This text is a template the platform prepared for the legal adviser of NXDPRO Solutions to review. It is not legal advice and may change before it applies. Where a detail is missing, it is marked.
This list is Annex 1 of the data processing agreement (Data processing agreement) and has its own version. It shows every provider the platform may use and, in the “In use” column, whether it uses it today. Before a provider is added, or one that was not in use starts being used, we tell account holders by email and in the admin, with a new version, so that they can object.
The platform’s providers
NXDPRO Solutions uses them for every store.
| Provider | What it does | Which data | Where | In use |
|---|---|---|---|---|
| OVH | The server the platform runs on: database, files, email sent from the server and backups. | All the stores’ data. | Germany | Yes |
| Cloudflare, Inc. | Network that carries and protects the traffic to the platform and the stores (HTTPS, protection from attacks). | IP addresses, the pages requested and what forms send, in transit. | Global network; company in the USA | Yes |
| Brevo (Sendinblue SAS) | Sending the stores’ emails (order confirmations, newsletters) and delivery reports, when email goes out through Brevo. | Recipient’s address and name, the email’s content. | France (EU) | Not yet |
| OpenAI | Translating the store’s texts and writing product descriptions, when the merchant asks for them. | Texts and details of the store’s products and pages. No customer data is sent. | USA (OpenAI, L.L.C.) [The legal adviser confirms the OpenAI company the platform contracts with.] | Yes |
| DeepL SE | Translating the store’s texts, when the merchant asks for it. | Texts of the store’s products and pages. No customer data is sent. | Germany (EU) | Not yet |
Services the merchant chooses
The platform sends them data only for stores that switch them on, under the merchant’s own agreement with each provider. The merchant names them in its own privacy policy (the platform’s template does so automatically).
| Provider | What it does | Which data | In use |
|---|---|---|---|
| Viva Wallet, JCC Payment Systems, Stripe | Card payments and refunds on the provider’s payment page. | Order number and amount and the customer’s email (for Viva Wallet also name and phone, for JCC also their IP address). The customer gives the card details directly to the provider. | Only for stores that switch it on |
| ACS Courier, Geniki Taxydromiki, BOX NOW, BOX NOW Cyprus | Issuing the voucher and label from the order, and the parcel’s status. | Recipient’s name, address, phone and email, weight, cash-on-delivery amount, the delivery notes (Geniki Taxydromiki) and the order’s value (BOX NOW). | Only for stores that switch it on |
| AADE (myDATA), the Greek tax authority | Sending retail receipts to the Greek tax authority (AADE), for businesses in Greece. | The receipt’s amounts and VAT. Retail receipts carry no customer details. | Only for stores that switch it on |
| Google Analytics, Meta Pixel | Statistics and advertising, only after the visitor accepts cookies. | IP address, pages the visitor saw, purchases without customer details. | Only for stores that switch it on |
| Webhooks | Notifications to systems the merchant connects itself (accounting, warehouse). | What the order holds, when the merchant chooses order events. | Only for stores that switch it on |
Where a provider processes data outside the European Economic Area, the transfer relies on the safeguards in its own data processing terms (an adequacy decision, such as the EU–US Data Privacy Framework, or standard contractual clauses). [The legal adviser confirms each provider’s safeguards.]