Data Processing Agreement

This data processing agreement (hereinafter: the “Data Processing Agreement”) forms an integral annex to the GENERAL TERMS AND CONDITIONS. The Data Processing Agreement becomes part of the contract between the parties together with the GENERAL TERMS AND CONDITIONS, upon acceptance thereof. ANNEX I (description of the parties and processing), ANNEX II (technical and organisational measures) and ANNEX III (register of Sub-processors) are attached to the main text of the Data Processing Agreement. The annexes shall be interpreted together with this main text. A separate annex containing standard contractual clauses does not form part of this agreement; in the event of a transfer to a third country, Chapter 11 and the provider safeguard specified in ANNEX III shall govern.

1. Subject matter and roles

1.1. In this Chapter and throughout this Data Processing Agreement, the Merchant acts as controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”) (hereinafter: “Controller”), and the Provider acts as processor within the meaning of Article 4(8) of the GDPR (hereinafter: “Processor”). The Controller and the Processor are hereinafter jointly referred to as the “Parties”, and individually as a “Party”.

1.2. The subject matter of this Data Processing Agreement is the regulation of the processing of personal data carried out by the Processor which the Controller entrusts to the Processor in the course of using the Platform and the Service, for its own processing purposes, including in particular, but not limited to, processing connected with the operation of the Store, the handling of orders, and the provision of additional Features activated by the Controller. This Data Processing Agreement constitutes a contract within the meaning of Article 28(3) of the GDPR.

1.3. This Data Processing Agreement does not cover processing operations in respect of which the Provider acts as an independent controller, thus in particular processing operations connected with the conclusion and performance of the contract concluded with the Merchant, invoicing, the operation of the Provider’s own websites and sales activities, the Provider’s own customer service and support contact with the Merchant and its Users, as well as notices regarding illegal content, moderation decisions, and correspondence connected with these. These processing operations are governed by the Provider’s PRIVACY NOTICE. If the support request contains Processed Personal Data, the Support feature group of ANNEX I shall apply to it. It is emphasised that, irrespective of the demarcation set out in this clause, the Processor may not use personal data falling within the scope of this Data Processing Agreement for its own purposes, with the exception of fraud prevention signals, which the Provider processes as an independent controller pursuant to clause 4.4 of the ARTIFICIAL INTELLIGENCE ANNEX.

1.4. The identification, contact persons, and notification details of the Parties are contained in ANNEX I. This Data Processing Agreement shall apply until the provision of the data processing service, and thereafter until the completion of the return or erasure pursuant to Chapter 13, and, in respect of data lawfully retained thereafter, until the expiry of the retention period.

2. Definitions

2.1. The terms used in this Data Processing Agreement that are defined in the GENERAL TERMS AND CONDITIONS – including in particular the terms Provider, Merchant, Platform, Service, Store, Administration Interface, Customer and Order Record – have the meanings set out in the GENERAL TERMS AND CONDITIONS. This Chapter defines exclusively the terms under the GDPR and terms not governed in the GENERAL TERMS AND CONDITIONS.

2.2. “Personal Data”: personal data within the meaning of Article 4(1) of the GDPR that forms the subject matter of the processing falling within the scope of this Data Processing Agreement (hereinafter as necessary: “Processed Personal Data”).

2.3. “Processing”: an operation or set of operations within the meaning of Article 4(2) of the GDPR performed by the Processor on behalf of the Controller.

2.4. “Data Subject”: an identified or identifiable natural person within the meaning of Article 4(1) of the GDPR to whom the Processed Personal Data relates.

2.5. “Personal Data Breach”: a breach of security within the meaning of Article 4(12) of the GDPR that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, Processed Personal Data transmitted, stored or otherwise processed.

2.6. “Documented Instructions”: instructions given by the Controller to the Processor in writing – including electronic form –, in the GENERAL TERMS AND CONDITIONS, in this Data Processing Agreement, or through the intended use of the Service, in particular by means of settings made on the Administration Interface and the activation of individual features.

2.7. “Sub-processor”: another processor engaged by the Processor in accordance with Chapter 7 within the meaning of Article 28(2) and (4) of the GDPR.

2.8. “Technical and Organisational Measures”: the measures applied by the Processor on the basis of Article 32 of the GDPR and set out in ANNEX II (hereinafter: “TOMs”).

2.9. “SCCs”: the standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR (standard contractual clauses; the standard contractual clauses under Commission Implementing Decision (EU) 2021/914), where they are contained in the data processing terms of the Sub-processor concerned, or where their application between the Parties becomes necessary.

2.10. Other terms used in this Data Processing Agreement that are defined in the GDPR have the meanings set out in the GDPR.

3. Instructions of the Controller

3.1. The Processor shall process Processed Personal Data exclusively on the basis of Documented Instructions of the Controller, in accordance with Article 28(3)(a) of the GDPR. The conclusion of the GENERAL TERMS AND CONDITIONS and the Data Processing Agreement, as well as the intended use of the Service, shall qualify as Documented Instructions with respect to the processing described in ANNEX I. The Processor shall not use Processed Personal Data for its own purposes – including in particular, but not limited to, model training or other use going beyond the Controller’s instructions; solely the fraud prevention signals pursuant to clause 1.3 constitute an exception to this.

3.2. The Processor may carry out the transfer of Processed Personal Data to a third country exclusively on the basis of Documented Instructions and in accordance with Chapter 11, unless the transfer is required by Union or Member State law applicable to the Processor. In the latter case, the Processor shall inform the Controller of that legal requirement prior to the processing, unless applicable law expressly prohibits such information on important grounds of public interest.

3.3. If, in the Processor’s opinion, an instruction of the Controller infringes the GDPR or other applicable Union or Member State data protection provisions, the Processor shall inform the Controller thereof without delay, in accordance with the second subparagraph of Article 28(3) of the GDPR. Such notification shall not qualify as an undertaking to carry out a general legal review of all instructions of the Controller. If the Controller maintains the instruction despite the notification, the Processor is entitled to suspend the performance of the processing concerned until lawfulness is restored, and to consult with the Controller thereon.

3.4. The Controller is responsible for determining the purposes and means of the processing, for the existence of the legal basis for data processing, for the information to be provided to Data Subjects, and for the lawfulness of its instructions. The Controller is entitled to use the Service exclusively in accordance with the applicable statutory provisions, and shall maintain its rights and authorisations in respect of the Processed Personal Data throughout the entire duration of the processing.

3.5. If the Processor is called upon by an authority, court or other third party to disclose Processed Personal Data, the Processor – provided that this is not prohibited by applicable law – shall inform the Controller thereof without undue delay, and shall restrict the disclosure to the extent mandatorily required by law.

4. Specification of the processing

4.1. In accordance with Article 28(3) of the GDPR, the subject matter and duration of the processing, the nature and purpose of the processing, the types of Processed Personal Data, the categories of Data Subjects, and the rights and obligations of the Controller are set out in detail in ANNEX I. The Processor’s activities extend in particular to providing hosting and operation of the Platform and the Store, supporting the technical handling of orders and customer communications, and providing further Features activated by the Controller – including in particular, but not limited to, the consent management tool and the AI Services. The Processor provides the individual Features exclusively in the event of and within the framework of activation or configuration by the Controller.

4.2. The duration of the processing corresponds to the duration of the contract existing under the GENERAL TERMS AND CONDITIONS, with the proviso that in the event of termination of the contract, the provisions of Chapter 13 shall apply. The Processor shall not process the Processed Personal Data beyond the duration and purposes indicated in ANNEX I, or differently from them.

4.3. The Controller shall keep the details in ANNEX I up to date, and shall introduce any substantive change affecting the subject matter of the processing, the types of Processed Personal Data or the categories of Data Subjects – including in particular the inclusion of special categories of personal data under Article 9 of the GDPR – only after prior consultation and, where necessary, the amendment of ANNEX I. In the absence of an agreement to the contrary, the Controller shall not transfer for processing special categories of data under Article 9 of the GDPR and data under Article 10 of the GDPR in connection with the Service.

