Data Processing Addendum

1. Parties, scope and priority

This Data Processing Addendum (DPA) forms part of the SmartProfit service agreement between SMART COD FORM S.R.L., CUI 55681023, J2026057225005, EUID ROONRC.J2026057225005, Str. Principala 203 C, Hintesti, Arges, Romania (“SmartProfit”, “we”), and the business customer accepting that agreement (“Customer”). It applies where we process personal data on the Customer’s behalf under GDPR or other applicable data protection law.

The Customer is normally controller and SmartProfit processor. Where the Customer is a processor acting for another controller, it must have authority to appoint us as subprocessor. This DPA prevails over conflicting service terms on the processing of personal data. Applicable mandatory law and any applicable Standard Contractual Clauses prevail over this DPA. Our own account, billing and legal-administration processing is explained separately in the Privacy Policy.

2. Processing particulars and instructions

Subject and duration: provision of SmartProfit store analytics, financial reporting and customer-enabled integrations for the service term, followed by the return/deletion and legally required retention described below.

Nature and purpose: authorized collection, transmission, organization, storage, retrieval, calculation, display, export and erasure of business reporting information; support and security necessary to provide these functions.

Data subjects: the Customer’s shoppers, representatives, staff and authorized platform-account users to the extent included in the Customer’s data. Data categories: order/customer identifiers and order references, product and transaction details, shipping country and methods, financial totals and tax information; advertising-account/campaign/ad metadata and performance; and, only for enabled functions that require them, names, contact details, invoice details and billing/shipping addresses. Special-category data and full payment-card credentials are not required or authorized.

The agreement, selected settings and authorized integrations are the Customer’s documented instructions. We process personal data only on those instructions, including instructions concerning transfers, unless applicable law requires otherwise. In that case we inform the Customer before processing unless the law prohibits notice. We promptly inform the Customer if, in our opinion, an instruction infringes applicable data protection law.

3. Customer responsibilities

The Customer determines its purposes and lawful grounds, provides required notices, obtains necessary platform authorization and consents, ensures its instructions are lawful, and limits data and team access to what is necessary. The Customer must not instruct us to import data it has no right to provide or to bypass a platform’s restrictions.

These responsibilities do not remove SmartProfit’s own obligations as processor. We do not sell Customer personal data, use it for unrelated advertising or train general-purpose AI models on it.

4. Confidentiality and safeguards

We ensure authorized personnel are bound by confidentiality obligations and access data only as needed for their duties. We implement technical and organizational measures appropriate to the risk, taking account of the nature, scope and purposes of processing and the rights of individuals.

Relevant safeguards include HTTPS for public service access; authenticated account access; workspace and store authorization boundaries; a server-side encrypted vault for public Shopify/Meta authorization credentials; validation of signed platform events; limited administrative access; and procedures for handling privacy requests and incidents. Infrastructure security is also dependent on the hosting provider’s controls. Specific integration availability and protections must match the deployed implementation.

We may update safeguards without materially reducing the overall protection. We will provide information reasonably necessary to assess them. This clause is not a claim of a particular certification or an absolute security guarantee.

5. Subprocessors and connected platforms

The Customer gives general written authorization for the hosting subprocessor below and its disclosed infrastructure subprocessors to the extent needed for the service:

We impose data protection duties on our subprocessors that provide no less protection than the applicable obligations in this DPA and remain responsible for their performance as required by law.

Before a new subprocessor or a material replacement begins processing Customer personal data, we provide at least 30 days’ advance notice using the Customer’s account contact and allow objections on reasonable data protection grounds during that period. We work in good faith to resolve an objection; if no reasonable solution is available, either party may end the affected service, and we refund prepaid fees for its unused period.

Shopify, TikTok and Meta are normally platforms the Customer independently authorizes as data sources, rather than subprocessors we appoint to perform their platform services. Their own terms apply. The optional ipapi.co website-country lookup concerns visitor presentation under the Privacy Policy; it is not used to enrich merchant customer records.

6. Rights requests, incidents and cooperation

Taking account of the processing and information available to us, we assist the Customer with individual rights requests, security obligations, data protection impact assessments and prior regulatory consultation. If a request concerns the Customer’s data, we refer it to the Customer unless legally required to act directly, and we do not disclose that data to an unauthorized requester.

We notify the Customer without undue delay after becoming aware of a personal data breach affecting its data, provide available information about the nature of the breach, affected data and individuals, likely consequences, mitigation and a contact point, and provide further information as it becomes available. We cooperate with investigation and remediation. Notice does not depend on admitting liability. The Customer remains responsible for any notifications it must make to regulators or individuals.

7. International transfers

The Customer authorizes processing in the locations disclosed above only subject to compliance with applicable international-transfer rules. We must ensure a valid transfer mechanism, such as an applicable adequacy decision or appropriate Standard Contractual Clauses and necessary supplementary measures, before a restricted transfer. Authorization in this DPA is not a substitute for those safeguards and is not reliance on blanket data-subject consent.

Contact support@getsmartprofit.com for the safeguards applicable to your processing. The hosting provider’s published DPA describes its transfer provisions. If additional terms are required for a Customer’s location or processing, the parties must complete them before the affected processing starts.

8. Return, deletion and end of service

At the end of processing, we delete or return the Customer’s personal data at its choice and delete remaining copies, unless applicable law requires retention. The Customer may request an export before deletion. If a specific export format requires additional work, we agree reasonable arrangements without preventing the exercise of mandatory rights.

Any legally retained data is isolated from ordinary service use and processed only for the retention purpose. Restricted backup copies follow the relevant infrastructure deletion cycle and deletions must be reapplied upon restoration. Customer instructions for deletion can be sent using Data Deletion; cancelling or disconnecting alone must not be interpreted as permission to keep personal data indefinitely.

9. Compliance evidence and audits

We make available information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections by the Customer or an independent auditor it appoints. We cooperate with competent supervisory authorities.

Reasonable notice, confidentiality protections and measures to protect other customers’ data may apply. Existing documentation may be used where sufficient; it does not replace an inspection where one is necessary. We may agree proportionate arrangements for routine audit costs, but no fee or contractual restriction may prevent a legally required audit, urgent incident review, regulator access or a mandatory individual right.

Questions and requests for a signed copy: support@getsmartprofit.com.