This Data Processing Addendum (DPA) sets out the terms for personal data that FullBricks LLC, operating RiskBack (RiskBack), processes on behalf of a business customer (Customer). FullBricks LLC's address is 30 N Gould St Ste N, Sheridan, WY 82801, USA.
1. Application and definitions
This DPA forms part of a service agreement or order form between RiskBack and Customer (Agreement) when that Agreement expressly incorporates it or the parties otherwise accept it in writing. Viewing this page alone does not enter a visitor into a processing agreement.
Customer Personal Data means personal data supplied to, or generated by, the contracted services that RiskBack processes on Customer's behalf. Data Protection Law means privacy and data-protection laws applicable to that processing. Subprocessor means a provider RiskBack engages to process Customer Personal Data on Customer's behalf. Personal Data Breach means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
Terms such as controller, processor, service provider, personal data and processing have their meanings under applicable Data Protection Law. This DPA applies only within its subject matter and does not certify compliance with every privacy regime.
2. Roles and Customer responsibilities
Customer is the controller, or an authorized processor acting for a controller, and RiskBack is Customer's processor or subprocessor for the processing covered here. Customer must have authority to appoint RiskBack, provide lawful documented instructions, establish an appropriate legal basis, deliver required notices and obtain any necessary permissions.
Customer must configure the services appropriately and provide accurate information about applicable processing restrictions. Each party remains responsible for its own obligations under Data Protection Law.
Where RiskBack independently determines purposes and means for information used for its own business operations, that processing is outside this processor DPA and is described in the Privacy Policy. The parties must document any additional independent-controller use of transaction information before that use begins.
3. Instructions and permitted processing
RiskBack will process Customer Personal Data only on Customer's documented instructions, including the Agreement, this DPA, the selected service configuration and other instructions accepted in writing. Instructions cover any authorized international transfers. Processing is limited to delivering and supporting the agreed services and activities described in the processing details below.
RiskBack will promptly inform Customer if, in its opinion, an instruction infringes applicable Data Protection Law and may suspend the affected processing while the parties resolve the issue. If law requires processing outside Customer's instructions, RiskBack will notify Customer before processing unless the law prohibits that notice.
Customer Personal Data remains subject to the Agreement's ownership and confidentiality provisions. This DPA grants no general permission to sell that data, publish it, use it for unrelated advertising or train unrelated models. Any additional processing purpose requires lawful, documented authorization and applicable contractual safeguards.
4. Confidentiality and security
RiskBack will restrict access to persons who need it for authorized work and ensure those persons are bound by appropriate confidentiality obligations. RiskBack will maintain technical and organizational measures appropriate to the processing risks, taking account of the data involved and the nature, scope, context and purposes of processing.
The security commitments below apply to covered processing. A deployment-specific security schedule may add detail or stronger commitments. RiskBack will not materially reduce the overall protection of covered processing during the Agreement. The public Security Overview provides context; it is not an audit report or a replacement for agreed measures.
5. Subprocessors
RiskBack will use Subprocessors only with Customer's prior specific or general written authorization. Before covered processing begins, RiskBack will make available the applicable Subprocessor list, functions and processing locations for Customer's authorization.
Where Customer grants general authorization, RiskBack will provide advance written notice of intended additions or replacements, giving Customer a reasonable opportunity to object on data-protection grounds before the change takes effect. The parties will work in good faith to address an objection, including through an alternative provider or arrangement where reasonably available. If no acceptable arrangement is available, Customer may end the affected service before the change, subject to an orderly return or deletion of its data.
RiskBack will bind each Subprocessor to data-protection obligations offering at least the protection required by this DPA for its processing. RiskBack remains responsible to Customer for its Subprocessors' performance of those obligations. A provider Customer engages directly is subject to Customer's own arrangements with that provider.
6. Rights requests and compliance assistance
Taking account of the nature of processing and information available, RiskBack will provide reasonable assistance with Customer's obligations concerning individual rights, processing security, breach notifications, data-protection impact assessments and required consultation with regulators.
RiskBack will promptly refer requests concerning Customer Personal Data to Customer and will not substantively respond on Customer's behalf unless instructed or required by law. Customer is responsible for deciding and communicating its response. Requests concerning RiskBack's own processing are handled under the Privacy Policy.
The parties may agree reasonable charges for exceptional assistance, to the extent permitted by law. Charges must not prevent compliance with a mandatory obligation.
7. Personal Data Breaches
RiskBack will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification will use the incident contact or other appropriate business contact designated by Customer.
As information becomes available, RiskBack will provide the known nature and likely consequences of the breach, affected data and individuals where reasonably identifiable, a contact for further information, and measures taken or proposed to contain and address it. Initial notice may be followed by updates; it will not be delayed solely because an investigation is incomplete.
RiskBack will take reasonable steps to contain and remediate the breach and cooperate with Customer's legally required response. Customer determines its notifications to individuals and authorities, except where law requires RiskBack to act directly. A notice does not itself admit fault or liability.