4.4. Where the consent management Feature is used, the Processor shall provide a technical tool for managing consent categories to be applied in the Controller’s Store and for loading optional code subject to consent, as described in ANNEX I. The Controller shall be responsible for the lawful use of cookies and similar technologies, for the content of its own cookie and privacy notices, and for measures within the Controller’s own sphere of competence necessary to demonstrate consents. It is emphasised that the provision of the technical tool in itself does not replace the fulfilment of the Controller’s obligations to provide information and proof.

4.5. If the Controller activates a Feature for the provision of which the transfer of Processed Personal Data to a Sub-processor is necessary, the activation of the Feature shall constitute Documented Instructions within the scope described in ANNEX I and ANNEX III. The procedure for the engagement of Sub-processors is determined by Chapter 7, and the rules for transfers to a third country are determined by Chapter 11.

4.6. The Controller shall upload to, or store in, the Service exclusively such Processed Personal Data for the processing of which it has lawful authorisation, and shall, within its own sphere of competence, rectify inaccurate or unnecessary data or initiate their erasure, using the tools available on the Administration Interface.

5. Confidentiality and persons authorised to access

5.1. The Processor shall ensure that persons authorised to process the Processed Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, in accordance with Article 28(3)(b) of the GDPR.

5.2. The Processor shall restrict access to the Processed Personal Data to what is strictly necessary for the performance of duties, manage authorisations in a documented manner, and revoke access without delay upon the cessation of authorisation, in accordance with the access management provisions of ANNEX II. The Processor’s staff may access the Controller’s data for support purposes exclusively to the extent and for the duration necessary for the provision of the service, bug fixing or security measures.

5.3. The confidentiality obligation under this Chapter shall survive the completion of the processing and the termination of the Data Processing Agreement, until the expiry of the retention period in respect of lawfully retained data. The confidentiality obligation shall not extend to the disclosure of information that is mandatorily required by law, a court decision or an authority decision; in such a case, clause 3.5 shall apply.

6. Security and technical and organisational measures

6.1. The Processor shall, in accordance with Article 28(3)(c) of the GDPR, take all measures required pursuant to Article 32 of the GDPR. Within this framework, the Processor shall apply Technical and Organisational Measures tailored to the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, taking into account Article 32(1)–(2) of the GDPR.

6.2. The scope of the specific measures applied – including in particular, but not limited to, measures relating to encryption, access management, segregation per Controller, logging, and backup and recovery – is determined exclusively by ANNEX II. This main text sets out a general obligation on this subject and contains no specific technical parameters beyond the reference to ANNEX II.

6.3. The Processor shall regularly review the TOMs and is entitled to develop them in line with technological progress and changes in risks, provided that the modification does not, overall, reduce the level of protection of the Processed Personal Data. To any material modification that overall reduces the level of protection, the amendment procedure under Chapter 14 shall apply.

6.4. The Controller shall, within its own competence, assess prior to using the Service and during the term of processing whether the measures set out in ANNEX II provide sufficient guarantees – as measured against the purposes of processing and risks determined by it – in accordance with Article 28(1) of the GDPR. The Controller acknowledges that it is responsible, within its own competence, for allocating its own user permissions on the Administration Interface and for protecting its credentials.

7. Sub-processors

7.1. In accordance with Article 28(2) of the GDPR, the Controller hereby grants general written authorisation to the Processor to engage other processors, as set out in Article 28(3)(d) of the GDPR, under the conditions set out in this Chapter. The authorisation extends exclusively to Sub-processors individually named as legal entities in the register of Sub-processors in ANNEX III, and to any Sub-processor engaged in an urgent case pursuant to clause 7.6; in the latter case, the Processor shall remedy the entry in the register without undue delay. Entry of the Sub-processor into the register and the commencement of its engagement may take place in accordance with the procedure set out in clauses 7.4–7.6. Reference to a service provider category, description of function or service group in itself does not constitute authorisation, and no Sub-processor may be engaged on that basis.

7.2. The Processor may engage a Sub-processor only if the Sub-processor provides sufficient guarantees that the processing will meet the requirements of the GDPR and ensure the protection of the rights of Data Subjects, in accordance with Article 28(1) of the GDPR. The Processor shall conclude a contract with the Sub-processor that imposes the same data protection obligations on the Sub-processor as those incumbent on the Processor under this Data Processing Agreement, in accordance with the first sentence of Article 28(4) of the GDPR, including in particular, but not limited to, the rules on adherence to Documented Instructions, confidentiality, the implementation of TOMs, restrictions on engaging further processors, breach notification, assistance with data subject rights, audits and deletion. If the Sub-processor fails to fulfil its data protection obligations, the Processor engaging the Sub-processor shall remain fully liable to the Controller for the performance of the Sub-processor’s obligations, in accordance with the second sentence of Article 28(4) of the GDPR; in the relationship between the Parties, the extent of liability shall be governed by clause 14.5.

7.3. The prevailing scope of Sub-processors is set out in the register of Sub-processors in ANNEX III. No separate live register is published. For each Sub-processor, the register contains at least the name of the legal entity, the purpose of engagement, the scope of data processed, the location of processing or transfer, and, where a third country is involved, the applicable transfer safeguard. The start date of engagement is governed by clauses 1.4 and 3.1 of ANNEX III, and in the event of a change, by the notice pursuant to clause 7.4, whereas in an urgent case pursuant to clause 7.6, the start date of engagement is the date on which actual engagement commences. In the case of processing within the European Economic Area, the register records the location of processing by referring to the European Union or the European Economic Area, and where a third country is involved, by specifying the third country concerned; a change of location within the European Economic Area does not constitute an expansion of the location of processing for the purposes of clause 7.4, unless the register restricted the processing concerned exclusively to the European Union; in such case, a location outside the Union but within the European Economic Area constitutes an expansion. Following the entry into effect of the change pursuant to clauses 7.4–7.6, the Processor shall incorporate the change into the prevailing version of ANNEX III; until such incorporation, the state communicated and having taken effect pursuant to clauses 7.4–7.6 shall be governing for the Controller concerned.

7.4. If the change involves re-routing to a legal entity that was already listed as an individually named Sub-processor in the register pursuant to clause 7.3 prior to the change, and the re-routing remains within the scope of the function, data scope, location of processing and transfer safeguard recorded in the register, the Processor may implement the change without any prior waiting period. Load and capacity sharing between Sub-processors listed with the same purpose of engagement, data scope, location of processing and transfer safeguard, which does not affect the recorded content of the register, does not constitute a change under this clause; the Processor records the actual engagement of individual Sub-processors in its internal records and provides information thereon upon request of the Controller. In the event of re-routing qualifying as a change under this clause, the Processor shall inform the Controller in writing (including notice sent to the notification email address specified in ANNEX I) at the latest simultaneously with the change taking effect, and shall incorporate the change into ANNEX III in accordance with clause 7.3 only if the content of ANNEX III actually changes or the former provider is removed from the register. In the case of a legal entity that was not previously listed in the register, or if the change expands the scope of the function, data scope, location of processing or transfer safeguard already recorded, the Processor shall inform the Controller of the planned change in writing at least fourteen calendar days prior to the planned start date of engagement; the Controller’s Processed Personal Data may not be made accessible to the Sub-processor concerned until the fourteen calendar days have elapsed—or, in the event of an objection pursuant to clause 7.5, until the date specified therein—with the exception set out in clause 7.6. The notice shall contain the details pursuant to clause 7.3 and the reason for the change. Prior to commencing engagement, the Processor shall record the existence of the contractual and transfer conditions pursuant to clause 7.2 in its internal records.

