Data Processing Addendum
Last updated: July 27, 2026
Version: 1.0
This Data Processing Addendum ("DPA") forms part of the Terms of Use, Enterprise Agreement, Order Form, or other written agreement between Saees LLC ("Saees," "Processor," "we," "our," or "us") and the Customer ("Controller" or "Customer") governing the processing of Personal Data in connection with the Services.
This DPA applies whenever Saees Processes Personal Data on behalf of a Customer.
Where this DPA conflicts with another agreement regarding Personal Data Processing, this DPA governs solely with respect to such Processing unless the parties expressly agree otherwise in writing.
TABLE OF CONTENTS Purpose Scope Definitions Roles of the Parties Subject Matter of Processing Nature of Processing Duration of Processing Categories of Personal Data Categories of Data Subjects Customer Instructions Lawful Processing Confidentiality Security Measures Personnel Obligations Technical Measures
On this page 55 sections
1. PURPOSE
This DPA establishes the obligations of the parties regarding the Processing of Personal Data in accordance with applicable Data Protection Laws.
Its objectives include:
protecting Personal Data; defining responsibilities; implementing appropriate safeguards; facilitating lawful international data transfers; supporting Customer compliance; protecting the rights of Data Subjects.
2. SCOPE
This DPA applies whenever Saees Processes Personal Data on behalf of a Customer while providing:
AI Commerce OS; AI Services; marketplace integrations; workflow automation; reporting; APIs; support services; Enterprise Services; Professional Services.
This DPA applies regardless of whether Processing occurs through:
the web platform; APIs; integrations; AI Agents; support systems; cloud infrastructure.
3. DEFINITIONS
For purposes of this DPA:
Applicable Data Protection Laws
All applicable privacy and data protection laws governing the Processing of Personal Data, including where applicable:
GDPR; UK GDPR; Washington State privacy laws; applicable U.S. federal laws; California privacy laws; Brazilian LGPD; other applicable legislation. Controller
The entity determining the purposes and means of Processing Personal Data.
Processor
The entity Processing Personal Data on behalf of the Controller.
For purposes of this DPA, Saees acts as Processor except where applicable law provides otherwise.
Personal Data
Information relating to an identified or identifiable natural person.
Processing
Any operation performed upon Personal Data including:
collection; storage; organization; use; disclosure; transmission; analysis; deletion; destruction. Subprocessor
A third party engaged by Saees to Process Personal Data in connection with providing the Services.
Security Incident
A confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by Saees.
4. ROLES OF THE PARTIES
Except where applicable law provides otherwise:
The Customer acts as the Controller.
Saees acts as the Processor.
Where Saees independently determines the purposes and means of Processing for its own business purposes, Saees acts as an independent Controller for that Processing.
Nothing in this DPA prevents either party from acting as an independent Controller where applicable law recognizes separate Processing activities.
5. SUBJECT MATTER OF PROCESSING
Saees Processes Personal Data solely for purposes necessary to provide the Services, including:
user authentication; Organization management; AI Services; workflow automation; support; reporting; platform security; billing; system administration; integration management; incident response.
6. NATURE OF PROCESSING
Processing activities may include:
collection; recording; organization; storage; consultation; retrieval; transmission; synchronization; analysis; AI-assisted processing; deletion; secure destruction.
Processing occurs only as reasonably necessary to deliver the Services or comply with applicable law.
7. DURATION OF PROCESSING
Saees will Process Personal Data only for the duration necessary to:
provide the Services; comply with Customer instructions; comply with applicable law; satisfy contractual obligations; resolve disputes; enforce agreements.
Upon expiration or termination of the applicable agreement, Processing will cease except where continued Processing is legally required.
8. CATEGORIES OF PERSONAL DATA
Depending upon Customer use of the Services, Personal Data may include:
names; email addresses; telephone numbers; usernames; organization information; account identifiers; billing contacts; IP addresses; device identifiers; login history; support communications; workflow information; AI prompts containing Personal Data submitted by Customers; marketplace account identifiers.
Saees does not intentionally require Customers to submit special categories of Personal Data unless expressly supported and authorized.
