Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (the "DPA") is part of the Terms of Service. It applies when Gamecart processes personal data of buyers and other visitors of a seller's store. For that data the seller is the controller and Gamecart is the processor, except for the limited use Gamecart makes of it as controller to secure the Service and prevent fraud and abuse, as described in the Privacy Policy. Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

2. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "security incident" have the meaning given by the data protection law that applies, such as the LGPD in Brazil or the GDPR in Europe. "Buyer data" means the personal data of buyers and visitors of a seller's store that Gamecart processes for the seller. "Sub-processor" means a service provider that processes buyer data for Gamecart.

3. Details of the processing

• Subject and duration: operating the seller's store for as long as the seller uses the Service.
• Data subjects: buyers and visitors of the store, who may include children and adolescents.
• Data: contact and identification data, IP address, game and Discord identifiers, checkout field answers, billing details and order history.
• Purposes: hosting the store, processing orders, delivering products, sending order emails, keeping the records the seller needs and, when the seller enables them, showing buyer nicknames, products and amounts in public store widgets.

4. Seller's obligations as controller

• Have a legal basis for the processing of buyer data and for every destination the seller configures.
• Give buyers a privacy notice that describes the processing, including the use of Gamecart.
• Obtain any consent from a parent or legal guardian that the law requires for buyers who are children.
• Give only instructions that comply with data protection law, and answer the requests of buyers and authorities addressed to the seller.

5. Processing on the seller's instructions

Gamecart processes buyer data only to provide the Service and on the seller's documented instructions, which are these Terms and the settings the seller chooses in the dashboard. Sending buyer data to destinations the seller configures, such as its payment providers, custom gateway, game servers, webhooks, Discord server and email server, is done on the seller's instructions. Gamecart does not use buyer data for advertising or profiling. Gamecart will tell the seller if it believes an instruction breaks data protection law.

6. Confidentiality and security

People authorized to process buyer data are bound by confidentiality. Gamecart keeps technical and organizational measures appropriate to the risk, including encryption in transit, access limited by permission, authentication with email verification and audit records.

7. Sub-processors

The seller authorizes the service providers listed in the Privacy Policy, which process data under the data protection terms each of them offers, and Gamecart remains responsible for them. The third-party resources the official themes load in the buyer's browser, also listed there, are not sub-processors. Gamecart will announce new sub-processors in advance, and the seller may object on reasonable data protection grounds by writing to support@gamecart.gg.

8. Security incidents

Gamecart will notify the seller without undue delay, and within 72 hours, after becoming aware of a security incident affecting buyer data. The notice will describe, as far as then known, what happened and when, the data and data subjects affected, including whether children or adolescents are involved, the likely consequences and the measures taken, so the seller can meet its own notification duties. Gamecart keeps a record of security incidents.

9. Assistance to the seller

Taking into account the nature of the processing, Gamecart will help the seller answer requests from data subjects, carry out impact assessments and deal with data protection authorities. Access and portability requests can be met in the dashboard by exporting customer and order data. Deleting an order in the dashboard removes it from view but does not erase it; to delete or anonymize a buyer's data, the seller writes to support@gamecart.gg. If a buyer writes to Gamecart directly, Gamecart forwards the request to the seller.

10. Aggregated and anonymized data

Gamecart may create statistics from buyer data that are aggregated or anonymized so that they no longer identify any person, such as daily visit counts and sales totals, and use them to operate and improve the Service. Such statistics are not buyer data.

11. International transfers

Some service providers process buyer data outside Brazil, as described in the Privacy Policy, under the data protection terms each of them offers its customers.

12. Information and audits

Gamecart will make available the information reasonably needed to show compliance with this DPA. Requests for further information can be sent to support@gamecart.gg.

13. Return and deletion

The seller can export store data while the account is active. After the account or store is closed, Gamecart deletes or anonymizes buyer data at the seller's request, except what the law requires it to keep.

14. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms, except where the law does not allow it to be limited.