QUADPICK AI DATA PROCESSING ADDENDUM

Effective date: 29 September 2026

This Data Processing Addendum ("DPA") forms part of the QuadPick AI Terms of Service ("Terms") and applies where Brix + Bailey Technology Limited processes Personal Data on behalf of a Merchant in connection with QuadPick AI (internal working title "PEARL").

1. Parties

This DPA is between:

Brix + Bailey Technology Limited, company number 10234158, whose registered office is at Suite 1, 24-25 Barnack Business Centre, Blakey Road, Salisbury, SP1 2LP ("QuadPick AI", "we", "us", "Processor");

and

the person or organisation that installs, subscribes to or uses QuadPick AI ("Merchant", "you", "Controller").

If the Merchant is itself acting as a processor on behalf of another controller, references in this DPA to QuadPick AI as Processor include QuadPick AI acting as a subprocessor where appropriate.

2. Definitions

In this DPA:

Applicable Data Protection Law means all privacy and data-protection laws applicable to the Processing, including, where applicable, the UK GDPR, the Data Protection Act 2018, the EU GDPR and applicable national legislation implementing or supplementing those laws.

Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach and Supervisory Authority have the meanings given to them under Applicable Data Protection Law.

Merchant Data means data supplied by the Merchant or made available to QuadPick AI through the Merchant's authorised Shopify account.

Protected Customer Data means information classified by Shopify as protected customer data.

Subprocessor means another processor engaged by QuadPick AI to Process Personal Data on behalf of the Merchant.

3. Roles of the parties

For Personal Data processed by QuadPick AI solely to provide QuadPick AI to a Merchant:

1. the Merchant is the Controller; and
2. QuadPick AI is the Processor.

The Merchant determines the purposes for which QuadPick AI is enabled and the Shopify permissions and functionality authorised by the Merchant.

QuadPick AI may separately act as an independent Controller for limited Personal Data required to operate its own business relationship with the Merchant, including business contact information, account administration, billing records, support communications, fraud prevention, security administration and legal or compliance records.

QuadPick AI's independent Controller activities are described in the QuadPick AI Privacy Policy and are outside the processor provisions of this DPA.

4. Processing instructions

QuadPick AI will Process Personal Data only:

1. on the Merchant's documented instructions;
2. as necessary to provide, secure and support the QuadPick AI functionality selected by the Merchant;
3. as provided in the Terms and this DPA; or
4. where required by applicable law.

The Merchant's installation, configuration and authorised use of QuadPick AI constitute documented instructions to Process Personal Data as necessary to provide the selected functionality.

If applicable law requires QuadPick AI to Process Personal Data otherwise than on the Merchant's documented instructions, QuadPick AI will inform the Merchant before carrying out that Processing unless prohibited by law.

QuadPick AI will promptly inform the Merchant if, in QuadPick AI's reasonable opinion, a Processing instruction infringes Applicable Data Protection Law.

5. Purpose limitation

QuadPick AI will Process Personal Data only for purposes necessary to provide, operate, secure and support QuadPick AI and to comply with applicable legal obligations.

QuadPick AI will not:

• sell Merchant customer Personal Data;
• share Merchant customer Personal Data for cross-context behavioural advertising;
• use Merchant customer Personal Data to create advertising profiles;
• use Merchant customer Personal Data for an unrelated independent commercial purpose; or
• combine Merchant customer Personal Data with unrelated customer datasets for independent profiling.

6. QuadPick AI order processing

Where the Merchant enables QuadPick AI's optional order-derived functionality, the Merchant instructs QuadPick AI to access the minimum Shopify order information necessary to identify products purchased together and to show shoppers how many times a suggested product was bought together with the product it is suggested for (only for pairs bought together in at least three qualifying orders), to report to the Merchant the orders, items and sales value that QuadPick AI's suggestions assisted and, where the Merchant has switched on public discovery pages, to rank which of the Merchant's products' public discovery pages are listed in the sitemap and on the public discovery index page using aggregated per-product order counts.

Those purposes do not need line-item quantities; QuadPick AI currently reads them only to calculate the per-product unit count described below, which no current feature of the Service uses.

This Processing may include:

• limited order metadata;
• technical order identifiers where temporarily necessary to distinguish one order from another;
• line-item product or variant identifiers and quantities;
• order and line-item amounts and the order currency;
• order custom attributes, of which QuadPick AI uses only the marker it adds to the cart when a product is added from one of its suggestions;
• product-to-product associations and per-product order and unit counts derived from qualifying orders; and
• daily totals of the orders, items and sales value that QuadPick AI's suggestions assisted.

