Data Processing Addendum

Parties

• Controller: The seller or tenant (you)
• Processor: CartFlow

Subject matter

Processing of buyer, order, cart, and payment data through CartFlow for checkout, shared carts, deliveries, wallet, and related seller services.

Categories of data subjects

Sellers, buyers, cart participants, and authorised team members.

Types of personal data

Contact details, cart and order records, checkout activity, delivery addresses, payment status, phone numbers for M-Pesa, and integration metadata.

Processor obligations

CartFlow shall:

• Process data only on documented instructions
• Ensure confidentiality of personnel
• Implement appropriate technical and organisational measures
• Assist with data subject requests where feasible
• Notify of personal data breaches without undue delay
• Delete or return data on termination subject to legal retention
• Use subprocessors with appropriate safeguards

Subprocessors

Listed at /subprocessors. We will notify sellers of material changes.

International transfers

Transfers use appropriate safeguards including contractual protections where required.

Acceptance

By creating a seller account, enabling seller tools, or checking "I accept the DPA" during onboarding, you agree to this Addendum. Contact support@bizclinic.africa with questions.