Data Processing Agreement (Article 28 GDPR)

1. Parties and Incorporation

This Data Processing Agreement (“DPA”) forms part of the contract between the business customer identified in the applicable Order (“Controller” or “Client”) and Stefan Kneisel trading as PureVision Digital, 6 Croftwell Drive, Dublin 24, D24 EY9D, Ireland, CRO Business Name Registration Number 791088 (“Processor” or “PureVision Digital”).

This DPA applies whenever PureVision Digital processes Personal Data on behalf of the Client in connection with VisionConnect, VisionService, Odoo implementation, migration, integration, support or another service for which the Client determines the purposes and essential means of processing.

If the Client itself acts as a processor for another controller, PureVision Digital acts as the Client’s sub-processor and the references in this DPA to Controller instructions include the lawful instructions of the ultimate controller as passed through the Client.

This DPA takes effect when the relevant processing begins and remains in force for as long as PureVision Digital processes Personal Data on behalf of the Client. In the event of a conflict concerning processing of Personal Data, this DPA prevails over the general Terms of Business.

2. Definitions

“Data Protection Laws” means the GDPR and all applicable laws implementing, supplementing or replacing it, including applicable Irish and EU data protection law and any mandatory national data protection rules that apply to the relevant processing.

“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR.

“Client Personal Data” means Personal Data processed by PureVision Digital on behalf of the Client under this DPA.

“Sub-processor” means a third party engaged by PureVision Digital to process Client Personal Data on behalf of the Client.

3. Subject Matter and Processing Details

The subject matter, duration, nature and purpose of processing, categories of Data Subjects and types of Personal Data are described in Annex 1.

The Client is responsible for ensuring that its instructions comply with Data Protection Laws and that it has a lawful basis for the collection, disclosure and processing of Client Personal Data.

The Client must not intentionally provide special-category data under Article 9 GDPR, criminal-offence data under Article 10 GDPR, full payment-card data or other unusually sensitive information unless the parties have expressly agreed the processing and appropriate safeguards in writing.

4. Documented Instructions

PureVision Digital will process Client Personal Data only on documented instructions from the Client, including instructions contained in the Order, configuration of VisionConnect, support requests and other documented communications, unless Union or Member State law requires otherwise.

If law requires processing beyond the Client’s instructions, PureVision Digital will inform the Client before processing unless the law prohibits such information on important grounds of public interest.

PureVision Digital will promptly inform the Client if, in its reasonable opinion, an instruction infringes Data Protection Laws and may suspend the affected processing until the parties resolve the issue.

5. Confidentiality

PureVision Digital will ensure that persons authorised to process Client Personal Data are subject to appropriate confidentiality obligations and receive access only to the extent necessary for their role.

6. Security of Processing

PureVision Digital will implement and maintain appropriate technical and organisational measures designed to provide a level of security appropriate to the risk, taking account of the nature, scope, context and purposes of processing.

The current principal measures are summarised in Annex 2. PureVision Digital may update security measures over time provided that the overall level of protection is not materially reduced.

7. Sub-processors

The Client gives PureVision Digital general written authorisation to engage the Sub-processors listed in Annex 3 and to add or replace Sub-processors in accordance with this clause.

PureVision Digital will ensure that each Sub-processor is bound by written data protection obligations that provide substantially the same protection for Client Personal Data as required by Article 28 GDPR and this DPA, to the extent applicable to the services performed by that Sub-processor.

PureVision Digital remains responsible to the Client for the performance of its Sub-processors’ data protection obligations as required by Article 28 GDPR.

Where PureVision Digital intends to add or replace a Sub-processor that will process Client Personal Data, it will provide reasonable prior notice, for example by email, contractual notice or an updated Sub-processor list. The Client may object on reasonable data-protection grounds within 14 days of notice. The parties will seek a commercially reasonable solution. If no reasonable alternative is available, either party may terminate the affected service without affecting fees accrued before termination.

Client-selected platforms such as Amazon, eBay or other marketplaces are not PureVision Digital Sub-processors merely because VisionConnect transmits data to or from those platforms on the Client’s instructions. The Client is responsible for its own contractual and data-protection relationship with those platforms.

8. International Transfers

PureVision Digital will not transfer Client Personal Data outside the European Economic Area except on the Client’s documented instructions or where a lawful transfer mechanism is in place as required by Data Protection Laws.

Where a transfer to a country without an applicable adequacy decision is necessary, PureVision Digital will use appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.

PureVision Digital’s primary Odoo production infrastructure is located at Hetzner in Falkenstein, Germany. Backup storage for the managed environment is also on Hetzner infrastructure. Google Workspace may involve international processing in accordance with Google’s applicable data-processing terms and transfer safeguards.

9. Data Subject Rights

Taking into account the nature of the processing, PureVision Digital will assist the Client by appropriate technical and organisational measures, insofar as reasonably possible, in responding to requests from Data Subjects exercising their rights under Data Protection Laws.

If PureVision Digital receives a request directly concerning Client Personal Data, it will not respond on the merits unless authorised by the Client or required by law and will forward the request to the Client where reasonably possible.

10. Personal Data Breaches

PureVision Digital will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.

The notification will include information reasonably available to PureVision Digital that the Client may need to comply with Articles 33 and 34 GDPR, including the nature of the incident, categories of affected data where known, likely consequences and measures taken or proposed.

PureVision Digital will take reasonable steps to contain, investigate and remediate the breach and will cooperate with the Client. Notification is not an admission of fault or liability.

