Data Processing Agreement

1. Subject and duration

The Provider processes personal data only to provide Tapsa to the Customer, for as long as the Customer uses the service, and deletes it afterwards as set out in section 8.

2. Nature and purpose

Reading, storing, calculating and presenting the Customer's store and marketing data to produce reports, forecasts, alerts and recommendations for the Customer.

3. Data and data subjects

Data subjects: the Customer's buyers, and the Customer's staff who use the service.

Buyers: order data without names or contact details, linked only through a keyed one-way code; country; the source of the visit. Staff: name, email, sign-in sessions.

No special categories of personal data are processed.

4. The Provider's obligations

Process the data only on the Customer's documented instructions, which are the Terms of Service, this agreement and the Customer's settings in the service; tell the Customer if an instruction appears to break the law.

Make sure everyone with access to the data is bound by confidentiality.

Keep appropriate technical and organisational security measures, including: data stored in the EU; encryption in transit and of access keys at rest; access limited to the people who need it; keyed pseudonymisation of buyers; separation of each customer's data; regular backups.

Help the Customer, as far as reasonably possible, to answer data subjects' requests and to meet its obligations on security, breach notification and impact assessments.

5. Sub-processors

The Customer authorises the following sub-processors:

• Google Cloud (Google Cloud EMEA Ltd): hosting and database, in the europe-north1 region (Hamina, Finland).
• Anthropic (Anthropic PBC, USA): the Ask Tapsa assistant. It receives your store's summed-up figures needed to answer a question, never customer identifiers. Anthropic does not train its models on this data.
• Resend (Resend Inc., USA): sending account emails such as invitations, password resets and reports.

The Provider binds each sub-processor to data protection obligations equal to these, and stays responsible for them. The Provider will inform the Customer of new sub-processors at least 14 days in advance; the Customer may object and, if no solution is found, stop using the service.

6. Transfers outside the EU

Personal data is transferred outside the EU/EEA only with a valid transfer mechanism, such as the EU–US Data Privacy Framework or the EU's standard contractual clauses.

7. Personal data breaches

The Provider notifies the Customer without undue delay, and at the latest within 48 hours of becoming aware, of a personal data breach affecting the Customer's data, with the information the Customer needs to meet its own obligations.

8. Deletion

When a store is removed or the service ends, the Provider deletes the Customer's personal data within 30 days, including backups, unless law requires keeping it. The Customer can export its reports before that.

9. Audits

The Provider makes available the information needed to show compliance with this agreement, and allows reasonable audits by the Customer or an auditor it appoints, with reasonable notice and at the Customer's cost.

10. Liability and precedence

The limits of liability in the Terms of Service apply, unless mandatory law says otherwise. If this agreement and the Terms conflict on data protection, this agreement prevails.

Contact: hello@tapsa.io. Version 2026-10-17.