Legal

Data Processing Agreement for shopper data

When you connect a store, Pindash reads order data about your shoppers on behalf of your business. This agreement governs that relationship: you are the controller and Pindash is the processor. It is signed together with the service agreement, before the first import.

This is the model in force. The agreement each customer accepts, with their details and signature, is private and stored in their account. The Spanish version prevails over this translation.

Version 1.2 · approved. This is the model signed in the app before connecting a store.

This English text is a translation of the Spanish original, version 1.2. If the two differ, the Spanish version prevails.

Parties

Provider: BIERZO SEO Y MARKETING S.L., tax ID (CIF) B24730178, registered in the Registro Mercantil de León, hoja LE-26008, folio 177, tomo 1343, inscripción 1.ª, with registered office at C. General Gómez Núñez, 2, planta 1, oficina 2, 24402 Ponferrada (León), España.

Customer: the person or entity that holds the account, with the details they provide when signing.

Signer: the person who signs on behalf of the Customer, identified when signing.

1. Parties and subject matter

The Customer is the controller of the personal data of its stores’ buyers. The Provider acts as processor and processes that data only on the Customer’s behalf and to provide the Pindash service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

2. Duration

This agreement applies for as long as the Provider processes data from the Customer’s stores and until that data is returned or deleted when the service ends.

3. Nature and purpose

Reading, with read-only permissions, the order, catalog and stock data of the connected stores; normalizing and storing that data and calculating metrics, alerts and summaries for the Customer; where the store records it, reading the source of each order to show the Customer its sales by channel and campaign (clause 5); and, where the Customer authorizes it, answering queries from its AI assistant (clause 9).

4. Data processed

Personal data: a pseudonymized buyer identifier, which the Provider calculates from the store’s customer identifier without storing the latter, and the details of each order linked to it: visible order number, dates, statuses, amounts, discounts, shipping costs, currency, refunds and order lines (product, reference or SKU, quantity and amount). A pseudonymized identifier is still personal data.

Source of each order, if the store records it (clause 5): source type, the source, medium, campaign, content and term UTM tags, referring domain, landing page path without parameters or fragment, device type and the type of ad click identifier, without its value. It is linked to the order and, through the order, to the buyer’s pseudonymized identifier: it is not anonymous data.

Business data that contains no personal data: products, variants, SKUs and stock, if the store gives access to them.

Technical credentials: each store’s read keys or authorizations, stored encrypted.

Names, emails, addresses, phone numbers, card details, passwords and free-text order notes are not kept: if the store returns them, they are discarded before being stored. License codes that some stores add to the product name are also discarded. For the source of orders, the following are not kept either: the browser (user agent), the time or number of pages in the session, the number of visits or the value of click identifiers.

5. Source of orders

Where the store records where each purchase came from, the Provider reads that source together with the order, on the Customer’s behalf and only to show the Customer its sales statistics by channel and campaign. The Provider does not use it for its own purposes, to create profiles, to track individuals across sessions or stores, or for advertising or remarketing, and does not disclose it to advertising platforms.

1. WooCommerce. The source comes from the Order Attribution feature that WooCommerce includes and manages in the store itself. For this function Pindash does not install anything in the store or add any cookies: using the same read-only authorization, it reads the source data that WooCommerce has already stored with each order and discards the rest. Configuring that feature and informing the store’s visitors are the Customer’s responsibility.
2. PrestaShop. The source only exists if the Customer installs the Pindash module in the store and turns on the source of orders in it. While waiting for payment confirmation, the module may store in the store, linked to the cart, a provisional record of the source for a maximum of 48 hours from when it reads it; that provisional record stays in the store and is never sent to the Provider. Once the order is confirmed, the source is linked to it, and that is what the Provider reads. The Module Annex describes these operations in detail and supplements this agreement for them.
3. Retention. The Provider keeps the source of each order for a maximum of 24 months from the order date; a new import or the restoration of a backup does not restart that period. When the period expires, the source is deleted, not the order or its amounts. The Customer’s instructions, the exercise of data subject rights or the end of the service may require earlier deletion (clause 13). All other data keeps its own retention periods.
4. If the store does not record the source of an order, the order appears without a source: the Provider does not infer it or fill it in from other sources.

6. Data subjects

Buyers and customers of the connected stores. In stores with the PrestaShop module, also the people who confirm a purchase, because of the provisional record the module stores in the store (clause 5 and the Module Annex).

