Privacy & Data Requirements

This document has two sections. Section A describes how Whatalo collects and processes Developer data. Section B defines the data protection obligations every Developer must follow when handling Store Owner and End User data through the Whatalo Platform.

These requirements are grounded in Dominican Republic Law 172-13 on the Protection of Personal Data, GDPR principles for Developers serving European users, and industry-standard data protection practices.

---

Section A — How Whatalo Handles Developer Data

A.1 Data We Collect

When you register for the Whatalo Developer Program, we collect and process the following data:

A.2 How We Use Developer Data

We use your data exclusively for:

1. Service Delivery — Operating the Developer Program, processing submissions, and facilitating Marketplace distribution.
2. Communication — Sending review decisions, policy updates, security alerts, and platform announcements.
3. Payments — Processing revenue share payouts and generating tax documentation.
4. Security — Detecting and preventing abuse, fraud, and unauthorized access.
5. Platform Improvement — Aggregated and anonymized usage data to improve API performance, documentation, and developer tools.

We do not sell Developer personal data to third parties.

A.3 Data Sharing

We share Developer data only in these circumstances:

A.4 Data Retention

A.5 Developer Rights

Under Dominican Republic Law 172-13 and applicable data protection laws, you have the right to:

• Access — Request a copy of all personal data Whatalo holds about you.
• Correction — Request correction of inaccurate or incomplete personal data.
• Deletion — Request deletion of your personal data, subject to legal retention obligations.
• Portability — Receive your data in a structured, machine-readable format.
• Objection — Object to processing of your data for specific purposes.

To exercise these rights, submit a request through the Developer Portal. We will respond within thirty (30) calendar days.

A.6 Data Security

Whatalo implements the following measures to protect Developer data:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access controls with principle of least privilege.
• Regular security audits and penetration testing.
• Incident response procedures with defined notification timelines.
• Infrastructure hosted in SOC 2-compliant data centers.

---

Section B — Developer Data Protection Obligations

B.1 Data Minimization

• Only collect and process data that is strictly necessary for your Plugin's stated functionality.
• Do not request OAuth scopes beyond what your Plugin actively uses.
• Do not collect data "for future use" or speculative purposes.
• Regularly audit your data collection practices and remove any unnecessary data.

B.2 Consent and Transparency

• Clearly inform Store Owners and End Users about what data you collect, why you collect it, and how you use it.
• Obtain explicit consent before collecting any data not inherently required for the Plugin's core functionality.
• Provide a clear, accessible privacy policy that covers all data collection and processing activities.
• If your Plugin collects data from End Users (store customers), ensure the Store Owner has appropriate notices in place.

B.3 Data Security Requirements

B.4 Data Deletion on Uninstall

When a Store Owner uninstalls your Plugin:

1. You will receive an uninstall webhook notification.
2. Within thirty (30) calendar days of receiving the uninstall notification, you must delete all data associated with that store.
3. Exceptions: You may retain data required by law (e.g., tax records, transaction logs) for the legally mandated period, but must delete all other data.
4. You must be able to demonstrate compliance with deletion requirements upon request.

B.5 Prohibition on Data Sales

This includes:

• Selling anonymized or aggregated data derived from Platform data.
• Sharing data with advertising networks or data brokers.
• Using Platform data to build or enrich profiles for sale.
• Providing data to third parties for marketing purposes without explicit Store Owner consent.

B.6 Data Breach Notification

In the event of a data breach affecting data obtained through the Whatalo Platform:

Your breach notification to Whatalo must include:

• Nature and scope of the breach (what data, how many records).
• Date and time of discovery.
• Containment measures taken.
• Planned remediation steps.
• Contact person for ongoing communication.

B.7 Privacy Policy Requirements

Your Plugin's privacy policy must, at minimum, include:

1. Identity — Your company name, contact information, and data protection officer (if applicable).
2. Data Collected — Specific categories of data your Plugin collects.
3. Purpose — Clear explanation of why each data category is collected.
4. Legal Basis — The lawful basis for processing (consent, legitimate interest, contractual necessity).
5. Third Parties — Any third parties with whom data is shared, and why.
6. Retention — How long data is retained and criteria for determining retention periods.
7. User Rights — How Store Owners and End Users can exercise their data rights.
8. Security — Overview of security measures protecting the data.
9. Updates — How changes to the privacy policy are communicated.

B.8 Legal Compliance

You must comply with all applicable data protection laws in the jurisdictions where your Plugin operates:

B.9 Data Subject Rights

You must provide mechanisms for Store Owners and End Users to exercise their data rights:

• Right of Access — Provide copies of personal data upon request within 30 days.
• Right of Correction — Correct inaccurate data upon request within 15 days.
• Right of Deletion — Delete personal data upon request within 30 days (subject to legal retention).
• Right of Portability — Provide data in a structured, machine-readable format upon request.
• Right to Object — Allow individuals to object to specific processing activities.

B.10 Sub-Processors

If you use third-party services (sub-processors) to process data obtained through the Platform:

• Maintain a list of sub-processors and make it available upon request.
• Ensure sub-processors provide at least the same level of data protection as required by this policy.
• Execute data processing agreements with all sub-processors.
• You remain fully liable for the acts and omissions of your sub-processors.

---

Compliance Audits

Whatalo reserves the right to audit Developer compliance with these data protection requirements. Audits may be conducted:

• As part of the Plugin review process (initial and updates).
• In response to a data breach or security incident.
• On a periodic basis (with reasonable notice).
• In response to Store Owner complaints.

You agree to cooperate with audits and provide reasonable access to documentation, systems, and personnel as necessary.

---