7.5. The Controller may raise an objection in writing within 30 calendar days of receipt of the notice pursuant to clause 7.4. Specific indication of a data protection ground or justification is not required for the objection; the Controller may state the reason for the objection during the consultation in order to seek a solution. If the objection is received within the fourteen-calendar-day advance notice period pursuant to clause 7.4, the new or expanded engagement concerned may not commence with respect to the Controller’s Processed Personal Data until an agreement on a solution is reached, or in the absence of a solution, until the expiry of a further fifteen days following the fifteen-day consultation period specified below, or—if the Controller terminates the contract within that period—until the termination takes effect. In the event of an objection, the Parties shall consult without delay; the Processor shall examine, in particular, whether the processing concerned can be performed with another Sub-processor, or by excluding the Controller’s Processed Personal Data from the scope of the disputed change in the future. If no solution can be reached within fifteen days of communication of the objection, the Controller is entitled to terminate the service element concerned, or—if the processing concerned cannot reasonably be separated from the Service—the contract between the Parties, in writing with immediate effect, without setting an additional period pursuant to clause 18.8 of the GENERAL TERMS AND CONDITIONS; refunds of fees shall be governed by clause 9.4.1 of the PLANS AND PRICING ANNEX. The legal consequences of the objection shall apply with effect for the future. In the case of advance notice pursuant to clause 7.4, in the absence of an objection, the change may take effect upon the expiry of the fourteen calendar days; this does not preclude an objection raised subsequently within 30 calendar days of the notice. A purely editorial clarification of ANNEX III—which does not affect the legal entity of the Sub-processor, or the subject matter, location or safeguard of the processing—does not require separate notice; the Processor shall record such clarification in its internal change log and incorporate it into the next version of ANNEX III.

7.6. If the immediate replacement of the Sub-processor is unavoidable due to a security incident, service outage or the cessation of the Sub-processor’s business, and waiting for the fourteen-calendar-day advance notice period would materially jeopardise the security or continuity of the Service, the Processor may implement the change without waiting for the advance period pursuant to clause 7.4. The urgent change may extend only to the narrowest scope of data and duration necessary to restore security or continuity; a transfer to a third country may take place only where a safeguard pursuant to Chapter 11 exists. The Processor shall provide the notice—indicating the reason for urgency, the details pursuant to clause 7.3 and the safeguards applied—simultaneously with implementing the change or, failing that, within forty-eight hours at the latest, and shall incorporate the change into ANNEX III in accordance with clause 7.3. In such case, the right of objection pursuant to clause 7.5 may be exercised within thirty days of the notice, with legal consequences for the future.

8. Assistance with the exercise of Data Subjects’ rights

8.1. The Processor, in accordance with Article 28(3)(e) of the GDPR, taking into account the nature of the processing and to the extent of the information available to it, shall assist the Controller with appropriate technical and organisational measures in fulfilling its obligations relating to responding to requests for exercising the rights of Data Subjects under Articles 15–22 of the GDPR – including, in particular, the right of access, to rectification, to erasure, to restriction of processing, to data portability and to object.

8.2. The Processor shall provide the Controller with self-service tools on the Administration Interface, in particular for the following: exporting the personal data of individual Customers in a structured format, initiating erasure alongside the display of circumstances potentially preventing erasure – in particular the existence of a statutory retention obligation –, revoking the initiated erasure within a ten (10) day revocation time window, and tracking the deadlines for fulfilling Data Subject requests. The Processor shall execute the erasure following the expiry of the revocation time window, in the absence of preventing circumstances.

8.3. In addition to the tools specified in clause 8.2, the Processor shall provide support for the exercise of rights by Data Subjects within the scope of the Features actually implemented on the Administration Interface and in the Store. It is emphasised that under this Chapter, the Processor is not obliged to provide full data export encompassing all data categories at full organisational or full Store level, nor can such an undertaking be derived from any other provision of the contract between the Parties. Requests not falling within the scope of self-service tools and requiring ad hoc assistance may be fulfilled based on an order by the Controller, in accordance with clause 9.3.

8.4. If the Data Subject addresses their request directly to the Processor, the Processor shall forward the request to the Controller without undue delay, but at the latest within five Business Days, and shall direct the Data Subject to the Controller. In the absence of Documented Instructions from the Controller, the Processor shall not provide a substantive response to the request and shall not take substantive action, unless required to do so by law.

8.5. The Controller shall ensure the assessment of Data Subject requests and compliance with the deadlines under Article 12 of the GDPR. The Processor shall execute erasure, rectification or restriction operations carried out on the basis of the Controller’s instructions across all instances of Processed Personal Data under its own control, as set out in Chapter 13 with regard to backup copies and statutory retention, and shall inform the Controller of the performance by way of confirmation.

9. Assistance with security and impact assessment obligations

9.1. In accordance with Article 28(3)(f) of the GDPR, taking into account the nature of processing and the information available to it, the Processor shall assist the Controller in fulfilling its obligations pursuant to Articles 32–36 of the GDPR, in particular in connection with guaranteeing the security of processing (Article 32), notifying personal data breaches to the supervisory authority and informing Data Subjects (Articles 33–34), conducting a data protection impact assessment (Article 35), as well as prior consultation with the supervisory authority (Article 36).

9.2. Within the scope of the assistance under clause 9.1, the Processor shall, upon the reasoned request of the Controller, make available in particular the description of the TOMs applied to the processing in accordance with ANNEX II, the information on data flows and Sub-processors set out in ANNEX I and ANNEX III, as well as, in the event of a Personal Data Breach, the information pursuant to Chapter 10. Carrying out the data protection impact assessment and the prior consultation and making the decisions relating thereto shall remain the task of the Controller.

9.3. The Processor shall be obliged to commence and perform ad hoc assistance provided under Chapter 8 and this Chapter that exceeds the scope of the self-service tools and the provision of information covered by the annexes, on the basis of detailed Documented Instructions of the Controller, as a general rule only following prior written acceptance of the scope, performance deadline and fee of the assistance. If the failure to provide ad hoc assistance would directly jeopardise the performance of a statutory, time-bound obligation of the Controller, the Processor shall commence the assistance minimally necessary to meet the deadline even prior to the prior acceptance of the fee; the Parties shall subsequently settle the fee on an itemised basis, on the basis of a reasonable fee for the work actually expended. The handover of information and documents already available and recorded in the annexes shall not constitute fee-bearing ad hoc assistance. This clause does not make the essential assistance to be mandatorily provided by the Processor under the GDPR and the Data Processing Agreement subject to a separate fee, including in particular the incident notification under Chapter 10. The fee settlement under this clause shall apply exclusively between the Parties and shall not affect the Data Subject’s exemption from fees under Article 12(5) of the GDPR. If clause 18.19 of the GENERAL TERMS AND CONDITIONS applies, the remuneration for assistance related to switching providers under clause 18.19 shall be governed not by this clause, but by clause 18.19.6 of the GENERAL TERMS AND CONDITIONS.

10. Personal Data Breach

10.1. If the Processor becomes aware of a Personal Data Breach, the Processor shall notify the Controller thereof without undue delay after becoming aware, in accordance with Article 33(2) of the GDPR. According to its internal procedure, the Processor shall provide the notification within a target deadline of forty-eight (48) hours from becoming aware, which target deadline does not replace or extend the requirement of “without undue delay”. If the notification takes place beyond the target deadline, the Processor shall inform the Controller of the time of becoming aware and the reason for the delay. The notification shall be made to the incident notification contact details specified in ANNEX I.

10.2. In the notification under clause 10.1, the Processor shall – to the extent of the information available to it, where necessary in phases, as it becomes available – inform the Controller in particular of the following: the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and affected data records, the likely consequences of the Personal Data Breach, and the measures taken or planned to be taken to address it and to mitigate its possible adverse effects, as well as the contact person from whom further information can be requested, in accordance with the content elements set out in Article 33(3) of the GDPR.

10.3. The Processor shall, without delay after becoming aware, commence the investigation, containment and remediation of the Personal Data Breach, take the measures necessary to prevent further damage, document the incident and the measures taken, and continuously inform the Controller of substantive developments in the investigation until the Controller has received all information available to the Processor that is necessary for the performance of its tasks under Articles 33–34 of the GDPR. In the event of a Personal Data Breach occurring at a Sub-processor, the Processor shall ensure that the Sub-processor informs it of the breach without undue delay, and shall forward the information thus received in accordance with this Chapter.