QuadPick AI does not require customer:

• names;
• email addresses;
• telephone numbers;
• billing addresses; or
• shipping addresses

for this functionality.

QuadPick AI will not intentionally request those fields for this Processing.

Underlying order information is processed transiently for the purpose of calculating product-to-product relationships, per-product order counts and assisted-sales totals.

QuadPick AI does not retain an order-level customer dataset after the relevant processing operation is complete.

QuadPick AI retains product-level relationship information, per-product order counts, daily assisted-sales totals and associated aggregate metrics required to provide the Service. With each per-product order count it also stores the number of units of that product in those orders, which no current feature of the Service uses.

If the Merchant switches the order-derived functionality off, QuadPick AI no longer has access to order information and, from the next time the ranking is rebuilt, stops using per-product order counts to rank public discovery pages, but the product-to-product associations from its most recent calculation, including the bought-together counts shown to shoppers, stay in use until the first calculation after the functionality is switched back on, or until the Merchant's data is erased.

Per-product order counts, and the ranking order of public discovery pages they contribute to, are not published.

QuadPick AI applies minimum aggregation and small-cell suppression controls before qualifying order-derived relationships are retained or used.

7. Artificial intelligence processing

QuadPick AI may use artificial intelligence to analyse Merchant catalogue and product information.

QuadPick AI currently uses Anthropic's commercial API for that purpose.

The AI processing path is logically separated from QuadPick AI's Shopify order-analysis path.

QuadPick AI does not intentionally submit Shopify order-level Protected Customer Data, customer identities, customer contact information or customer purchasing histories to Anthropic for catalogue analysis.

Information submitted to Anthropic is limited to the Merchant's catalogue and product information required for the relevant AI function.

If catalogue information supplied or authorised by the Merchant itself contains Personal Data, that Personal Data may be processed by Anthropic solely to the extent required to provide the relevant AI functionality.

8. Confidentiality

QuadPick AI will ensure that persons authorised to Process Personal Data:

1. are subject to contractual or statutory duties of confidentiality;
2. have access only where reasonably necessary for their role; and
3. are informed of applicable data-protection and security obligations.

9. Security

QuadPick AI will implement and maintain appropriate technical and organisational measures designed to provide a level of security appropriate to the risk of the Processing.

Measures include, as appropriate:

• encryption of data in transit;
• encryption of stored data;
• managed cryptographic key protection;
• logical separation between Merchant tenants;
• controlled and least-privilege production access;
• secure authentication;
• data minimisation;
• segregation of order Processing from AI catalogue Processing;
• retention and deletion controls;
• security and operational monitoring;
• dependency and vulnerability management;
• controlled production deployment;
• incident-response procedures; and
• measures designed to maintain the confidentiality, integrity and availability of the Service.

Further details are set out in Schedule 3.

10. Subprocessors

The Merchant gives QuadPick AI general written authorisation to use the Subprocessors listed in Schedule 2.

QuadPick AI will ensure that each Subprocessor which Processes Personal Data on QuadPick AI's behalf is bound by written data-protection obligations providing an appropriate and substantially equivalent level of protection for the Personal Data relevant to the service performed.

QuadPick AI remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law.

QuadPick AI will maintain an up-to-date Subprocessor list.

QuadPick AI may appoint or replace a Subprocessor where reasonably necessary to provide the Service.

QuadPick AI will provide reasonable prior notice of a material new Subprocessor that will Process Personal Data on behalf of Merchants.

The Merchant may object to a new Subprocessor within 15 days of receiving notice where the objection is based on reasonable and documented data-protection grounds.

QuadPick AI and the Merchant will work in good faith to address a valid objection.

If QuadPick AI cannot reasonably provide the relevant functionality without the Subprocessor, the Merchant may discontinue that functionality or terminate the Service.

11. Data Subject requests

Taking into account the nature of QuadPick AI's Processing, QuadPick AI will provide reasonable technical and organisational assistance to enable the Merchant to respond to Data Subject requests under Applicable Data Protection Law.

Where QuadPick AI receives a request directly from an individual concerning Personal Data processed solely on behalf of a Merchant, QuadPick AI may direct that individual to the relevant Merchant unless QuadPick AI is legally required to respond directly.

QuadPick AI supports Shopify's applicable privacy and compliance mechanisms, including:

• customers/data_request;
• customers/redact; and
• shop/redact.

