GDPR Compliance

1. Scope and Roles Under GDPR

Harper is operated by HERBOZON INC. We are committed to handling personal data in accordance with the EU General Data Protection Regulation (GDPR) where applicable.

Depending on the use case, Harper may act as:

• Controller: for Harper account, billing, support, and website visitor data.
• Processor: for merchant end-user attribution and conversion data processed on merchant instructions.
• Merchant as Controller: for data collected on merchant properties and channels.

2. Lawful Bases for Processing

• Contract: to provide requested services, integrations, and support.
• Legitimate interests: security, fraud prevention, diagnostics, and service improvement.
• Legal obligation: tax, accounting, and regulatory recordkeeping.
• Consent: where required (for example specific marketing/cookie activities).

3. Your Rights Under GDPR

• Right of access.
• Right to rectification.
• Right to erasure (where legally applicable).
• Right to restrict processing.
• Right to data portability.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent where processing is consent-based.
• Right to lodge a complaint with a supervisory authority.

4. Response Timelines

We respond to verified GDPR requests without undue delay and, in most cases, within one month of receipt.

Where requests are complex or numerous, we may extend by up to two additional months as permitted by law and will inform you of the reason for delay.

5. How to Exercise GDPR Rights

To submit a GDPR request, contact us at contact@getharper.co. We may need identity verification before fulfilling requests.

If you are an end-user of a merchant store that uses Harper, contact that merchant first. Harper assists merchants with processor-side request handling where required.

6. Complaints to Supervisory Authorities

You may lodge a complaint with your local data protection supervisory authority in the EEA/UK if you believe your data has been processed in violation of GDPR.

7. Processor Commitments and DPA

Where Harper acts as a processor, we process data on documented instructions from the merchant controller and apply appropriate technical and organizational measures.

Where required, merchant customers may request data processing addendum terms that define processor obligations, sub-processing conditions, and assistance obligations.

8. International Data Transfers

Personal data may be processed in India, the United States, and other jurisdictions where Harper processors and merchant-selected integrations operate.

Where GDPR requires transfer safeguards, we use appropriate mechanisms such as contractual safeguards and related transfer controls.

9. Data Retention, Security, and Automated Decisions

We retain personal data only for as long as needed for service delivery, legal obligations, dispute resolution, and legitimate business purposes.

We apply commercially reasonable technical and organizational safeguards, including access controls, token protection/encryption, and security monitoring.

Harper does not intentionally use solely automated decision-making that produces legal or similarly significant effects on data subjects without appropriate safeguards.

10. Article 27 Representative and DPO Contact Point

Harper is operated from India. Where GDPR Article 27 representation is required for our activities, we will designate an EU/EEA representative and provide relevant contact details in this policy or our Privacy Policy.

For privacy and data protection communications, contact us at contact@getharper.co.

11. Company Information and Contact