Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Controller: the merchant entity that has installed Simple MFA on their BigCommerce storefront ("you", "Merchant", "Controller"); and
• Processor: The Bearded Developer Ltd, a company registered in England and Wales (company number 09866209), trading as Simple MFA ("we", "us", "Simple MFA", "Processor").

This DPA supplements and forms part of the Simple MFA Terms of Service. By installing or using Simple MFA you agree to this DPA. If you are accepting on behalf of a company, you represent that you have authority to bind that company.

2. Definitions

In this DPA:

• "Applicable Data Protection Law" means, as applicable: the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"); and any implementing legislation or successor legislation.
• "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", and "Processing" each have the meanings given in Applicable Data Protection Law.
• "EU SCCs" means the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914.
• "UK IDTA" means the International Data Transfer Agreement issued by the UK Information Commissioner's Office (version B1.0, March 2022), or any successor instrument.
• "Sub-processor" means any third party engaged by us to process Personal Data on your behalf in connection with the Service.
• "Service" means the Simple MFA authentication service as described in the Terms of Service.

3. Scope and details of processing

Subject matter	Provision of the Simple MFA hosted authentication service to the Merchant's BigCommerce storefront.
Nature of processing	Collection, storage, retrieval, verification, encryption, and deletion of authentication credentials and login activity data.
Purpose	To authenticate store customers on behalf of the Merchant via password and optional TOTP multi-factor authentication; to issue BigCommerce login sessions; to send transactional emails (magic links, password resets); and to provide the Merchant with authentication audit logs.
Duration	For the period during which the Merchant has Simple MFA installed. On uninstallation, Personal Data is permanently deleted within 30 days.
Types of Personal Data	Email addresses; PBKDF2-SHA256 password hashes (original password is never stored or recoverable); AES-GCM encrypted TOTP secrets; backup code hashes; IP addresses; browser user-agent strings; BigCommerce customer IDs; first name; last name.
Categories of Data Subjects	Customers of the Merchant's BigCommerce storefront who interact with the Simple MFA login, registration, or account management pages.

4. Processor obligations

4.1 Lawful instructions

We will process Personal Data only on your documented instructions, which include these Terms of Service, this DPA, and any additional written instructions you provide. If we are required by law to process Personal Data for another purpose, we will inform you before doing so unless prohibited by law from doing so.

4.2 Confidentiality

We will ensure that all personnel authorised to process Personal Data under this DPA are subject to binding confidentiality obligations and process the data only to the extent necessary to provide the Service.

4.3 Security

We will implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking into account the state of the art, costs, and the nature of the data. Those measures currently include:

• Password hashing using PBKDF2-SHA256 with a per-user salt (100,000 iterations) — the original password cannot be recovered from the stored hash.
• TOTP secrets encrypted using AES-GCM with a server-side encryption key before storage.
• All data in transit protected by TLS 1.2 or higher.
• Authentication attempt rate limiting and IP-based threat detection.
• Automatic purge of authentication logs (IP address, user agent, login outcome) after 90 days.
• Access to production systems restricted to authorised personnel only.

4.4 Sub-processors

You provide general authorisation for us to engage the Sub-processors listed in section 7. We will inform you of any intended changes to Sub-processors by updating this DPA and giving at least 30 days' notice via email or in-app notice. If you reasonably object to a new Sub-processor on data protection grounds, you may notify us in writing within 14 days. If we cannot accommodate your objection, you may terminate the Service without penalty on written notice.

We will impose data protection obligations on Sub-processors that are equivalent to those in this DPA and remain liable to you for their acts and omissions.

4.5 Data subject rights

We will promptly notify you of any data subject request received directly by us relating to Personal Data we process on your behalf. We will provide reasonable assistance to you in fulfilling your obligations to respond to such requests, including by making available the technical tools in the Simple MFA admin panel (credential deletion, MFA removal, trusted device removal, and login history).

4.6 Personal Data Breach notification

We will notify you without undue delay — and in any event within 72 hours of becoming aware — of a Personal Data Breach affecting Personal Data processed under this DPA. The notification will include, to the extent then known: the nature of the breach; the categories and approximate number of Data Subjects and records affected; likely consequences; and measures taken or proposed to address the breach and mitigate its effects.

4.7 Deletion and return

On termination of the Service, or on your written request, we will delete all Personal Data processed under this DPA within 30 days, unless Applicable Data Protection Law requires us to retain it for longer. We will confirm deletion in writing on request.

