This Data Processing Addendum ("DPA") forms part of the agreement between a merchant using AffiliConnex ("Customer") and BlueConneX Corp, operator of AffiliConnex ("Processor"), to the extent AffiliConnex processes personal data on Customer's behalf.
1. Scope and roles
Customer determines the purposes and essential means of its affiliate program and is the controller/business where applicable. AffiliConnex processes Customer Personal Data to provide the service and acts as processor/service provider/contractor to the extent required by applicable data-protection law. Each party remains responsible for its independent legal obligations.
2. Documented instructions
AffiliConnex will process Customer Personal Data only on documented instructions from Customer, including the Terms, configured program settings, API calls, support requests, and other written instructions, unless processing is required by applicable law. If legally permitted, AffiliConnex will notify Customer of such a legal requirement before processing.
3. Confidentiality
Persons authorized to process Customer Personal Data will be subject to appropriate confidentiality obligations and will receive access only as reasonably necessary for their duties.
4. Security measures
AffiliConnex will maintain reasonable technical and organizational measures appropriate to the risk, including access controls, tenant-aware authorization, credential hashing, encryption of selected stored secrets, rate limiting, session protections, audit logging, least-privilege database access, secure API authentication, change controls, and guarded production-launch procedures. Additional measures are summarized in Annex B.
5. Subprocessors
Customer provides general authorization for AffiliConnex to use subprocessors necessary to deliver the service. AffiliConnex will impose data-protection obligations appropriate to the services performed by each subprocessor. For material new or replacement subprocessors affecting Customer Personal Data, AffiliConnex will provide reasonable notice through the service or another written channel where required, giving Customer an opportunity to raise a reasonable data-protection objection.
6. Data-subject requests
Taking into account the nature of the processing, AffiliConnex will provide reasonable assistance to Customer in responding to verified requests to exercise data-protection rights where Customer cannot reasonably fulfill the request without AffiliConnex's assistance. AffiliConnex may direct an individual to the relevant merchant when the merchant controls the underlying affiliate-program data.
7. Security incidents
AffiliConnex will notify Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data and will provide reasonably available information needed for Customer to meet applicable notification obligations. Notification is not an admission of fault or liability.
8. Compliance assistance
Taking into account the nature of processing and information available to AffiliConnex, AffiliConnex will provide reasonable assistance with Customer's obligations concerning security, breach response, data-protection impact assessments, and regulator consultation where applicable to the service.
9. Return and deletion
At the end of the service, AffiliConnex will delete, return, or anonymize Customer Personal Data within a commercially reasonable period upon Customer's verified instruction, unless retention is required or reasonably necessary for law, accounting, security, fraud prevention, backup integrity, or dispute resolution. Data in backups may remain until overwritten under normal backup cycles and will remain protected while retained.
10. Audits and information
AffiliConnex will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Audit requests should be proportionate, protect other customers and confidential information, and ordinarily use current security documentation, questionnaires, or independent reports before requesting intrusive inspection.
11. International transfers
If Customer Personal Data subject to transfer restrictions is transferred to a country without an applicable adequacy decision, the parties will use a legally recognized transfer mechanism where required, which may include applicable standard contractual clauses and supplementary safeguards.
12. U.S. state privacy terms
To the extent the CCPA or similar U.S. state law applies and AffiliConnex acts as a service provider or contractor, AffiliConnex will process personal information for the limited and specified business purposes described in the agreement; will not sell or share that personal information for cross-context behavioral advertising; will not retain, use, or disclose it outside the direct business relationship except as permitted by law; and will not combine it with personal information received from another person or collected from AffiliConnex's own consumer interactions except as legally permitted for service-provider/contractor purposes.
13. Customer responsibilities
Customer is responsible for having a lawful basis for collection and processing, providing required notices, obtaining required consent, configuring retention and tracking lawfully, responding to individuals where Customer is the controller/business, and ensuring its affiliate program and marketing practices comply with applicable law.
14. Precedence
If this DPA conflicts with the Terms concerning processing of Customer Personal Data, this DPA controls to the extent of the conflict. Mandatory provisions of applicable data-protection law control over inconsistent contractual language.
Annex A — Processing details
| Subject matter | Operation of affiliate-program software and related merchant/affiliate support. |
|---|---|
| Duration | For the term of the merchant relationship plus applicable return, deletion, backup, legal, security, and dispute-retention periods. |
| Nature and purpose | Account administration; affiliate applications and portals; referral attribution; order/conversion reporting; commission calculation and adjustment; payout preparation; email invitations; security; support; billing administration. |
| Data subjects | Merchant users, affiliates/applicants, referred website visitors/customers represented in order and attribution records, and support contacts. |
| Data categories | Identifiers/contact information; affiliate profile and referral information; click/visitor-token data; device/network metadata; order/conversion amounts and IDs; commission/payout records; support/application communications; account and security logs. |
| Sensitive data | The service is not designed for merchants to intentionally submit special-category or highly sensitive personal data unless separately agreed and appropriately protected. |
Annex B — Security measures
- Role-based merchant access and tenant isolation.
- Password hashing and hashed one-time tokens/API credentials.
- Rate limits on authentication and public forms.
- Authenticated server-to-server APIs with scoped credentials.
- Audit logging for administrative, security, lifecycle, and API events.
- Session idle/lifetime controls and periodic session-ID rotation.
- Least-privilege application database access.
- Controlled TEST versus LIVE states and explicit production-launch confirmation.
- Reasonable backup, monitoring, patching, and incident-response practices appropriate to the hosting environment.
Annex C — Subprocessors
AffiliConnex may use infrastructure hosting, database, transactional email, monitoring/security, and payment-processing providers as subprocessors when those services are enabled for production use. BlueConneX Corp maintains the current operational subprocessor list and will provide it through the support channel upon request. Providers configured only for development or TEST use are not treated as production subprocessors until they process production Customer Personal Data.