10.4. The Controller shall decide on and attend to the notification of the Personal Data Breach to the supervisory authority pursuant to Article 33(1) of the GDPR – including compliance with the seventy-two (72) hour deadline –, as well as the communication to Data Subjects pursuant to Article 34 of the GDPR. The Processor shall not make any notification to the supervisory authority or communication to Data Subjects instead of the Controller, unless it receives express Documented Instructions from the Controller to do so, and is entitled to perform it on the basis of legislation or an official requirement.

10.5. An unsuccessful security event that has not compromised the confidentiality, integrity or availability of the Processed Personal Data shall not constitute a Personal Data Breach. The Processor shall inform the Controller of such an event upon its substantiated request, within the framework of Chapter 9.

11. Transfer to a third country

11.1. The Processor may transfer Processed Personal Data to a third country or to an international organisation – including remote access from a third country – exclusively on the basis of Documented Instructions of the Controller and where the conditions of Chapter V of the GDPR (Articles 44–49) are fulfilled. The location of processing and transfer applicable at any given time is determined by ANNEX I and ANNEX III. It is emphasised that the Data Processing Agreement contains no commitment regarding an exclusive European Union processing location or data storage residency; with regard to the location of processing, exclusively the data individually indicated in the annexes shall govern.

11.2. If the European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR in respect of the recipient country, territory, sector or international organisation, the transfer may be carried out under that decision. A transfer on the basis of the EU-US Data Privacy Framework (hereinafter: “EU-US DPF”) falls within this scope exclusively if the recipient organisation has a valid certification and the transfer falls within the scope of the certification and the adequacy decision. The Processor shall keep records of recipients engaged on the basis of an adequacy decision in ANNEX III, indicating the safeguard.

11.3. In the absence of an adequacy decision or in the case of a transfer falling outside its scope, the transfer may take place exclusively in accordance with Article 46 of the GDPR, on the basis of the provider safeguard indicated in ANNEX III. In the case of a transfer carried out by engaging a Sub-processor, the safeguard contained in the Sub-processor’s own data processing terms shall govern, including the SCCs contained therein; a separate SCC annex or separate SCC negotiation does not form part of this agreement. If the Controller is located outside the European Economic Area and the disclosure of data between the Parties itself constitutes a transfer to a third country not covered by an adequacy decision, no such transfer shall take place until the Parties have recorded the safeguard pursuant to Article 46 of the GDPR – where necessary, the applicable SCC module, the roles of the Parties and its appendices – separately in writing. In the absence of such separate recording, this agreement does not contain SCCs between the Parties; if recorded, in the event of any discrepancy between the SCCs and the Data Processing Agreement, the SCCs shall govern with regard to the transfer to a third country.

11.4. Prior to the transfer pursuant to clause 11.3, the Processor shall – in cooperation with the Controller – carry out a documented transfer assessment covering an evaluation of the law and practice of the recipient country, the circumstances of the transfer and the effectiveness of the applicable safeguard, and where necessary shall apply supplementary technical, contractual or organisational measures. The Processor shall make the documented transfer assessment available upon the Controller’s reasoned request, redacting data of other customers and details constituting trade secrets. If, based on the transfer assessment, an essentially equivalent level of protection cannot be ensured pursuant to Article 44 of the GDPR, the Processor shall not carry out the transfer or shall suspend it, and shall inform the Controller thereof without delay.

11.5. A transfer based on a derogation pursuant to Article 49 of the GDPR may take place exclusively on an exceptional, ad hoc basis and on the basis of prior, express Documented Instructions of the Controller. The Processor shall not carry out regular, bulk or structural transfers on the basis of a derogation.

11.6. If the adequacy decision, the certification under the EU-US DPF or the other applied safeguard ceases to be in force or is suspended, or the safeguard is materially modified, the Processor shall inform the Controller thereof without undue delay, apply the notification and objection procedure of Chapter 7, and, in the absence of a lawful safeguard, suspend the transfer concerned.

12. Audit and provision of information

12.1. In accordance with Article 28(3)(h) of the GDPR, the Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this Data Processing Agreement and in Article 28 of the GDPR, and shall allow for and contribute to audits, including on-site inspections, conducted by the Controller or another auditor mandated by the Controller, within the reasonable framework set out in this Chapter.

12.2. The Controller may initiate a routine audit no more than once per calendar year, with written notice sent at least 30 days in advance. The limit of once per calendar year shall not apply where the Controller initiates the audit due to a Personal Data Breach, a request to provide evidence by a supervisory authority or a court, a well-founded suspicion of a material breach of contract substantiated by documentary evidence, or a one-off, targeted document-based follow-up audit of the remediation of a deficiency identified in a previous audit; such an exceptional audit may exclusively cover the scope of processing related to the triggering cause. In the case of an exceptional audit, the prior written notice period shall be five Business Days; in the case of a Personal Data Breach, the document-based examination may be commenced without delay following the notice. The audit shall be conducted primarily on the basis of documents made available by the Processor; an on-site inspection may only take place if the document-based examination is insufficient for the purpose of the audit. The Parties shall consult in advance, within a reasonable time, on the date, scope and participants of the on-site inspection; the Processor shall not unduly delay the date of the on-site inspection, and no further consent from it shall be required beyond the insufficiency of the document examination. The audit may take place during Business Hours, in a manner that does not unduly disrupt the operations of the Processor, following prior consultation. The auditor and the persons participating in the audit shall be subject to a duty of confidentiality and shall be obliged to comply with the reasonable security regulations of the Processor during their activities. The audit may not extend to access to the data of other Merchants; the Processor shall exclude such data from the scope of the audit and redact them from the materials provided.

12.3. For the purposes of the audit, the Processor may make available, in particular, the description of the measures set out in ANNEX II, relevant extracts from the records of processing activities, and – where available – copies of independent certifications, audit reports and summaries thereof. Making the reports available shall not in itself extinguish the Controller’s right to audit under clause 12.1. Each Party shall bear its own costs of the audit, including the fees and costs of its own auditor and other agents. The prior acceptance of fees under clause 9.3 shall not apply to the handover of already existing documents and record extracts. For the remuneration of extraordinary work requiring genuinely new data collection or preparation, the procedure of prior written acceptance under clause 9.3 shall apply, with the proviso that the lack of acceptance of the fee shall not hinder the mandatory cooperation under clause 12.1, and the second sentence of clause 9.3 shall apply accordingly.

12.4. If the audit reveals a breach of this Data Processing Agreement, the Controller shall inform the Processor thereof in writing, stating the reasons, and the Processor shall remedy the infringement within a reasonable deadline, and communicate to the Controller in writing the steps necessary for remediation and their planned completion deadline. This Chapter shall not limit either other contractual or statutory rights of the Controller, or the powers of the supervisory authority. In accordance with Article 31 of the GDPR, the Processor shall cooperate with the supervisory authority, and shall inform the Controller of any request from an authority affecting the Processed Personal Data in accordance with clause 3.5.

13. Return and deletion

13.1. At the end of the provision of data processing services, the Processor shall, in accordance with Article 28(3)(g) of the GDPR, at the choice of the Controller and in accordance with the procedure set out in clause 13.2, return all Processed Personal Data to the Controller or delete them, and delete existing copies, unless Union or Member State law requires their storage. Network signals for the prevention of fraud and abuse processed by the Provider as an independent controller under clause 4.4 of the ARTIFICIAL INTELLIGENCE ANNEX do not qualify as Processed Personal Data and do not fall under the scope of the return or deletion procedure under this clause; the processing, retention and deletion of these signals shall be governed exclusively by clauses 4.4–4.5 of the ARTIFICIAL INTELLIGENCE ANNEX.