4.8 Audit and inspection

We will make available to you all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or a mandated auditor. You agree to: give at least 30 days' prior written notice; conduct any audit during business hours without unreasonable disruption; and keep the results confidential. We may recover our reasonable costs of supporting any audit from you.

5. Controller obligations

You represent and warrant that:

• You have a lawful basis under Applicable Data Protection Law for the Personal Data you direct us to process.
• You have provided Data Subjects with appropriate notice (including in your own privacy policy) of the processing described in this DPA.
• You will comply with your obligations as a Controller under Applicable Data Protection Law, including responding to data subject requests that fall within your responsibility.
• You will provide us with any additional instructions required by changes in Applicable Data Protection Law in sufficient time for us to comply.

6. International transfers

Personal Data processed under this DPA may be transferred to and stored in the United States, where our infrastructure and Sub-processors are located. Such transfers are made under the mechanisms set out below.

6.1 EU merchants (GDPR)

For transfers of Personal Data from the European Economic Area to the United States, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller to Processor) are incorporated into this DPA by reference. You are the "data exporter" (Controller) and we are the "data importer" (Processor). The applicable annexes are as follows:

• Annex I.A (Parties): as set out in section 1 of this DPA.
• Annex I.B (Description of transfer): as set out in section 3 of this DPA.
• Annex I.C (Competent supervisory authority): the supervisory authority of the EU member state in which the Controller is established, or the Irish Data Protection Commission where the Controller is not established in the EU.
• Annex II (Technical and organisational measures): as set out in section 4.3 of this DPA.
• Annex III (Sub-processors): as set out in section 7 of this DPA.

In the event of any conflict between the EU SCCs and this DPA, the EU SCCs shall prevail.

6.2 UK merchants (UK GDPR)

For transfers of Personal Data from the United Kingdom to the United States, the UK International Data Transfer Agreement (ICO, version B1.0, March 2022) is incorporated into this DPA by reference. The "Exporter" is you (Controller) and the "Importer" is The Bearded Developer Ltd (Processor). The tables required by the IDTA are populated as follows:

• Table 1 (Parties): as set out in section 1 of this DPA.
• Table 2 (Selected SCCs): the EU SCCs, Module 2 (Controller to Processor), as described in section 6.1.
• Table 3 (Appendix information): as set out in sections 3 and 4.3 of this DPA.
• Table 4 (Ending the IDTA): either party may end the IDTA as set out in section 19 of the IDTA.

7. Sub-processors

The following Sub-processors are authorised under this DPA:

Sub-processor	Role	Country	Transfer mechanism
Cloudflare, Inc.	Serverless compute (Workers), database (D1), CDN and DDoS protection	USA	EU SCCs / UK IDTA (Cloudflare DPA)
Resend, Inc.	Transactional email delivery (magic links, password resets)	USA	EU SCCs / UK IDTA (Resend DPA)
Stripe, Inc.	Payment processing and billing	USA	EU SCCs / UK IDTA (Stripe DPA)
BigCommerce Pty Ltd	E-commerce platform API (customer lookup, session creation)	USA	EU SCCs / UK IDTA (BigCommerce DPA)

Each Sub-processor's own Data Processing Agreement and Standard Contractual Clauses are available on their respective websites. Our use of each Sub-processor is subject to their applicable DPA terms.

8. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits either party's liability where such limitation is not permitted by Applicable Data Protection Law (including in respect of the EU SCCs or UK IDTA).

9. Term and termination

This DPA remains in force for as long as we process Personal Data on your behalf. It terminates automatically on termination of the Terms of Service. Sections 4.7 (deletion), 4.8 (audit), 6 (international transfers), and 8 (liability) survive termination.

10. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales, except where Applicable Data Protection Law requires a different governing law (in particular, the EU SCCs are governed by the law of the EU member state designated in Annex I.C). Any dispute arising under this DPA is subject to the exclusive jurisdiction of the courts of England and Wales, except as required otherwise by Applicable Data Protection Law.

11. Changes to this DPA

We may update this DPA from time to time to reflect changes in Applicable Data Protection Law or our processing activities. We will give at least 30 days' notice of material changes via email or in-app notice. Continued use of the Service after a change takes effect constitutes acceptance.

Contact

For any questions about this DPA or your data protection rights: [email protected]