Seller Data Processing Addendum

StarPlace is the Controller of buyer personal data. The Seller acts as a Processor on behalf of StarPlace solely to deliver the specific order matched to the Seller. The data processed under this DPA is limited to:

• the buyer's RSI gift email;
• the buyer's RSI handle, where shown on the order;
• any messages the buyer sends to the seller through the platform.

The Seller may process buyer personal data only to deliver the specific order through CIG's official gifting system, to respond to the buyer's questions about that order through the platform, and to defend itself in a dispute related to that order. Any other use is prohibited, including in particular:

• marketing, promotional or any other commercial communication;
• resale, rental, transfer or disclosure to any third party;
• combining buyer data with data from any other source;
• use after the order is closed and the retention period has expired.

The Seller will keep buyer personal data confidential and will not disclose it to any person who does not have a strict need to know it for the permitted purpose. Any person authorized by the Seller to process the data must be under a binding obligation of confidentiality.

The Seller will at minimum:

• use a strong, unique password and two-factor authentication on its account;
• not store buyer data in plain text on shared, public, or unsecured devices;
• delete buyer data from local devices once the order is closed;
• not screenshot, copy, or otherwise persist buyer data outside what is strictly necessary to deliver and to retain evidence of delivery for the dispute window.

The Seller is not permitted to engage any subprocessor to handle buyer personal data. All delivery actions must be performed by the Seller in person.

If a buyer contacts the Seller directly to exercise a data subject right (access, correction, deletion, etc.), the Seller must promptly forward the request to contact@starplace.net and not act on it independently. The Controller will respond as required by law.

The Seller will notify StarPlace within 24 hours of becoming aware of any actual or suspected unauthorized access, disclosure, loss, or alteration of buyer personal data. The notice must include the nature of the incident, the categories and approximate number of records affected, and the measures taken or proposed.

The Seller will delete buyer personal data within 30 days after the order is finally closed (no open dispute, no chargeback window remaining), except where retention is required by law. Evidence submitted to a dispute is retained by StarPlace, not by the Seller.

On reasonable notice, the Seller will cooperate with reasonable inquiries from StarPlace, regulators, or auditors regarding its handling of buyer personal data, and will produce records of its processing relevant to this DPA.

Buyers and sellers on StarPlace are located in many jurisdictions, so buyer personal data is routinely transferred internationally. The Seller acknowledges these transfers and agrees to support the legal mechanisms used by StarPlace as Controller — in particular the EU Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum for transfers from the EEA/UK, and the LGPD mechanisms (art. 33) for transfers from Brazil. The Seller will not further transfer the data outside the country to which it has been delivered, nor disclose it to any third party, except as strictly required to deliver the order through CIG's official gift system.

The Seller is fully liable to StarPlace and to any data subject for any damages caused by the Seller's breach of this DPA. StarPlace may withhold payouts, suspend the account, and pursue indemnification for losses (including regulatory fines, dispute costs, and reasonable legal fees) caused by such a breach.

This DPA continues for as long as the Seller has access to any buyer personal data. On termination, the Seller will delete all buyer personal data in its possession and confirm deletion on request. Sections 3, 7, 9, and 11 survive termination.

This DPA is governed by the law identified on the Operator Identification page. Disputes are subject to the forum stated there.