Data processing agreement

1. Parties, subject and form of this DPA

This data processing agreement (the "DPA") is made between two parties:

• you, the Seller, as controller: the business or professional that accepts the Terms to publish a Shop and that decides why and how Buyer Data is processed;
• we, Weston Trade SL, as processor: tax ID (CIF) B64950371, registered office at Paseo de la Ribera 44, 08870 Sitges (Barcelona), registered in the Registro Mercantil (the Spanish Commercial Registry) [COMPLETAR CO-04: Commercial Registry entry: volume, folio, sheet and registration]. We provide the cataloop service (the "Service").

This DPA governs how we process Buyer Data on your behalf. It gives effect to Article 28 of Regulation (EU) 2016/679 (GDPR) and complies with Spanish Organic Law 3/2018 (LOPDGDD).

This DPA forms part of the Terms. You accept it by ticking the box on the signup form, together with the Terms. We keep the version, the date and the person who accepted it. That electronic form counts as written form (Art. 28(9) GDPR).

On data protection, this DPA prevails over the Terms where the two conflict. On everything else the Terms apply.

Words with an initial capital have the meaning the Terms give them. Personal data, processing, controller, processor, sub-processor and personal data breach have the meaning the GDPR gives them (Arts. 4(1), 4(2), 4(7), 4(8) and 4(12) GDPR). A day is a calendar day.

2. What data we process, and why

Annex I describes the processing in the detail the GDPR requires (Art. 28(3) GDPR). In short:

• Subject: hosting and running your Shop, your Back office and the Orders you receive.
• Duration: the term of the Terms, plus the 90 days after the Effective cancellation date, or the retrieval period for switching provider if it ends later, plus any blocking the law requires.
• Nature: collection through the Shop, the Customer link and the "My details" page; storage, viewing and editing; sending transactional emails; export, backup and deletion.
• Purpose: the one you decide, that is, managing your Orders and writing to the Buyer about an Order in your Shop's name.
• Data and data subjects: the Buyer Data listed in Annex I, about your Buyers and their contact people.

The Service is not designed to process special categories of data (Art. 9 GDPR).

3. Your instructions

We process Buyer Data only on your documented instructions, including with regard to international transfers (Art. 28(3)(a) GDPR). The documented instructions are:

• the Terms;
• this DPA;
• the settings you choose in your Back office and the actions you take there;
• the requests you make to us in writing, such as the set-up of your Shop included in the Grande Plan.

The maintenance tasks the Service needs in order to run also count as instructed, as long as they do not change the content of your data:

• backups;
• deleting the data when this DPA ends;
• format fixes, such as writing WhatsApp numbers in international form or linking past Orders to their Buyer's record.

If a task would change the content of your data, we tell you beforehand.

Where Union or Member State law requires us to process the data otherwise, we inform you of that legal requirement first, unless the law prohibits this on important grounds of public interest (Art. 28(3)(a) GDPR).

If we consider that an instruction of yours infringes the GDPR or another data protection rule, we tell you immediately (Art. 28(3) GDPR, last paragraph).

We do not process Buyer Data for purposes of our own. If we did, we would be the controller of that processing (Art. 28(10) GDPR). In particular, Support access serves only to support you.

The one exception is the Service's own security uses. We use the IP address to limit repeated attempts and stop abuse, and we keep server logs and error reports. For those uses we are the controller, as the Privacy policy explains (Art. 33(2) LOPDGDD).

4. Staff confidentiality

The people on our team who can access Buyer Data have signed a confidentiality undertaking, which we show you if you ask. The law also imposes that duty on them (Arts. 28(3)(b) and 29 GDPR; Art. 5 LOPDGDD).

Those people process the data only on your instructions, unless Union or Member State law requires them to do otherwise (Art. 32(4) GDPR).

The duty of confidentiality continues after their relationship with us ends (Art. 5(3) LOPDGDD).

5. Security of processing

We apply technical and organisational measures appropriate to the risk, as Article 32 GDPR requires (Art. 28(3)(c) GDPR). Annex II lists the measures we apply.

We help you meet your own security obligations, taking into account the nature of the processing and the information available to us (Art. 28(3)(f) GDPR).

6. Sub-processors

You give us a general authorisation to engage sub-processors (Art. 28(2) GDPR). The current list is on the Sub-processor list (Annex III).

We tell you by email to the Owner, and with a notice in the Back office, at least 30 days before adding or replacing a sub-processor. Within that period you may object, on reasonable data protection grounds, by writing to privacidad@cataloop.app. The parties try to resolve the objection in good faith.

If we do not reach an agreement, you may terminate the Terms and this DPA before the change applies, and we refund the unused part of the paid period.

We impose on each sub-processor, by contract, the same data protection obligations that this DPA imposes on us (Art. 28(4) GDPR). If a sub-processor fails to meet those obligations, we remain fully liable to you (Art. 28(4) GDPR).

7. Buyers' rights

Your Buyers may exercise their rights of access, rectification, erasure, objection, restriction and portability (Arts. 15 to 22 GDPR). You, as controller, answer those requests.

If a request reaches us, we forward it to you without delay and do not answer it ourselves.

