Data Processing Agreement (DPA)

This Data Processing Agreement (this “DPA”) sets out the terms under which ZEONE Inc. (“ZEONE”) processes Customer Data on behalf of Users in connection with ShopIndex (the “Service”) provided by ZEONE. This DPA forms part of the ShopIndex Terms of Service (the “Terms”) and takes effect between ZEONE and a User when the User agrees to the Terms. Unless otherwise defined in this DPA, capitalized terms have the meanings given in the Terms.

1. Definitions

In this DPA, the following terms have the meanings below.

• “Applicable Data Protection Laws” means the laws and regulations on the protection of personal information that apply to the processing of Customer Data, including the Act on the Protection of Personal Information of Japan (the “APPI”) and the laws of other countries and regions.
• “Customer Data” means Customer Data (as defined in the Terms) that ZEONE processes on behalf of a User in providing the Service.
• “Processing” means any operation performed on Customer Data, including collecting, recording, storing, modifying, using, providing, and deleting it.
• “Data Subject” means an individual who is identified or identifiable by Customer Data.
• “Sub-processor” means a third party to which ZEONE entrusts all or part of the Processing of Customer Data.
• “Personal Data Breach” means a leak, loss, or damage of, unauthorized disclosure of, or unauthorized access to Customer Data processed by ZEONE or a Sub-processor, or any other incident affecting the security of Customer Data.

2. Scope and order of precedence

1. This DPA applies to all Users, regardless of the country in which they are located.

2. If this DPA and the Terms differ on the Processing of Customer Data, this DPA prevails.

3. Roles of the parties

1. For purposes of the APPI, the User entrusts the Processing of Customer Data to ZEONE, and ZEONE acts as the User’s entrusted service provider. Where Applicable Data Protection Laws distinguish between controllers and processors, the User is the controller (or, where the User itself acts as a processor, a processor) and ZEONE is the processor (or sub-processor).

2. If the User itself has been entrusted by a third party with the Processing of Customer Data, ZEONE processes the Customer Data in accordance with this DPA as the User’s sub-processor. In that case, the User warrants that it has obtained any necessary authorization from that third party for the terms of this DPA.

3. The subject matter, duration, nature, and purpose of the Processing of Customer Data, the types of personal data, and the categories of Data Subjects are set out in Annex 1.

4. Processing on the User’s instructions

1. ZEONE processes Customer Data only on the User’s documented instructions. The Terms, this DPA, and the User’s settings and actions in the Service (including connecting Connected Services and exporting and deleting data) constitute the User’s documented instructions.

2. Notwithstanding the preceding paragraph, ZEONE may process Customer Data to the extent required by applicable law. In that case, ZEONE will notify the User before the Processing, unless the law prohibits this.

3. If ZEONE believes that an instruction from the User violates Applicable Data Protection Laws, ZEONE will notify the User immediately.

4. ZEONE processes Customer Data only to provide the Service to the User and does not process it for any other purpose, including ZEONE’s own advertising or marketing or providing services to other Users. ZEONE does not sell Customer Data, use it for third-party advertising or other marketing, or use it to train AI models.

5. User’s obligations

1. The User warrants that it has the legal basis required under Applicable Data Protection Laws for processing Customer Data in the Service, and that it has notified Data Subjects, described the processing in its privacy policy, and completed any other required steps.

2. The User will not submit, or cause the Service to process, any special care-required personal information.

6. Confidentiality

ZEONE ensures that its personnel authorized to process Customer Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality. ZEONE limits access to Customer Data to personnel who need it to provide and maintain the Service and to prevent misuse.

7. Security control measures

1. Taking into account the nature, scope, context, and purposes of the Processing of Customer Data and the risks to the rights and interests of Data Subjects, ZEONE implements the technical and organizational security control measures set out in Annex 2.

2. ZEONE may update its security control measures as technology advances. However, no update will lower the overall level of security.

8. Sub-processors

1. The User gives ZEONE general authorization to entrust the Processing of Customer Data to the Sub-processors listed in Annex 3.

2. If ZEONE adds or replaces a Sub-processor, ZEONE will notify the User at least 30 days in advance by posting a notice in the Service, sending a notice to the registered email address, or another appropriate method.

3. The User may object to the addition or replacement, with reasonable grounds, within 30 days of receiving the notice described in the preceding paragraph. In that case, ZEONE and the User will discuss the matter in good faith. If the matter is not resolved through discussion, the User may stop using the Service by closing its account.

4. ZEONE enters into a written agreement with each Sub-processor that provides the same level of protection as this DPA, and supervises each Sub-processor as necessary and appropriate.

5. ZEONE is responsible for the Processing of Customer Data by its Sub-processors to the same extent as for its own Processing.

9. Assistance with Data Subject requests

1. Taking into account the nature of the Processing, ZEONE will assist the User, to the extent possible and through appropriate technical and organizational measures, in responding to requests from Data Subjects to exercise their rights, including requests for disclosure, correction, deletion, restriction of Processing, data portability, and objection.

