For partners · DRAFT

Data Processing Addendum

Last updated: 17 August 2026 · Warsha (Lebanon)

This Data Processing Addendum (“DPA”) describes how personal data flows through the Warsha marketplace for partner review. It supplements the Privacy Policy (DRAFT) and Master Services Agreement (DRAFT) where applicable.

1. Roles (summary)

• Warsha acts as the data controller for app user accounts (buyers, delivery partners, and shop operator accounts), platform operations, early-registration leads, and data processed to run the marketplace.
• Google Firebase / Google Cloud (Authentication, Firestore, Storage, and related services) acts as a data processor / infrastructure provider processing data on Warsha’s instructions under Google’s terms.
• Google Maps Platform processes location and geocoding data when users place delivery pins or use routing features.
• Shop partners may act as independent controllers for business and catalog data they upload, and for how they use buyer contact information received to fulfill orders outside the Platform.
• Meta (Facebook) and Google process social-login data under their own controller/processor roles when users choose those sign-in methods.

2. Categories of data processed

• Account identifiers (name, email, phone, role, profile photo)
• Order, address, and map-pin data
• Catalog, pricing, and product images (shops)
• Order chat (text and voice notes)
• Early-registration form submissions from the website
• Technical logs and security data

3. Purpose & instructions

Processors and subprocessors may process data only to provide the Warsha Platform, fulfill orders, secure accounts, comply with law, and support users — as described in the Privacy Policy and this DPA. Warsha instructs Firebase/Google infrastructure accordingly through configuration, security rules, and account settings.

4. Security

Warsha implements access controls, Firebase security rules, and reasonable organizational measures appropriate to a marketplace startup. Cyber insurance is to be arranged with a broker. Partners should use strong passwords and protect shop admin accounts.

5. Subprocessors

Key subprocessors include Google (Firebase, Maps), email/form notification providers for website registration, and social login providers chosen by users. A formal subprocessor list: [to be maintained and published after counsel review].

6. Retention & deletion

Retention periods: [ORDER_RETENTION] for order-related records (draft). User deletion procedures are on Data deletion.

7. International transfers

Firebase and Google services may process data on servers outside Lebanon. Transfer mechanisms and safeguards: [to be confirmed with counsel].

8. Contact

Data protection / partner inquiries: warshaa961@gmail.com

Operator: [LEGAL_ENTITY_NAME], [REGISTERED_ADDRESS], Lebanon.