Where QuadPick AI holds no customer-specific Personal Data responsive to a request, QuadPick AI may record that no responsive retained customer data exists.

12. Personal Data Breaches

QuadPick AI will notify the Merchant without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.

To the extent reasonably available, QuadPick AI will provide information concerning:

• the nature of the breach;
• the categories of affected Personal Data;
• the categories and approximate number of affected Data Subjects where ascertainable;
• likely consequences;
• measures taken or proposed to contain and remediate the incident; and
• relevant contact information.

QuadPick AI will take reasonable steps to investigate, contain and remediate the breach.

Notification under this clause does not constitute an admission of fault or liability.

13. Assistance to the Merchant

Taking into account the nature of the Processing and information available to QuadPick AI, QuadPick AI will provide reasonable assistance with the Merchant's obligations concerning:

• security of Processing;
• Data Subject rights;
• Personal Data Breach assessment and notification;
• data protection impact assessments;
• prior consultation with Supervisory Authorities; and
• demonstrating compliance with applicable processor obligations.

14. Retention, return and deletion

QuadPick AI will not retain Personal Data for longer than is reasonably necessary for the purpose for which it is Processed.

Shopify order information used for co-purchase calculations, assisted-sales reporting and public discovery page ranking is intended to be transiently Processed and is not retained by QuadPick AI as an underlying order-level customer dataset.

Upon uninstall or termination, QuadPick AI will delete tenant-specific Merchant Data under its control in accordance with its deletion process unless:

1. continued retention is required by applicable law;
2. limited retention is reasonably necessary for the establishment, exercise or defence of legal claims; or
3. the information has been transformed so that it no longer constitutes Personal Data.

Where data is retained under paragraph 1 or 2, QuadPick AI will restrict further Processing to the applicable retention purpose and continue to protect the information.

Where a Subprocessor maintains unavoidable backup, security or disaster-recovery copies following deletion from active systems, those copies remain subject to applicable contractual security and retention controls and will not be returned to active use except where reasonably necessary for recovery, security or legal compliance.

At the Merchant's written request made before termination, QuadPick AI will provide a reasonable means to obtain Merchant Data that QuadPick AI is technically able and contractually required to return.

15. Audits and compliance information

QuadPick AI will make available information reasonably necessary to demonstrate compliance with the Processor obligations applicable to the Processing under this DPA.

QuadPick AI may satisfy an audit request initially by supplying relevant:

• security documentation;
• compliance information;
• policies;
• third-party assurance documentation; or
• written responses.

Where that information is reasonably sufficient to demonstrate compliance, the Merchant will not require an intrusive audit.

Where an additional audit is reasonably required by Applicable Data Protection Law or a competent Supervisory Authority, QuadPick AI will permit and contribute to a proportionate audit conducted by the Merchant or an independent auditor appointed by the Merchant.

Audits must:

• be subject to reasonable prior notice unless an urgent regulatory or security reason prevents it;
• take place during normal business hours;
• be limited to systems and information relevant to the Merchant;
• protect QuadPick AI's confidential information and security;
• avoid access to another Merchant's data; and
• avoid unreasonable disruption to the Service.

16. International transfers

QuadPick AI may use Subprocessors whose support, management or Processing activities involve countries outside the United Kingdom or European Economic Area.

QuadPick AI will ensure that restricted international transfers of Personal Data use an appropriate lawful transfer mechanism where required.

Such mechanisms may include:

• UK adequacy regulations;
• European Commission adequacy decisions;
• an applicable recognised data-transfer framework;
• the European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• the UK International Data Transfer Agreement; or
• another transfer mechanism recognised under Applicable Data Protection Law.

QuadPick AI will take reasonable steps to ensure that applicable Subprocessor contracts contain the transfer safeguards required for their Processing.

17. Records and regulatory cooperation

QuadPick AI will maintain records concerning its Processing activities where required by Applicable Data Protection Law.

QuadPick AI will cooperate with a competent Supervisory Authority in relation to Processing carried out under this DPA where legally required.

18. Controller responsibilities

The Merchant is responsible for:

1. ensuring that its instructions to QuadPick AI comply with Applicable Data Protection Law;
2. establishing an appropriate lawful basis for Personal Data it instructs QuadPick AI to Process;
3. providing required notices to its customers and other Data Subjects;
4. ensuring that the Shopify scopes and QuadPick AI functionality it enables are appropriate for its purposes;
5. responding to Data Subject requests as Controller;
6. determining whether a data protection impact assessment is required for its use of QuadPick AI; and
7. not intentionally submitting special-category or highly sensitive Personal Data to QuadPick AI unless QuadPick AI has expressly agreed in writing to support such Processing.