13.2. In the event of general termination of the provision of data processing services, the Controller shall communicate its choice under clause 13.1 in writing within at most 30 calendar days from the completion of the data processing services, which time limit coincides with the 30-day export period under clause 18.13 of the GENERAL TERMS AND CONDITIONS. Return shall take place under clause 18.14 of the GENERAL TERMS AND CONDITIONS, through the export functions available in the Administration Interface or via an export file issued upon a customer support request; the contractual schedule of data scopes and formats is determined by clause 18.14 of the GENERAL TERMS AND CONDITIONS. Processed Personal Data not included therein shall be returned by the Processor upon the request of the Controller free of charge, in a structured, machine-readable format available to it; remuneration under clause 9.3 may be applied exclusively to custom formats or custom processing requested by the Controller. If the Controller chooses deletion within the time limit, the Processor shall delete the Processed Personal Data stored in live systems within 30 calendar days from the communication of the choice, but at the latest by the 60th day from the completion of the data processing services; in the event of immediate termination under clause 18.7 of the GENERAL TERMS AND CONDITIONS, deletion shall be governed by the recovery period specified therein, unless the Controller expressly waives the possibility of recovery in its choice of deletion. If the Controller chooses return, the Processor shall delete any copies remaining in live systems after the return has been completed at the latest by the 60th day from the completion of the data processing services. In the absence of communication of a choice, the Processor shall delete the Processed Personal Data stored in live systems within a further 30 calendar days from the expiry of the deadline for choosing, and shall inform the Controller thereof in advance; backup copies shall be governed by clause 13.3 and the rules of ANNEX II, and mandatory retention shall be governed by clause 13.4.

13.2.1. In the event of termination of a Store that has not gone live and is not subject to fee payment due to inactivity, the general choice procedure under clause 13.2 and the subsequent export period under clause 18.13 of the GENERAL TERMS AND CONDITIONS shall not apply. Such termination shall be governed by clauses 3.8.2 and 18.12 of the GENERAL TERMS AND CONDITIONS with regard to the schedule of warnings (notice sent 1 day before locking, and 7 days and 1 day before deletion), unlocking, and export prior to deletion – as the option to choose return. If unlocking does not take place during the 30-day locking period, the Processor shall delete the Store’s data stored in live systems after the expiry of the locking period, within at most 7 days. Backup copies shall remain governed by clause 13.3 and the rules of ANNEX II, and data that must be mandatorily retained under legislation shall remain governed by clause 13.4.

13.2.2. In the event of termination of the contract by provider switching (by the procedure under clause 18.19 of the GENERAL TERMS AND CONDITIONS), the first 30 days following termination shall constitute the data retrieval and export period under clauses 18.13 and 18.19.5 of the GENERAL TERMS AND CONDITIONS, as well as the concurrent period for the choice under clause 13.1. If the Controller chooses deletion during this 30-day period, or communicates no choice, the Processor shall delete the Processed Personal Data stored in live systems at the latest within the next 30 days, that is to say, in total at the latest by the 60th day from the termination of the contract. If the Controller chooses return, the Processor shall delete any copies remaining in live systems after the return has been completed at the latest by the 60th day from the termination of the contract. The deletion of data not qualifying as personal data shall be governed exclusively by clause 18.19.5 of the GENERAL TERMS AND CONDITIONS; this clause does not regulate that scope. Backup copies shall remain governed by clause 13.3 and the rules of ANNEX II, and mandatory retention shall remain governed by clause 13.4 in this case as well.

13.3. The Processor shall execute deletion in the live systems. It is emphasised that the targeted, immediate removal of Processed Personal Data contained in backup copies and copies retained for recovery purposes cannot be performed technically; from the moment of deletion, these data may be stored exclusively for the purposes of integrity, security and the execution of the overwrite cycle, they may not be actively processed, and they shall be overwritten or destroyed in accordance with the backup overwrite schedule set out in ANNEX II within the time limit set out therein. Permanent physical deletion extending to all copies may not be demanded prior to the expiry of the overwrite time limit.

13.4. With regard to data that must be mandatorily retained under Union or Member State law, the Processor shall store the data exclusively for the purpose and duration requiring retention, shall continue to apply the provisions of this Data Processing Agreement on confidentiality and security to them, and shall delete them following the expiry of the retention period. The Provider’s own billing, accounting and contract-proving records as an independent controller shall be governed by clause 1.3; these records do not form the subject of return or deletion under clause 13.1.

13.5. Upon the written request of the Controller, the Processor shall provide written confirmation of the completion of the return or deletion under clauses 13.1–13.3. With regard to Processed Personal Data held by Sub-processors, the Processor shall ensure through the contracts under clause 7.2 that the Sub-processors execute the return or deletion instruction in accordance with the schedule set out in this Chapter.

14. Miscellaneous provisions

14.1. This Data Processing Agreement is concluded in writing, in electronic form, in accordance with Article 28(9) of the GDPR. The fact of its conclusion through the acceptance of the GENERAL TERMS AND CONDITIONS – during registration or at the time of the Order –, the effective date of the applicable text and the time of acceptance are recorded by the register under clause 4.7.3 of the GENERAL TERMS AND CONDITIONS. The electronic form satisfies the requirement of written form.

14.2. In data processing matters, in the event of any conflict between the Parties’ contractual documents, the order of precedence is: where the SCCs specifically recorded under clause 11.3 are applicable, the SCCs, followed by the body text and annexes of this Data Processing Agreement, and then the GENERAL TERMS AND CONDITIONS; for the Parties’ liability towards each other, clause 14.5 shall apply. For individual provisions separately and expressly accepted by the Parties affecting this Data Processing Agreement, the order of precedence under clauses 5.4–5.5 of the GENERAL TERMS AND CONDITIONS shall apply, provided that no stipulation contrary to mandatory provisions of the GDPR may be applied. This clause does not affect the precedence of the ARTIFICIAL INTELLIGENCE ANNEX in respect of provisions concerning AI Services, however, during the processing of personal data in connection with AI Services, the rules of this Data Processing Agreement shall apply in all cases.

14.3. The Controller acknowledges that the Processor reserves the right to amend the TOMs (ANNEX II) subject to the conditions of clause 6.3, and to amend the register of Sub-processors (ANNEX III) in accordance with clauses 7.4–7.6. To any other amendment of this Data Processing Agreement, clauses 18.2–18.4 of the GENERAL TERMS AND CONDITIONS shall apply; the amendment may only take place by publishing a new, dated version, with prior notice to the Controller, and earlier versions remain permanently retrievable in the legal centre. To any amendment affecting a stipulation falling under clause 5.3 of the GENERAL TERMS AND CONDITIONS, clause 5.6 of the GENERAL TERMS AND CONDITIONS shall apply; in the absence of express acceptance, the previous stipulation remains in effect, without prejudice to the mandatory content under Article 28 of the GDPR.

14.4. If any provision of this Data Processing Agreement conflicts with a provision of the GDPR or other mandatorily applicable legislation, or is invalid, this shall not affect the validity of the remaining provisions; in place of the invalid provision, the mandatory content of the legislation or, in the absence thereof, a valid rule most consistent with the purpose of the Parties shall apply. No provision of this Data Processing Agreement may be interpreted as restricting the rights of Data Subjects based on the GDPR – including in particular their right to damages under Article 82 of the GDPR.

14.5. To the Parties’ liability towards each other – including the liability under Article 28(4) of the GDPR set out in clause 7.2 and the recourse claim under Article 82(5) of the GDPR – Chapter 15 of the GENERAL TERMS AND CONDITIONS shall apply exclusively; this does not affect the non-derogable provisions of the GDPR and other mandatorily applicable legislation.

14.6. In matters not regulated in this Chapter – including in particular the delivery of notices, applicable law and jurisdiction –, the provisions of the GENERAL TERMS AND CONDITIONS shall apply. Notices to be given under this Data Processing Agreement shall be sent to the contact details specified in ANNEX I; the Parties shall communicate any change in their contact details without delay.

14.7. Confidentiality under Chapter 5, return and deletion under Chapter 13, as well as the provisions of this Chapter shall survive the termination of this Data Processing Agreement until performance of Chapter 13, or, in respect of lawfully retained data, until the expiry of the retention period.

Annex I – Parties and description of the processing

This Annex I forms an integral part of the Data Processing Agreement.