8. International transfers
Customer authorizes processing only in the locations documented for its service and on its lawful instructions. RiskBack will ensure that any restricted transfer of Customer Personal Data has a valid mechanism under applicable Data Protection Law before it occurs.
Where necessary, the parties will complete and incorporate applicable transfer clauses, their required annexes and any supplementary measures before the transfer. This DPA alone does not constitute completed EU standard contractual clauses, a UK transfer addendum or participation in an adequacy or certification program. Any agreed data-residency restriction remains binding within its scope.
9. Return, deletion and retained records
When the relevant processing services end, RiskBack will, at Customer's choice, return or delete Customer Personal Data and delete remaining copies, unless applicable law requires retention. The parties will agree practical export, deletion and backup arrangements consistent with applicable law and the Agreement.
Data awaiting deletion from backups will remain protected, be isolated from ordinary use and be removed under the applicable deletion cycle. If a backup is restored, the relevant deletion instructions will be reapplied. Legally retained data will be limited to the required purpose and period. On request, RiskBack will confirm completion of the agreed return or deletion.
10. Information, audits and inspections
RiskBack will make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by Customer or an independent auditor it appoints, as required by Data Protection Law.
The parties will coordinate reasonable notice, scope, timing, confidentiality and protection of other customers' data and service security. Available documentation may address an inquiry first, but does not replace an audit or inspection right required by law. These arrangements must not delay a legally required investigation or restrict a competent authority's powers.
11. California service-provider terms
Where the California Consumer Privacy Act applies and RiskBack acts as a service provider or contractor, Customer discloses personal information only for the specified business purposes in the Agreement and processing details below. RiskBack will provide the same level of privacy protection required of it by that law.
RiskBack will not sell or share that information, retain, use or disclose it outside the specified business purposes or direct business relationship, or combine it with information from other sources, except as permitted by that law. RiskBack will notify Customer if it can no longer meet these obligations.
Customer may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorized processing. RiskBack certifies that it understands these restrictions and will comply with them when this DPA applies.
12. Processing details
The selected products, integrations and configuration determine the actual scope. Before processing begins, the Agreement and associated documentation must identify any service-specific categories, restrictions, Subprocessors, locations and retention arrangements.
| Item | Covered processing |
|---|---|
| Subject matter | Providing the agent-commerce risk services selected in the Agreement |
| Duration | The service term and the limited return, deletion or legally required retention period that follows |
| Nature of processing | Receiving, organizing, storing, analyzing, retrieving, transmitting, restricting and deleting data as required for authorized service workflows |
| Purposes | Selected intent and fraud-risk assessments, order controls, dispute support, spend oversight, reporting and related service support |
| Individuals | Customer personnel, shoppers, purchasers, agent users, business representatives and other individuals whose relevant information Customer is authorized to provide |
| Data categories | Business and contact details, account identifiers, order and payment references, agent activity, risk signals and assessments, dispute records and relevant technical information |
| Frequency | Ongoing or transaction-based processing according to the enabled integration |
| Sensitive data | Excluded unless specifically agreed in writing with appropriate safeguards; ordinary forms and integrations must not be used to submit unnecessary sensitive data or full payment-card credentials |
RiskBack's independent processing for its own billing, legal obligations or other separately documented purposes must be distinguished from processing on Customer's behalf.
13. Security commitments for covered processing
RiskBack will maintain measures appropriate to the risk that address:
- Access: authenticated access, appropriate authorization, confidentiality duties and removal of access when no longer required.
- Data protection: safeguards for network transmission and storage, including encryption or pseudonymization where appropriate to the processing risk.
- Service resilience: measures supporting confidentiality, integrity, availability and timely restoration of access following a physical or technical incident.
- Operational security: appropriate management of credentials, system changes and vulnerabilities, with procedures to receive and investigate security reports.
- Data lifecycle: procedures for authorized disclosure, rights assistance, retention, return and secure deletion.
- Review: regular assessment of the effectiveness of safeguards, with adjustments appropriate to changes in risk and the service.
These are contractual obligations when this DPA is incorporated into an Agreement. Specific implementations, review evidence and additional requirements must be recorded for the relevant deployment; no certification or testing result is asserted by this schedule.
14. Priority, updates and contact
This DPA takes priority over conflicting general terms for the processing it covers. Mandatory transfer clauses and non-waivable Data Protection Law take priority where applicable. The Agreement's liability provisions apply to the extent lawful, without restricting individuals' or authorities' non-waivable rights.
Updating this public page does not unilaterally replace a version incorporated into an existing Agreement. Amendments follow that Agreement and applicable law. This DPA continues to protect retained Customer Personal Data for as long as RiskBack processes it on Customer's behalf.
To arrange a DPA, request the applicable processing documentation or raise a data-protection question, use RiskBack's contact page or write to:
FullBricks LLC Attn: RiskBack Data Protection 30 N Gould St Ste N Sheridan, WY 82801, USA