Data Processing Agreement

Last updated: October 15, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the merchant ("Controller"), and APPCARTEL S.R.L., Trade Register no. J2025073028003, CUI 52570322, Strada Principală 72P, Corușu 407056, Baciu commune, Cluj County, Romania, operating ProfitDay ("Processor"). It applies whenever ProfitDay processes personal data on your behalf, and it meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Subject matter, duration, nature and purpose

• Subject matter: providing the ProfitDay service: importing store, catalog and ad data and calculating sales, costs and profit.
• Duration: for as long as you use ProfitDay, and until deletion under section 9.
• Nature: collection from Shopify and ad platforms, storage, structuring, calculation, display, export and deletion.
• Purpose: only to provide the service to you and as described in the Terms of Service.

2. Data subjects and data categories

• Data subjects: your store's customers, to the extent order records relate to them.
• Categories of data: order identifiers and numbers, order dates, order amounts, line items, discounts, taxes, refunds and cancellations, payment gateway, and the order's destination country.
• Not processed: customer names, email addresses, phone numbers and street addresses. ProfitDay does not request these fields from Shopify.
• Special categories: none.

3. Instructions

The Processor processes personal data only on the Controller's documented instructions. The Terms of Service, this DPA and the Controller's use of the app's settings are the Controller's complete instructions. If the Processor believes an instruction breaks data protection law, it will tell the Controller.

4. Confidentiality

Everyone authorised to process the data is bound by confidentiality.

5. Security

The Processor applies the technical and organisational measures in Annex 1 and keeps them up to date.

6. Sub-processors

• The Controller gives general authorisation for the sub-processors listed in Annex 2.
• The Processor will notify the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds; if the parties cannot agree, the Controller may terminate the service.
• The Processor imposes data protection obligations on each sub-processor equivalent to this DPA and remains responsible for their performance.

7. International transfers

The Processor stores the Controller's data in the European Union. Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses.

8. Assistance

The Processor helps the Controller, taking into account the nature of the processing:

• to respond to data subject requests. Shopify's customer data requests and customer redaction requests are handled automatically, and the Processor confirms that it holds no direct customer contact data;
• with security, data protection impact assessments and prior consultations, where required.

9. Deletion and return

When the Controller uninstalls ProfitDay from a store, deletes the account, or the contract ends, the Processor deletes the related personal data within 30 days, unless law requires keeping it. Before deletion, the Controller can export its data from the app.

10. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own obligations.

11. Audits

The Processor makes available the information needed to show compliance with this DPA. The Controller may audit compliance, at its own cost, once a year with 30 days' written notice, or after a personal data breach. Audits rely first on written documentation and must not compromise other customers' data.

12. Liability and precedence

Liability under this DPA follows the Terms of Service. If this DPA conflicts with the Terms of Service on data protection, this DPA prevails.

Annex 1: Technical and organisational measures

• Encryption in transit (TLS 1.2 or higher) and at rest.
• Shopify and ad platform access tokens additionally encrypted with AES-256-GCM, with the key kept outside the database and decrypted only in server code.
• Row Level Security in the database: every record belongs to one account, and each account can read only its own records. Automated tests check this.
• Requests from Shopify (OAuth and webhooks) are verified with HMAC signatures.
• Administrative access is limited to the operator, protected by two-factor authentication, and every administrative action is logged.
• Daily encrypted backups, and monitoring with alerts.
• Least-privilege access scopes: only the Shopify and ad platform permissions the service needs, read-only.
• Dependency scanning and secret scanning on the source code.

Annex 2: Sub-processors