Data processing agreement

1. The parties and the purpose of the agreement

This data processing agreement (the “agreement”) is made between the merchant, as controller, and Vindesto, as processor (our details are below), under Article 28 of Regulation (EU) 2016/679 (the “GDPR”). It is part of the service contract made up of the order form and the platform's terms and conditions, and where they conflict on data protection, this agreement prevails.

The agreement covers the personal data we process on the merchant's behalf to provide the shop. It does not cover each person's Vindesto account, the address book, the platform's security or our contractual relationship with the merchant: for those, Vindesto is an independent controller, under the privacy policy.

2. What we process, why and for how long

The nature and purpose of the processing, the types of data and the categories of data subjects are described in annex 1. We process the data only for the term of the service contract and, after it ends, only as point 6.9 of the terms provides (export, retrieval, deletion).

3. The merchant's instructions

• We process the data only on the merchant's documented instructions, including regarding transfers outside the Union. The instructions are this agreement, the service contract and what the merchant does in the back office (for example, confirming an order, blocking a customer or inviting someone).
• If the law requires us to process the data otherwise, we tell the merchant beforehand, unless the law forbids that.
• If an instruction seems to us to breach the GDPR, we tell the merchant at once and may suspend it until it is confirmed or changed.
• We do not use the data for our own purposes, sell it or combine it with other shops' data.

4. The merchant's part

• It has a legal basis for each processing operation and informs customers. The privacy policy we generate for the shop, completed with the company details from Settings → Legal, helps it do so.
• It uses customers' data only for their orders and its legal obligations, and gives access only to team members who need it.
• It answers customers' requests about their data, with our help (point 7).

5. Confidentiality

The people on Vindesto's team with access to the data have committed to confidentiality or are bound to it by law. The technical team enters a shop's back office only to help, when the merchant asks or when a technical problem requires it; the back office then shows a banner, and every action appears in the shop's change log.

6. Security

We apply the technical and organisational measures in annex 2, appropriate to the risk (GDPR Article 32). We may improve them at any time, without lowering the level of protection.

7. Help with data subjects' requests

The back office shows the merchant each customer's data (orders, the addresses used for them, the last sign-in) and lets it block or remove the customer. For anything the back office cannot do, such as exporting one customer's data, we help on request within 10 working days. If someone contacts us directly about a shop's data, we pass the request to the merchant without delay and do not answer in its place.

8. Security incidents

If we become aware of a breach affecting the shop's data, we notify the merchant without undue delay and within 48 hours at the latest, by e-mail to the owners, with what we know: what happened, which data and how many people are affected, the likely consequences and what we did to limit them. We add information as we learn it. We help the merchant notify ANSPDCP and, where needed, the data subjects (GDPR Articles 33 and 34). We also help with impact assessments and prior consultations of ANSPDCP, when they are needed (Articles 35 and 36).

9. Other providers (sub-processors)

• The merchant gives us general authorisation to use the providers in annex 3.
• Before adding or replacing a provider, we e-mail the shop's owners at least 30 days in advance. The merchant may object on reasonable data protection grounds; if we find no solution, it can end the contract at no cost before the change.
• Each provider has, by contract, the same data protection obligations as we do, and we remain liable to the merchant for how it meets them.

10. Transfers outside the Union

We transfer data outside the European Economic Area only with the safeguards of Chapter V of the GDPR. The only transfer today is to Cloudflare, Inc. (United States), relying on the EU-US Data Privacy Framework (Decision (EU) 2023/1795) and the standard contractual clauses (Decision (EU) 2021/914).

11. When the contract ends

At the merchant's choice, we make all the data available (the export in point 6.9 of the terms) and then delete it, or delete it straight away. We delete the data within 30 days of the end of the retrieval period, except what the law obliges us to keep, and confirm the deletion on request.

12. Information and audits

We give the merchant the information needed to show that this agreement is followed: answers to questionnaires, a description of the measures and the providers. The merchant (or an auditor it chooses, bound by confidentiality) may carry out an audit at most once a year, with 30 days' notice, at its own cost and without affecting the security or the data of other shops; after a security incident, an audit may take place at any time.

13. Liability and changes

The parties' liability follows point 6.7 of the terms, without limiting liability to data subjects under GDPR Article 82. We e-mail the owners about changes to this agreement at least 30 days before they apply; the merchant may object and, if we do not reach agreement, end the contract at no cost.

Annex 1. Details of the processing

Annex 2. Technical and organisational measures

• Encryption in transit. All traffic uses HTTPS (TLS), with certificates issued automatically, and browsers are told not to use the platform any other way (HSTS, two years).
• Signing in. No passwords: 6-digit codes sent by e-mail, valid for 10 minutes, single-use, at most 5 attempts, only the newest code valid, and limits on repeated requests per e-mail address and per IP address.
• Sessions. Signed cookies, not readable by scripts on the page (HttpOnly), sent only over HTTPS and bound to the domain the sign-in happened on; the application's session cookie is encrypted.
• Separation of shops. Every request is limited to the data of the shop it belongs to.
• Access control. Roles in each shop (owner, administrator, editor, customer), settings only for owners and administrators; Vindesto team access is shown and recorded in the shop's log.
• Change log. Changes to products, orders, the team and settings are recorded, with the author and time, for 12 months.
• Infrastructure. The database and the search engine are not reachable from the internet; the server is in the European Union; uploaded files are kept in Cloudflare R2 object storage.
• E-mails. Sent from the vindesto.ro domain, through Brevo, with SPF and DKIM authentication.
• Backups. The database is copied every night and before the updates that change its structure. The copies are encrypted on the server, before they leave it, and kept for 30 days in separate Cloudflare R2 storage, where not even the platform can delete them sooner; the latest 7 also stay on the server. Deleted data leaves the copies within 30 days. Once a week the newest copy is restored as a test.
• Organisation. Access to the server and the data is limited to Vindesto's technical team, bound by confidentiality; incidents are handled under point 8.

Annex 3. Providers (sub-processors)