19. Special-category data

QuadPick AI does not require special-category Personal Data to provide its normal functionality.

The Merchant must not intentionally instruct QuadPick AI to Process special-category Personal Data unless QuadPick AI has expressly agreed to that Processing in writing and appropriate safeguards have been implemented.

20. US state privacy laws

Where QuadPick AI Processes Personal Data subject to a US state privacy law under which QuadPick AI qualifies as a processor, service provider or contractor, QuadPick AI will Process that information solely for the purposes specified in the Terms, this DPA and the Merchant's documented instructions.

QuadPick AI will not sell such Personal Data or share it for cross-context behavioural advertising.

QuadPick AI will not retain, use or disclose such Personal Data outside its direct business relationship with the Merchant except where permitted or required by applicable law.

21. Liability

Liability arising from this DPA is subject to the liability provisions of the QuadPick AI Terms of Service except to the extent a contractual limitation is prohibited by Applicable Data Protection Law.

Nothing in this DPA limits the rights of Data Subjects or the statutory powers of a competent Supervisory Authority.

22. Precedence

If there is a conflict relating to Personal Data between:

1. mandatory Applicable Data Protection Law or binding transfer clauses;
2. this DPA; and
3. the QuadPick AI Terms of Service,

the documents prevail in that order to the extent of the conflict.

23. Duration

This DPA takes effect when QuadPick AI begins Processing Personal Data on behalf of the Merchant.

It continues for as long as QuadPick AI Processes Personal Data on behalf of the Merchant.

SCHEDULE 1

DETAILS OF PROCESSING

Subject matter

Provision of QuadPick AI, a Shopify application that derives product-to-product relationships within a Merchant's own catalogue, including optional analysis of the Merchant's Shopify order information to derive product co-purchase relationships (including counts, shown to shoppers, of how many times a suggested product was bought together with the product it is suggested for), to report the orders, items and sales value that QuadPick AI's suggestions assisted and to rank which of the Merchant's products' public discovery pages are listed in the sitemap and on the public discovery index page.

Duration

For the period during which QuadPick AI Processes Personal Data to provide the Service and for any limited period reasonably necessary to complete deletion or meet applicable legal obligations following termination.

Nature of Processing

Processing may include:

• accessing;
• receiving;
• reading;
• transmitting;
• organising;
• analysing;
• aggregating;
• temporarily holding data in memory;
• storing product-level outputs and aggregate totals;
• securing; and
• deleting information.

Purpose

To provide, operate, secure, maintain and support QuadPick AI and the functionality selected by the Merchant.

Categories of Data Subjects

Depending on the functionality enabled:

• individuals who place orders with the Merchant; and
• Merchant personnel and authorised users.

Categories of Personal Data

Depending on the functionality enabled:

• limited Shopify order metadata;
• transient technical order identifiers;
• line-item product or variant associations and quantities;
• order and line-item amounts and currency;
• order custom attributes, of which only QuadPick AI's own marker is used;
• Merchant account and administrative information;
• technical information reasonably necessary to operate and secure the Service; and
• Personal Data incidentally contained in Merchant catalogue content.

The order-derived functionality does not require customer names, email addresses, telephone numbers, billing addresses or shipping addresses.

Special-category Personal Data

None is intentionally required or requested.

Frequency

As required when the Merchant uses or refreshes the applicable QuadPick AI functionality.

Retention

Underlying order-level information used for co-purchase analysis, assisted-sales reporting and public discovery page ranking is transiently processed.

QuadPick AI retains the resulting product-level relationships and aggregate information required to provide the Service.

Tenant-specific Merchant Data is deleted following uninstall or termination subject to the limited exceptions specified in this DPA.

SCHEDULE 2

SUBPROCESSORS

Railway Corporation

Service: Production application hosting, database and associated infrastructure.

QuadPick AI deployment region: EU West Metal, Amsterdam, Netherlands.

Purpose: Hosting and operation of QuadPick AI's production application, database and related infrastructure.

Data: Merchant Data and QuadPick AI application data as necessary to provide the Service.

International Processing: Railway may conduct supporting or primary Processing operations in the United States notwithstanding the selected Amsterdam deployment region.

