Book a demo

Data Processing Agreement

DATA PROCESSING AGREEMENT
Version: 2026.06 Effective for each Customer: on the date the Customer accepts these Terms Last updated: April 21, 2026

  1. Background
    This Data Processing Agreement (“DPA”) is entered into between Twini S.r.l., an Italian limited liability company with registered office at Via Pietro Paleocapa 7, 20121 Milano (MI), Italy, codice fiscale and VAT number 13697330960, REA MI-2739354, share capital Euro 5,000.00 fully paid-up, PEC twini@pec.it (“Twini” or “Processor”), and the business entity subscribing to the Service (“Customer” or “Controller”). Twini and the Customer are individually a “Party” and jointly the “Parties”.
    This DPA is an annex to, and forms an integral part of, the Twini Terms of Service available at twini.ai/terms-conditions (the “Agreement”). By accepting the Agreement, the Customer also accepts this DPA.
    The Parties are entering into this DPA to comply with Article 28 of Regulation (EU) 2016/679 (“GDPR”) and, where applicable, the UK Data Protection Act 2018 and UK GDPR (“UK GDPR”), and the Swiss Federal Act on Data Protection (“FADP”), in respect of the processing of Personal Data by Twini on behalf of the Customer in connection with the Service.

  2. Definitions
    Capitalized terms used but not defined in this DPA have the meanings given in the Agreement or in the GDPR.
    “Applicable Data Protection Law” means the GDPR, the UK GDPR, the FADP, and any national implementing or supplementary legislation, in each case as may be amended or replaced from time to time.
    “EEA” means the European Economic Area.
    “Data Subject” means an identified or identifiable natural person whose Personal Data is processed under this DPA.
    “Personal Data” has the meaning given in Article 4(1) of the GDPR and refers to Personal Data processed by Twini on behalf of the Customer in connection with the Service.
    “Personal Data Breach” has the meaning given in Article 4(12) of the GDPR.
    “Processing” has the meaning given in Article 4(2) of the GDPR; the terms “Process” and “Processed” shall be construed accordingly.
    “Restricted Transfer” means a transfer of Personal Data from the EEA, the United Kingdom, or Switzerland to a country that does not benefit from an adequacy decision.
    “SCCs” means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended or replaced from time to time.
    “Subprocessor” means any third party engaged by Twini to Process Personal Data on the Customer’s behalf in connection with the Service.
    “UK Addendum” means the International Data Transfer Addendum to the EU Commission SCCs issued by the UK Information Commissioner’s Office (ICO), as may be amended or replaced from time to time.

  3. Relationship of the Parties
    3.1 Roles. In respect of Personal Data processed under this DPA, the Customer is the Controller and Twini is the Processor. The Customer may itself be acting as a Processor on behalf of another Controller; in that case, Twini is a Subprocessor of the ultimate Controller, and references in this DPA to the Customer’s rights and obligations shall be construed accordingly.
    3.2 Customer Responsibility. The Customer is responsible for (a) determining the purposes and means of Processing; (b) the lawfulness of the Processing and of the instructions given to Twini; (c) providing any required notices to, and obtaining any required consents or authorizations from, Data Subjects; and (d) ensuring that its use of the Service, and any data it uploads, complies with Applicable Data Protection Law.
    3.3 Processor Scope. Twini will Process Personal Data solely on behalf of the Customer and only as necessary to provide the Service or as otherwise instructed by the Customer in accordance with this DPA.

  4. Subject Matter, Nature, and Purpose of Processing
    4.1 Subject Matter. The subject matter of the Processing is the provision of the Service by Twini to the Customer under the Agreement.
    4.2 Nature of Processing. The nature of the Processing includes collection, storage, retrieval, consultation, use, transmission, dissemination or otherwise making available, aligning or combining, restriction, erasure, and destruction of Personal Data, to the extent necessary to provide the Service.
    4.3 Purpose of Processing. The purpose of the Processing is to enable Twini to provide the Service to the Customer, including (a) operating the conversational AI assistant embedded in the Customer’s storefront; (b) generating, enriching, and optimizing product content for AI search visibility; (c) supporting, maintaining, securing, and improving the Service; and (d) meeting Twini’s obligations under the Agreement and Applicable Data Protection Law. Further details of the Processing are set out in Annex I.
    4.4 No Training. Twini will not use Personal Data to train, fine-tune, or improve any foundational artificial intelligence model or any third-party AI model. This limitation is consistent with Section 4.4 of the Agreement and may not be waived except by a separate written addendum signed by both Parties.

