Data Processing Addendum
Effective date: August 12, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the merchant accepting those terms ("Merchant") and FarmBot Inc, a California benefit corporation doing business as 100x Apps ("100x Apps"), for 100x Media Manager (the "Service"). It applies when 100x Apps processes Personal Data on Merchant's behalf. Capitalized terms not defined here have the meanings in the Terms or applicable Data Protection Law.
1. Roles and instructions
Merchant is the Controller or Business and 100x Apps is the Processor or Service Provider for Merchant Personal Data. Merchant instructs 100x Apps to process that data only to provide, secure, support, and improve the Service for Merchant; comply with documented settings and publication instructions; and meet legal obligations. The Terms, this DPA, the Service configuration, and authorized user actions are Merchant's documented instructions.
Merchant is responsible for the lawfulness, accuracy, and scope of Merchant Personal Data and for providing notices and obtaining consents required by law. If 100x Apps believes an instruction violates Data Protection Law, it may suspend that instruction and notify Merchant unless prohibited by law.
2. Processing details
- Subject and duration. Content collection, organization, analysis, generation, scheduling, publishing, support, security, billing administration, export, and deletion for the term of the Service and the bounded retention periods in the Privacy Policy.
- Nature and purpose. Hosting, importing, synchronizing, deduplicating, searching, transforming, generating, transmitting, backing up, restoring, troubleshooting, and deleting data as requested through the Service.
- Data subjects. Merchant personnel and authorized users; people appearing in, speaking in, authoring, or referenced by Merchant Content; and other individuals whose information Merchant chooses to process.
- Data categories. Shopify store and user identifiers; contact and support information; product, brand, source, campaign, publication, and audit records; text, images, video, audio, metadata, and generated enrichments; IP address and device or security events; connected-account identifiers and encrypted authorization credentials.
- Sensitive data. The Service is not designed for payment-card data, government identifiers, health data, private keys, passwords, or other sensitive personal data. Merchant must not submit such data unless 100x Apps has agreed in writing to appropriate additional safeguards.
3. Confidentiality and security
100x Apps will ensure that personnel authorized to process Merchant Personal Data are bound by confidentiality obligations and receive access only as needed. 100x Apps maintains reasonable administrative, technical, and organizational safeguards appropriate to the risk, including tenant-scoped authorization, encryption in transit, encrypted OAuth and provider credentials, managed key protection, private object storage, signed media access, audit records, least-privilege service identities, monitored production health, and tested backup and recovery procedures.
4. Subprocessors
Merchant gives general authorization for 100x Apps to engage the subprocessors listed in the Privacy Policy. 100x Apps will impose data-protection obligations appropriate to each subprocessor's services and remains responsible for its obligations under this DPA. Before a material new subprocessor processes Merchant Personal Data, 100x Apps will update the list and provide notice in the Service or by email when reasonably practicable.
Merchant may object on reasonable data-protection grounds by contacting contact@100x-apps.com within 14 days after notice. The parties will work in good faith on a reasonable alternative. If none is available, Merchant may stop the affected feature or terminate the Service and export its workspace before deletion.
5. Assistance and requests
Taking into account the nature of processing and information available, 100x Apps will reasonably assist Merchant with verified data-subject requests, security and breach obligations, data-protection impact assessments, and regulator consultations required by Data Protection Law. If a data subject contacts 100x Apps about Merchant Personal Data, 100x Apps will direct the request to Merchant unless legally required to respond.
6. Security incidents
100x Apps will notify Merchant without undue delay after confirming a Personal Data Breach affecting Merchant Personal Data. The notice will include available information about the nature of the incident, likely consequences, affected data, containment or remediation, and a contact for follow-up. Notification is not an admission of fault. Merchant is responsible for notifications it is legally required to make as Controller.
7. Return, export, and deletion
Merchant can request a complete workspace export from Settings → Data management → Export your data. On termination or a valid Shopify redaction request, 100x Apps will delete or render unavailable Merchant Personal Data as described in the Privacy Policy, unless law requires retention. Restricted recovery copies expire on the documented schedules and are not restored for ordinary processing.
8. International transfers
Where Data Protection Law requires a transfer mechanism, the parties incorporate the applicable 2021 European Commission Standard Contractual Clauses, using Module Two for Controller-to-Processor transfers or Module Three for Processor-to-Processor transfers. This DPA and the Terms complete the annexes: the parties and processing are described here and in the Terms; the competent supervisory authority and governing member state are determined by applicable law; the security measures are described in Section 3; and approved subprocessors are listed in the Privacy Policy. The UK Addendum applies to restricted transfers subject to UK law. These mechanisms apply only to the extent legally required.
9. United States privacy laws
For U.S. state privacy laws, 100x Apps acts as Merchant's Service Provider or Processor. It will not sell or share Merchant Personal Data for cross-context behavioral advertising; retain, use, or disclose it outside the business purposes in this DPA except as permitted by law; or combine it with personal data received from another person except as permitted to provide the Service. 100x Apps will notify Merchant if it can no longer meet these obligations and will permit reasonable steps to stop and remediate unauthorized use.
10. Demonstrating compliance
On reasonable written request, no more than once annually unless an incident or regulator requires otherwise, 100x Apps will provide information reasonably necessary to demonstrate compliance. If that information is insufficient, Merchant may conduct a narrowly scoped audit during normal business hours, subject to confidentiality, security, non-interference, and reimbursement of reasonable costs. Audits may not expose another merchant's data, provider secrets, or security-sensitive details.
11. Order of precedence and liability
If this DPA conflicts with the Terms regarding processing of Merchant Personal Data, this DPA controls. The liability limitations and dispute terms in the Terms apply to this DPA to the maximum extent permitted by law.
12. Contact
FarmBot Inc dba 100x Apps
75 Higuera Street, Suite 105
San Luis Obispo, CA 93401, United States
contact@100x-apps.com