Data processing agreement

1. Parties and subject matter

This agreement is entered into between the customer subscribing to Payezz, hereinafter the controller, and PENDING: company name, with tax ID (NIF) PENDING: NIF or CIF and registered office at PENDING: full registered office address, hereinafter the processor.

Its purpose is to govern the processing of personal data that the processor carries out on behalf of the controller when providing the service described in the terms of service, in accordance with Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (Ley Orgánica 3/2018, LOPDGDD). It forms an integral part of the main contract and is accepted upon acceptance of that contract.

In the event of any conflict between this agreement and the terms of service, this agreement prevails in matters of data protection.

2. Who is who in each processing activity

Distinguishing the roles avoids the most common confusion in this sector:

• You are the controller of the data of your buyers and your contacts: who buys, what they buy, which invoice is issued to them, which ticket they open. You decide why and for what purposes it is processed.
• Payezz is the processor of that same data: it hosts and processes it in your instance on your instructions, and does not use it for anything else.
• Payezz is a controller, in its own right, of the data relating to your relationship with us: your account, your billing, your support. That is governed by the privacy policy, not by this agreement.
• Stripe is an independent controller of the data relating to the payment transactions it processes, in accordance with payment services and anti-money laundering regulations. It is not a sub-processor of Payezz in that respect.

3. Processing on instructions

The processor processes personal data only on documented instructions from the controller. The main contract, this agreement, the configuration the controller applies in its admin panel and the requests it submits through the support channels constitute documented instructions.

The processor will not use the data for its own purposes, will not disclose it to third parties except as provided in this agreement, and will not use it to train machine learning models.

If a legal obligation under Union or Member State law requires the processor to carry out different processing, it will inform the controller before doing so, unless that law prohibits such information on grounds of public interest. If the processor considers that an instruction infringes data protection law, it will inform the controller immediately.

4. Confidentiality of personnel

The processor ensures that the persons authorised to process personal data have expressly committed themselves in writing to confidentiality, under an undertaking that survives the end of their relationship, and have received the necessary data protection training. Access is granted on a least-privilege basis and reviewed periodically.

5. Security of processing

The processor implements the appropriate technical and organisational measures under Article 32 GDPR, detailed in Annex II. The first of them is a matter of architecture, not configuration: each customer has its own container and its own database, with a user whose permissions extend only to that database. There is no shared database in which a filtering error could show one customer’s data to another.

6. Sub-processors

The controller grants the processor general authorisation to engage the sub-processors listed below, with whom the processor has entered into data protection obligations equivalent to those in this agreement.

The processor will inform the controller of any addition or replacement of a sub-processor at least thirty days in advance. During that period the controller may object on reasonable grounds relating to data protection; if the objection cannot be resolved, the controller may terminate the contract without penalty and with a refund of the proportional part of any amounts paid in advance.

The processor is liable to the controller for the performance of its sub-processors as if it had carried out the processing itself.

7. International transfers

Instances are hosted within the European Union. Where processing involves access from a third country, as is the case with the US entity of the payment provider, it is based on the standard contractual clauses approved by the European Commission, on the supplementary measures agreed and, where applicable, on an adequacy decision in force.

The processor will not transfer the data to a third country without a valid basis among those provided for in Chapter V of the GDPR.

8. Assistance to the controller

Taking into account the nature of the processing, the processor:

• Makes available to the controller, in the admin panel itself, the functions needed to respond to requests from its data subjects for access, rectification, erasure, restriction, objection and portability.
• If a data subject of the controller contacts the processor directly, the processor will not handle the request on its own: it will forward it to the controller without undue delay.
• Assists the controller with the data protection impact assessment and the prior consultation of the supervisory authority, where required, by providing the information about the processing in its possession.
• Makes available to the controller the information necessary to demonstrate compliance with the obligations in this agreement.

9. Personal data breaches

The processor will notify the controller of any personal data breach without undue delay and, in any event, within forty-eight hours of becoming aware of it, by email to the account’s contact address.

The notification will include, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where it is not possible to provide all the information at once, it will be completed in phases without further delay.

Notification to the supervisory authority and, where applicable, to the data subjects is the responsibility of the controller. The processor will cooperate by providing the information it holds.

10. Return and deletion

At the controller’s choice, at the end of the provision of services the processor will return or delete the data, together with any existing copies, unless it is required to retain them by law.

In practice, and unless instructed otherwise, the process is the one described in the cancellation policy: the database dump is delivered on request from cancellation, and the instance is archived and then destroyed after the published period.

11. Audits

The processor will make available to the controller the documentation necessary to demonstrate compliance with this agreement and will allow for and contribute to audits, including inspections, conducted by the controller or by an auditor mandated by the controller.

Audits will be notified at least thirty days in advance and carried out during business hours, no more than once a year unless there has been a personal data breach or the supervisory authority requires it, and without compromising the security or confidentiality of other customers’ data. The auditor will sign a confidentiality undertaking.

12. Liability and term

This agreement remains in force for as long as the processor processes data on behalf of the controller. The confidentiality, deletion and assistance obligations survive its termination to the extent applicable.

Each party is liable for the damage it causes by breaching the obligations that the GDPR specifically imposes on it, under the terms of Article 82. The limitations of liability agreed in the terms of service do not apply to the penalties imposed on a party for its own non-compliance.

For any matter relating to this agreement, write to hola@payezz.app.

Annex I. Details of the processing

Subject matter and nature

Hosting and processing of the controller’s store and billing data: storage, consultation, modification, document generation and sending of transactional communications.

Purpose

Providing the controller with the subscribed service, so that it can sell to, invoice, provision and support its own customers.

Duration

The duration of the contractual relationship, plus the archiving period described in section 10.

Categories of data subjects

• The controller’s buyers and end customers.
• Contact persons and users of the controller’s admin panel.
• People who open support tickets in the store.
• Subscribers to the communications that the controller sends from its instance.

Categories of personal data

• Identification and contact data: first name, surname, email, telephone, address.
• Tax and billing data: tax ID (NIF), tax address, invoices and their status.
• Business relationship data: orders, subscribed services, renewals, coupons, tickets.
• Limited payment data: transaction and payment method identifiers, last four digits and card brand. No full card number or security code.
• Technical data: IP address, timestamp, user agent and activity logs.

The processing of special categories of data under Article 9 GDPR is not envisaged. The controller undertakes not to enter such data in its instance without prior written agreement.

Annex II. Security measures

Isolation

• One instance per customer: its own container, its own database and its own domain.
• A database user with permissions limited to its own database. No instance can read another’s.
• The control plane does not expose the database of any instance, and no instance has access to the control plane’s database.

Encryption

• Encryption in transit with TLS on all connections, including those to custom domains, with automatically issued certificates.
• Secrets encrypted at rest and injected into the container, rotatable.

Access control

• Individual authentication and least privilege for the processor’s personnel.
• Logging of administrative activity, with retention configurable by the controller.
• Communication between planes authenticated with HMAC-SHA256 signatures, constant-time comparison, a five-minute time window and an anti-replay cache.

Resilience

• Versioned schema migrations, applied in a controlled manner by the control plane.
• Database dump delivered at the controller’s request.

The processor may update these measures provided that the resulting level of security is equivalent or higher.