Data Processing Agreement

Version: [VERSION AND DATE]

1. Parties and scope

This agreement binds the customer identified when contracting ProfitRocket, hereinafter the "Customer", and [COMPANY NAME], tax identification number [TAX ID], address [ADDRESS], hereinafter "ProfitRocket".

The Customer acts as controller of the personal data of its stores or, where it processes data on behalf of another controller, as a processor with sufficient authorisation to engage ProfitRocket. ProfitRocket acts as processor or sub-processor respectively in relation to the operations described in Annex I.

ProfitRocket's own processing relating to the account, billing and commercial relationship is described in its Privacy Policy and is not to be confused with processing carried out on the Customer's behalf.

2. Subject matter and duration

The subject matter is to enable provision of the contracted profitability analytics service: receiving and organising authorised data, calculating indicators, presenting reports and the operations in Annex I. It does not authorise independent purposes of advertising, commercialisation of buyer data or training of general models.

The agreement applies for as long as ProfitRocket processes data on the Customer's behalf, including the return, erasure and restricted retention operations that apply when the service ends. Obligations that must survive in relation to data still retained are not extinguished by cancelling a plan.

3. Customer instructions

ProfitRocket will process data in accordance with documented instructions: this agreement, the features activated by authorised people and other instructions compatible with the contract and applicable law. Additional instructions will be communicated through [VERIFIED CHANNEL] and will be recorded.

If an instruction appears to infringe data protection law, ProfitRocket will notify the Customer and may suspend the affected operation while the issue is resolved, preserving the data. If a legal obligation requires different processing, it will inform the Customer beforehand unless legally prohibited.

4. Customer obligations

The Customer determines the legal basis and purpose of the original processing, provides the necessary information to data subjects and limits what it connects or imports to data appropriate for the service. It maintains the accuracy of its instructions and the authorisations to access third-party sources.

It must not include special categories of data or data relating to convictions and offences unless their processing is expressly agreed, a legal basis exists and the necessary safeguards are adopted. If it uses ProfitRocket as a processor for another controller, it must evidence the relevant authorisations and pass on the applicable instructions.

These obligations do not release ProfitRocket from those that apply to it by reason of its own role and conduct.

5. Confidentiality and access

ProfitRocket will limit access to people who need it for authorised functions. Those people will be bound by confidentiality and will receive appropriate instructions. Granting, review and withdrawal of access will be managed, and confidentiality will be maintained after the relationship with authorised people ends.

Support access to a store's data will be limited to what is necessary for the incident and will be subject to the authorisation and logging mechanism described in Annex III.

6. Security

ProfitRocket will apply technical and organisational measures appropriate to the risk, set out in Annex III. It will consider the confidentiality, integrity, availability and recoverability of the data, as well as the evaluation of the effectiveness of those measures.

Technical changes may not unjustifiably reduce the agreed level of protection. The parties will cooperate where a change to sources, data or purposes requires risks and measures to be reviewed. No certifications or technical guarantees are attributed to ProfitRocket unless identified and evidenced in the annexes.

7. Sub-processors

The Customer gives general written authorisation to the sub-processors identified in Annex II for the functions stated there. Providers not identified there are not deemed authorised merely by generic expressions such as "cloud services".

ProfitRocket will notify intended additions or replacements thirty days in advance, stating the entity, function, location and data involved. The Customer may object during that period on reasonable data protection grounds. The parties will seek a suitable alternative; where none exists, an orderly termination of the affected part will be agreed, together with return or erasure and adjustment of amounts paid in advance for services not provided.

ProfitRocket will impose on the sub-processor protection obligations equivalent to those applicable and will remain responsible to the Customer for compliance with those obligations. The independent roles of certain providers must be documented separately and not presented as sub-processing where that is not the case.

8. International transfers

Transfers and access from outside the EEA must be identified in Annex II, covered by instructions and by a valid mechanism where necessary. The applicable safeguards, assessments and supplementary measures will be documented.

This agreement does not by itself incorporate standard contractual clauses or evidence an adequacy decision or a provider's certification. The relevant instruments will be identified and made available under their applicable regime. Requests from authorities will be handled in accordance with the law and communicated to the Customer where not legally prohibited.

9. Rights requests

ProfitRocket will assist the Customer, taking into account the nature of the processing, in responding to data subject requests. If it receives a request relating to data processed on the Customer's behalf, it will forward it without undue delay to the designated contact and will not respond substantively on the Customer's behalf without instructions, unless legally obliged.

The tools or procedures available to locate, export, rectify, restrict or erase records are described in Annex III. Assistance must allow applicable deadlines to be met, without internal waiting periods that prevent this.

10. Personal data breaches

ProfitRocket will notify the Customer, without undue delay after becoming aware, of personal data breaches affecting data processed on its behalf. The operational channel will be the one stated in Annex I.

