This text is a template the platform prepared for the legal adviser of NXDPRO Solutions to review. It is not legal advice and may change before it applies. Where a detail is missing, it is marked.
This agreement supplements the terms of service (Terms of service for merchants) and applies for as long as the merchant’s account lasts. The account holder accepts it in the admin, where we keep the version and the text accepted, who accepted it and when.
1. Roles
For the personal data that reaches the store, the merchant is the controller and NXDPRO Solutions is the processor, within the meaning of Article 28 of Regulation (EU) 2016/679 (GDPR).
2. The processor
The processor is NXDPRO Solutions:
- Name
- NXDPRO Solutions
- Address
- Pontidos 17
- Registration number
- 00000000
- VAT / tax identification number
- 00000000
- [email protected]
3. Subject matter and nature of the processing
- Subject matter: hosting and running the merchant’s online store on NXDPRO Commerce.
- Duration: for as long as the account lasts and until the data is deleted under section 8.
- Nature and purpose: storing, showing, sending email, passing on to the providers the merchant switches on, backups and deletion, only to run the store.
- Categories of data subjects: the store’s customers, people who subscribe to its newsletter, write to the store or write reviews, and its visitors (their IP address in logs and security limits). The data of the merchant’s team members as users of the platform is processed by NXDPRO Solutions for its own purposes, under the Privacy policy.
- Data: identity and contact details, delivery addresses, orders, business invoicing details, messages, withdrawal requests, newsletter consents, product reviews (name and town), copies of the emails the store sends, IP addresses (acceptance of terms, messages, logs, security limits), payment details with the card number masked as the provider returns it (for example the first 6 and last 4 digits, never the whole number), courier labels. Special categories of data are not intended.
- Addresses that do not take email: the merchant agrees that hard bounces and complaints about its store’s emails feed the list of addresses that do not take email, which NXDPRO Solutions keeps for its own purposes as cryptographic hashes, shared by every store (as the Privacy policy says), and that the store’s newsletters skip the addresses on it.
4. The processor’s obligations
NXDPRO Solutions:
- processes the data only on the merchant’s documented instructions, as given through its settings and actions in the admin, including with regard to transfers to third countries; where law requires other processing, it first informs the merchant unless that law prohibits it; if an instruction seems unlawful to it, it tells the merchant;
- binds everyone with access to the data to confidentiality;
- takes the security measures of Annex 2 (Article 32 GDPR);
- helps the merchant answer data subjects’ requests, mainly through the admin’s “Privacy requests” tools (export and erasure of a customer’s data);
- helps the merchant with its obligations under Articles 32 to 36 GDPR, with the information available to it;
- tells the merchant without undue delay, and within [to be completed: hours] hours at the latest, after becoming aware of a breach affecting its store’s data, with the details it has;
- makes available to the merchant the information it needs to show compliance and allows audits with reasonable notice, without putting other stores’ data at risk.
5. Sub-processors
The merchant gives general authorisation to use the sub-processors of Annex 1, which has its own version and shows every provider the platform may use and whether it uses it today. Before a sub-processor is added, or one on the list that was not in use starts being used, NXDPRO Solutions tells the account holder by email and in the admin; the merchant may object within [to be completed: days] days and, if no solution is found, close its account. Every sub-processor is bound by obligations that protect the data at least as well as this agreement, and NXDPRO Solutions remains fully liable to the merchant for the performance of their obligations.
6. Services the merchant switches on
Payment providers, couriers, the Greek tax authority, statistics and advertising tools and the systems the merchant connects with webhooks receive data only when the merchant switches them on, under its own agreement with each provider. The merchant names them in its own privacy policy.
7. Transfers outside the EEA
Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision or standard contractual clauses (Chapter V GDPR). [The legal adviser confirms each sub-processor’s safeguards.]
8. Return and deletion
The merchant can download the export of the whole store at any time (products, orders, customers, messages, subscribers, photos). When the store is closed, it stays 30 days so that it can open again; then the data is deleted, except the tax records the law requires the merchant to keep, which we keep on its behalf, anonymised as far as possible, until 31 December of the year that comes 6 years after their year, and give to the merchant when it asks. Backups expire within 35 days.
