Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between SPEUX E.I.R.L. (Tax ID 20607072168, “Zentro”, Processor) and the Customer (Controller), and applies when Zentro's processing of personal data on behalf of the Customer is subject to GDPR (EU), UK GDPR, CCPA/CPRA (California), LGPD (Brazil), or equivalent regulations.

1. Definitions

• Personal Data: any information relating to an identified or identifiable natural person that the Customer entrusts to us through the Service.
• Processing: any operation performed on Personal Data.
• Controller: the Customer, who determines the purposes and means of Processing.
• Processor: Zentro, processing data on behalf of the Customer.
• Sub-processor: a third party engaged by Zentro to process Data.

2. Subject matter and duration

Zentro will process Personal Data only as necessary to provide the Service described in the Terms. This DPA applies for the duration of the commercial relationship and until data is deleted.

3. Nature and purpose of Processing

• Importing and managing the Customer's COD orders, including those from their connected Shopify stores, and syncing changes to those orders back to those stores.
• Communicating with the Customer's buyers, on the Customer's instructions, to manage their orders (section 8 of the Terms of Service).
• Synchronization with couriers and authorized integrations.
• Generating operational reports for the Customer.
• Providing technical support when requested by the Customer.

4. Categories of Personal Data and data subjects

• Customer's users: name, email, role, access logs.
• Customer's end-customers: name, phone, national ID, address, order history.

We do not process special categories of data (health, biometric, ideological, etc.). If the Customer uploads such data, it does so under its own responsibility and must have the appropriate legal bases.

5. Zentro's obligations as Processor

• Process Data only on the Customer's documented instructions.
• Ensure that authorized personnel commit to confidentiality or are subject to a legal obligation of confidentiality.
• Implement appropriate technical and organizational measures: AES-256-GCM encryption, TLS 1.2+, role-based access control (RBAC), multi-tenant isolation, audit logging.
• Assist the Customer in fulfilling its obligations (responding to data-subject rights, impact assessments, breach notifications).
• Notify the Customer without undue delay (target: 72 hours) of any security breach affecting their Data.
• At the Customer's choice, delete or return Data at the end of the service, unless legally required to retain.

6. Sub-processors

The Customer authorizes Zentro to engage the following Sub-processors. Zentro maintains contracts imposing equivalent obligations to this DPA with each Sub-processor:

Zentro will notify the Customer at least 30 days in advance of any addition or replacement of Sub-processors. The Customer may object in writing to privacy@zentro.one.

7. International transfers

When Data is transferred outside the Customer's country, Zentro transfers only what is needed to provide the Service, and only to the Sub-processors in section 6. The providers of the infrastructure where Data is hosted (Vercel and Neon) hold SOC 2 and ISO 27001 certifications. If the Customer needs a specific transfer mechanism, such as the European Commission's Standard Contractual Clauses for EU or UK data, they can request it at privacy@zentro.one.

8. Data subject rights

Zentro provides in-platform mechanisms enabling the Customer to handle data subject requests (access, rectification, deletion, portability). If a data subject contacts Zentro directly, we will redirect them to the Customer and provide reasonable assistance.

9. Audit

The Customer may request, once per year with 30 days' advance notice, evidence of compliance with security measures: the description of our controls and the certifications that Sub-processors publish. On-site audits require prior agreement and are at the Customer's expense.

10. Limitation of liability

Liability under this DPA is subject to the limitations of the Terms of Service. Aggregate liability shall not exceed the amount paid by the Customer in the 12 months prior to the triggering event.

11. Acceptance

This DPA is part of the Terms of Service and is accepted together with them, by using the service or by installing the Zentro Shopify app. If the Customer also needs a signed copy, they may:

• Request a signed copy by writing to privacy@zentro.one with subject “DPA Request”.
• Accept it electronically from Settings → Compliance (coming soon).

12. Contact

Processor: SPEUX E.I.R.L. · Tax ID 20607072168 · privacy@zentro.one