This agreement governs, under Article 28 of the GDPR, how Discoders Ventures SL, tax ID (NIF) B56721012, registered office at Calle Carnaval De Venecia 47º A, 50021 Zaragoza (Zaragoza), Spain (Unicono, the “processor”) processes, on behalf of its customer (the “controller”), the personal data of the controller's customers that the controller sends to the service. The controller accepts it when connecting its store or starting to use the service, and it forms part of the Terms of Service.
Subject matter and duration
The processor processes the data only to provide the contracted service: preparing it, computing predictions and alerts, and measuring their results.
The agreement lasts as long as the service. When it ends, the “End of the service” section applies.
Data and data subjects
Order data (dates, amounts, products, statuses, returns and refunds) and an identifier of the end customer. With the WooCommerce plugin, that identifier is a pseudonym computed in the store itself, and no names, emails, phone numbers or addresses are sent; in files the controller uploads, whatever fields the controller includes.
Data subjects: the controller's customers.
The service is not intended for special categories of data (health, beliefs, etc.): the controller must not send them.
Controller's instructions
The processor processes the data only on the controller's documented instructions: this agreement and the settings the controller chooses in the service. It does not use the data for its own purposes, does not sell it and does not use it to serve other customers. If an instruction seems unlawful, it will tell the controller.
Confidentiality and security
People authorized to process the data are bound by a duty of confidentiality.
Security measures (Article 32 GDPR): servers in the European Union, encryption in transit, encrypted backups, restricted per-account access, separation of each customer's data and automatic purging according to the configured retention period.
Subprocessors
The controller gives general authorization to the subprocessors listed in the Privacy Policy (currently Hetzner, Resend, xAI and Modal), each bound by data protection obligations equivalent to those in this agreement. The processor will give reasonable notice of any change so the controller can object.
Where a subprocessor is outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses.
Assistance to the controller
The processor helps the controller, as far as possible, to respond to data subjects' rights (access, erasure, etc.), with impact assessments and with the information needed to comply with the GDPR.
Security breaches
If the processor becomes aware of a breach affecting the controller's data, it will notify the controller without undue delay, with the information available so the controller can meet its own obligations.
End of the service
When the service ends, the processor deletes the controller's data or, if the controller asks first, returns it, unless the law requires keeping it. Backups expire within 30 days at most.
Audits
The processor makes available to the controller the information needed to demonstrate compliance with this agreement and allows reasonable audits, with prior notice and without compromising the security or data of other customers.
Controller's obligations
The controller warrants that it has a legal basis to process the data it sends and that it informs its customers of this processing.