Соглашение об обработке данных

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Seller Niche ("Data Processor" or "Processor") and the customer entity that has executed the Terms of Service ("Data Controller" or "Controller"). This DPA governs the processing of personal data by Seller Niche on behalf of the Controller in connection with the Seller Niche platform and services. This DPA remains in force for as long as the underlying Terms of Service are in effect.

Seller Niche processes personal data solely to provide the agreed services under the Terms of Service, including: (a) Amazon Seller Central data analysis via SP-API; (b) keyword research, product tracking and competitive intelligence; (c) AI-powered listing generation and optimization; (d) PPC analytics and bid management; (e) FBA refund recovery processing; (f) sales reporting and profit analytics; (g) account management, billing and customer support. Processing is performed only on documented instructions from the Controller, unless required by law.

The personal data processed under this DPA includes: (a) Identification data: name, email address, username; (b) Contact data: billing address, phone number; (c) Financial data: subscription plan, payment history (processed by our payment provider — Seller Niche does not store card numbers or CVVs); (d) Amazon seller data: store name, ASIN lists, sales data, advertising spend, revenue and profit metrics authorized via SP-API; (e) Usage data: platform interactions, feature usage, IP address, device and browser information; (f) Communications: support tickets and correspondence.

Seller Niche makes the following binding commitments regarding third-party data sharing: • We will NEVER sell, rent, trade or otherwise transfer your personal data or Amazon seller data to any third party for commercial purposes. • Your Amazon seller data (sales, revenue, ASINs, keywords, ad spend) is YOUR proprietary business information. It is never used to train models that benefit other sellers or disclosed to other Seller Niche users. • Aggregated, fully anonymized statistical data (e.g. "sellers in electronics see average BSR of X") may be used for platform improvements. Individual account data is never included in such aggregations. • We use a limited set of sub-processors (cloud infrastructure, payment processing, email delivery, error monitoring) who are contractually bound by data processing agreements equivalent to this DPA. See Section 6 for the current sub-processor list. • Law enforcement disclosures: We will notify you before disclosing your data to law enforcement unless legally prohibited from doing so.

Seller Niche implements the following technical and organizational security measures: Encryption: All data in transit is protected by TLS 1.3. All data at rest is encrypted using AES-256. Access Controls: Role-based access control (RBAC). Production data access is logged and audited. Staff access to customer data is on a need-to-know basis only. Infrastructure: Hosted on SOC 2-certified cloud infrastructure. Automated backups with point-in-time recovery. Monitoring: 24/7 intrusion detection, anomaly monitoring and automated alerts. Vulnerability Management: Regular penetration testing, dependency scanning and security patches applied within 48 hours of disclosure. Data Breach Response: Notification to affected Controllers within 72 hours of discovery, as required by GDPR Article 33.

Seller Niche uses the following approved sub-processors. All sub-processors are bound by data processing agreements: • Vercel Inc. — Hosting and edge network infrastructure (USA / EU regions available) • Supabase Inc. / PostgreSQL — Database hosting (EU region) • Stripe Inc. — Payment processing (cardholder data never touches Seller Niche servers) • Resend Inc. — Transactional email delivery • Sentry — Error monitoring and performance tracking (anonymized stack traces) • Amazon Web Services — SP-API data pipeline (EU / US regions) • OpenAI / xAI — AI content generation (data not used to train OpenAI or xAI models per enterprise agreements) sellerniche.com will notify the Controller at least 30 days before adding new sub-processors that process personal data. The Controller has the right to object to such additions.

Seller Niche will assist the Controller in fulfilling data subject rights requests as required by GDPR and KVKK, including: • Access: Provide a machine-readable export of all personal data held for a data subject within 30 days of request. • Rectification: Correct inaccurate data upon Controller instruction. • Erasure (Right to be Forgotten): Permanently delete all personal data within 30 days of Controller instruction, except where retention is required by applicable law. • Portability: Provide data in standard formats (JSON, CSV) upon request. • Restriction: Suspend processing upon Controller instruction pending dispute resolution. Requests from data subjects received directly by Seller Niche will be forwarded to the Controller within 5 business days.

Upon termination of the Terms of Service, Seller Niche will: 1. Within 30 days: Provide the Controller with a complete export of their data in JSON and CSV format. 2. Within 90 days: Permanently delete all personal data from active systems, including backups. 3. Provide written confirmation of deletion upon Controller request. Amazon SP-API access tokens are revoked immediately upon account termination. Aggregated, fully anonymized statistical data not attributable to any individual or business may be retained for platform improvement purposes.

Seller Niche processes data primarily within the European Union and the United States. For transfers of EU personal data outside the EEA, we rely on: • Standard Contractual Clauses (SCCs) approved by the European Commission (Controller-to-Processor and Processor-to-Processor modules as applicable). • Adequacy decisions where available. • Binding Corporate Rules where applicable. Enterprise customers may request a data residency option with data stored exclusively in EU regions. Contact support@sellerniche.com for data residency agreements.

The Controller has the right to audit Seller Niche's compliance with this DPA, subject to: • Providing at least 30 days written notice. • Audits limited to once per calendar year (unless triggered by a security incident). • Audit costs borne by the Controller. • Seller Niche may satisfy audit requests by providing up-to-date third-party audit reports (SOC 2 Type II, ISO 27001 where applicable) in lieu of on-site inspections. Enterprise customers may request a copy of our most recent SOC 2 Type II report under NDA by emailing support@sellerniche.com.

This DPA is governed by the laws of the Republic of Turkey and, where applicable, the laws of the European Union (including GDPR). Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of Istanbul, Turkey, unless mandatory EU law provides otherwise. For EU-established Controllers, this DPA also constitutes the binding agreement required under GDPR Article 28.