1. The parties

1.1. Acting as Controller is the Merchant whose identification and contact details are contained in the Order Record pertaining to the contract between the parties (hereinafter: ‘Controller’).

1.2. Acting as Processor is WZZ Lab Informatikai és Szolgáltató Korlátolt Felelősségű Társaság (short name: WZZ Lab Kft.) (registered office: 9700 Szombathely, Kassák Lajos utca 32/B 2. em. 3. ajtó, company registration number: 18-09-116842, registry court: Court of Registration of the Szombathely Regional Court, tax number: 33150176-2-18, EU VAT number: HU33150176, e-mail address: hello@poltura.com) as Provider (hereinafter: ‘Processor’).

1.3. The parties designate the following contact details as data protection points of contact:

on the part of the Controller: the data protection point of contact, notification e-mail address and incident notification contact details recorded in the Order Record;
on the part of the Processor: the Processor’s data protection point of contact, hello@poltura.com.

1.4. The Processor does not designate a data protection officer; it is available on data protection matters at the point of contact under clause 1.3. If the Controller designates a data protection officer, it shall communicate their contact details in the Order Record or in writing to the Processor.

1.5. Capitalised terms used in this Annex and not specifically defined herein shall be interpreted as defined in the GENERAL TERMS AND CONDITIONS or the main text of the Data Processing Agreement. With respect to concepts relating to the processing of personal data, the definitions of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: ‘GDPR’) shall prevail.

2. Subject matter and duration of the processing

2.1. The subject matter of the processing is the provision of the Service to the Controller in accordance with the GENERAL TERMS AND CONDITIONS and the Plan selected by the Controller, including in particular, but not limited to, the operation of the Store, the provision of the Administration Interface, and the operation of the feature groups specified in clause 3.

2.2. The Processor shall process personal data exclusively on the instructions of the Controller, to the extent and degree necessary for the provision of the Service. The procedure for giving instructions is governed by the main text of the Data Processing Agreement; this Annex does not repeat these provisions.

2.3. The duration of the processing corresponds to the duration of the contract between the parties for the use of the Service. Return, erasure, and any temporary retention following the termination of the contract shall be governed by the provisions of the main text of the Data Processing Agreement.

2.4. Due to the nature of the Service, the processing is continuous and repetitive. In accordance with the applicable provisions, the processing operations extend in particular to collection, recording, storage, organisation, retrieval, transmission, making available to the Controller, as well as erasure and destruction.

3. Nature and purpose of the processing by feature group

3.1. The nature and purpose of the processing by feature group can be defined as follows. Processing related to each feature group takes place only if and to the extent that it forms part of the Service on the basis of the Plan selected, feature activated, or instruction given by the Controller. The list is not exhaustive: processing related to additional features forming part of the Service falls within the scope of this clause if it remains within the scope of the data types under clause 4 and the categories of data subjects under clause 5.

Feature group	Nature of the processing	Purpose of the processing
Store operation and order management	Serving the public interface of the Store, product catalogue, basket and customer account operations, and the receipt, recording and status management of orders; recording and enforcing Customers’ consent choices; assessing the risk of fraud and abuse of orders based on order, billing and delivery data, as well as usage and network signals, including, where necessary, automated checking of publicly available web sources and generating a risk signal (fraud risk assessment); transferring data necessary for performance to integrations activated by the Controller in accordance with the Controller’s instructions	Enabling the Controller to offer its products and services online, fulfil, track and verify its orders, including assessing the risk of abuse and fraudulent orders, and technically supporting the enforcement of customer consent choices
Customer service communication and correspondence	Receiving, storing, organising and making available to the Controller messages and letters between Customers and the Controller, managing attachments; compiling, sending, recording delivery events of, and archiving correspondence for transactional and other electronic mail to be sent on the Controller’s instructions	Enabling the Controller to respond to and manage inquiries, and to deliver notifications related to orders and account operations to recipients
Support	Processing Processed Personal Data shared in the Controller’s support requests or accessed during support access under clause 4.3 of ANNEX II, and retaining records related to the request for one year from the closure of the matter	Fulfilling the Controller’s support request
AI Services	Processing input data provided by the Controller or its Users through an external model provider engaged by the Processor – in the case of a task containing personal data, exclusively with the model provider designated for this purpose in ANNEX III –, and making available the resulting Output	Supporting the Controller’s work, including in particular assisting in the generation of draft customer service responses, translations, catalogue data and other content

3.2. It is emphasised that the fraud risk assessment feature is directed towards making a risk signal and assessment available to the Controller under this Annex. This Annex does not record any commitment regarding automated decision-making in respect of this feature; automatic approval based on a threshold set by the Controller under clause 8.2 of the ARTIFICIAL INTELLIGENCE ANNEX is the execution of a prior, general decision of the Controller; at a high risk level and in all cases involving adverse consequences, the decision is made by the Controller in accordance with the provisions of the ARTIFICIAL INTELLIGENCE ANNEX. Platform-level fraud and abuse prevention network signals under clause 4.4 of the ARTIFICIAL INTELLIGENCE ANNEX, which the Provider processes as an independent controller in accordance with clause 1.3 of the main text, clause 12.2 of the GENERAL TERMS AND CONDITIONS, and clause 4.4 of the ARTIFICIAL INTELLIGENCE ANNEX, are strictly separated from the fraud risk assessment data processing under this Annex; these independent controller network signals do not form the subject matter of the data processing provided to the Controller, and are governed by the Provider’s PRIVACY NOTICE and clauses 4.4–4.5 of the ARTIFICIAL INTELLIGENCE ANNEX.

3.3. When using AI Services, input data may – depending on the purpose of the feature – also contain personal data, including in particular the content of customer service conversations or order contexts. Such transfer may take place exclusively through Sub-processors included in the register under Annex III, in accordance with the provisions of the main text of the Data Processing Agreement.

3.4. Transfer of data through connections with external services activated by the Controller in its own name – including in particular payment, delivery and billing services – constitutes an instruction of the Controller. The data protection role of such providers is determined not by this Annex, but by the actual data flow and the Controller’s legal relationship with them; these providers are included in the register under ANNEX III only if they are engaged by the Processor.

4. Types of personal data

4.1. The processing may – depending on the feature groups under clause 3 and the Controller’s use of the Service – extend to the following types of personal data:

identification and contact details, including in particular name, e-mail address and telephone number;
address data, including in particular billing and delivery address, and, where acting on behalf of an organisation, data relating to the organisation and its contact person;
account and access data, including in particular user identifier, authentication data in protected form, as well as role and permission data;
order and transaction data, including in particular data relating to ordered products and services, the amount and status of the order, as well as the fact, amount and time of payment;
communication data, including in particular the content, recipients, attachments and delivery events of customer service messages and electronic mail;
input data entered into AI Services and Output generated therefrom, if they contain personal data;
technical and usage data, including in particular internet protocol address, device and browser data, session and log data, as well as event data associated with the use of the Store;
in the context of fraud risk assessment, signals relating to order circumstances, network connection and past ordering behaviour, as well as risk assessments generated therefrom (with the proviso that network signals processed by the Provider as an independent controller under clause 4.4 of the ARTIFICIAL INTELLIGENCE ANNEX do not qualify as Processed Personal Data);
data provided by the Controller or generated during the procedure in connection with the exercise of data subjects’ rights and the handling of personal data breaches within the scope of cooperation under the main text of the Data Processing Agreement.

4.2. The list under clause 4.1 defines the types of data and does not mean that all data types are processed in respect of every Controller and every feature group.

5. Categories of data subjects

5.1. The processing may concern the following categories of data subjects:

Customers, including persons placing an order in the Store, holding a customer account, and contacting the Controller;
employees, agents and contact persons of the Controller who use the Service on behalf of the Controller as Users or act as contact persons;
contact persons, authorised representatives and agents of the Controller’s business partners, where their data enter the Platform during the intended use of the Service.

6. Exclusion of special categories of data

6.1. The processing does not extend to special categories of personal data under Article 9 of the GDPR, nor to personal data relating to criminal convictions and offences under Article 10 of the GDPR.