11. Assistance with Compliance

Taking into account the nature of the processing and information available to it, PureVision Digital will provide reasonable assistance to the Client with obligations under Articles 32 to 36 GDPR, including security, breach assessment, data protection impact assessments and prior consultation with supervisory authorities where applicable.

Additional assistance that goes materially beyond the ordinary service may be charged at the applicable professional-services rate where permitted by law and where the need for assistance was not caused by PureVision Digital’s breach of this DPA.

12. Audits and Information

PureVision Digital will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR.

Where appropriate, the parties will first rely on current documentation, security information, third-party certifications or audit reports made available by PureVision Digital or its infrastructure providers.

If an on-site or additional audit is reasonably necessary, the Client may conduct it or appoint an independent auditor bound by confidentiality on reasonable prior notice, during normal business hours and in a manner that does not unreasonably disrupt operations. Unless required by a supervisory authority or following a material security incident, such an audit will normally be limited to once in any twelve-month period.

The Client bears reasonable costs of an audit unless the audit identifies a material breach of this DPA by PureVision Digital.

13. Return and Deletion

At the end of the relevant services, PureVision Digital will, at the Client’s choice and where technically feasible, return or delete Client Personal Data, unless applicable law requires retention.

Data contained in backups may remain until overwritten or deleted through the ordinary backup cycle, during which time it remains protected by this DPA and will not be restored except for legitimate recovery, security or legal purposes.

The Client is responsible for requesting and validating any available export before service termination where continued possession of the data is required.

14. Records and Cooperation

PureVision Digital will maintain records of processing activities where required by Article 30 GDPR and will cooperate with the Client and competent supervisory authorities to the extent required by Data Protection Laws.

15. Liability and Main Agreement

The liability provisions of the main contract apply to this DPA to the maximum extent permitted by Data Protection Laws, without limiting any rights or liabilities that cannot lawfully be limited.

Nothing in this DPA changes the allocation of controller responsibilities to the Client, including responsibility for lawful collection, transparency notices, legal bases, retention instructions and the accuracy of Client Personal Data.

16. Governing Law and Term

This DPA is governed by the law governing the main contract, normally Irish law, without prejudice to mandatory Data Protection Laws.

Obligations relating to confidentiality, security, deletion and protection of Client Personal Data survive termination for as long as PureVision Digital or a Sub-processor retains Client Personal Data.

Annex 1 – Description of Processing

Subject matter

Provision of VisionConnect SaaS middleware and, where applicable, VisionService development, Odoo implementation, migration, integration, maintenance, support and related technical services requiring access to Client-controlled systems or data.

Duration

For the duration of the relevant service and any agreed transition period, followed by deletion or return subject to legal retention obligations and ordinary backup cycles.

Nature and purpose

Hosting, transmission, synchronisation, retrieval, organisation, storage, troubleshooting, migration, integration, development, testing, support, backup and other processing necessary to provide the contracted service on the Client’s instructions.

Categories of Data Subjects

The Client’s customers and marketplace customers; employees, contractors and users; suppliers and business contacts; delivery recipients; customer-service contacts; and other individuals whose Personal Data is contained in Client systems or transactions processed through the service.

Types of Personal Data

Names; business and personal contact details; customer and account identifiers; marketplace identifiers; order and transaction details; shipping and delivery information; product and inventory-related records linked to individuals; communications; user IDs; IP addresses; system and audit logs; support information; and other ordinary business data contained in the Client’s connected systems.

Special categories

Not intended. The Client must not intentionally submit special-category data, criminal-offence data or full payment-card data unless expressly agreed in writing and appropriate safeguards have been implemented.

Controller rights and obligations

The Client determines the purposes of processing, provides lawful instructions, ensures a lawful basis, provides required transparency information, manages Data Subject requests and gives PureVision Digital accurate retention and deletion instructions.

Annex 2 – Technical and Organisational Measures

Access to production and administrative systems is restricted to authorised personnel and service providers on a need-to-know basis.

Administrative access is authenticated and managed using appropriate credentials; multi-factor authentication is used where supported and appropriate.

Client environments, accounts and credentials are logically separated where applicable.

Data transmitted over public networks is protected using encrypted transport such as TLS where supported by the relevant service.

Production Odoo infrastructure is hosted on Hetzner infrastructure in Falkenstein, Germany; managed backups are stored on Hetzner infrastructure.

CloudPepper is used for management of relevant Odoo environments, including deployment, monitoring, maintenance, troubleshooting and backup management.

Systems are maintained through reasonable patching, update and vulnerability-management practices appropriate to the service and risk.

Logs and monitoring are used where appropriate for security, availability, troubleshooting and incident investigation.

Secrets, credentials and access keys are restricted and are not intentionally embedded in publicly accessible source code.

Personnel and contractors with access to Personal Data are subject to confidentiality obligations.

Reasonable incident-response procedures are maintained to identify, contain, investigate and remediate security incidents.

Backups and recovery procedures are maintained according to the configured service. Restoration is performed only for legitimate operational, recovery or security purposes.

Deletion and access revocation are carried out when access is no longer required, subject to retention duties and backup cycles.

Development and testing should use minimised or non-production data where reasonably practicable; production Personal Data is used only where necessary for the Client’s instructions.

Annex 3 – Authorised Sub-processors

Processor contact: PureVision Digital · hello@purevisiondigital.com · purevisiondigital.com

PureVision Digital · 6 Croftwell Drive, Dublin 24, D24 EY9D, Ireland · CRO 791088 · hello@purevisiondigital.com