Skip to content
// LEGAL

Data Processing Addendum

Dollarlabs — an alias of LESLETECH VENTURES PRIVATE LIMITED

Data Processing Addendum — Policy No: 1

Effective Date: Last Updated:
Policy Name:
Data Processing Addendum
Updated:
Issued By:
Dollarlabs
Owner:
Abel Lesle

Data Processing Addendum

Version 1.0. Effective November 6, 2026

This Addendum forms part of the terms of service (the "Terms") between Lesletech Ventures Private Limited, trading as Dollarlabs, 227 Lakshmi Nagar, Coimbatore North, Saravanampatti, Coimbatore 641035, Tamil Nadu, India ("Lesletech") and the merchant using Discounts, B2B or Dollarback (each an "App") (the "Merchant"). It takes effect when the Merchant accepts the Terms or installs an App.

1. Scope

1.1 This Addendum applies to personal data Lesletech processes for the Merchant through an App ("Merchant Data"), as described in Annex I. The Merchant is the controller and Lesletech is its processor. GDPR terms have their GDPR meanings.

1.2 Lesletech is an independent controller of the Merchant's account and billing data and of email suppression records. Its privacy policy covers that data.

2. Lesletech's obligations

2.1 Lesletech will:

  • process Merchant Data only on the Merchant's documented instructions, including for international transfers, unless the law requires otherwise, in which case it will tell the Merchant first unless that law forbids it. The Terms, this Addendum and the Merchant's use of an App are those instructions;
  • ensure that people authorised to process Merchant Data are bound by confidentiality;
  • maintain the security measures in Annex II, which it may update provided the overall protection of Merchant Data is not materially reduced;
  • notify the Merchant without undue delay after becoming aware of a personal data breach affecting Merchant Data; and
  • make available the information reasonably needed to demonstrate compliance with Article 28 GDPR, and allow and contribute to audits under section 2.6.

2.2 Instructions. Lesletech will tell the Merchant if it believes an instruction infringes data protection law, and may suspend the affected processing until the Merchant withdraws the instruction or changes it to a lawful form. Lesletech is not in breach of the Terms or this Addendum while it does so.

2.3 Assistance. Taking into account the nature of the processing and the information available to it, Lesletech will help the Merchant, by appropriate technical and organisational measures and insofar as possible, to respond to data subject requests and to meet its security, breach notification, impact assessment and regulator consultation obligations. The features and settings of each App are the primary form of this help. Help beyond them is at the Merchant's reasonable cost.

2.4 Breaches. A breach notification by Lesletech is not an acknowledgement of fault or liability. As controller, the Merchant is responsible for any notification to supervisory authorities and data subjects.

2.5 Deletion. Lesletech will delete Merchant Data within 30 days after the Merchant uninstalls an App, or after a redaction request from Shopify or the Merchant, unless the law requires it to be kept. Copies in backups are deleted as the backups expire in their normal cycle, and stay protected under this Addendum until then. The Merchant should export any Merchant Data it needs through the App before it uninstalls. Lesletech is not required to return Merchant Data in any other form.

2.6 Audits. Lesletech will first meet an audit request by providing documentation of its security measures and by answering a reasonable written questionnaire. If the Merchant reasonably believes that this is not sufficient, it may conduct an audit no more than once in any 12 months, on at least 30 days' written notice, during normal business hours and without unreasonable disruption, at its own cost, either itself or through an independent auditor that is not a competitor of Lesletech and that is bound by confidentiality. An additional audit is allowed only where a supervisory authority requires it or after a personal data breach affecting Merchant Data. All information obtained in an audit is Lesletech's confidential information.

3. Merchant's obligations

3.1 The Merchant is responsible for, and warrants that:

  • it has a lawful basis for the processing of Merchant Data under this Addendum, and its instructions comply with data protection law;
  • it has given all notices to, and obtained all consents from, data subjects that the law requires, including for marketing emails and for any collection of date of birth;
  • Merchant Data it provides is accurate and collected lawfully; and
  • its use of services it connects to an App, which are its own vendors, complies with the law.

3.2 The Merchant must not use an App to collect or process special categories of personal data.

3.3 The Merchant is liable for, and will indemnify Lesletech against, claims, fines and losses that arise from a breach of this section 3 or from processing that Lesletech carries out on the Merchant's instructions.

4. Subprocessors

4.1 The Merchant gives general authorisation for Lesletech to use subprocessors. Annex III says how to get the current list.

4.2 Lesletech will give 30 days' notice of any new or replacement subprocessor by email to the address on the Merchant's account. The Merchant may object on reasonable data protection grounds in that time. If the objection is not resolved, the Merchant's sole remedy is to stop using the affected App, without a refund of fees already paid.

4.3 Lesletech will bind each subprocessor to data protection obligations no less protective than these, and remains liable for each subprocessor's performance, subject to section 6.3.

5. International transfers

5.1 Lesletech processes Merchant Data in India and in the countries shown in the subprocessor list. The Merchant authorises those transfers.

5.2 Where a transfer to Lesletech is restricted under the GDPR, the Standard Contractual Clauses in Decision (EU) 2021/914 (the "SCCs") apply, Module Two, or Module Three where the Merchant is a processor. Clause 7 does not apply. In Clause 9(a), Option 2 applies, with the notice period in section 4.2. The optional language in Clause 11(a) does not apply. Under Clauses 17 and 18, the law and courts of Ireland apply. The supervisory authority is determined under Clause 13. Annexes I and II of this Addendum complete SCC Annexes I and II.

5.3 For transfers subject to UK law, the UK International Data Transfer Addendum (version B1.0) applies, completed with the same information. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as the Swiss Federal Act on Data Protection and the Swiss FDPIC as the authority.

6. General

6.1 Where the CCPA applies, Lesletech is a service provider. It will not sell or share Merchant Data, or retain, use or disclose it outside its direct business relationship with the Merchant or for any purpose other than those in the Terms and this Addendum.

6.2 The SCCs prevail over this Addendum. On the processing of Merchant Data, this Addendum prevails over the Terms. On all other matters, the Terms prevail.

6.3 Each party's liability under this Addendum is subject to the limits in the Terms. This does not limit data subjects' rights.

6.4 Lesletech may update this Addendum on 30 days' notice if protection of Merchant Data is not reduced. Where a change is required by law or by a supervisory authority, Lesletech may make it at once and will give notice as soon as practicable.

Annex I: Processing

Exporter: the Merchant, as identified in its Shopify account (controller, or processor).

Importer: Lesletech, contact Abel Lesle, Founder, [email protected] (processor, or subprocessor).

Data subjects: the Merchant's customers and prospective customers, business contacts, referrers and referred people, and staff named in App records.

Personal data: identity and contact details; customer identifiers and tags; order and cart data; technical data such as IP address; email delivery records; business and tax details from forms and uploaded documents; credit, referral and membership data; date of birth if collected; wallet and device tokens; and personal data in files the Merchant uploads.

Sensitive data: none intended. See section 3.2.

Nature, purpose and frequency: continuous processing to provide the Apps.

Retention: while an App is in use, then until deleted under section 2.5.

Annex II: Security measures

  • Encryption of personal data in transit, and at rest in primary databases and file storage.
  • Access controls, with each merchant's data kept separate and production access limited to authorised people with individual credentials.
  • Network protections and restricted administrative access.
  • Secure storage of credentials and keys.
  • Database recovery capability.
  • Logging and monitoring of systems.

Annex III: Subprocessors

The current list, with each subprocessor's name, purpose, country and contact details, is available on request to [email protected]. Services that a Merchant connects itself are that Merchant's own vendors.