Data Processing Agreement

Effective Date: March 7, 2026
Last Updated: March 7, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Invariably Digital Group (“Processor”, “we”) and the merchant organization (“Controller”, “you”) using the Omni platform.

This DPA applies to all personal data processed by Omni on your behalf, including customer records, order data, employee/user data, and data imported via third-party integrations.

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data (collection, storage, retrieval, use, disclosure, erasure).
• Sub-processor: Any third party engaged by the Processor to process personal data on behalf of the Controller.

2. Data Processing Purpose

We process personal data solely for the purposes of providing the services described in the Terms of Service:

• Point-of-sale and order management
• Customer relationship management (CRM)
• Inventory and fulfillment operations
• Billing and invoicing
• Reporting and analytics
• Integration sync with third-party platforms (when enabled by you)

We do not sell, rent, or share personal data with third parties for marketing purposes.

3. Controller Obligations

You are responsible for:

• Ensuring a lawful basis exists for collecting and sharing personal data with Omni.
• Providing appropriate privacy notices to your customers and end users.
• Obtaining necessary consents where required (e.g., before enabling third-party customer data sync).
• Responding to data subject rights requests (with our assistance as described below).

4. Processor Obligations

We shall:

• Process personal data only on your documented instructions.
• Ensure that persons authorized to process personal data have committed to confidentiality.
• Implement appropriate technical and organizational security measures (see Section 6).
• Assist you in responding to data subject rights requests.
• Delete or return personal data upon termination of services (subject to the retention periods below).
• Make available all information necessary to demonstrate compliance with this DPA.

5. Sub-processors

Current sub-processors:

We will notify you of any intended changes to sub-processors. You may object to a new sub-processor within 30 days of notification.

6. Security Measures

Technical

• Encryption in transit: TLS 1.2+ for all connections.
• Encryption at rest: Database-level encryption; AES-GCM field encryption for sensitive fields (MFA secrets, integration credentials, payment tokens).
• Tenant isolation: Schema-per-tenant PostgreSQL architecture — physical separation of each tenant’s data.
• Access control: Role-based access control (6 default roles, 19 resource areas), enforced at the API layer.
• Authentication: JWT with httpOnly cookies, refresh token rotation with theft detection, TOTP-based MFA.
• Rate limiting: Token-bucket algorithm on authentication and API endpoints.
• Audit logging: 10 security event types with immutable persistence (retained 2 years).

Organizational

• Least-privilege access for all personnel.
• Production credentials managed via Docker secrets (no plaintext in configuration).
• DOMPurify sanitization of user-generated content to prevent XSS.
• Automated dependency scanning (Trivy) in CI/CD pipeline.

7. Data Breach Notification

In the event of a personal data breach, we will:

1. Notify you without undue delay (and in any event within 72 hours of becoming aware).
2. Provide details of the breach: nature, categories of data affected, approximate number of records, likely consequences, and measures taken.
3. Cooperate with you in notifying supervisory authorities and data subjects as required.

8. Data Subject Rights

We will assist you in fulfilling data subject requests including:

• Right of access: Export tenant data via the built-in data export feature (async ZIP, CSV per table).
• Right to erasure: Tenant data deletion upon request (schema deletion after retention period).
• Right to portability: Data export in CSV format.
• Right to rectification: You can update records directly via the Omni UI or API.

9. Data Retention

Upon termination, tenant data is retained for 30 days (grace period for reactivation or export), then permanently deleted. Deleted tenant data ages out of backups within the 30-day backup retention window.

10. International Data Transfers

Personal data is stored in the region where your Omni instance is deployed. If data is transferred outside your jurisdiction, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.

11. Term and Termination

This DPA remains in effect for the duration of your use of Omni services. Upon termination, we will delete all tenant data within the retention periods specified above. You may request a final data export before deletion.

12. Governing Law

This DPA is governed by the same governing law as the Terms of Service.

13. Contact

For data protection inquiries: privacy@idomni.app