Data Processing Agreement

Data Processing Agreement with SCCs (Module 2)

This Data Processing Agreement (“DPA”) incorporates the EU Standard Contractual Clauses (Module 2 – Controller to Processor)
and aligns with existing vendor DPAs.

Controller:
Dr. Wholeness LLC, United States

Processors:
- Shopify Inc.
- Google Analytics (Google LLC)
- ActiveCampaign, LLC
- Shopify Inbox (Shopify Inc.)

This DPA supplements and does not replace existing Terms of Service or Privacy Policies.

ANNEX I – Description of Processing

Data Subjects:
- Customers
- Website visitors
- Email subscribers

Categories of Personal Data:
- Identifiers (name, email, IP address)
- Order and payment metadata
- Device and usage data
- Customer support communications

Purpose of Processing:
- Ecommerce operations
- Analytics and site performance
- Email marketing and transactional messaging
- Customer support chat

International Transfers:
- United States
Safeguards:
- EU Standard Contractual Clauses (Module 2)

ANNEX II – Technical and Organizational Measures

- Encryption in transit and at rest
- Role-based access controls
- MFA where available
- Incident response and breach notification procedures
- Regular platform security audits

ANNEX III – Sub-processors

Shopify:
- Cloud infrastructure providers (AWS, GCP)

Google Analytics:
- Google LLC infrastructure

ActiveCampaign:
- Hosting and email delivery infrastructure

Signatures

Controller:
_________________________
Name:
Date:

Processor:
_________________________
Name:
Date: