Data Processing Agreement

1. Details of the processing

• Subject matter and purpose: recording visits and orders on the Controller's stores, attributing orders to advertising, reporting, and sending purchase events to the ad platforms the Controller connects.
• Duration: for as long as the Controller uses SalesTracked, plus the deletion period in section 8.
• Data subjects: visitors to and customers of the Controller's stores.
• Personal data: online identifiers (visitor and session ids, ad click ids, Meta and Pinterest cookie identifiers, IP address, browser), browsing and purchase events, order details, and customer email, phone, name, city, postcode and country, the latter stored only as hashes.
• Special categories: none are intended; the Controller must not send them.

2. Instructions

The Processor processes the data only on the Controller's documented instructions — these Terms and the settings the Controller chooses in SalesTracked — unless the law requires otherwise, and tells the Controller if it believes an instruction infringes data protection law.

3. Confidentiality and security

Everyone authorised to process the data is bound by confidentiality. The Processor keeps appropriate technical and organisational measures under Article 32, including encryption in transit, encryption of credentials at rest, hashing of customer identifiers, access restricted to the people who operate the service, and providers with recognised security certifications.

4. Sub-processors

The Controller authorises the sub-processors below. The Processor binds each of them to data protection terms equivalent to this DPA, remains responsible for them, and announces new ones on this page and by email at least 14 days in advance, during which the Controller may object; if no solution is found, the Controller may terminate the affected service.

Ad platforms and store platforms the Controller connects (such as Meta, Google, Pinterest and Shopify) receive or provide data on the Controller's own instructions and under the Controller's agreements with them; they are not sub-processors of the Processor.

5. International transfers

Where data is transferred outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), which are incorporated by reference where required: Module 2 (controller to processor) or Module 3 (processor to processor, for transfers to sub-processors), as applicable. For the Clauses, the competent supervisory authority is the Portuguese CNPD and the governing law and courts are those of Portugal.

6. Assistance

Taking into account the nature of the processing, the Processor helps the Controller answer data subject requests, carry out data protection impact assessments and consult supervisory authorities. Requests the Processor receives directly are passed on to the Controller.

7. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own obligations.

8. Deletion and return

When the services end, the Processor deletes the Controller's personal data within 30 days, unless the law requires it to be kept. Before then the Controller may ask for an export of its data.

9. Audits

The Processor makes available the information needed to show compliance with this DPA and allows audits by the Controller or an auditor it mandates, with 30 days' notice, at most once a year unless a breach or authority requires otherwise, at the Controller's cost and subject to confidentiality.

10. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the GDPR or other mandatory law does not allow it. If this DPA conflicts with the Terms on the protection of personal data, this DPA prevails; if the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

11. Contact

Questions about this DPA: hello@salestracked.io.