  5. Types of Personal Data and Categories of Data Subjects
    5.1 The types of Personal Data Processed and the categories of Data Subjects are set out in Annex I.
    5.2 No Sensitive Personal Data. The Customer shall not upload to, or use the Service to Process, any special categories of Personal Data under Article 9 of the GDPR (including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation), any criminal convictions data under Article 10 of the GDPR, any payment card numbers subject to PCI DSS, or any protected health information subject to HIPAA or equivalent health-data regulations, unless the Parties have expressly agreed in writing to a framework for such Processing. The Customer acknowledges that End-Users may voluntarily share such information in chat interactions; in such case, the Customer remains responsible for compliance with any specific legal requirements applicable to such data, and Twini will apply the security measures set out in Annex II.

  6. Duration of Processing
    Processing will be carried out for the duration of the Subscription Term under the Agreement, plus any additional period required to comply with Section 11 (Return and Deletion) or with Applicable Data Protection Law.

  7. Obligations of the Controller
    The Customer represents and warrants that: (a) its instructions to Twini regarding the Processing of Personal Data comply with Applicable Data Protection Law; (b) it has a valid legal basis for the Processing of Personal Data by Twini under this DPA; (c) it has provided all notices to Data Subjects and obtained all consents or authorizations required under Applicable Data Protection Law; and (d) it will not request Twini to Process Personal Data in a manner that would cause Twini to violate Applicable Data Protection Law.

  8. Obligations of the Processor
    8.1 Documented Instructions. Twini will Process Personal Data only on the documented instructions of the Customer, including with regard to Restricted Transfers, unless required to do otherwise by Applicable Data Protection Law (in which case Twini will inform the Customer of that legal requirement before Processing, unless prohibited by law). The Agreement, this DPA, the Customer’s configuration of the Service, and any additional written instructions agreed between the Parties constitute the Customer’s documented instructions. If Twini believes an instruction infringes Applicable Data Protection Law, Twini will inform the Customer without undue delay.
    8.2 Confidentiality and Personnel. Twini will ensure that (a) access to Personal Data is strictly limited to personnel who need such access to perform their duties in connection with the Service; (b) all personnel authorized to Process Personal Data are bound by an obligation of confidentiality, whether contractual or statutory; (c) such personnel have received appropriate data protection and security awareness training; and (d) Twini takes reasonable steps to ensure the reliability of any personnel who may have access to Personal Data.
    8.3 Security. Twini will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. A description of these measures is set out in Annex II. Twini may update Annex II from time to time to reflect evolving best practices, provided that the overall level of security is not materially reduced. Twini will notify the Customer at least 15 business days in advance of any material adverse change to the technical and organizational measures set out in Annex II, and for the avoidance of doubt no such change shall materially reduce the overall level of security.
    8.4 No Training of AI Models. In accordance with Section 4.4 of this DPA and Section 4.4 of the Agreement, Twini will not use Personal Data to train, fine-tune, or improve any foundational AI model or any third-party AI model.
    8.5 Assistance with Data Subject Rights. Taking into account the nature of the Processing, Twini will assist the Customer by appropriate technical and organizational measures, insofar as this is possible, to fulfill the Customer’s obligation to respond to requests by Data Subjects to exercise their rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection). Twini will provide such assistance without undue delay and in a timeframe consistent with the Customer’s obligations under Article 12 of the GDPR, taking into account the nature of the request and the information available to Twini. If Twini receives a request directly from a Data Subject, Twini will, without undue delay, forward the request to the Customer and will not respond to the Data Subject directly except to confirm receipt and direct the Data Subject to the Customer.
    8.6 Assistance with Controller Obligations. Taking into account the nature of the Processing and the information available to Twini, Twini will assist the Customer in ensuring compliance with the obligations set out in Articles 32 to 36 of the GDPR, including assisting with Personal Data Breach notifications, Data Protection Impact Assessments (“DPIAs”), and prior consultations with Supervisory Authorities.
    8.7 Records of Processing. Twini will maintain a record of Processing activities carried out on behalf of the Customer, in accordance with Article 30(2) of the GDPR, and will make it available to the Customer upon reasonable request.
    8.8 Government Access Requests. Twini will not disclose Personal Data to any government agency, court, law enforcement agency, or other public authority, except (a) with the Customer’s prior written consent; or (b) as strictly required by applicable mandatory laws binding on Twini. If Twini receives a legally binding request from a public authority for the disclosure of Personal Data processed on behalf of the Customer, Twini will (i) promptly notify the Customer of the request, unless legally prohibited from doing so; (ii) exhaust all reasonable legal remedies to challenge the request where there are reasonable grounds to consider it unlawful, overly broad, or inconsistent with Applicable Data Protection Law; (iii) provide the minimum amount of Personal Data permissible when responding; and (iv) document the request and its response. Where Twini is legally prohibited from notifying the Customer, Twini will use reasonable efforts to obtain a waiver of the prohibition and will publish aggregate statistics of such requests where permitted.
    8.9 Data Protection Officer and EU Representative. Twini is not required to appoint a Data Protection Officer under Article 37 of the GDPR, because its core activities do not consist of (a) processing operations that require regular and systematic monitoring of data subjects on a large scale, or (b) processing on a large scale of special categories of data under Article 9 or of personal data relating to criminal convictions and offences under Article 10. Twini is established in Italy and is therefore not required to appoint an EU Representative under Article 27 of the GDPR. The Customer may address data protection inquiries to davide@twini.ai or twini@pec.it for formal notices.

