Data processing agreement (DPA)

1. Parties and subject matter

This agreement is made between the merchant who installs the Pryvexa app (the “Controller”) and PSP PANEL LIGHT S.R.L., registered office Strada Mărgăritarului nr. 6, Sat Gruiu, Comuna Gruiu, Județul Ilfov, România, Trade Register no. J2026020055006 (EUID ROONRC.J2026020055006), tax id 54342312 (the “Processor” or “we”), and forms part of the app’s Terms of service. It applies to the personal data of the store’s customers and visitors that we process on the Controller’s behalf.

Terms used have the meaning given in Regulation (EU) 2016/679 (“GDPR”). If this agreement and the Terms differ on data protection, this agreement prevails.

2. The Controller’s instructions

We process the data only on the Controller’s documented instructions. The instructions are: this agreement, the Terms, the Controller’s settings and actions in the app (for example turning on an automation, the autopilot or a campaign) and written requests sent to [email protected].

The Controller also expressly instructs us:

• to use the artificial intelligence providers in Annex 3 for the features it turns on (virtual assistant, WhatsApp replies, generated texts);
• if it joins the comparison network, to compute store-level totals from its data and combine them with those of at least 4 other stores, without customer data and without identifying the store;
• to send the data needed to the services it connects (for example Klaviyo, Meta / WhatsApp Business, Twilio, Infobip, SMSLink, SMSO). These are the Controller’s providers, not our sub-processors.

If, in our opinion, an instruction infringes the GDPR or other law, we tell the Controller immediately. We process the data for another purpose only if the law requires it, and then tell the Controller beforehand unless the law forbids it.

3. The Controller’s obligations

The Controller is responsible for the legal basis of the processing, for obtaining consent for marketing messages and for storing information on visitors’ devices (including through the store’s cookie banner), for informing customers in the store’s privacy policy, and for the lawfulness of its instructions.

The sign-up window follows the choices in the store’s cookie banner (Shopify Customer Privacy): it remembers after the tab is closed that the visitor closed it or subscribed only if they accepted preference cookies, and its A/B test includes only visitors who accepted analytics cookies. The Controller must have the banner on where the law requires it and describe these features in the store’s cookie notice.

4. Confidentiality and security

People with access to the data are bound by confidentiality. We apply the technical and organisational measures in Annex 2, appropriate to the risk (Art. 32 GDPR), and may improve them without lowering the level of protection.

5. Sub-processors

The Controller gives us general authorisation to use the sub-processors in Annex 3. We bind them by contract to data protection obligations at least as strict as those in this agreement and remain liable to the Controller for them.

We announce any new or replaced sub-processor in the app or by e-mail at least 30 days in advance. The Controller may object on reasonable grounds within that time; if we cannot find a solution, the Controller may end the contract by uninstalling the app, at no extra cost.

6. Assistance

We help the Controller answer data subjects’ requests. Requests of type customers/redact received through Shopify are carried out automatically when they arrive; this also deletes WhatsApp conversations with the phone number recorded in Shopify and chats in which the customer asked to talk to a person; other conversations expire within 30 days. For customers/data_request we record the request and, on the Controller’s request to [email protected], send it within 10 days a copy of the data we hold about that customer. If a person writes to us directly, we pass the request to the Controller without answering it on the merits ourselves.

We help, as far as the information we hold allows, with impact assessments and prior consultations (Art. 35–36 GDPR) and with meeting security obligations.

7. Personal data breaches

We notify the Controller without undue delay, and within 48 hours of becoming aware of a personal data breach affecting its data, with the information required by Art. 33(3) GDPR that we have at that time, and help it notify the authority and the data subjects where required.

8. Erasure at the end

When the app is uninstalled, Shopify sends us the shop/redact request after 48 hours, and we delete the store’s and its customers’ data. We keep only the store’s address, the action log, the acceptance of the terms and the record of the erasure, as evidence of compliance. Erased data also disappears from backups within 7 days, when the backups expire. The store’s core data stays in Shopify.

Before uninstalling, the Controller may ask at [email protected] for a copy of the data held only in the app (reviews, birthdays, WhatsApp consents, survey answers), which we provide in a common electronic format within 30 days.

9. Information and audits

On request we give the Controller the information needed to demonstrate compliance with Art. 28 GDPR. The Controller (or an auditor bound by confidentiality) may audit once a year, with 30 days’ notice, at its own cost and without affecting the security of other stores; an extra audit is possible after a personal data breach or at an authority’s request.

10. International transfers

Data is hosted in the European Union. Transfers to sub-processors outside the European Economic Area take place only with appropriate safeguards (Art. 46 GDPR), currently the Standard Contractual Clauses in their terms. Where the Controller is established outside the EEA in a country without an adequacy decision and its processing is not subject to the GDPR under Art. 3(2), the parties enter into Module 4 of the Standard Contractual Clauses (Decision (EU) 2021/914), incorporated by reference; Clause 17: Romanian law; Clause 18: courts of Romania; Annex I is filled in by Annex 1 of this agreement; for UK controllers the UK Addendum applies.

11. Service provider (CCPA)

To the extent California’s CCPA/CPRA applies, we act as a service provider: we do not sell or share the data, do not retain, use or disclose it outside the direct business relationship with the Controller or for any purpose other than providing the service, and do not combine it with data from other sources, except as the law allows and for the comparison network totals on the Controller’s instruction. We comply with the CCPA and provide the same level of privacy protection it requires; we notify the Controller if we can no longer meet these obligations; the Controller may take reasonable steps to ensure our use is consistent with the CCPA and to stop and remediate unauthorised use; our sub-processors are bound by the same terms.

12. Duration and liability

This agreement applies for as long as we process data on the Controller’s behalf. The parties’ liability is as set out in the Terms, within the limits allowed by Art. 82 GDPR. The agreement is governed by Romanian law and is accepted in English; the English version is the one that applies.

Annex 1. Details of the processing

Annex 2. Technical and organisational measures

• Hosting in the EU (Frankfurt), database encrypted at rest and encrypted backups.
• Encrypted connections (HTTPS/TLS), including to the database, with certificate verification.
• Tokens, API keys and the e-mail addresses left for “back in stock” or to talk to a person encrypted with AES-256-GCM.
• Store separation enforced by the database (Row-Level Security), with least-privilege roles and automated isolation tests.
• Minimisation: customers’ contact details are read from Shopify when sending, not copied (exception: the WhatsApp number and profile name in the WhatsApp inbox, 30 days); retention periods applied automatically.
• An action log that cannot be altered; error pages expose no internal data; secrets are removed from technical logs.
• Emergency stop for message sending, per store or globally; real sending is off by default.
• Internal access is limited to the operator’s administrators; the administration console has its own sign-in, separate from Shopify, and its actions are recorded in the action log.
• Automatic vulnerability check of dependencies on every code change; regular dependency updates.

Annex 3. Sub-processors