Data Processing Agreement

1. Parties and scope

• Processor: Ioannis Sakkoulas, sole proprietor, trading as addSynapse, Petrou Foumi 23, Heraklion, Crete 71307, Greece. Greek tax/VAT number (ΑΦΜ): 119679877. Controller: the customer that holds the addSynapse account (for an account with several members, the business the account belongs to).
• This DPA covers the personal data that we process on the customer’s behalf when providing the service (“customer personal data”). It does not cover data for which we are the controller (accounts, billing, security), which our Privacy Policy describes.
• It is accepted together with the Terms when the account is created, and we record which version was accepted. If it conflicts with the Terms on data protection, this DPA prevails.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the addSynapse modules connected to the customer’s shop — AI assistants that read shop data, answer questions and prepare changes; the Store Manager connection between the customer’s own AI assistant and its shop; the storefront Sales Agent; search.
• Nature: receiving, transmitting, storing, structuring, retrieving, redacting and deleting data; sending request content to AI model providers; applying approved changes to the shop through its plugin.
• Purpose: only to provide, secure and support the service for the customer, and to bill it.
• Duration: for as long as we provide the service, and until the data is deleted as described in “Deletion and return”.

3. Types of data and data subjects

• Data subjects: the shop’s customers and visitors; the customer’s staff who use the service.
• Types of data: shop customers’ name, email, phone, postal address and order notes in draft orders; email addresses in coupon restrictions; anonymous customer references and order summaries in reports; anything the customer or its staff type in a chat or upload in a file; messages shoppers write in the storefront chat; staff users’ names and emails. The service is not designed for special categories of data (Art. 9 GDPR); the customer should not enter them, but they can appear in what people type.

4. Customer instructions

• We process customer personal data only on the customer’s documented instructions: these Terms and this DPA, the customer’s settings, and its requests and approvals in the service. This includes transfers to the sub-processors listed below.
• We inform the customer if, in our opinion, an instruction infringes data protection law, and we may suspend that instruction until it is confirmed or changed. If the law requires us to process data otherwise, we inform the customer first unless the law forbids it.

5. Confidentiality

Only people we authorise may access customer personal data, only as needed for the service, and each is bound by a duty of confidentiality.

6. Security

We implement the technical and organisational measures in Annex 1, taking into account the state of the art, costs and the risks for data subjects (Art. 32 GDPR). We may improve them; we will not reduce the overall level of protection.

7. Sub-processors

• The customer authorises the sub-processors listed in Annex 2. We impose on each of them data protection obligations equivalent to this DPA and remain responsible to the customer for their performance.
• Before we add or replace a sub-processor, we tell the customer by email and update the list at least 30 days in advance. The customer may object on reasonable data protection grounds within that period. We then try to find a solution; if we cannot, the customer may terminate the affected service before the change takes effect.
• The AI assistant that the customer connects to Store Manager for WooCommerce (for example Claude by Anthropic or ChatGPT by OpenAI) is the customer’s own service, used under the customer’s agreement with that provider; it is not our sub-processor. We only return tool results to it at the customer’s request.

8. International transfers

Where a sub-processor processes customer personal data outside the European Economic Area, we make sure the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or by the EU Standard Contractual Clauses in that sub-processor’s data processing terms. Annex 2 shows the mechanism for each.

9. Help with data subject requests and compliance

• If a data subject contacts us about customer personal data, we forward the request to the customer without undue delay and do not answer it ourselves, except to say that we forwarded it.
• We help the customer answer requests (access, erasure, correction, export) with the means the service provides — the data export, deleting sites or conversations, and searching our records on request — and assist with data protection impact assessments and consultations with authorities, as far as they concern our service.

10. Personal data breaches

• We notify the customer of a personal data breach affecting customer personal data without undue delay after becoming aware of it, aiming for 48 hours. This is separate from, and earlier than, the customer’s own 72-hour duty to notify the authority.
• The notice describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact person. We add information as it becomes available, take the measures needed to contain the breach, and help the customer notify the authority and data subjects.

11. Deletion and return at the end

• Before ending the service, the customer can export its account data (Settings → Privacy → Export) and ask for an export of activity records and conversations; the shop’s own data stays in its shop.
• When the customer deletes a site or its account, the service stops at once; during the next 30 days we can, at the customer’s request, restore it or provide the export. The data is then deleted from our live systems (immediately, if the customer asks). Backup copies expire at the latest 730 days later. We keep only what the law requires us to keep (billing records), anonymised where possible.

12. Information and audits

• We make available the information needed to demonstrate compliance with Art. 28 GDPR: this DPA, the annexes, our security page and answers to reasonable security questionnaires.
• The customer, or an independent auditor bound by confidentiality, may audit our compliance once per year with 30 days’ written notice, during business hours and without access to other customers’ data — and additionally after a personal data breach or when a supervisory authority requires it. Each party bears its own costs.

13. Liability

Each party’s liability under this DPA follows the liability section of the Terms; nothing limits the rights of data subjects under Art. 82 GDPR.

14. Annex 1 — Technical and organisational measures

The measures we actually apply (checked against our code and configuration):

15. Annex 2 — Sub-processors

• Anthropic (Anthropic Ireland, Limited; processing in the USA; EU Standard Contractual Clauses) and, only for sites set to an OpenAI model, OpenAI (OpenAI Ireland Ltd; processing in the USA; EU Standard Contractual Clauses) — AI answers.
• netcup GmbH (Germany, EU) — hosting, database and search engine.
• Resend (Plus Five Five, Inc., USA; EU Standard Contractual Clauses) — delivery of the emails we send to the customer’s users (for example account, billing and support emails).
• Backups: Backups (encrypted) are kept on our own server in the EU (our hosting provider above).
• Details, transfer mechanisms and links: Privacy Policy — Sub-processors. Stripe processes billing data as part of our own role as controller and is not a sub-processor for customer personal data.

16. Annex 3 — Processing by module

Retention of each category: Privacy Policy — How long we keep data.