  9. Subprocessors
    9.1 General Authorization. The Customer provides a general authorization for Twini to engage Subprocessors to Process Personal Data in connection with the Service, subject to this Section 9.
    9.2 List of Subprocessors. The current list of Subprocessors is published at twini.ai/subprocessors (the “Subprocessor List”) and is incorporated by reference into this DPA. A snapshot of the Subprocessor List as of the effective date of this DPA is set out in Annex III.
    9.3 Notification of Changes. Twini will provide at least 15 days’ prior notice to the Customer (by email to the account email address, by dashboard notification, or by updating the Subprocessor List and notifying subscribed Customers) before adding or replacing a Subprocessor.
    9.4 Right to Object. The Customer may object to a new Subprocessor on reasonable data protection grounds by written notice to Twini within 15 days of receiving the notification in Section 9.3. The Parties will work in good faith to address the objection. If the Parties cannot reach an agreement within a further 15 days, the Customer may terminate the affected Order Form upon written notice and receive a pro-rata refund of prepaid fees for the unused portion of the Subscription Term.
    9.5 Flow-Down Obligations. Twini will enter into a written contract with each Subprocessor that imposes data protection obligations that are, in substance, no less protective than those in this DPA, and specifically the obligations set out in Article 28(3) of the GDPR.
    9.6 Liability. Twini remains fully liable to the Customer for the performance of the Subprocessor’s obligations under this DPA.

  10. Personal Data Breach
    10.1 Notification to Customer. Twini will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data Processed on behalf of the Customer. The notification will include, to the extent known at the time of notification, the information required under Article 33(3) of the GDPR.
    10.2 Information and Cooperation. Twini will (a) provide the Customer with further information about the Personal Data Breach as it becomes available; (b) cooperate with the Customer in investigating, mitigating, and remediating the Personal Data Breach; and (c) provide the information necessary to allow the Customer to notify the competent Supervisory Authority and affected Data Subjects, where required under Articles 33 and 34 of the GDPR.
    10.3 No Admission. A notification of a Personal Data Breach under this Section 10 does not constitute an acknowledgment by Twini of any fault or liability.