9. CATEGORIES OF DATA SUBJECTS
Personal Data may relate to:
Customers; Users; Organization Administrators; employees; contractors; marketplace operators; suppliers; business contacts; customer support contacts; authorized representatives.
The specific categories depend upon Customer use of the Services.
10. CUSTOMER INSTRUCTIONS
Saees will Process Personal Data only:
in accordance with documented Customer instructions; as necessary to provide the Services; as required by applicable law; as necessary to protect the security of the Services.
Where applicable law requires Processing beyond Customer instructions, Saees will notify the Customer unless legally prohibited.
Customers represent that all instructions provided to Saees comply with applicable Data Protection Laws.
11. LAWFUL PROCESSING
The Customer is responsible for establishing an appropriate legal basis for the Processing of Personal Data.
Saees does not independently determine whether the Customer possesses an appropriate legal basis for each Processing activity performed through the Services.
Customers remain responsible for:
obtaining required consents; providing required notices; honoring Data Subject rights; maintaining lawful Processing.
12. CONFIDENTIALITY
Saees will treat Personal Data as Confidential Information.
Personnel authorized to Process Personal Data are bound by:
confidentiality agreements; employment obligations; professional duties; internal security policies.
Access is limited to personnel with a legitimate business need.
13. SECURITY MEASURES
Saees maintains commercially reasonable administrative, technical, and organizational measures designed to protect Personal Data against:
unauthorized access; unauthorized disclosure; accidental loss; destruction; alteration; misuse.
Security measures are designed according to:
current technology; implementation cost; nature of Processing; sensitivity of information; identified risks.
14. PERSONNEL OBLIGATIONS
Saees personnel authorized to Process Personal Data receive access only where reasonably necessary.
Personnel may be subject to:
confidentiality obligations; access controls; security training; acceptable use requirements; disciplinary procedures for unauthorized access.
Access privileges are reviewed and revoked where appropriate.
15. TECHNICAL MEASURES
Saees implements commercially reasonable technical safeguards which may include:
encryption in transit; encryption at rest; role-based access controls; multi-factor authentication; audit logging; backup procedures; vulnerability management; monitoring; intrusion detection; secure software development practices; disaster recovery procedures.
Technical measures evolve as technology and security practices develop.
16. SUBPROCESSORS
Saees may engage qualified third-party Subprocessors to support the delivery of the Services.
Subprocessors may provide services including:
cloud infrastructure; data hosting; authentication; monitoring; logging; customer support; email delivery; payment processing; analytics; artificial intelligence infrastructure; security services; backup services.
Saees remains responsible for the performance of its Subprocessors to the extent required by applicable law and this DPA.
17. SUBPROCESSOR SELECTION
Before engaging a Subprocessor, Saees shall use commercially reasonable efforts to evaluate the provider's ability to implement appropriate technical and organizational safeguards.
Selection criteria may include:
security capabilities; privacy practices; operational reliability; regulatory compliance; contractual commitments; business continuity; technical expertise.
Saees may replace Subprocessors where reasonably necessary for operational, legal, security, or commercial reasons.
18. SUBPROCESSOR OBLIGATIONS
Saees shall require Subprocessors that Process Personal Data on its behalf to enter into written agreements imposing data protection obligations that are substantially equivalent to those contained in this DPA where required by applicable law.
Such agreements may include obligations regarding:
confidentiality; security; restricted Processing; incident notification; deletion of Personal Data; audit cooperation; compliance with applicable law.
19. CURRENT CATEGORIES OF SUBPROCESSORS
As of the Effective Date, Subprocessors may include providers supporting:
cloud hosting; authentication; AI model processing; transactional email; payment processing; monitoring and observability; logging; customer communications; infrastructure security; content delivery.
Saees may publish a current list of significant Subprocessors on its website or provide it upon reasonable request by Enterprise Customers.
20. INTERNATIONAL DATA TRANSFERS
Personal Data may be Processed in countries other than the country in which it was originally collected.
Where Personal Data is transferred internationally, Saees shall implement an appropriate transfer mechanism where required by applicable Data Protection Laws.
Transfers may occur for purposes including:
cloud hosting; AI processing; technical support; disaster recovery; monitoring; security operations; infrastructure redundancy.
