Data Processing Agreement

Version ID dpa-1.1-2026-10-08. The version and date of this text are shown below. Questions: support@ppftec.com; data protection: privacy@ppftec.com.

EuBinder Data Processing Agreement
Version 1.1 of 8 October 2026 · ID dpa-1.1-2026-10-08

Between the merchant that installs EuBinder ("Controller") and PPFTEC S.R.L., J2026052999008, CUI RO55537142, Râmnicu Vâlcea, România ("Processor").

1. Subject matter and duration

1.1 The Processor processes personal data on behalf of the Controller in order to provide the EuBinder app under the Terms of Service.

1.2 This DPA applies for as long as the Processor processes the data, that is until deletion under §10.

2. Nature and purpose of the processing

• Storing business data the Controller enters or uploads.
• Generating documents: GPSR product-page details, PPWR declarations of conformity and technical files, accessibility statements.
• Writing the GPSR block data into the Controller's Shopify store.
• Accessibility scans of the Controller's public store pages.
• Hosting the document center and serving shared documents to holders of a share link.
• Reminders and export.

3. Categories of data subjects and personal data

No special categories of data (GDPR Art. 9) and no shopper or order data are to be processed. The Controller undertakes not to upload or type them.

4. Controller's instructions

4.1 The Processor processes personal data only on the Controller's documented instructions. These consist of the Terms, this DPA and the Controller's use of the app's functions, including where data is transferred to a third country.

4.2 If the Processor believes an instruction infringes data protection law, it informs the Controller without undue delay.

4.3 If Union or Member State law requires processing beyond the instructions, the Processor informs the Controller before processing, unless that law prohibits it.

5. Confidentiality

Persons authorised to process the data, currently PPFTEC's administrator only, are bound by confidentiality.

6. Security (Art. 32)

The Processor implements the technical and organisational measures in Annex 2 and may update them provided the overall level of protection is not reduced.

7. Sub-processors (Art. 28(2) and (4))

7.1 The Controller gives general authorisation for the sub-processors listed at https://eubinder.ppftec.com/subprocessors (Annex 3).

7.2 The Processor announces any addition or replacement at least 30 days in advance, in the app and by e-mail to the shop e-mail. The Controller may object on reasonable data-protection grounds within that period. If no solution is found, the Controller may terminate by uninstalling. In that case the Processor refunds, on request, the part of any fee already paid that covers the period after termination.

7.3 The Processor imposes on each sub-processor data-protection obligations that provide sufficient guarantees (Art. 28(4)), mainly through the sub-processor's standard DPA, and remains responsible for its sub-processors.

8. Assistance

8.1 The Processor helps the Controller, taking into account the nature of the processing, to:

• answer data-subject requests: self-service export and editing in the app; deletion of all data by uninstalling; other requests by e-mail to privacy@ppftec.com;
• meet its obligations under Art. 32–36 (security, breach notification, DPIA, prior consultation).

8.2 Requests sent by data subjects directly to the Processor are passed on to the Controller without undue delay.

9. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the Controller's data. The notice goes to the shop e-mail and is shown in the app. It includes, as far as known:

• the nature of the breach;
• the categories and approximate number of data subjects and records;
• the likely consequences;
• the measures taken or proposed;
• a contact point.

Information not yet available is provided as it becomes available.

10. Deletion or return at the end

10.1 During the service the Controller can export its data at any time (Terms §8).

10.2 After uninstall, Shopify sends shop/redact 48 hours later. The Processor then deletes all personal data of the Controller from its database and storage within 30 days, unless Union or Member State law requires storage. Backup copies (Cloudflare D1 Time Travel, point-in-time recovery of the database) expire 30 days after that. If the database is ever restored from a backup, the Processor repeats all deletions already made before the service resumes. Data written into the Controller's Shopify store remains under the Controller's control.

10.3 The Processor keeps only a pseudonymous record that the deletion was requested and done, without the shop's name or contact details, for 3 years, to demonstrate compliance.

11. Audits and information

11.1 The Processor makes available the information necessary to demonstrate compliance with Art. 28: this DPA, Annex 2, the sub-processor list and the sub-processors' certifications or reports where available.

11.2 The Controller may carry out an audit, or have one carried out by an independent auditor bound by confidentiality, at most once a year (more often after a breach or on an authority's request), with 30 days' notice, at its own cost, and preferably first by written questionnaire.

12. International transfers

The Processor's sub-processor Cloudflare, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework; the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in its DPA apply as fallback. The Processor stores the Controller's data in the EU (database: Cloudflare D1; files: Cloudflare R2; both created with EU jurisdiction).

13. Liability and precedence

Liability under this DPA follows Art. 82 GDPR and, between the parties, the Terms (§9). If this DPA conflicts with the Terms on data protection, this DPA prevails.

Annex 1 — Description of the processing

See §2–3. Frequency: continuous while the app is installed. Retention: until deletion under §10; scan results are limited to the last 5 scans per shop; soft-deleted evidence files are purged after 30 days unless an issued document references them.

Annex 2 — Technical and organisational measures

1. Encryption. TLS in transit; encryption at rest by the providers; Shopify access tokens encrypted at application level before storage.
2. Tenant isolation. Every tenant record is keyed by shop, and every query is scoped to the authenticated shop in the application layer, with an always-on SQL scope guard and automated cross-tenant tests. The app server is the only database client; there is no public data API. File keys are prefixed per shop and never taken from client input.
3. Access control. Production access is limited to PPFTEC's administrator, with multi-factor authentication on the provider accounts. Deployment credentials are used only for deployments and migrations.
4. Share links. Random tokens stored as hashes, revocable and with expiry. A uniform 404 hides whether a link exists.
5. Logging. No IP addresses, no webhook payloads and no merchant free text in logs. Server logs are kept 7 days. Webhook events are kept for 30 days. The audit log is append-only.
6. Data minimisation. No customer or order scopes; no staff names; no IP addresses in the app database. Request limits are counted per shop.
7. Availability and recovery. Hosted on managed infrastructure with EU storage. Point-in-time recovery of the database for 30 days (Cloudflare D1 Time Travel). After any restore, a deletion log replays all deletions before traffic resumes.
8. Testing. Separate test and production data. Automated tests for tenant isolation and deletion.
9. Incident handling. Breach procedure with a 48-hour notice to merchants and a 72-hour assessment for notifying ANSPDCP (Art. 33).
10. Deletion. The shop/redact job deletes database rows and storage objects within 30 days.

Annex 3 — Sub-processors

See the public list at https://eubinder.ppftec.com/subprocessors (ID subprocessors-1.0-2026-10-07 or the version current on the date of acceptance).