  11. Return and Deletion of Personal Data
    11.1 During the Subscription Term. The Customer may export its Personal Data at any time during the Subscription Term by submitting a written request to Twini. Twini will provide the Personal Data in a structured, commonly used, and machine-readable format within a reasonable period.
    11.2 Post-Termination. Within 30 days after termination or expiry of the Subscription Term, at the Customer’s choice, Twini will either (a) return the Personal Data to the Customer in a structured, commonly used, and machine-readable format, or (b) delete the Personal Data. If the Customer does not exercise this choice within 30 days, Twini will delete the Personal Data. Deletion from Twini’s production systems will be completed within 90 days of termination or of the Customer’s deletion request, whichever is earlier. Personal Data held in routine backup media will be deleted in accordance with Twini’s backup retention schedule described in Annex II. Twini may retain Personal Data where storage is required by Applicable Law, for the limited period and scope required.
    11.3 Certification. Upon written request by the Customer, and in any event within 30 days following completion of the deletion, Twini will provide written certification that it has complied with this Section 11, except for Personal Data retained pursuant to Applicable Law or held in routine backup media pending deletion.

  12. International Data Transfers
    12.1 General. Where the Processing under this DPA involves a Restricted Transfer, the Parties will comply with the requirements of Applicable Data Protection Law.
    12.2 SCCs. To the extent that a Restricted Transfer from the Customer (as data exporter) to Twini (as data importer) is made under this DPA, the SCCs are hereby incorporated by reference and the Parties agree that:
    (a) Module Two (Controller to Processor) applies where the Customer is a Controller and Twini is a Processor, or Module Three (Processor to Processor) applies where the Customer is itself a Processor and Twini is a Subprocessor;
    (b) Clause 7 (Docking Clause) applies;
    (c) in Clause 9 (Use of Subprocessors), Option 2 (general authorization) applies, with a notification period of 15 days as set out in Section 9.3;
    (d) in Clause 11 (Redress), the optional language regarding an independent dispute resolution body does not apply;
    (e) in Clause 17 (Governing Law), the SCCs are governed by the laws of Italy;
    (f) in Clause 18 (Choice of Forum and Jurisdiction), disputes are resolved before the Courts of Milan, Italy;
    (g) Annex I (List of Parties, Description of Transfer, Competent Supervisory Authority) is completed by reference to Annex I of this DPA;
    (h) Annex II (Technical and Organizational Measures) is completed by reference to Annex II of this DPA;
    (i) Annex III (List of Subprocessors) is completed by reference to Annex III of this DPA and twini.ai/subprocessors.
    12.3 Subprocessor Transfers and Transfer Impact Assessment. Where Twini engages a Subprocessor located outside the EEA, Twini will ensure that the transfer is protected by SCCs (or an equivalent approved transfer mechanism) and, where necessary, by supplementary technical, organizational, and contractual measures determined on the basis of a transfer impact assessment (“TIA”). Upon the Customer’s reasonable written request, Twini will cooperate with the Customer in conducting a TIA for the transfers under this DPA, including by providing (a) information about the destination country’s legal framework relevant to government access to Personal Data that is reasonably available to Twini; (b) a description of the supplementary measures applied; and (c) any relevant documentation Twini has received from its Subprocessors.
    12.4 UK Transfers. Where a Restricted Transfer is subject to the UK GDPR, the UK Addendum applies to the SCCs incorporated under Section 12.2, with the tables completed as follows: Table 1 (Parties) by reference to Annex I of this DPA; Table 2 (Selected SCCs, Modules, and Selected Clauses) as set out in Section 12.2; Table 3 (Appendix Information) by reference to Annexes I, II, and III of this DPA; Table 4 (Ending this Addendum when the Approved Addendum Changes) enabling neither Party to terminate.
    12.5 Swiss Transfers. Where a Restricted Transfer is subject to the FADP, the SCCs apply with the following modifications: (a) references to the GDPR are understood as references to the FADP insofar as the data transfer is governed by the FADP; (b) the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC); (c) the term “EU Member State” does not prevent Data Subjects in Switzerland from exercising their rights in their place of habitual residence.