21. STANDARD CONTRACTUAL CLAUSES
Where required under the GDPR or other applicable law, the parties agree that the European Commission's Standard Contractual Clauses ("SCCs"), as amended or replaced from time to time, are incorporated into this DPA by reference.
The SCCs apply only to the extent legally required.
Where another lawful transfer mechanism becomes available or mandatory under applicable law, Saees may rely upon that mechanism.
22. UK INTERNATIONAL DATA TRANSFERS
Where the United Kingdom General Data Protection Regulation applies, the parties agree that the applicable UK International Data Transfer Addendum or successor mechanism shall apply where legally required.
If the United Kingdom adopts a replacement transfer mechanism, that mechanism shall automatically replace the previous mechanism to the extent required by law.
23. OTHER INTERNATIONAL TRANSFER MECHANISMS
Where applicable, Saees may rely upon additional lawful transfer mechanisms recognized by applicable law, including:
adequacy decisions; approved certifications; binding corporate rules; approved contractual mechanisms; legally recognized derogations.
Saees reserves the right to update transfer mechanisms as laws evolve.
24. DATA SUBJECT RIGHTS
Where legally required, Saees shall provide commercially reasonable assistance to enable the Customer to respond to Data Subject requests relating to:
access; correction; deletion; restriction; objection; portability; withdrawal of consent; applicable privacy rights.
Customers remain responsible for determining whether a request should be granted.
25. DATA SUBJECT REQUESTS RECEIVED BY SAEES
If Saees receives a request directly from a Data Subject relating to Personal Data Processed on behalf of a Customer, Saees may:
notify the Customer; redirect the request to the Customer; provide reasonable assistance where appropriate.
Unless legally required, Saees will not independently respond to such requests without authorization from the Customer.
26. ASSISTANCE WITH COMPLIANCE
Upon reasonable request and subject to applicable law, Saees shall provide commercially reasonable assistance to the Customer regarding:
privacy impact assessments; security documentation; data transfer information; Processing activities; compliance inquiries; regulatory investigations relating to Processing performed by Saees.
Such assistance may be subject to reasonable fees where extensive effort is required.
27. SECURITY INCIDENTS
Saees maintains procedures for identifying, investigating, containing, and responding to confirmed Security Incidents involving Personal Data.
Incident response procedures may include:
investigation; containment; eradication; recovery; notification; corrective action; documentation; post-incident review.
Not every cybersecurity event constitutes a reportable Security Incident.
28. SECURITY INCIDENT NOTIFICATION
Where required by applicable law, Saees shall notify the Customer without undue delay after becoming aware of a confirmed Security Incident involving Personal Data Processed on behalf of the Customer.
Notification may include, where available:
nature of the incident; categories of affected Personal Data; categories of affected Data Subjects; likely consequences; mitigation measures; recommended Customer actions; contact information for follow-up.
Information may be provided in phases as additional facts become available.
29. GOVERNMENT ACCESS REQUESTS
If Saees receives a legally binding request from a governmental authority seeking disclosure of Personal Data Processed on behalf of a Customer, Saees shall, where legally permitted:
review the request; seek to narrow overly broad requests; notify the Customer; disclose only information legally required.
Saees will not voluntarily disclose Customer Personal Data to governmental authorities except where required by law or necessary to protect rights, safety, or security.
30. LEGALLY REQUIRED DISCLOSURES
Nothing in this DPA prevents Saees from Processing or disclosing Personal Data where required by:
applicable law; court order; lawful subpoena; regulatory authority; legally binding governmental request.
Where legally permitted, Saees shall use commercially reasonable efforts to notify the Customer before disclosure.
31. DATA RETENTION
Saees retains Personal Data only for as long as reasonably necessary to:
provide the Services; comply with Customer instructions; comply with legal obligations; resolve disputes; enforce contractual rights; maintain security; prevent fraud.
Retention periods vary according to:
type of information; legal requirements; Subscription plan; operational necessity.
32. DELETION OF PERSONAL DATA
Upon termination of the applicable agreement, and subject to applicable law, Saees shall delete or anonymize Customer Personal Data after expiration of applicable retention periods unless continued retention is legally required.
