Vertex Data Processing Addendum

The merchant is controller, or processor acting for the relevant controller, for data submitted through its store. Vertex is processor only to the extent it carries out the merchant's documented instructions to provide, secure, support, and comply with law for the Service. Vertex remains an independent controller for account, security, support, service-administration, and legal-compliance data.

Processing includes SEO analysis, import and synchronization, recommendations, merchant-approved metadata apply and readback, support, and security. Data categories include identity/access, store/install, catalog/product/SEO, operational/audit, webhook, and entitlement data as described in the SEO Data Use Schedule. The certified path does not intentionally require sensitive data.

Vertex limits access to authorized people and services and applies reasonable measures including token encryption, HTTPS, installation-generation binding, webhook-signature verification, and separation of authority. The merchant gives a general authorization for the services in the Subprocessor Register as needed; the register must be updated before a material new processor, data category, or processing region is added.

Vertex will reasonably assist the merchant with rights requests, impact assessments, regulator requests, and incident information as required by law and taking account of the Service and available information. This Addendum does not create a notice deadline that is not stated by law or a final contract.

Uninstall revokes authority and stops work; it is not a deletion instruction. On a documented, verified deletion request, Vertex handles data under the Privacy Policy, legal obligations, and documented security and backup exceptions. Vertex does not promise a numeric deletion period here before it is technically implemented.