  13. Audits and Information Rights
    13.1 Information. Twini will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR.
    13.2 Third-Party Certifications. The Customer agrees that any audit report or certification from a recognized third-party auditor (including, when available, SOC 2 Type II and ISO/IEC 27001) that Twini makes available to the Customer satisfies the Customer’s audit rights under this DPA and Article 28(3)(h) of the GDPR.
    13.3 On-site Audits. Where the Customer reasonably determines that the information and certifications made available under Sections 13.1 and 13.2 are not sufficient to demonstrate compliance, the Customer may, no more than once per calendar year (except in case of a Personal Data Breach or upon request of a Supervisory Authority), conduct an audit of Twini’s compliance with this DPA, subject to the following conditions: (a) at least 30 business days’ prior written notice; (b) the audit is conducted during normal business hours and in a manner that does not interfere with Twini’s business operations or the security and confidentiality of other customers’ data; (c) the audit is conducted by an independent auditor bound by confidentiality obligations, reasonably acceptable to Twini; (d) the Customer bears its own costs and, unless a material non-compliance is found, also Twini’s reasonable costs of cooperating with the audit.

  14. Liability
    14.1 Liability under this DPA is subject to the limitations and exclusions set out in Section 13 of the Agreement, except where such limitation is prohibited by Applicable Data Protection Law.
    14.2 Without prejudice to Section 14.1, each Party shall bear liability to Data Subjects as determined by the competent Supervisory Authority or court in accordance with Article 82 of the GDPR.

  15. Term and Termination
    This DPA takes effect on the effective date of the Agreement and remains in force until the earlier of (a) termination or expiry of the Agreement or (b) completion of Twini’s obligations under Section 11. Termination or expiry of this DPA does not discharge either Party from obligations that, by their nature, are intended to survive.

  16. Order of Precedence
    In case of conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA prevails. In case of conflict between this DPA and the SCCs, the SCCs prevail.

  17. Governing Law, Jurisdiction, and General Provisions
    17.1 Governing Law and Jurisdiction. This DPA is governed by the laws of Italy. The Parties submit to the exclusive jurisdiction of the Court of Milan, Italy, without prejudice to the jurisdiction provisions set out in the SCCs with respect to SCC-based disputes.
    17.2 Severability. If any provision of this DPA is held unenforceable, the remaining provisions continue in full force, and the unenforceable provision is modified to the minimum extent necessary to be enforceable.
    17.3 Modifications. Twini may update this DPA from time to time, in line with evolving regulatory requirements or operational needs. Material changes will be notified to the Customer at least 30 days before they take effect. If the Customer objects to a material change, the Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid fees for the unused portion of the Subscription Term.
    17.4 Language. This DPA is executed in the English language. In case of translation, the English version prevails.


Annex I — Details of Processing
A. List of Parties
Data Exporter (Controller). The Customer, as identified in the Order Form or account registration.
Data Importer (Processor). Twini S.r.l., Via Pietro Paleocapa 7, 20121 Milano (MI), Italy. Contact: davide@twini.ai (primary), twini@pec.it (formal notices).
B. Description of the Processing
Subject matter. Provision of the Twini AI conversational shopping assistant and product data optimization service, as described in the Agreement.
Purpose. To deliver the Service: operating the AI assistant on the Customer’s storefront, enriching and optimizing product content for AI search visibility, providing support, security, and improvement of the Service.
Nature of Processing. Collection, storage, retrieval, consultation, use, transmission, organization, structuring, adaptation, alignment, combination, restriction, erasure, and destruction of Personal Data, as necessary to provide the Service.
Duration. For the duration of the Subscription Term, plus the retention period set out in Section 11 of the DPA.
Frequency. Continuous during the Subscription Term.
C. Categories of Data Subjects
• End-Users (shoppers, visitors, and customers of the Customer interacting with the Service on the Customer’s storefront).
• Authorized Users of the Customer (employees, contractors, and Affiliates accessing the Twini dashboard).
D. Categories of Personal Data
• Identification and contact data: name, email address, IP address, Shopify customer ID or equivalent platform identifier, user-agent and device identifier.
• Account data of Authorized Users: name, work email, role, authentication data.
• Behavioral data: product pages viewed, clicks, session duration, session path, cart and checkout events.
• Conversational data: text questions, answers, and related content exchanged between the End-User and the AI assistant.
• Transactional data: order identifier, order status, order value, returns and refunds metadata (excluding full payment card numbers, which are handled by third-party payment gateways).
E. Special Categories of Personal Data
Not required for the Service. The Customer shall not upload or use the Service to collect special categories of Personal Data, as set out in Section 5.2 of this DPA. The Customer acknowledges that End-Users may voluntarily share such information in chat interactions; in such case, the security measures in Annex II apply.
F. Competent Supervisory Authority
The Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Roma, Italy, is the competent Supervisory Authority for Twini as data importer. Where the Customer is established in the EEA, the Supervisory Authority of the Customer’s Member State of establishment acts as lead authority for the Customer’s Processing.