Deletion may occur through:
secure deletion; cryptographic destruction; anonymization; backup expiration; media retirement.
Deletion from backup systems may occur according to normal backup lifecycle schedules.
33. RETURN OF PERSONAL DATA
Where technically feasible and supported by the applicable Subscription, Customers may export certain Personal Data before termination of the Services.
Following termination, Saees is not obligated to maintain Customer Personal Data beyond applicable retention periods.
Customers remain responsible for exporting data they wish to retain.
34. BACKUP COPIES
Backup copies may remain temporarily available until overwritten through normal backup rotation procedures.
Such backups:
remain protected by appropriate safeguards; are not actively Processed except for restoration or legal compliance; are deleted according to operational backup schedules.
35. RECORDS OF PROCESSING
Where required by applicable law, Saees shall maintain records describing categories of Processing activities performed as Processor.
Such records may include:
categories of Processing; categories of Personal Data; categories of Data Subjects; Subprocessor categories; international transfers; security measures.
These records are maintained in accordance with legal requirements and internal operational practices.
36. AUDIT RIGHTS
Where required by applicable law or a written Enterprise Agreement, Customers may request reasonable information demonstrating Saees' compliance with this DPA.
Audits shall:
occur during normal business hours; avoid unreasonable operational disruption; protect Confidential Information of other Customers; comply with reasonable security requirements.
Saees may satisfy audit requests by providing:
security documentation; compliance reports; certifications; independent audit reports; responses to reasonable security questionnaires.
37. AUDIT LIMITATIONS
Unless otherwise agreed in writing:
audits may not occur more than once annually; Customers bear their own audit costs; audits require reasonable advance notice; auditors must execute confidentiality agreements.
Saees is not required to disclose:
source code; penetration testing methodologies that create security risk; proprietary security tools; information relating to other Customers; legally privileged information.
38. REGULATORY COOPERATION
Where legally required, Saees shall cooperate with competent supervisory authorities regarding Processing activities covered by this DPA.
Such cooperation shall remain subject to:
confidentiality obligations; attorney-client privilege; protection of third-party information; applicable law.
39. LIABILITY
Each party shall remain responsible for its own compliance with applicable Data Protection Laws.
Nothing in this DPA expands or limits either party's liability beyond the liability provisions contained in the governing Terms of Use, Enterprise Agreement, or other applicable agreement, except where applicable law prohibits such limitation.
Where multiple parties are responsible for the same Processing activity, liability shall be allocated according to applicable law and each party's respective responsibility.
40. CUSTOMER RESPONSIBILITIES
The Customer is responsible for:
determining the lawful basis for Processing; providing required privacy notices; obtaining legally required consents; responding to Data Subject requests; ensuring the legality of Customer Data; configuring access permissions; managing authorized Users; complying with applicable privacy laws.
Saees is not responsible for the Customer's independent compliance obligations.
41. INDEMNIFICATION
To the extent permitted by applicable law, the Customer agrees to indemnify and hold harmless Saees against claims arising from:
unlawful Customer Processing; Customer instructions violating applicable law; Customer misuse of the Services; unauthorized disclosure caused by Customer personnel; Customer failure to obtain legally required consents.
This section is subject to any indemnification limitations contained in the governing agreement.
42. LIMITATION OF LIABILITY
Except where prohibited by applicable law, the liability limitations contained in the Terms of Use or Enterprise Agreement apply equally to this DPA.
Nothing in this DPA excludes liability that cannot legally be limited under applicable law.
43. CHANGES TO THIS DPA
Saees may update this DPA to reflect:
changes in applicable law; new Services; new Processing activities; updated security practices; new international transfer mechanisms; changes to Subprocessors.
Material changes shall become effective upon publication or as otherwise required by applicable law.
44. ORDER OF PRECEDENCE
In the event of any inconsistency:
Applicable law; Signed Enterprise Agreement; This Data Processing Addendum; Terms of Use; Other supporting documentation.
shall govern in that order solely with respect to Personal Data Processing.
