Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Merchant Services Agreement and governs the processing of personal data by Velta, LLC, doing business as Lollipay ("Lollipay"), in connection with the platform, in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR). It sets out where Lollipay acts as the Merchant's Processor and where Lollipay acts as an independent Controller, as described in Section 2.

By using Lollipay, you agree to this DPA.

1. Definitions

• "Personal Data" — Any information relating to an identified or identifiable natural person.
• "Processing" — Any operation performed on Personal Data (collection, storage, use, disclosure, deletion).
• "Controller" — The party that determines the purposes and means of processing. The Merchant is the Controller for its own customer relationships and business data. Lollipay is an independent Controller for the processing described in Section 2.2.
• "Processor" — Lollipay, when it processes Personal Data on behalf of and on the documented instructions of the Merchant as described in Section 2.1.
• "Sub-processor" — A third party engaged by Lollipay to process Personal Data.

2. Scope and Roles

As Merchant of Record, Lollipay acts in two distinct capacities depending on the processing activity.

2.1 Lollipay as Processor. For processing carried out on the Merchant's documented instructions to operate the Merchant's storefront and customer relationships (such as hosting the Merchant's product listings and providing the Merchant with buyer contact details for support), Lollipay acts as the Merchant's Processor and processes Personal Data only to provide those services.

2.2 Lollipay as Independent Controller. As the legal seller of record, Lollipay determines the purposes and means of, and acts as an independent Controller for, the following processing, and does not act on the Merchant's instructions in respect of it:

• Processing payments and transactions and issuing receipts and invoices to Buyers.
• Calculating, collecting, and remitting taxes.
• Fraud detection and prevention, and identity verification (KYC/AML).
• Chargeback and dispute handling.
• Meeting Lollipay's own legal, regulatory, and Card Scheme obligations.

Each party is responsible for compliance with applicable data protection law in respect of the processing for which it is the Controller.

3. Data Categories

For clarity, Buyer transaction, payment, tax, and fraud-related data processed under Section 2.2 is processed by Lollipay as an independent Controller, not on the Merchant's behalf.

4. Lollipay's Obligations

Lollipay will:

• When acting as Processor under Section 2.1, process Personal Data only on the Merchant's documented instructions, except where required by applicable law.
• Ensure personnel authorized to process Personal Data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Assist the Controller in responding to data subject rights requests.
• Delete or return Personal Data upon termination of services, unless retention is required by law.
• Make available information necessary to demonstrate compliance and allow for audits.
• Notify the Controller without undue delay (within 72 hours) upon becoming aware of a Personal Data breach.

5. Sub-processors

Lollipay uses the following sub-processors:

Infrastructure

Payments & Banking

Identity & Compliance

Communications

AI & Machine Learning

Observability & Analytics

Lollipay will notify the Controller at least 30 days before engaging a new sub-processor. The Controller may object within 14 days by contacting legal@lollipay.cc. If the objection cannot be reasonably resolved, the Controller may terminate the Agreement.

All sub-processors are bound by data processing obligations no less protective than those in this DPA.

6. International Transfers

Where Personal Data is transferred outside the EU/EEA, Lollipay relies on:

• EU Standard Contractual Clauses (SCCs).
• Adequacy decisions by the European Commission.
• Other approved transfer mechanisms under applicable law.

7. Data Subject Rights

Lollipay will assist the Controller in fulfilling data subject requests including access, rectification, erasure, portability, restriction, and objection, within the timelines required by applicable law.

8. Security Measures

Primary data storage is in secure data centers located in Ashburn, Virginia, United States. Certain sub-processors listed in Section 5 process limited data in other locations, including the United Kingdom, Sweden, and Australia; such transfers are governed by Section 6. Lollipay implements the following measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls and multi-factor authentication for internal systems.
• Regular security assessments and penetration testing.
• Incident response procedures and breach notification protocols.
• Automated backups with geographic redundancy.

9. Data Breach Notification

In the event of a Personal Data breach, Lollipay will:

1. Notify the Controller within 72 hours of becoming aware of the breach.
2. Provide details of the breach including the nature, categories of data affected, approximate number of data subjects, and measures taken or proposed.
3. Cooperate with the Controller in investigating and mitigating the breach.

10. Term and Termination

This DPA remains in effect for the duration of the Merchant Services Agreement. Obligations regarding data deletion and confidentiality survive termination.

11. Contact

For questions about this DPA or data processing, contact legal@lollipay.cc.