6.2. The Controller may enter such data into the Service exclusively on the basis of a prior written agreement between the parties, under the conditions set out therein. In the absence of such an agreement, the Processor shall notify the Controller without delay of any data under clause 6.1 coming to its knowledge and shall act in accordance with the Controller’s instructions.

7. Reference to the location of processing

7.1. The location of processing, as well as the Sub-processors engaged, are determined by the register of Sub-processors under ANNEX III. This Annex does not record any independent commitment regarding data residency.

Annex II – Technical and Organisational Measures

This Annex II forms an inseparable part of the Data Processing Agreement.

1. General provisions

1.1. This Annex sets out the technical and organisational measures that the Processor applies to ensure the security of processing, in accordance with Article 32 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”). The measures apply to the entirety of the processing under Annex I, in respect of all feature groups unless provided otherwise.

1.2. The Processor designs and maintains the measures taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of data subjects.

1.3. The Processor is entitled to further develop the measures and replace them with more modern procedures without reducing the level of protection. The Processor shall inform the Controller of any change materially affecting the level of protection in accordance with the procedure set out in the main text of the Data Processing Agreement.

2. Encryption

2.1. Encryption in transit

2.1.1. Interfaces and services accessible on public networks may only be used via an encrypted connection. Data traffic with the storage serving for the storage of files and other content also takes place exclusively via an encrypted connection.

2.1.2. Calls between the internal services of the Platform are cryptographically authenticated. In operator sessions, authentication is supplemented by a cryptographic proof tied to the given session.

2.2. Encryption at rest

2.2.1. Encryption of Processed Personal Data at rest is not universal. The Processor stores Customer and order data, as well as uploaded files, in primary systems without encryption at rest by default.

2.2.2. By way of derogation from clause 2.2.1, the Processor stores sensitive credentials and correspondence archives encrypted.

2.2.3. The Processor stores backups encrypted. This Annex does not detail the type and technical design of the encryption applied, and does not contain a comprehensive commitment to encryption at rest or database-level encryption for primary storage.

3. Tenant isolation

3.1. In the multi-tenant operation of the Platform, the data and runtime environments of individual Stores are isolated. Isolation at the compute environment level is implemented as follows:

each Store operates in its own isolated runtime environment, which is subject to default-deny network rules;
rendering code not controlled by the Processor runs in an isolated runtime environment with monitored and restricted outbound network access.

3.2. Isolation at the database level is implemented as follows:

the Processor stores the data of each Store in its own database assigned exclusively to that Store, with an isolated access role assigned to that Store;
the configuration of the database connection management layer prevents session settings of a connection from leaking into the serving of another Store.

3.3. Certain shared services – including in particular correspondence and customer service communication – operate in shared systems with logical separation per Store. In such cases, access takes place with verification of the scope belonging to the given Store for every operation.

4. Access management and authentication

4.1. Access to the Platform and the Administration Interface is based on role-based permission management. Each User may access data and features exclusively within the scope of the permissions assigned to their role.

4.2. The Platform supports two-factor authentication via time-based one-time code and passcode-less, device-bound authentication key (passkey). It is emphasised that enabling two-factor authentication is subject to the decision of the User or the Controller; this Annex does not record any commitment as to its mandatory nature at Merchant level.

4.3. Access by the Processor’s staff for support purposes may take place under the following conditions:

access may be granted exclusively for justified support or troubleshooting purposes, to the extent necessary for the specific task;
access is provided by a short delegated permission valid for at most a few minutes, which terminates automatically upon expiry of its validity period;
repeated, elevated (step-up) authentication is required to perform sensitive operations;
a log entry is created regarding the granting of support access and the operations performed within its framework in accordance with clause 5.

5. Logging

5.1. The Processor maintains an audit log of significant operations performed within the operational and administrative features of the Platform. The log records the occurrence, time and performer of the operation, and serves the investigation of security events as well as the accountability of processing.

5.2. Application logs are generated in a structured format. Sensitive data elements recognisable in log entries – including in particular e-mail addresses, telephone numbers, payment card numbers, bank account numbers and access credentials – are automatically masked by the Processor’s system prior to recording to ensure that logs do not contain unnecessary personal data.

5.3. Only authorised operator roles may access logs, in accordance with the access management rules under clause 4.

6. Security of uploaded files

6.1. Files uploaded to the Platform undergo an automated security scan prior to being served, which covers – including in particular – checks for malicious code and known malicious patterns.

6.2. As part of the scan, the system unpacks compressed archives subject to size and item-count limits. Image files are re-encoded by the system, and additional data embedded in the image is removed during re-encoding. PDF files are stored in rebuilt form following the scan.

6.3. If the scan detects malicious content, the Processor ceases serving the affected file and, in order to take the necessary measures, records whether the file had previously been downloaded.

7. Protection against overload and automated abuse

7.1. The Processor applies rate limiting (limitation of request frequency) to Platform services, which is enforced both per Store and at the application programming interface level.

7.2. On specific public flows – including in particular registration and public forms – verification impeding automated abuse and bot traffic is active.

8. Backup and recovery

8.1. The Processor creates continuous transaction log archiving as well as daily backups of databases. The retention period of backups is 14 days. The backup scheme enables point-in-time recovery of the database to an earlier state.

8.2. An automated testing tool is available to verify the operability of the recovery procedure.

8.3. This clause 8 describes a technical backup scheme and does not in itself establish any contractual data loss metric or recovery time limit. Such commitment may only be stipulated in the AVAILABILITY AND SUPPORT ANNEX, substantiated by own measurement and recovery testing; no availability, data loss or recovery warranty follows from this clause in itself.

9. Vulnerability and dependency management

9.1. The Processor tracks updates to the Platform’s software dependencies with automated recommendations and incorporates security updates as part of the development process.

9.2. The Processor records released software components with a verifiable cryptographic hash to ensure that the identity and immutability of the running version can be determined. The integrity of the locked list of dependencies and compliance with the published interface specification are verified by automated checks in the development process, and in the event of any discrepancy, the process prevents release.

Annex III – Register of Sub-processors

This Annex III forms an integral part of the Data Processing Agreement.

1. Purpose and governing status of the register

1.1. This Annex is the register of Sub-processors engaged by the Processor, in accordance with the provisions of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”). No separate live register is published.

1.2. The governing status of the register at any given time is contained in the version of this Annex in force at any given time. A change communicated and having taken effect pursuant to clauses 7.4–7.6 of the Data Processing Agreement shall govern the Controller concerned with the content of the notification until it is incorporated into this Annex.

1.3. Only a provider that is listed in the register by its legal entity, with the purpose of engagement, the scope of data processed and the place of processing, may be engaged as a Sub-processor. A service category alone, without specifying the legal entity providing it, may not be included in the register as an authorised Sub-processor. An exception is the urgent case under clause 7.6 of the Data Processing Agreement, in which the Processor shall make up for the incorporation into this Annex without undue delay.

1.4. The start date of engagement of the Sub-processors included in the table under clause 3 is determined by clause 3.1; in the case of an engagement introduced by a change, the start date of engagement is the planned start date specified in the notification under clause 7.4 of the Data Processing Agreement, whereas in the case of an urgent replacement under clause 7.6, it is the date on which actual engagement commences.

1.5. Services of the same legal entity that differ in purpose, scope of data, place of processing, transfer safeguard or activation conditions are listed in separate rows. The authorisation, notification and objection under clause 7.1 and clauses 7.4–7.5 of the Data Processing Agreement apply on a row-by-row basis; the scope specified in one row does not grant authorisation for the engagement of another service.

2. Procedure for changes

2.1. The register does not distinguish between Sub-processors by active and standby status. A provider included in the register may be engaged under the conditions specified in the body of the Data Processing Agreement, from the start date of engagement under clause 1.4.

2.2. Changes to the register – including the addition of a new Sub-processor, the replacement of an existing Sub-processor, and a change in the place of processing – are governed by the provisions of the body of the Data Processing Agreement with regard to notification, objection and the consequences of objection. This Annex does not establish independent time limits or procedural rules on this matter.

