GDPR Notice (EU Users)

Last Updated: February 2026

This GDPR Notice applies to individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland. It supplements our Privacy Policy and explains how Doblly processes Personal Data in accordance with Regulation (EU) 2016/679 ("GDPR").

1. Identity of the Controller

For Merchant account data, Doblly acts as Data Controller. For End Customer data collected by Merchants through stores powered by Doblly, the Merchant acts as Data Controller and Doblly acts as Data Processor.

2. Categories of Personal Data

• Contact information (name, email, phone number)
• Business and billing information
• Transaction and order data
• Technical data (IP address, device, browser)
• Usage and analytics data

3. Legal Bases for Processing

Doblly relies on the following legal bases under Article 6 GDPR:

• Contractual Necessity: To provide platform services and fulfill contractual obligations.
• Legitimate Interests: To improve services, prevent fraud, ensure security, and maintain platform integrity.
• Consent: For non-essential cookies or marketing communications where required.
• Legal Obligation: To comply with applicable laws and regulatory requirements.

4. Purpose of Processing

• Providing SaaS eCommerce infrastructure
• Account management and authentication
• Payment processing and transaction support
• Analytics and performance monitoring
• Fraud detection and security enforcement
• AI-assisted content generation tools
• Compliance with legal obligations

5. Automated Decision-Making & Profiling

Doblly may use automated systems for fraud detection, security monitoring, and analytics. These systems do not produce legal or similarly significant effects without human review. Users may request additional information regarding automated processing.

6. International Transfers

Personal Data may be transferred outside the EEA. Where such transfers occur, Doblly implements appropriate safeguards including:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements with sub-processors
• Additional technical and organizational safeguards

7. Data Retention

Personal Data is retained only as long as necessary to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. Backup copies may be retained temporarily in accordance with disaster recovery policies.

8. Data Subject Rights

Under GDPR, you have the following rights:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure ("Right to be forgotten") (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to withdraw consent at any time

Requests may be submitted to: legal@doblly.com

9. Complaints to Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority in the EU member state of your residence or place of work.

10. Sub-Processors

Doblly engages trusted sub-processors for hosting, infrastructure, analytics, and support services. All sub-processors are bound by contractual data protection obligations. A current list of sub-processors is available upon request.

11. Security Measures

Doblly implements appropriate technical and organizational measures including encryption in transit, access controls, monitoring systems, and regular security assessments to protect Personal Data.

12. Contact & Data Protection Inquiries

For GDPR-related inquiries or to exercise your rights, contact: legal@doblly.com

If required under applicable law, Doblly may appoint a Data Protection Officer (DPO).

13. Changes to This Notice

We may update this GDPR Notice periodically to reflect legal or operational changes. Continued use of the platform constitutes acceptance of the updated version.