Annex II — Technical and Organizational Measures
Twini implements and maintains the following technical and organizational measures to ensure an appropriate level of security for Personal Data, in accordance with Article 32 of the GDPR. Twini may update these measures from time to time, provided that the overall level of security is not materially reduced.

  1. Access Control
    • Tenant isolation is enforced at the application layer through shop-scoped identifiers on every query, so personnel and processes can only access data belonging to the authenticated tenant.
    • All Twini personnel access production cloud, source-code, and administrative interfaces through accounts protected by multi-factor authentication (MFA).
    • Access to production systems is limited to personnel whose role requires it. Access is reviewed periodically and revoked promptly upon role change or termination.
    • Unique user identifiers are used for all personnel and administrative accounts; credential sharing is prohibited.
    • End-User sessions on the storefront chat are authenticated through short-lived signed tokens (JWT HS256, 5-minute time-to-live) bound to the merchant shop. Inbound requests originating from Shopify are verified through HMAC signature checks before any processing.

  2. Encryption
    • Personal Data is encrypted in transit using TLS 1.2 or higher for all traffic between End-Users, the Customer’s Shopify storefront, the Twini dashboard, and the Service. TLS termination is provided by the hosting platform using automatically provisioned and renewed certificates. All internal service-to-service traffic on Railway’s private network is encrypted using WireGuard tunnels, with services isolated per project and per environment.
    • Personal Data, including database contents and backups, is encrypted at rest using AES-256 (or equivalent) by the underlying managed-database and managed-storage services.
    • Application-level secrets and credentials are stored as environment variables managed through the hosting platform’s secret store and are never committed to source control.

  3. Infrastructure and Hosting
    • The Service is hosted on infrastructure provided by Railway (railway.com), including the application runtime, all PostgreSQL databases, Redis cache, RabbitMQ message broker, the Typesense search index, and MinIO (S3-compatible object storage). Physical security, perimeter security, and underlying compute, network, and storage hardening are provided by Railway and its upstream cloud providers (GCP and AWS). Railway maintains SOC 2 Type II, SOC 3, and GDPR compliance attestations.
    • Production and staging environments are logically segregated with separate databases, credentials, and deployment pipelines.
    • Customer Data is logically segregated between Customers at the application layer: every persisted record is keyed to a unique shop reference, and all data-access paths filter by that reference.
    • A current list of Subprocessors is maintained at twini.ai/subprocessors.

  4. Network and Application Security
    • Application traffic is served through the hosting platform’s managed network ingress with TLS termination. Backing services (databases, cache, message broker, search index, object storage) are protected by mandatory authentication and authorization on every connection, with credentials managed as secrets. Where a backing service exposes a public endpoint provided by the hosting platform, access requires valid credentials over TLS; service-to-service traffic within Railway uses the encrypted private network described in Section 2.
    • Inbound webhooks and storefront API calls are authenticated and integrity-checked (Shopify HMAC for webhooks, signed JWTs for storefront sessions) before being accepted by the application.
    • Source code is version-controlled in GitHub. All changes are reviewed before deployment to production; production deployments are performed exclusively through automated GitHub Actions pipelines, removing the need for direct production-host access during release.
    • Static analysis and linting (ruff, basedpyright for the backend; ESLint and TypeScript for the frontends) run as part of the development workflow. Dependencies are pinned via lockfiles (Poetry, npm) and updated periodically; security advisories surfaced by GitHub are reviewed and patched.

