This Vendor Data Processing Agreement (“DPA”) is between Baroow Digital Agency Inc., incorporated and operational in Barbados at Warrens, St. Michael, BB12001, Barbados (“Baroow”), and the vendor, merchant, host, service provider, organiser, employer, or other business participant using Baroow (“Vendor”).

This DPA provides a worldwide baseline for personal data disclosed or made accessible through Baroow. The parties' privacy roles are determined separately for each processing activity:

• Vendor as processor: The Vendor acts only on Baroow's documented instructions when Baroow determines the purpose and essential means of the processing.
• Vendor as independent controller: The Vendor acts as its own controller when it determines why and how to use data for its own fulfilment, hiring, property management, legal, tax, customer-service, safety, or business purposes. Employers and property listers will commonly be independent controllers after receiving an application or inquiry.
• Joint or separate roles: If the parties jointly determine purposes and means, or applicable law assigns another role, they will document the required allocation before the processing begins.

Processor-only clauses in this DPA apply only when the Vendor is actually Baroow's processor. Controller obligations and general security, confidentiality, minimisation, breach, rights-cooperation, and deletion duties apply whenever relevant.

Vendor types covered by this DPA:

• Marketplace Sellers: individuals or businesses listing goods for sale on the Baroow Classifieds or Marketplace vertical
• Restaurant Operators: food establishments accepting dine-in reservations, pickup, or delivery orders via the Food Delivery vertical
• Grocery Stores: grocery and convenience retailers fulfilling orders via the Grocery Delivery vertical
• Pharmacy Operators: licensed pharmacies dispensing over-the-counter (OTC) products via the Pharmacy vertical (prescription items are excluded from the platform)
• Vehicle Rental Hosts: individual vehicle owners or fleet operators listing vehicles for rent via the Vehicle Rental vertical
• Property Hosts: individual homeowners, landlords, or fleet property managers listing properties for short-term or long-term rental via the Property Rental vertical
• Home Service Providers: independent contractors or businesses offering professional services (e.g., cleaning, plumbing, electrical, landscaping) via the Home Services vertical
• Event Organisers: individuals or entities listing events, tours, or experiences for booking via the Events vertical
• Job Posters: employers or recruiters listing job opportunities via the Jobs vertical

By accepting the Terms & Conditions and this DPA during onboarding, the Vendor agrees to be bound by this Agreement. Baroow maintains a timestamped acceptance record for audit and enforcement purposes.

Lawful basis: Each controller is responsible for identifying, documenting, and communicating its lawful basis. Contract necessity applies only where the processing is objectively necessary for a contract with the individual. Consent must be separate and freely given where law requires it.