Data Processing Agreement

1. Definitions

• "Data Controller" (or "Controller") means the entity that determines the purposes and means of processing personal data. In this agreement, the Seller is the Data Controller for buyer transaction data.
• "Data Processor" (or "Processor") means the entity that processes personal data on behalf of the Controller. Famous Title acts as a Data Processor when handling buyer data on behalf of Sellers.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, including collection, storage, use, transmission, and deletion.
• "Sub-Processor" means a third party engaged by the Processor to process personal data on behalf of the Controller.
• "Data Subject" means the individual whose personal data is being processed (e.g., a buyer).

2. Scope & Purpose of Processing

This Data Processing Agreement ("DPA") governs the processing of personal data by Famous Title on behalf of Sellers who use the platform to sell products. By using the Famous Title platform as a Seller, you agree to the terms of this DPA.

Famous Title processes personal data for the following purposes:

• Facilitating transactions between Sellers and Buyers
• Processing payments through Stripe Connect
• Managing orders, shipping, and fulfillment
• Sending transactional emails (order confirmations, shipping notifications, refund notices)
• Providing customer support and dispute resolution
• Maintaining platform security and preventing fraud

3. Roles & Responsibilities

Famous Title as Data Controller

Famous Title is the Data Controller for data collected for its own platform operations, including Seller account information, platform analytics, and data necessary to maintain and improve the service.

Famous Title as Data Processor

Famous Title is the Data Processor for buyer transaction data processed on behalf of Sellers. This includes buyer names, email addresses, shipping addresses, and order details. The Seller, as the merchant of record, is the Data Controller for this data.

Seller Responsibilities

As the Data Controller for buyer transaction data, Sellers are responsible for:

• Ensuring they have a lawful basis for processing buyer data
• Providing buyers with appropriate privacy notices
• Responding to data subject access requests related to their customers
• Complying with applicable data protection laws in their jurisdiction

4. Types of Data Processed

The following categories of personal data may be processed through the Famous Title platform:

• Buyer Information: Name, email address, shipping address, billing address
• Order Information: Products purchased, quantities, prices, order status, shipping details
• Payment Information: Processed by Stripe; Famous Title does not store raw payment card data
• Communication Data: Order-related emails, support correspondence
• Technical Data: IP addresses, browser information (for security and fraud prevention)

5. Security Measures

Famous Title implements appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit using TLS/SSL
• Encryption of data at rest
• Regular security assessments and monitoring
• Access controls limiting data access to authorized personnel
• PCI DSS compliance through Stripe hosted checkout (no raw card data handled)
• Secure password hashing and authentication mechanisms
• Regular software updates and security patches

6. Sub-Processors

Famous Title engages the following sub-processors to provide its services. Each sub-processor is bound by data protection obligations:

• Stripe (San Francisco, USA) — Payment processing and merchant services
• Heroku / Amazon Web Services (USA) — Cloud infrastructure and hosting
• Postmark (USA) — Transactional email delivery
• PostgreSQL (hosted on Heroku) — Database storage

We will notify Sellers of any changes to our sub-processor list by updating this page. Sellers may object to a new sub-processor by contacting us within 30 days of the update.

7. Data Breach Notification

In the event of a personal data breach that affects Seller or Buyer data:

• Famous Title will notify affected Sellers without undue delay and no later than 72 hours after becoming aware of the breach.
• The notification will include the nature of the breach, categories of data affected, approximate number of records, and the measures taken to address the breach.
• Famous Title will cooperate with Sellers to meet their own notification obligations to supervisory authorities and affected individuals.
• Sellers are responsible for notifying their own customers (buyers) as required by applicable law.

8. Data Subject Rights

Data subjects (buyers) have the following rights under GDPR and similar data protection laws:

• Right of access to their personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing

When Famous Title receives a data subject request related to a Seller's buyer data, we will promptly notify the relevant Seller and assist in fulfilling the request. As the Data Controller, the Seller is ultimately responsible for responding to these requests.

9. Data Deletion Upon Termination

Upon termination of a Seller's account:

• Famous Title will delete or anonymize personal data processed on behalf of the Seller within 90 days, unless retention is required by law.
• Order records may be retained in anonymized form for accounting and legal compliance purposes.
• Sellers may request a copy of their data before account deletion.
• Data that is part of an active dispute or legal proceeding will be retained until the matter is resolved.

10. Governing Law

This Data Processing Agreement is governed by the laws of the United States. For personal data of individuals in the European Economic Area (EEA), this DPA incorporates the obligations required by the General Data Protection Regulation (GDPR).

By using the Famous Title platform as a Seller, you acknowledge and agree to the terms of this Data Processing Agreement. This DPA is incorporated into and forms part of the Seller Terms of Service.