  5. Logging and Monitoring
    • The Service produces structured JSON application logs with per-request correlation identifiers, capturing application events, errors, and access to administrative endpoints.
    • Application errors and exceptions are captured and aggregated through Sentry, which is configured to alert on anomalous error rates and exception classes.
    • Hosting-platform metrics and access logs (CPU, memory, network, deployment events, request logs) are retained by Railway for 30 days and reviewed when investigating incidents.
    • LLM execution traces, used for debugging and quality monitoring of chatbot responses, are retained by LangSmith for 14 days.
    • Logs are retained for the period necessary for security monitoring, forensic analysis, and applicable legal obligations.

  6. Backup and Business Continuity
    • The primary PostgreSQL database is backed up by Railway on a daily, weekly, and monthly rotation.
    • Backups are encrypted at rest by the managed-database service and managed independently from primary data through the hosting platform’s backup service.
    • Backup retention is limited to the period necessary for disaster recovery and is managed through the hosting platform’s backup policy.

  7. Incident Response
    • Twini maintains an internal incident response process covering detection, containment, eradication, recovery, and post-incident review.
    • Personal Data Breach notification to the Customer is performed in accordance with Section 10 of the DPA, using the contact details provided by the Customer.

  8. Personnel
    • All Twini personnel authorized to Process Personal Data are bound by written confidentiality obligations as part of their engagement.
    • Personnel are briefed on data-protection responsibilities and on the handling of credentials, secrets, and Customer Data relevant to their role.
    • Access to production systems is limited to the minimum number of personnel required to operate the Service.

  9. Subprocessor Management
    • Subprocessors are selected on the basis of their security posture, contractual data-protection terms, and suitability for the processing activity.
    • Each Subprocessor is engaged under terms that impose data-protection obligations no less protective than those set out in this DPA, to the extent applicable to the Subprocessor’s role.
    • The list of Subprocessors at twini.ai/subprocessors is updated when Subprocessors are added or removed, and Customer notification follows the process described in the DPA.

  10. Data Minimization and Retention
    • Collection of Personal Data is limited to what is necessary to provide the Service: merchant identifiers, chat session identifiers, message content exchanged with the chatbot, and product / catalog data provided by the Customer.
    • End-User identifiers received from Shopify (for example, logged-in customer IDs) are used only transiently to mint a short-lived session token and are not persisted by the Service.
    • Retention periods are aligned with the purpose of Processing and with Section 11 of the DPA. Customer Data is deleted upon end of the retention period or upon Customer request, except where storage is required by Applicable Law.

  11. Roadmap
    Twini is working toward SOC 2 Type II and ISO/IEC 27001 certifications. Updates on the roadmap are available to the Customer upon reasonable request under NDA.


Annex III — List of Subprocessors
The current list of Subprocessors is maintained at twini.ai/subprocessors and is incorporated by reference into this DPA. The Subprocessor List categorizes Subprocessors by function, including, without limitation: (i) large language model providers and aggregators, (ii) cloud hosting and infrastructure providers, (iii) payment processor, and (iv) operational and analytics tools.
For each Subprocessor, the Subprocessor List indicates (a) the legal name of the Subprocessor; (b) the service provided to Twini; (c) the type of Personal Data processed; (d) the location of processing; and (e) the applicable transfer mechanism, where the Subprocessor processes Personal Data outside the EEA.
In the event of inconsistency between this Annex III and the Subprocessor List at twini.ai/subprocessors, the Subprocessor List prevails.


Annex IV — Standard Contractual Clauses
Where Restricted Transfers occur in connection with this DPA, the Parties incorporate the SCCs by reference as set out in Section 12 of this DPA. The full text of the SCCs is available at the following official source, as may be amended or replaced from time to time:
Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
The UK Addendum, where applicable under Section 12.4, is available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/.
For the avoidance of doubt, the Annexes to the SCCs are completed by reference to Annexes I, II, and III of this DPA, as set out in Section 12.2.