitors to your website who use one of your finders.
• Categories of personal data — a randomly generated session identifier, answers selected, numeric inputs such as budget, completion status, recommended and clicked products, referrer information, and technical request data such as IP address processed by hosting infrastructure. Picklett does not require a shopper's name, email address or phone number for a standard finder.
• Special category data — Picklett is not designed for, and you must not use it to collect, special category or sensitive personal data.

3. Your obligations as controller

• Ensure you have a lawful basis and any required consent for the data collected through your finders.
• Provide your own privacy notice and cookie notice to your visitors, describing this processing.
• Only give Picklett instructions that comply with applicable data protection law.
• Do not put personal data about your customers into product content, question text or finder settings.

4. Picklett's obligations as processor

• Process shopper data only to provide the service, as instructed by you, and as permitted by applicable law.
• Not sell shopper data, and not share it for cross-context behavioural advertising or targeted advertising.
• Not use shopper data for our own independent purposes outside providing and securing the service.
• Keep shopper data confidential and limit access to personnel who need it to operate or support the service, subject to confidentiality obligations.
• Assist you, at your cost where the effort is substantial, with data protection impact assessments and with responses to regulators.

5. Security measures

Picklett applies the technical and organisational measures actually implemented in the product, including:

• Row-level database access rules that restrict every record to the account that owns it.
• Authentication handled by our authentication infrastructure, with password credentials not stored by Picklett in readable form.
• Encryption of data in transit using TLS.
• Privileged database keys held only on the server and never included in code delivered to browsers.
• Published finders exposing only the questions, design and recommendable products a shopper needs; drafts and analytics remain readable only by the owning account.
• Data minimisation by default — anonymous or pseudonymous shopper session identifiers rather than shopper contact details.

Picklett does not hold SOC 2, ISO 27001, PCI DSS, HIPAA or GDPR certification, and makes no such claim. The measures above are what has actually been implemented.

6. Subprocessors

You authorise Picklett to engage the following subprocessors:

• Lovable Cloud — application hosting, database, storage and authentication infrastructure.
• Google — only where a merchant chooses Google sign-in, and for serving web fonts on our own website.

Picklett will impose data protection obligations on subprocessors substantially equivalent to this DPA and remains responsible for their performance. We will give notice before adding a new subprocessor that processes shopper data, and you may object on reasonable data protection grounds; if the objection cannot be resolved, you may stop using the affected feature or terminate the affected subscription.

7. Data subject requests

If Picklett receives a request from one of your shoppers, we will not respond on your behalf beyond confirming that we act as a processor, and we will refer them to you where we can identify the relevant merchant.

Picklett will provide reasonable assistance so you can meet access, correction, deletion, restriction, objection and portability requests. Much of this can be done yourself: finder, product and analytics records are deletable from within the product.

8. Security incidents

Picklett will notify you without undue delay after becoming aware of a personal data breach affecting shopper data processed for you, and will provide the information reasonably available to us so you can meet your own notification obligations. We will take reasonable steps to contain and remediate the incident.

9. Deletion and return of data

You can delete finders, products and their associated interaction records from within the product at any time. On termination or on your written request, Picklett will delete shopper data processed for you, except where retention is required by law or genuinely necessary for the limited purposes described in the Privacy Policy. Routine backups expire on their own schedule.

10. International transfers

Shopper data may be processed in countries other than your own, including the United States. Where data is transferred out of the EEA, the UK or Switzerland, the parties rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum as applicable, which are incorporated into this DPA by reference, with Picklett as data importer and you as data exporter.

11. Compliance information and audits

On reasonable written request, and no more than once a year unless a regulator requires otherwise, Picklett will provide the information reasonably available to us about the measures described in this DPA so you can verify our compliance. Because Picklett holds no third-party audit certification, we cannot provide an audit report, and we will not permit on-site audits of shared infrastructure operated by our subprocessors.

DPA questions and signature requests can be sent to contact@picklett.com.