45. SEVERABILITY
If any provision of this DPA is determined to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
The invalid provision shall be interpreted to most closely reflect its original legal intent.
46. NO THIRD-PARTY BENEFICIARIES
Except as expressly required by applicable Data Protection Laws, this DPA creates no rights in favor of third parties.
Nothing herein limits rights expressly granted to Data Subjects under applicable law.
47. GOVERNING LAW
Unless otherwise required by mandatory Data Protection Laws or a signed Enterprise Agreement, this DPA shall be governed by the laws of the State of Washington, without regard to conflict-of-laws principles.
48. CONTACT INFORMATION
Questions regarding this DPA may be directed to:
Privacy
Legal
General Support
Mailing Address
Saees LLC
4730 University Wy NE, Seattle, WA 98105
49. EFFECTIVE DATE
Effective Date:
July 27, 2026
Last Updated:
July 27, 2026
ANNEX I
DETAILS OF PROCESSING Controller
Customer using the Services.
Processor
Saees LLC.
Subject Matter
Provision of AI Commerce OS, marketplace integrations, AI-powered functionality, workflow automation, reporting, APIs, customer support, and related Services.
Nature of Processing
Processing activities may include:
collection; storage; organization; retrieval; consultation; synchronization; AI-assisted processing; transmission; deletion; anonymization. Purpose of Processing
Personal Data is Processed solely to:
provide the Services; authenticate Users; manage Organizations; provide AI functionality; support integrations; deliver customer support; secure the platform; process billing; comply with applicable law. Duration
For the duration of the Customer relationship and any additional retention period required by applicable law or legitimate operational necessity.
Categories of Personal Data
Depending on Customer use, Personal Data may include:
names; business email addresses; usernames; account identifiers; organization information; IP addresses; device identifiers; authentication logs; support communications; marketplace account identifiers; AI prompts containing Customer-submitted Personal Data. Categories of Data Subjects Users; Organization Administrators; employees; contractors; suppliers; business contacts; customer support contacts; authorized representatives.
ANNEX II
TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES
Saees maintains commercially reasonable security controls that may include:
Organizational Measures documented security policies; confidentiality agreements; employee access controls; least-privilege principles; security awareness training; incident response procedures; vendor risk management; change management processes. Technical Measures encryption in transit using TLS; encryption at rest where supported; role-based access control; multi-factor authentication; secure authentication; audit logging; infrastructure monitoring; vulnerability management; secure software development lifecycle; malware protection; automated backups; disaster recovery planning. Physical Measures
Where infrastructure is operated through cloud providers, physical security is implemented by the applicable infrastructure provider, which may include:
controlled facility access; surveillance; environmental controls; redundant power; redundant networking; disaster resilience.
ANNEX III
AUTHORIZED SUBPROCESSOR CATEGORIES
Depending upon the Services used, Saees may engage Subprocessors providing:
cloud hosting infrastructure; authentication services; payment processing; email delivery; customer support platforms; monitoring services; logging services; AI model providers; analytics services; backup providers; security providers; content delivery networks.
The identity of individual Subprocessors may change over time without requiring amendment of this DPA, provided equivalent contractual protections are maintained where required by applicable law.
ANNEX IV
INTERNATIONAL TRANSFER SAFEGUARDS
Where Personal Data is transferred internationally, Saees may rely upon one or more lawful mechanisms including:
European Commission Standard Contractual Clauses; UK International Data Transfer Addendum; adequacy decisions; approved certifications; legally recognized transfer mechanisms adopted in the future.
Transfer mechanisms shall automatically update to successor legal mechanisms where required by applicable law.
ANNEX V
SECURITY INCIDENT CONTACTS
Privacy inquiries:
Legal inquiries:
General support:
Security reporting:
Customers are encouraged to report suspected security incidents promptly.
ENTIRE AGREEMENT
This Data Processing Addendum, together with the Terms of Use, Privacy Policy, Acceptable Use Policy, Artificial Intelligence Policy, applicable Order Forms, and any signed Enterprise Agreement, constitutes the complete agreement between the parties regarding the Processing of Personal Data in connection with the Services and supersedes all prior discussions relating solely to the subject matter of this DPA.