Data Processing Agreement AISEOPages

This Data Processing Agreement ("DPA") forms part of the agreement between Dapo Fashion B.V., trading as AISEOPages, registered at De Run 4479, 5503 LS Veldhoven, the Netherlands, Chamber of Commerce no. 17157363 ("AISEOPages" or "Processor"), and the customer using AISEOPages ("Customer" or "Controller").

For personal data that AISEOPages processes on behalf of the Customer, the Customer is the controller and AISEOPages is the processor within the meaning of the GDPR.

For the Customer's own account and billing data, AISEOPages is the controller. This is covered by our privacy statement.

This DPA applies once the Customer uses or connects AISEOPages, including via the Lightspeed App Store.

AISEOPages processes personal data only to provide the service: creating and publishing content in the Customer's store, measuring the results, and (only if the Customer enables it) creating a data report based on orders.

This DPA remains in force as long as AISEOPages processes personal data on behalf of the Customer.

Data subjects: customers of the Customer's store.

Data report (only if the Customer enables it and grants read access to orders in Lightspeed): AISEOPages reads orders when the report is created. These may contain personal data of store customers, such as name and address. This data is filtered out immediately in working memory and is NOT stored. AISEOPages only keeps aggregated results that cannot be traced to individuals (for example which products are often bought together) and the report text.

Product, category and content data from the store are mostly not personal data. AISEOPages uses them to create and publish pages.

Free text fields filled in by the Customer (for example a customer review) are used to write content. The Customer does not enter names or other personal data of its customers in these fields unless it has permission to do so.

Special categories of personal data and data of children are not knowingly processed.

AISEOPages processes the data only on documented instructions of the Customer. This DPA and the dashboard settings constitute such instructions. AISEOPages will inform the Customer immediately if it believes an instruction infringes the law.

All persons at AISEOPages with access to the data are bound by confidentiality.

AISEOPages does not use the data for its own purposes, never sells it, and does not use it to train AI models.

The Customer gives general authorisation for the sub-processors listed below.

AISEOPages will announce a new or replaced sub-processor at least 30 days in advance by email or in the dashboard. The Customer may object on reasonable grounds within that period. If the parties cannot agree, the Customer may terminate with immediate effect.

AISEOPages imposes the same obligations on sub-processors and remains liable for them.

Sub-processors that may process personal data on behalf of the Customer:

AISEOPages notifies the Customer of a personal data breach without undue delay, and no later than 48 hours after discovery, at the Customer's email address.

The notification includes what is known: what happened, which data and how many data subjects, the likely consequences and the measures taken. AISEOPages will update it as more becomes known.

The Customer decides whether to notify the supervisory authority and data subjects. AISEOPages assists.

AISEOPages reasonably assists the Customer with a DPIA and with questions from the supervisory authority.

On request, AISEOPages provides the information needed to demonstrate compliance. An audit by an independent expert is possible at most once a year, with 30 days notice, at the Customer's expense unless a material breach is found.

When the Customer removes the app from Lightspeed, AISEOPages immediately deletes the access keys and stops retrieving data.

No later than 30 days after the end of the service, AISEOPages deletes the data it holds on behalf of the Customer, unless the law requires longer retention (such as tax retention of invoices). On request, AISEOPages provides an export first.

Pages published in the store remain the Customer's property and are not removed by AISEOPages.

Liability is governed by the AISEOPages terms and conditions.

In case of conflict, this DPA prevails over the terms and conditions with regard to personal data.

This DPA is governed by Dutch law. Disputes are submitted to the competent court of the District Court of Oost-Brabant (location Eindhoven), the Netherlands.

AISEOPages may amend this DPA. Material changes will be announced 30 days in advance.