Data processing agreement

This agreement is concluded between you, as controller — the individual or company in whose name the OnSell shop is opened — and EPRISM SOLUTIONS SRL, with its registered office at Str. Traian Vuia nr. 38, Mun. Buzău, 120262, registered with the Trade Register under number J10/94/2017, VAT/tax identification number RO36994199, as processor (“OnSell”, “we”).

It supplements the terms of service and is read together with the privacy policy. In the event of any inconsistency concerning the processing of your customers' data, this agreement prevails.

For your own user account data — email address, password, sign-in sessions — the roles are reversed: there we are the controller, and this agreement does not apply. The distinction is explained in section 2 of the privacy policy.

Subject matter. Provision of the OnSell platform: synchronising orders, products and customers from the channels you connect, stock management, issuing invoices and generating transport documents.

Duration. For as long as the contract is in force, plus the deletion period set out in section 9.

Nature of the processing. Collection from the connected channels, storage, structuring, consultation by the users you authorise, transmission to the services you connect, and deletion.

Purpose. Solely the performance of the contract. We do not use your customers' data for purposes of our own, do not sell it, do not make it available to our other customers and do not use it to train artificial intelligence models.

The categories of data and of data subjects are listed in Annex 1.

We process the data only on your documented instructions. Your instructions are: this agreement, the terms of service, the configuration you set up in the platform — the channels connected, the synchronisation rules, the users you grant access to — and any written request you send us subsequently.

If Union law or Romanian law requires us to process in some other way, we will inform you beforehand, unless that law itself prohibits the notification.

If we consider that an instruction received from you infringes the GDPR, we will tell you and may suspend its execution until the matter is clarified.

Access to your shop's data is limited to the people who need it in order to provide or maintain the service. All of them are bound by a duty of confidentiality.

Our personnel access a shop's data only for maintenance, to resolve an incident, or at your request for support. Each shop runs with its own database, isolated from the others, so that a user of one shop cannot reach another's data.

We apply the technical and organisational measures required by Article 32 GDPR, proportionate to the risk:

• traffic between the browser and the platform, and between our own services, is encrypted with TLS;
• the credentials of the integrations you configure — the access tokens, API keys and secrets of shops, couriers and invoicing providers — are encrypted in the database rather than stored in the clear;
• account passwords are kept only as bcrypt hashes, and email tokens and sessions likewise as hashes;
• each shop has its own database and its own file storage, separate from those of other customers;
• access to the platform is through named accounts, with role-based permissions set by your shop's administrators;
• we keep access and activity logs that allow it to be established who made a change and when;
• we take regular backups of the databases.

You authorise us to use the sub-processors listed in Annex 2. Each is bound by contract to the same data protection obligations that we owe to you, and we remain liable to you for their activity as for our own.

If we intend to add or replace a sub-processor, we will publish the change in Annex 2 and notify you by email at least 30 days in advance. If you have a reasonable objection, you may send it to us within that period; if we cannot reach a solution, you may terminate the contract without penalty before the change takes effect.

The services you connect yourself are not our sub-processors. Shopify, eMAG, Trendyol, Oblio, SmartBill, FAN Courier, Cargus, DPD, Sameday and the rest have their own relationship with you, to which we are not a party: we merely transmit, on your command, the data needed for the operation you ask for — for example the recipient's address, to the courier you chose, at the moment you generate the shipping label.

Your shop's customers exercise their rights against you, because you are the controller. We help you answer them.

The platform gives you direct access to a customer's data and lets you correct, export or delete it yourself, without depending on us. If a request cannot be resolved from the platform, write to us at contact@onsell.ro and we will assist you in good time, bearing in mind the one-month deadline you have to meet.

Requests arriving through channels. Where a channel itself sends us a request about a shopper — as Shopify does — we take it up automatically, without you having to intervene: an erasure request is carried out within minutes of arriving, and an access request is recorded and flagged to you, because the answer to the shopper is yours to give. What is erased and what remains is described in section 8 of the privacy policy.

If one of your customers contacts us directly, we do not answer in your place: we direct them to you and let you know.

If we become aware of a security breach affecting your shop's data, we will inform you without undue delay and in any event within 48 hours of becoming aware — so that you are left with time out of the 72 hours in which you must notify the authority.

The notification covers what happened, which categories of data and approximately how many people are affected, the likely consequences and the measures we have taken. If we do not yet have every detail, we tell you what we know and follow up as we learn more.

We also support you, with the information available to us, with data protection impact assessments (Article 35) and with prior consultation of the authority (Article 36), where you need them.

On termination of the contract we make your data available for download for 30 days. After that period we delete it, including from backups as those are rotated.

Within the same period you may ask in writing either for the data to be returned in a structured format, or for it to be deleted immediately.

The only exception is what we are required by law to keep — principally records of fiscal relevance — and only for the period the law requires. For that data, processing is limited to storage.

At your written request we will make available the information necessary to demonstrate that we are meeting our obligations under this agreement.

If that information is not sufficient for you, you may request an audit, once per calendar year, on reasonable notice, during working hours, without affecting the operation of other customers and subject to signing a confidentiality undertaking. The cost of an audit you request is borne by you, unless the audit finds a breach of this agreement.

Your shop's data is stored and processed in the European Union, in the data centre in Frankfurt, Germany.

Where a sub-processor listed in Annex 2 processes data outside the European Economic Area, the transfer is made under the standard contractual clauses adopted by the European Commission or under an adequacy decision, and Annex 2 says so.

Categories of data subjects: the customers and shoppers of your shop, the recipients of the parcels you dispatch, and the contact persons of your commercial partners.

We do not process special categories of data on your behalf within the meaning of Article 9 GDPR — data on health, beliefs, trade union membership, biometric data — nor data relating to criminal convictions. The platform has no fields intended for them. If you enter such data in free-text fields you do so on your own responsibility and undertake to tell us, because it calls for additional measures.

The list is current as at the date shown at the top of the page. Changes are notified in accordance with section 6.

For any matter concerning this agreement, including a signed copy or an audit request, write to us at contact@onsell.ro. We answer within one month, and immediately for anything concerning a security incident.

By your use of the OnSell platform, or use by the users you authorise, this agreement is concluded between you and EPRISM SOLUTIONS SRL in the version published as at the date above.