The notification will include the available information on the nature, the data and people potentially affected, the consequences, the measures adopted and a follow-up contact. It may be completed in phases as the investigation progresses. Necessary records will be kept and cooperation provided for containment and for any notifications that fall to the controller.

ProfitRocket will not wait for a final report before giving the first notification, nor will it assume, under this clause, the role of notifying on the Customer's behalf without instructions or a legal obligation of its own.

11. Assistance, verification and audit

ProfitRocket will make available the information necessary to demonstrate compliance with this agreement and will allow audits and inspections by the Customer or an authorised auditor, with confidentiality measures and protection of other customers.

Routine checks may be coordinated with reasonable notice. Such coordination must not prevent urgent action arising from incidents, legal obligations or requirements of an authority. Independent reports may be used where sufficient, without removing the right to justified additional checks.

It will provide reasonable assistance for impact assessments and prior consultations, taking into account the processing and the information available to it. Arrangements on the cost of additional assistance cannot hollow out legal obligations or block necessary urgent action.

12. Return and erasure

At the end of the processing, the Customer may choose return or erasure, with deletion of copies, except where retention is required by law. The return format, deadlines and treatment of backups are set out in Annex IV.

Where an obligation requires certain data to be retained, it will be identified and restricted to that purpose. Data temporarily kept in backups will not be used for other purposes, will remain protected and will be deleted in the agreed cycle. Any restoration must respect erasures already requested.

13. Term and precedence

This agreement prevails over the general terms as regards processing on the Customer's behalf, without displacing transfer instruments that must prevail within their scope. It is governed by the law applicable to the contract, subject to mandatory data protection provisions.

Acceptance and the applicable version will be bound to the Customer through [SIGNATURE OR DOCUMENTED ACCEPTANCE MECHANISM]. Publication on the web does not allow unilateral modification of the instructions or contractual safeguards in force.

Annex I. Processing and contacts

Item	Scope to be completed and validated
Service	Profitability analysis of the Customer's authorised stores.
Data subjects	Buyers and other data subjects whose data is legitimately included in the sources; [SPECIFY AND REMOVE UNNECESSARY CATEGORIES].
Data	Order identifiers, dates, products, amounts, destination country and other fields actually received; [EXACT INVENTORY, INCLUDING CONTACTS/ADDRESSES ONLY IF PROCESSED].
Sensitive data	Not envisaged within the standard scope. [DOCUMENT ANY AGREED EXCEPTION].
Operations	Authorised collection, storage, organisation, consultation, calculation, export and erasure; [SPECIFY OTHER ACTUAL OPERATIONS].
Duration	The contract and the final return/erasure phase in Annex IV.
Customer contact	[IDENTITY AND EMAIL OF THE AUTHORISED CONTACT].
ProfitRocket contact	[OPERATIONAL EMAIL FOR PRIVACY AND INCIDENTS].

An order identifier or pseudonymised information may still be personal data. It must not be declared anonymous without verification.

Annex II. Sub-processors and locations

Legal entity	Specific service	Data involved	Country of storage and access	Transfer and safeguard	Authorisation date
[TO BE COMPLETED]	[TO BE COMPLETED]	[TO BE COMPLETED]	[TO BE COMPLETED]	[COMPLETE OR JUSTIFY AS NOT APPLICABLE]	[TO BE COMPLETED]

Annex III. Measures and assistance

To be completed with implemented measures and available evidence. This table does not assert that they have already been deployed.

Area	Verified measure and scope
Access control	[ROLES, SERVER-SIDE AUTHORISATION, REVIEW AND WITHDRAWAL OF ACCESS].
Separation of customers and stores	[CONTROLS AND ISOLATION TESTING].
Protection of communications and storage	[ACTUAL MECHANISMS, SCOPE AND KEY MANAGEMENT].
Integration credentials	[STORAGE, ACCESS, ROTATION AND REVOCATION].
Support	[AUTHORISATION AND LOGGING OF ACCESS TO DATA].
Logging and incidents	[DETECTION, TRIAGE, CHANNEL AND PROCEDURE].
Backups and recovery	[FREQUENCY, LOCATION, CYCLE AND RESTORE TESTING].
Changes and vulnerabilities	[UPDATES, REVIEW AND REMEDIATION].
Rights	[PROCEDURE FOR LOCATING, EXPORTING, RECTIFYING AND ERASING].

Annex IV. End of processing

• Request and verification of the authorised contact: [PROCEDURE].
• Format and secure channel for return: [FORMAT AND CHANNEL].
• Deadline for return and for operational deletion: [SPECIFIC DEADLINES].
• Backups and prevention of data reappearing: [CYCLE AND MECHANISM].
• Data retained under a legal obligation and its purpose: [IDENTIFY].
• Confirmation of completion: [PROCEDURE].