DATA PROCESSING AGREEMENT (DPA)

DATA PROCESSING AGREEMENT (DPA)

Last Updated: October 2025

  1. Purpose and Scope
This Data Processing Agreement forms part of the Terms & Conditions and Privacy Policy of Kitsify, a subsidiary of Immensity Group Business Development Services Corporation (“Controller”).It governs how personal data is processed when Users, Customers, Affiliates, or Partners interact with www.kitsify-shop.com and related systems operated by Kitsify and its authorized processors (“Processors”).
  1. Definitions
  • Controller: Kitsify, determining the purpose and means of processing.
  • Processor: Any third-party service (e.g., Shopify Inc., Shopify International Ltd., PayPal, analytics providers, or affiliates) acting on behalf of the Controller.
  • Personal Data: Any information that can identify an individual.
  • Processing: Any operation performed on Personal Data, including collection, storage, or deletion.
  1. Processing Purpose and Legal Basis
Kitsify processes personal data to:
  • Fulfill product purchases, affiliate payouts, and partner agreements.
  • Manage accounts, customer service, and marketing communications.
  • Comply with legal, accounting, and regulatory obligations.
Processing is lawful under:
  • Consent (e.g., marketing opt-ins, cookies).
  • Contract Performance (orders, payouts).
  • Legitimate Interest (fraud prevention, analytics).
  • Legal Obligation (tax, invoicing, compliance).
  1. Roles and Responsibilities
  • Kitsify ensures all Processors provide adequate safeguards.
  • Processors act only on Kitsify’s written instructions.
  • Kitsify maintains a record of processing activities and implements appropriate security measures.
  1. Data Types and Retention
Data may include: names, contact details, payment identifiers, affiliate identifiers, IP addresses, and site analytics.Retention follows business necessity or legal requirement (typically up to 5 years after last interaction) unless deletion is requested.
  1. Data Transfers and Sub-Processors
Personal Data may be transferred internationally to trusted partners such as Shopify (Headquartered in Canada) or Google LLC (USA).All transfers comply with applicable cross-border data-protection standards (GDPR adequacy or contractual safeguards).Kitsify maintains a list of sub-processors upon request.
  1. Security and Confidentiality
Both parties shall:
  • Implement administrative, physical, and technical security measures to protect data.
  • Restrict access to authorized personnel under confidentiality obligations.
  • Promptly report any suspected breach within 72 hours of awareness.
  1. Data Subject Rights
Users may:
  • Access, correct, or delete their personal data.
  • Withdraw consent.
  • Request portability of records.
Requests must be sent to hello@kitsify-shop.com, subject to verification.
  1. Breach Notification and Assistance
In the event of a data breach, Kitsify will:
  • Notify affected data subjects and regulators as required.
  • Provide timely information about the scope and mitigation measures.
Processors shall cooperate fully in any investigation.
  1. Term and Termination
This DPA remains effective while Kitsify processes personal data on behalf of Users or until all such data is deleted or returned upon termination of services.
  1. Governing Law
This DPA is governed by the laws of the Republic of the Philippines, with exclusive venue in the courts of Quezon City, Metro Manila.