2. If ZEONE receives a request directly from a Data Subject, ZEONE will forward the request to the User and will not respond to it without the User’s instructions, except to tell the Data Subject that the request should be made to the User.

3. If ZEONE receives a request through a Connected Service to disclose or delete data about a Data Subject or a store, ZEONE will handle it in accordance with the rules of the Connected Service and the Terms.

10. Notification of Personal Data Breaches

1. If ZEONE becomes aware of a Personal Data Breach, ZEONE will notify the User without undue delay.

2. The notice described in the preceding paragraph will include the following information, to the extent known. Any information not yet known will be provided as soon as it becomes known.

• The nature of the Personal Data Breach (including the categories and approximate number of Data Subjects concerned, and the types of Customer Data and the approximate number of records concerned)
• ZEONE’s point of contact
• The likely consequences of the Personal Data Breach
• The measures ZEONE has taken or plans to take (including measures to mitigate possible adverse effects)

3. ZEONE will provide reasonable assistance to the User in reporting to supervisory authorities and notifying Data Subjects (including under Article 26 of the APPI).

4. ZEONE’s notification or assistance is not an acknowledgment of fault or liability for the Personal Data Breach.

11. Assistance with impact assessments and prior consultations

Taking into account the nature of the Processing and the information available to ZEONE, ZEONE will provide reasonable assistance to the User when the User carries out an impact assessment of, or consults with a supervisory authority about, the Processing of Customer Data.

12. Return and deletion of Customer Data

1. Because the original Customer Data remains in the Connected Service, ZEONE responds to requests for the return of Customer Data by deleting it. Customer Data contained in chat history and Output can be exported in accordance with Section 13 of the Terms.

2. In any of the following cases, ZEONE will delete the relevant Customer Data within 30 days and will erase any copies remaining in backups within a reasonable period after that. This excludes Customer Data contained in the User’s chat history and Output, which is kept until it is deleted in accordance with the Terms. If applicable law requires ZEONE to retain Customer Data, ZEONE will retain it only for the period required by that law and only for the purposes of that law, and will delete it afterward.

• The User disconnects the Service from a Connected Service or uninstalls the Service
• The User’s agreement ends because the User closes its account or for any other reason
• ZEONE receives a request through a Connected Service to delete data about a Data Subject or a store

3. At the User’s request, ZEONE will certify in writing (including by electronic means) that the deletion has been completed.

13. Information and audits

1. At the User’s request, ZEONE will provide the information necessary to demonstrate compliance with its obligations under this DPA (including a summary of its security control measures, a list of Sub-processors, and copies of any third-party certification or audit reports).

2. If the User reasonably determines that the information described in the preceding paragraph is not sufficient to confirm compliance, or if a supervisory authority requires it, the User may conduct an audit at ZEONE’s premises, either itself or through a third party it appoints (which must be bound by confidentiality obligations and must not be a competitor of ZEONE).

3. An audit under the preceding paragraph must be conducted with at least 30 days’ written notice, during ZEONE’s normal business hours, in a way that does not unreasonably disrupt ZEONE’s business, and in principle no more than once a year. The 30-day notice requirement and the once-a-year limit do not apply if a Personal Data Breach has occurred or a supervisory authority requires the audit. ZEONE may propose a documentary or online audit instead of an on-site audit.

4. The User bears the cost of the audit. However, ZEONE bears the cost if the audit finds that ZEONE has materially breached this DPA.

5. The User will keep confidential any information about ZEONE and other Users that it learns through an audit.

14. International transfers

1. ZEONE is located in Japan. ZEONE may transfer Customer Data to Sub-processors outside Japan listed in Annex 3. In that case, in accordance with Article 28 of the APPI, ZEONE ensures, through contracts or other means with the Sub-processor, that the Sub-processor has established a system that conforms to the standards prescribed by the rules of the Personal Information Protection Commission (the “PPC Rules”).

15. Requests from public authorities

1. If a public authority requests disclosure of Customer Data, ZEONE will check the legal basis and scope of the request and will not disclose more than the law requires.

2. Unless the law prohibits it, ZEONE will try to notify the User before disclosure so that the User has an opportunity to object.

16. Liability

Each party’s liability under this DPA is subject to Section 21 of the Terms. However, that Section does not limit any liability to Data Subjects under Applicable Data Protection Laws.

17. Term

This DPA remains in effect for the term of the User’s agreement and, after that agreement ends, for as long as ZEONE holds Customer Data.

18. Changes

ZEONE may change this DPA in accordance with the provisions of the Terms on changes. However, ZEONE will not make changes that lower the level of protection of the User’s Customer Data, except for changes required by amendments to Applicable Data Protection Laws, decisions of supervisory authorities, or other similar reasons.

19. Governing law and jurisdiction

The governing law and court of jurisdiction for this DPA are as set out in Section 28 of the Terms.

Annex 1: Details of processing

Annex 2: Technical and organizational security control measures

Annex 3: List of Sub-processors

ZEONE Inc.