We help you answer, with appropriate technical and organisational measures (Art. 28(3)(e) GDPR). The Back office lets you:

• view and correct each Buyer's data;
• export all your Buyers' data as a CSV file.

If you need something the Back office does not allow, such as deleting the data of one particular Buyer, we do it at your request within 10 days at most of receiving it.

8. Personal data breaches

We notify you of each personal data breach affecting Buyer Data without undue delay and, in any case, within 48 hours at most of becoming aware of it (Art. 33(2) GDPR).

The notice contains at least what Article 33(3) GDPR requires:

• the nature of the personal data breach and, where possible, the categories and approximate number of data subjects and of records concerned;
• the name and contact details of the person on our team who can give you more information;
• the likely consequences of the personal data breach;
• the measures taken or proposed to address it and to mitigate its effects.

If we cannot give you all the information at once, we give it in phases, without further delay (Art. 33(4) GDPR).

You decide whether to notify the supervisory authority and the data subjects (Arts. 33 and 34 GDPR). We help you with the information available to us (Art. 28(3)(f) GDPR).

9. Impact assessment and prior consultation

If you must carry out a data protection impact assessment or consult the supervisory authority in advance, we give you reasonable assistance (Arts. 35 and 36 GDPR). That assistance consists of giving you the information about the Service that we hold, taking into account the nature of the processing (Art. 28(3)(f) GDPR).

10. Support access to your Shop

Support access lets an Operator enter your Shop's Back office. This section sets out when, who, how and within what limits.

When. An Operator uses Support access only in two cases:

• to answer a support request from you;
• without a request, only for an incident or a fault affecting your Shop, and then only to look.

In both cases we email you when the Operator enters. The only purpose of Support access is to support you.

Who and how. The conditions are these:

• Only Operators with an open Operations console session may enter, and that console admits only someone who has a second authentication factor enabled. Opening Support access does not ask for that second factor again.
• Any authorised Operator may enter any active Shop.
• Access is opened for a single active Shop, through a single-use entry valid for 60 seconds.
• Access lasts 60 minutes and can be extended to 8 hours at most.
• Access ends when the Operator leaves or when their Operations console session ends.

Read-only by default. During Support access, the Service refuses every change until the Operator allows changes for that session. The Operator allows them only if you have asked, and first notes your request in the log. This is our obligation under this DPA; the Service does not check that the request exists.

What the Operator cannot do. Even with changes allowed, the Operator:

• can see, but not change, your Plan and your payments (Settings > Payments) and the Owner's contact details;
• cannot use the passwords, data export, user management, the Invoicing module or the chat with our team.

Outside your Shop, in the Operations console, our team sees the emails of each Shop's users, counts, the total of the Orders of the last 30 days and the feedback together with the sender's email.

What is logged. The log records each support session:

• the Operator's email;
• the start time and the end time;
• whether changes were allowed, when, and the note of your request;
• each admitted change, with the request method, the action and the time.

The log does not record the content of the changes, the pages the Operator views or the Operator's IP address, and a logged change may have changed nothing. You can ask us for the log of accesses to your Shop. We keep it for 2 years from the end of each access.

No other way in. We do not enter your Back office by any other means. In particular, we do not use your credentials. The technical tasks that can open the production database are on a closed list, only authorised staff run them and every run is logged.

Demo shop. This section does not apply to the Demo shop, which has no Owner.

11. Information and audits

We make available to you all the information needed to demonstrate compliance with Article 28 GDPR (Art. 28(3)(h) GDPR).

We allow for and contribute to audits, including inspections, conducted by you or by another auditor you mandate (Art. 28(3)(h) GDPR), under these rules:

• you may audit us once a year, or more often if there is a personal data breach or an authority requires it of you;
• give us 30 days' notice;
• first we give you the information and documents you ask for. If they are not enough, the audit is carried out by an independent auditor bound to secrecy;
• each party bears its own costs.

12. International transfers

We transfer Buyer Data outside the European Economic Area only on your documented instructions (Art. 28(3)(a) GDPR).

Every transfer relies on one of the safeguards in Chapter V GDPR (Arts. 44 to 46 GDPR). For US sub-processors, the safeguard is the EU-US Data Privacy Framework and, in addition, the standard contractual clauses in their contracts. There is also a transfer when the data is stored in the European Union but the provider accesses it from outside the European Economic Area.

The Sub-processor list shows, for each sub-processor, where the data is stored and which safeguard covers the transfer. By accepting this DPA, you instruct the transfers that list shows.

13. Records of processing and cooperation with the authority

We keep a record of the categories of processing activities we carry out on your behalf (Art. 30(2) GDPR).

We cooperate with the supervisory authority on request (Art. 31 GDPR). In Spain, the supervisory authority is the Agencia Española de Protección de Datos, the Spanish Data Protection Agency (www.aepd.es).