2.3. If a Sub-processor engages another processor in the processing, the Processor keeps a record of this in accordance with the body of the Data Processing Agreement, and makes the identification data concerning the processing chain available upon the request of the Controller.

3. Content of the register

3.1. The Sub-processors included in the register are set out in the table below. The data of the legal entities included in the table were recorded by the Processor on the basis of verification on 31 October and 1 November 2026. The start date of engagement of the Sub-processors included in the table recorded at the entry into force of this Annex is the date of entry into force of the Data Processing Agreement.

Legal entity of the Sub-processor	Purpose of engagement	Scope of data processed	Place of processing / region	Safeguard for transfer to a third country
UpCloud Oy	Server and virtual server services for the provision of the Service	Processed Personal Data stored or processed on the servers or virtual servers of the provider during the provision of the Service	European Union	Not relevant (processing within the EEA)
Rackforest Zrt.	Server and virtual server services for the provision of the Service	Processed Personal Data stored or processed on the servers or virtual servers of the provider during the provision of the Service	European Union	Not relevant (processing within the EEA)
dataforest GmbH	Server and virtual server services for the provision of the Service	Processed Personal Data stored or processed on the servers or virtual servers of the provider during the provision of the Service	European Union	Not relevant (processing within the EEA)
SCALEWAY SAS	Server and virtual server services for the provision of the Service	Processed Personal Data stored or processed on the servers or virtual servers of the provider during the provision of the Service	European Union	Not relevant (processing within the EEA)
netcup GmbH	Server and virtual server services for the provision of the Service	Processed Personal Data stored or processed on the servers or virtual servers of the provider during the provision of the Service	European Union	Not relevant (processing within the EEA)
Hetzner Online GmbH	Server and virtual server services for the provision of the Service	Processed Personal Data stored or processed on the servers or virtual servers of the provider during the provision of the Service	European Union	Not relevant (processing within the EEA)
Google Cloud EMEA Limited (Vertex AI)	Artificial intelligence model service (AI Service); AI tasks containing personal data may be directed exclusively to this provider as model provider	Input data and Output of the AI Services within the scope according to the feature	Global locations: countries according to the provider’s published list of locations, in particular the United States of America; in the case of a Store requesting EU data residency, the place of model computation and data storage is the European Union, alongside the provider’s global maintenance and support infrastructure	EU-US Data Privacy Framework (certification of Google LLC); additionally standard contractual clauses ((EU) 2021/914, Module 3) under Google Cloud’s data processing terms
OpenRouter, Inc.	Gateway towards artificial intelligence model providers (AI Service) in the scope of template code, catalogue data, and layout and branding tasks; AI tasks containing personal data may not be directed here	Non-personal data input and Output of the task; tasks containing personal data may not be directed here, and this row does not grant authorisation for the transfer of any personal data that may nevertheless be provided	United States of America; underlying model providers exclusively: DigitalOcean and Cloudflare, and – in OpenRouter’s own contractual chain – Google Vertex AI	Standard contractual clauses ((EU) 2021/914) incorporated into clause 13.2 of OpenRouter’s data processing agreement
Amazon Web Services EMEA SARL – SES	Sending electronic mail and handling delivery events	Recipient data, email content, attachments, delivery events	European Union	Not relevant (processing within the EEA)
Google Cloud EMEA Limited (Google Workspace)	Receipt of electronic mail arriving at the customer correspondence channel of Stores and storage required for its transmission to the Platform’s customer support system; furthermore, receipt of Processed Personal Data shared by the Controller in electronic mail via the Processor’s support channel	Customer data in incoming customer emails and in the Controller’s support requests (address and header data, email content and attachments)	European Union and third countries according to the provider’s published list of locations, in particular the United States of America (global infrastructure, maintenance and support)	EU-US Data Privacy Framework (certification of Google LLC); additionally standard contractual clauses ((EU) 2021/914, Module 3) under Google’s data processing terms
BunnyWay d.o.o.	Content delivery, caching, image storage, container execution and domain name resolution	Traffic of the Store’s public interface, image content, connection and log data	Storage and execution: European Union; content serving and caching: countries according to the provider’s published point-of-presence list, including third countries	Central European Union processing and point-of-presence data processing terms set out in BunnyWay’s existing data processing agreement
Cloudflare, Inc.	Domain name resolution, network protection and content delivery, code execution at the network edge, object storage, automated abuse prevention checks, and – behind OpenRouter – artificial intelligence model service	Traffic of the Administration Interface and the Platform’s associated control surfaces and data transmitted thereby, network and connection data of Users, security logs, stored files, and data processed by code running on the edge network	Global network: countries according to the provider’s published list of locations, in particular the United States of America with regard to logs and metadata	EU-US Data Privacy Framework (certification of Cloudflare, Inc.); additionally standard contractual clauses ((EU) 2021/914, Module 3) under Cloudflare’s customer data processing agreement
PostHog, Inc.	Traffic and usage analytics for the public interface of Stores, session recording in case of visitor consent, and error tracking	Visitor and customer events linked to a pseudonymised identifier segregated per Store, browser and device data, consent status, masked session recording, and error events purged of direct identifiers; IP address is anonymised	European Union (primary storage and processing) and United States of America (support access and serving infrastructure)	EU-US Data Privacy Framework (certification of PostHog, Inc.); additionally standard contractual clauses ((EU) 2021/914, Module 2) under PostHog’s data processing agreement

3.2. Providers specifically designated as AI Service in the table process personal data exclusively in the context of providing the specific artificial intelligence feature. The availability of each feature, its method of activation and the terms governing it are set out in clauses 2.1.1–2.1.2 of the ARTIFICIAL INTELLIGENCE ANNEX; in the absence of using the feature concerned, the processing associated with it does not take place.

4. Demarcation from services activated by the Merchant

4.1. This register contains exclusively the Sub-processors engaged by the Processor in the course of processing. External services activated by the Controller in its own name – including in particular payment, shipping, invoicing and advertising services – do not become part of this register merely by being connectable with the Platform; their data protection role is to be assessed in accordance with clause 3.4 of ANNEX I.

4.2. For collecting and invoicing its own fees from Merchants, the Provider engages payment and invoicing service providers, including in particular the services of Stripe Technology Europe, Limited and – in the context of technology platform services – Stripe Payments Europe, Limited in the case of card payments and SEPA direct debit, Wise Europe SA in the case of payment by bank transfer, and Billingo Technologies Zrt. in the context of issuing invoices. The Provider engages these providers within its own controller scope, and does not engage them to process Processed Personal Data subject to this Data Processing Agreement on behalf of the Controller; therefore, they are not included as Sub-processors in this register. Information on these providers and the data processed by them is provided in the Provider’s PRIVACY NOTICE.

4.3. For domain name operations initiated by the Merchant on the Platform, the Provider engages the domain name registrar service of Hosting Concepts B.V. (Openprovider). For the operation, the Provider processes the identification and contact data of the Merchant or of the person designated as the user of the domain name, for the purpose of performing the contract between the Provider and the Merchant, within the Provider’s own controller scope; the Provider does not process Processed Personal Data subject to this Data Processing Agreement on behalf of the Controller in this context, and therefore Openprovider is not included as a Sub-processor in this register. The data is also received by the registry of the chosen extension – acting as an independent controller; information on this and on any transfer to a third country is provided in the Provider’s PRIVACY NOTICE.

4.4. The Provider also engages certain providers included in the register – in particular Google Workspace for its own general, support and DSA correspondence – within its own controller scope. Such engagement for own purposes is governed by the Provider’s PRIVACY NOTICE; the rows under clause 3.1 apply exclusively to processing carried out on behalf of the Controller.

5. Transfer to a third country

5.1. If the engagement of any Sub-processor involves the transfer of personal data to a third country, this may take place exclusively under the conditions set out in the body of the Data Processing Agreement, in accordance with Chapter V of the GDPR. This Annex does not establish an independent commitment regarding transfer safeguards.

Product

Resources