Safeguards: Railway Data Processing Addendum and applicable international-transfer provisions, including EU Standard Contractual Clauses and UK transfer provisions where required.

Anthropic Ireland, Limited and applicable Anthropic affiliates

Service: Anthropic commercial API.

Purpose: Artificial-intelligence inference used to analyse Merchant catalogue and product information.

Data: Merchant catalogue and product content submitted by QuadPick AI for the relevant AI functionality.

Excluded from QuadPick AI's AI path: Shopify order-level Protected Customer Data, customer identity information, customer contact information and customer purchasing histories are not intentionally submitted by QuadPick AI to Anthropic.

Processing locations: Anthropic may process commercial API data using infrastructure in the United States, Europe, Asia and Australia and currently states that standard commercial API data storage is in the United States unless otherwise agreed.

Standard API retention: Anthropic currently states that standard API inputs and outputs are automatically deleted from its backend within 30 days, subject to its stated contractual, safety and legal exceptions and any different agreed retention arrangement.

Safeguards: Anthropic Commercial Terms and incorporated Data Processing Addendum, including applicable Standard Contractual Clauses and UK transfer provisions.

Amazon Web Services EMEA SARL and applicable AWS affiliates

Service: AWS Key Management Service and related security infrastructure.

QuadPick AI configuration: Relevant key-management services are configured in the AWS eu-central-1 region.

Purpose: Cryptographic key management, signing and related security functions.

Data: Cryptographic key material, identifiers and associated service metadata required to provide the security function.

QuadPick AI does not use AWS KMS as an AI or customer-order analytics processor.

Safeguards: AWS Data Processing Addendum, incorporated transfer safeguards and applicable Standard Contractual Clauses and UK transfer provisions.

Shopify

Shopify is not listed as a QuadPick AI Subprocessor merely because a Merchant uses Shopify.

The Merchant has its own relationship with Shopify and instructs QuadPick AI, through the permissions granted to the application, to obtain relevant Merchant Data from Shopify.

SCHEDULE 3

TECHNICAL AND ORGANISATIONAL MEASURES

QuadPick AI maintains measures proportionate to the nature of its Processing and the associated risk.

Data minimisation

QuadPick AI limits Shopify API access and Processing to data required for the functionality provided, except line-item order quantities, which it currently reads only to calculate the unused per-product unit count described in section 6.

The order-derived functions do not require customer names, email addresses, telephone numbers, billing addresses or shipping addresses.

Transient order Processing

Underlying order information used for co-purchase analysis, assisted-sales reporting and public discovery page ranking is processed transiently and is not retained as an order-level customer dataset.

Aggregation and small-cell suppression

QuadPick AI applies a minimum aggregation threshold before order-derived product associations qualify for retention or use.

Separation of Processing paths

Shopify order-derived Processing is separated from AI catalogue analysis.

QuadPick AI does not intentionally send Shopify customer or order-level Protected Customer Data to Anthropic.

European production deployment

QuadPick AI's production Railway services containing Merchant Data are configured in Railway's Amsterdam, Netherlands region.

Encryption

QuadPick AI uses encrypted network connections for data in transit and encryption at rest where applicable.

Key management

Cryptographic key functions use managed key-management infrastructure configured in an EU AWS region.

Access control

Production access is restricted to authorised persons and systems with a legitimate operational requirement.

Tenant separation

Merchant data is logically separated within QuadPick AI's multi-tenant application architecture.

Logging and monitoring

Operational and security logging is used to support availability, security, troubleshooting and incident investigation.

QuadPick AI applies data-minimisation principles to information recorded in logs.

Vulnerability and dependency management

QuadPick AI maintains processes for identifying and addressing relevant software vulnerabilities and dependency risks.

Incident response

QuadPick AI maintains procedures for identifying, investigating, containing, remediating and documenting security incidents.

Retention and deletion

QuadPick AI maintains retention and deletion controls designed to prevent Personal Data being retained beyond the period reasonably required for its Processing purpose.

Uninstallation

QuadPick AI's uninstall process is designed to remove the Merchant's tenant-specific active application data and QuadPick AI-controlled tenant key records, subject to legally required retention and applicable protected backup copies.

CONTACT

Data-protection enquiries relating to this DPA should be sent to:

Brix + Bailey Technology Limited
Suite 1, 24-25 Barnack Business Centre, Blakey Road, Salisbury, SP1 2LP
Email: mail@brixbailey.com