Data Processing Agreement

1. Parties and roles

This agreement is an annex to the User Agreement between Test (the "Processor") and the User who runs the Store (the "Controller"). For the personal data of the Store's Buyers, visitors and newsletter subscribers the User is the controller and the Platform the processor.

2. Subject and duration

Hosting; order, customer and return records; e-mail and SMS delivery; backups. For the term of the agreement and the statutory retention periods.

3. Data categories and data subjects

Identity, contact, transaction, security (IP address, source port, sessions) and marketing permission data; Buyers, visitors, subscribers.

4. Instructions

The Processor processes personal data only to provide the Service and on the Controller's instructions given in the panel, and for no other purpose.

5. Security measures

TLS in transit and encryption of secrets, authorisation and store isolation, access logs, backups, staff confidentiality.

6. Sub-processors

List of hosting, e-mail, SMS and backup providers; prior notice of changes and the right to object.

7. International transfers

Legal basis and countries, if any.

8. Data subject requests

The Processor gives the Controller tools in the panel to answer data subject requests (export, erasure, withdrawal of permissions) and forwards requests it receives without delay.

9. Breach notification

The Processor notifies the Controller of a data breach within 72 hours of becoming aware of it, describing the breach, the data concerned and the measures taken; the parties cooperate to remedy it.

10. Audits

Information requests with reasonable notice; independent audit reports.

11. End of the agreement

When the agreement ends the Processor allows a reasonable period for export, then deletes or anonymises the personal data. Records the law requires to keep (orders, invoices, contract copies, consent records) are kept with restricted access until their retention period ends.

12. Entry into force

This agreement enters into force when the User accepts it electronically and applies for the term of the User Agreement.