9. The merchant’s obligations
The merchant has a legal basis for every processing it asks for, informs its customers with its own privacy policy (the platform gives a template) and does not ask the platform for processing the law does not allow.
10. Liability
The parties’ liability follows Article 82 GDPR and the terms of service (Terms of service for merchants). [The legal adviser reviews.]
Annex 1: Sub-processors
The same list, with its version: Sub-processors. A new version of the list applies as section 5 sets out.
The platform’s providers
NXDPRO Solutions uses them for every store.
| Provider | What it does | Which data | Where | In use |
|---|---|---|---|---|
| OVH | The server the platform runs on: database, files, email sent from the server and backups. | All the stores’ data. | Germany | Yes |
| Cloudflare, Inc. | Network that carries and protects the traffic to the platform and the stores (HTTPS, protection from attacks). | IP addresses, the pages requested and what forms send, in transit. | Global network; company in the USA | Yes |
| Brevo (Sendinblue SAS) | Sending the stores’ emails (order confirmations, newsletters) and delivery reports, when email goes out through Brevo. | Recipient’s address and name, the email’s content. | France (EU) | Not yet |
| OpenAI | Translating the store’s texts and writing product descriptions, when the merchant asks for them. | Texts and details of the store’s products and pages. No customer data is sent. | USA (OpenAI, L.L.C.) [The legal adviser confirms the OpenAI company the platform contracts with.] | Yes |
| DeepL SE | Translating the store’s texts, when the merchant asks for it. | Texts of the store’s products and pages. No customer data is sent. | Germany (EU) | Not yet |
Services the merchant chooses
The platform sends them data only for stores that switch them on, under the merchant’s own agreement with each provider. The merchant names them in its own privacy policy (the platform’s template does so automatically).
| Provider | What it does | Which data | In use |
|---|---|---|---|
| Viva Wallet, JCC Payment Systems, Stripe | Card payments and refunds on the provider’s payment page. | Order number and amount and the customer’s email (for Viva Wallet also name and phone, for JCC also their IP address). The customer gives the card details directly to the provider. | Only for stores that switch it on |
| ACS Courier, Geniki Taxydromiki, BOX NOW, BOX NOW Cyprus | Issuing the voucher and label from the order, and the parcel’s status. | Recipient’s name, address, phone and email, weight, cash-on-delivery amount, the delivery notes (Geniki Taxydromiki) and the order’s value (BOX NOW). | Only for stores that switch it on |
| AADE (myDATA), the Greek tax authority | Sending retail receipts to the Greek tax authority (AADE), for businesses in Greece. | The receipt’s amounts and VAT. Retail receipts carry no customer details. | Only for stores that switch it on |
| Google Analytics, Meta Pixel | Statistics and advertising, only after the visitor accepts cookies. | IP address, pages the visitor saw, purchases without customer details. | Only for stores that switch it on |
| Webhooks | Notifications to systems the merchant connects itself (accounting, warehouse). | What the order holds, when the merchant chooses order events. | Only for stores that switch it on |
Where a provider processes data outside the European Economic Area, the transfer relies on the safeguards in its own data processing terms (an adequacy decision, such as the EU–US Data Privacy Framework, or standard contractual clauses). [The legal adviser confirms each provider’s safeguards.]
Annex 2: Security measures
- HTTPS on every connection, with HSTS on the platform’s address.
- Each store sees only its own data; the admin never answers on a store’s address.
- Passwords as cryptographic hashes; provider keys and two-step verification encrypted.
- Access roles per team member, two-step verification, an activity log, limits on sign-in attempts.
- Card details never pass through the platform: the customer gives them on the payment provider’s page.
- A database backup every night (and the photos when space allows), on the same server; one per day for 7 days and one per week up to 35 days; no off-site copy yet. Application logs for 30 days, without customers’ emails and names; logs of the server and its firewall (IP address, browser, page) for 90 days.
- Monitoring with alerts, and automatic deletion of old data within the periods of each store’s privacy policy.