7. Customer obligations

The Customer, as controller, decides the purpose of the processing, makes sure that the collection of data in its stores is lawful and that it is entitled to commission this processing, and gives the Provider instructions that comply with the applicable rules.

8. Provider obligations

The Provider:

1. Processes the data only on the Customer’s documented instructions, which are those in this agreement and the settings the Customer chooses in Pindash, unless European Union or Member State law requires it to carry out other processing; in that case it will inform the Customer beforehand, unless that law prohibits it.
2. Will immediately inform the Customer if it considers that an instruction infringes data protection rules.
3. Ensures that the persons authorized to process the data have committed themselves to confidentiality.
4. Applies security measures appropriate to the risk: encryption of store credentials, isolation of each account’s data, read-only support team access, authorized by the Customer, limited to 72 hours and logged, encrypted backups and regular restore tests.
5. Only engages sub-processors under the terms of clause 10, imposes on them by contract the same data protection obligations, and is liable to the Customer for their compliance.
6. Helps the Customer respond to data subject rights requests, including the deletion of a specific buyer.
7. Helps the Customer comply with its obligations regarding security, notification and communication of data breaches, data protection impact assessments and prior consultation with the supervisory authority, where applicable, taking into account the information available to the Provider.
8. When the service ends, returns or deletes the data in accordance with clause 13.
9. Makes available to the Customer the information needed to demonstrate compliance with this agreement, and allows for and contributes to audits and inspections by the Customer or by an auditor authorized by the Customer. The parties coordinate how they are carried out, with measures to protect confidentiality and third parties, without this preventing the exercise of this right.

9. AI assistants authorized by the Customer

The Customer can authorize, in Settings → AI assistants, queries about the stores it chooses from a compatible external assistant (for example, Claude or ChatGPT). Before the connection is activated, Pindash shows what information can be queried. On the Customer’s instructions, the Provider discloses to that assistant only aggregated figures to answer its queries, without individual buyer data, and for each query logs only the tool used, the connection, the result and its duration, never the question or the answer.

The Customer chooses and subscribes to the assistant: it is not a sub-processor of the Provider, and what it does with the figures is governed by its own terms. The Customer can withdraw access at any time; from then on, the next query is rejected, although withdrawing access does not delete what the assistant has already received.

10. Sub-processors

The Customer gives general authorization to the sub-processors listed in the annex. The Provider will notify the Customer by email of any change at least 15 calendar days in advance; the Customer may object, giving reasons, within 10 days of the notice. If no reasonable alternative is found, the Customer may terminate the service before the change takes effect, without penalty and with the return or deletion provided for in clause 13. The Provider keeps a history of the versions of the annex and of the changes notified.

The emails the Provider sends to the Customer do not include individual buyer data.

11. Security breaches

The Provider will notify the Customer without undue delay, and no later than 48 hours after becoming aware of it, of any security breach affecting this data. It will not wait for that period to run out or for the investigation to be completed: it will report what it knows about the breach’s nature, scope, likely consequences, measures taken and contact person, and will provide further information as it becomes available.

12. Data location

The data is hosted in the European Union. No international transfers are planned; if any sub-processor were to need them, they will only take place with the safeguards of Chapter V of the GDPR and after notifying the Customer in accordance with clause 10. If the Customer is established outside the European Union, the disclosure of the data from its country to the Provider may be an international transfer or transmission under that country’s law; the parties will complete whatever instrument that law requires.

13. End of the agreement: return and deletion

When the service ends, the Customer may choose to have the data returned, through the export provided for in the Service Agreement, or deleted. For the following 30 days the Customer can view and export its figures, although no new data is imported; the specific periods for non-payment or usage over plan limits are those in the Service Agreement. Once the return is completed or that period expires, the Provider deletes the data from its systems, unless a legal rule requires it to keep it. That period does not extend the retention period for the source of orders: whichever expires first applies. Backups, encrypted and isolated, are kept for 14 days and the data disappears from them when they expire; if a backup has to be restored, data whose deletion has been ordered and the source of orders whose retention period has expired will not be reactivated.

Annex. Sub-processors

1. OVH Hispano S.L. (OVHcloud), tax ID (NIF) B83834747, C/ Alcalá 21, 5.ª planta, 28014 Madrid (Spain). Service: virtual private server hosting the application and the database. Has access to all the data in clause 4. Location: Gravelines (France), European Union.
2. OVH Hispano S.L. (OVHcloud), with the same details. Service: object storage for backups, encrypted before they leave the server. Has access to the encrypted database backups. Location: Strasbourg (France), European Union.