Data Processing Addendum

This Addendum forms part of the BrandsGateway Terms and Conditions (the "Terms") between Gateway Holdings OÜ, registry code 14276496, Narva mnt 5, 10117 Tallinn, Estonia, trading as BrandsGateway (the "Processor"), and each business customer that accepts the Terms (the "Customer"). The Customer accepts it by accepting the Terms. It applies from the date the Customer accepts the Terms or, for customers registered before 29 October 2026, from that date. Version 1.0.

For the end-consumer data the Customer sends the Processor to fulfil orders, the Customer is the controller and the Processor is its processor. The Processor is an independent controller only for the order, invoice, customs and tax records it must keep by law, and for data it needs to establish or defend legal claims, including claims with carriers.

Purpose: receiving, fulfilling, shipping, tracking and returning the Customer's orders, and related support. Data: name, shipping address, phone, email, order contents and tracking data of the Customer's end consumers. Each order's data is kept as long as needed to fulfil, deliver and return the order and to settle claims about it, and then deleted, except the records in clause 1, which are kept for their legal period.

The Customer is responsible for the lawfulness of the processing and for informing its end consumers, sends only the data needed for an order, and gives its instructions in writing.

The Processor processes the data only on the Customer's documented instructions: the Terms, this Addendum and the Customer's orders, including on transfers outside the EEA. If EU or Member State law requires other processing, the Processor informs the Customer first, unless that law prohibits it on important grounds of public interest. It informs the Customer immediately if it believes an instruction infringes data-protection law, and may suspend that instruction until the Customer confirms or changes it. It does not use end-consumer data for any purpose of its own, including marketing, profiling or analytics.

Everyone authorised to process the data is bound by confidentiality.

The Processor implements at least the measures in Annex 1, reviews them regularly, and does not change them in a way that lowers the level of protection.

The Customer gives a general authorisation for the Processor to use sub-processors of these kinds: the vendors and warehouses that fulfil orders; hosting and storage; email delivery; support tools; network security; and error monitoring. Some of them are in the United States, under clause 9. The current list is available on request at [email protected].

The Processor informs the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds; if this cannot be resolved, it may end the affected services. The Processor imposes on each sub-processor, by contract, data-protection obligations that protect the data at least as well as this Addendum, and remains fully liable for them.

To deliver an order, the Processor gives the recipient's name, address, phone, email and the parcel's contents and value to the carrier and, where needed, to customs authorities and agents. The Customer instructs this by placing the order. These recipients act as independent controllers under their own terms.

Sub-processors outside the EEA are used only where an adequacy decision covers them (for the United States, only organisations certified under the EU-U.S. Data Privacy Framework), or under the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, Module 3. For a Customer outside the EEA in a country without an adequacy decision, Module 4 of those clauses forms part of this Addendum.

The Processor helps the Customer answer end consumers' requests, forwarding any it receives without undue delay and at the latest within 3 business days, and helps with security, breach notification and impact assessments (GDPR Articles 32 to 36).

The Processor notifies the Customer without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting the Customer's data, including at a sub-processor, with what is known, the likely consequences, the measures taken and a contact point.

When the services end, the Processor deletes or returns the end-consumer data within 30 days, at the Customer's choice, except the records in clause 1, and confirms it in writing on request to [email protected].

The Processor gives the information needed to show compliance with Article 28 GDPR. If that does not answer the Customer's reasonable questions, the Customer or its auditor may audit, on 30 days' notice, at most once a year unless there are signs of non-compliance or a breach, or an authority requires it. Each party bears its own costs.

Changes to this Addendum are emailed to the Customer at least 30 days before they apply; the Customer may end the affected services before then.

This Addendum prevails over the Terms on data protection. On request, the parties sign the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/915, which then prevail. Estonian law applies.

Our servers, databases, files and backups are hosted in data centres in the EU. Our websites are reached only over encrypted connections (TLS), behind network protection against attacks, and the databases holding orders are not reachable from the internet. Databases are backed up daily and encrypted before they leave the server.

Each person uses a personal account with only the rights their work needs. Server access uses personal cryptographic keys, not passwords.

Vendors and warehouses see only the orders they fulfil.

Application events and errors are logged centrally; only the technical team can read the logs.

Staff and contractors are bound by confidentiality.

Suspected breaches are reported to [email protected] and handled by the technical team; Customers are notified as in clause 11.