14. Your obligations

As controller, you:

• have a legal basis for processing Buyer Data (Art. 6 GDPR);
• inform your Buyers about the processing of their data (Arts. 13 and 14 GDPR), with your privacy information in the "Seller details" section of your Shop;
• keep the data you enter in the Back office accurate;
• give us only lawful instructions;
• do not enter special categories of data (such as health, religion, beliefs or ethnic origin; Art. 9 GDPR) in notes or in any other field. If you do, you answer for that processing;
• share each Customer link securely and only with its Buyer, because whoever holds the link can see that Buyer's data and prices.

15. What happens when this DPA ends

This DPA ends when the Terms end. When it ends, we return or delete Buyer Data, as you choose (Art. 28(3)(g) GDPR). In practice:

• You can export all your data from the Back office while the Subscription is active, in Read-only mode, during the Suspension and during the 90 days after the Effective cancellation date.
• If you ask, we hand your data to the provider you name, in the export formats (Art. 33(3) LOPDGDD).
• After 90 days from the Effective cancellation date, we delete Buyer Data and your Shop's files. If you have asked to switch provider, we do not delete them until the retrieval period ends, even if the 90 days have passed.
• Backups that contain that data are deleted automatically within 7 days at most. If you ask, we confirm by email that we have deleted your data.
• We keep data, duly blocked, only while liabilities may arise from our relationship with you (Arts. 32 and 33(4) LOPDGDD).
• If you have used the Invoicing module with tax validity, the law requires you to keep your invoices and their records. We return them to you in the export and, unless you ask us otherwise, we also keep a blocked copy on your behalf for that legal period, so that you can prove them to the Agencia Tributaria (Art. 33(3) LOPDGDD). [REVISAR EN-14: have a lawyer confirm this keeping of invoices on the Seller's behalf after this DPA ends]

Chapter VI of Regulation (EU) 2023/2854 (the Data Act), on switching between data processing services (Arts. 23 to 31), applies to the Service. We therefore:

• put no obstacles in the way of your switching to another provider or moving your data to your own systems (Art. 23);
• keep to the switching periods the Terms set: no notice period, a transitional period of up to 30 calendar days and a retrieval period of at least 30 calendar days after it (Art. 25);
• during the switch, assist you in good faith and maintain the continuity of the Service and the security of the data (Arts. 25 and 27);
• inform you of the switching procedures, methods and formats and of their technical restrictions (Art. 26);
• publish where the infrastructure we process the data with is located and what measures we take against access by governments outside the European Union (Art. 28);
• charge nothing for switching provider (Art. 29).

16. Liability

Each party is liable to data subjects for the damage caused by processing that infringes the GDPR (Art. 82 GDPR). We are liable only if we fail to meet the obligations the GDPR places on processors or act outside your lawful instructions (Art. 82(2) GDPR).

Between the parties, the liability cap in the Terms applies, except in cases of intent or gross negligence. That cap does not affect the rights of data subjects against either party (Art. 82 GDPR). [REVISAR EN-15: have a lawyer confirm that the cap in the Terms can apply to this DPA between the parties]

17. Term, changes, governing law and courts

This DPA applies from the date shown at the top and for as long as the Terms apply, and afterwards for as long as we keep data on your behalf.

Changes to this DPA follow the rules of the section "Changes to these Terms" of the Terms.

This DPA is governed by Spanish law. The competent courts and the prior attempt at negotiation are those the Terms set out.

18. Annex I: description of the processing

19. Annex II: security measures

We apply these technical and organisational measures (Art. 32 GDPR):

• Encryption in transit: the connection uses TLS up to our hosting platform, and HSTS is on in production.
• Encryption at rest: our database provider encrypts it with AES-256.
• Backups: the database can be restored to any moment of the last 7 days.
• Passwords: stored as a hash with the scrypt algorithm, never in plain text.
• Operators' second factor: they need a second factor to enter the Operations console, and its secret is stored encrypted.
• Cookies: HttpOnly, SameSite=Lax and limited to the address that sets them, and Secure in production. Sessions last 30 days, or 7 days without activity.
• Isolation: the data layer separates each Shop from the others, so that no query returns another Shop's data.
• Credentials: each Customer link, each Order link and each session identifier is a random key of 32 characters.
• Rate limits: the Service limits repeated attempts.
• Support access: read-only by default, limited in time, notified to you by email and logged (section "Support access to your Shop").
• Browser protection: a Content Security Policy (CSP), frame-ancestors none, X-Frame-Options DENY and nosniff.
• Photographs: the Service removes their metadata (EXIF).
• Server error reports: the Service adds no personal data to them and, before sending them, tries to remove the user, cookies, the headers that carry the IP address, emails and phone numbers.
• Test tools: they are barred from opening the production database and storage. The technical tasks that may do so are on a closed list, and every run is logged.
• Provider accounts: all our provider accounts use two-step verification.
• Incident response plan: we have a written procedure to detect, contain and notify personal data breaches.

20. Annex III: sub-processors

The current list of sub-processors is on the Sub-processor list. It shows each one's service, the data it processes, where that data is stored and the safeguard for each transfer.

That list forms part of this DPA. We keep it up to date as the section "Sub-processors" describes.

21. Language

This DPA is published in Spanish and in English. The Spanish version is the one that binds the parties. The English version is a translation for convenience, and the Spanish prevails if the two differ.