Umowa powierzenia przetwarzania danych (DPA)

1. Subject Matter and Duration

This DPA covers the processing of personal data that ecomDNAI carries out on behalf of the Customer when providing the ecomdnai.com platform.

The DPA applies as soon as the Customer processes personal data of third parties through ecomDNAI, for example by connecting a store or another service, uploading files or using the lead research. Its term corresponds to the term of the user agreement under the Terms. Obligations that by their nature continue after the end of the agreement (in particular section 10) survive.

2. Nature and Purpose of the Processing

ecomDNAI processes the data solely to provide the features the Customer uses: analyses and dashboards, creation of content (for example texts, images and reply drafts), customer win-back lists, the lead research, and reading from and writing to the services the Customer connects (integrations).

Processing operations include in particular retrieval, collection, display, analysis, aggregation, transmission to the subprocessors listed in the annex, storage and erasure.

ecomDNAI does not use the data for its own purposes, does not sell it and does not use it to train its own AI models. For AI features, the content required in each case is transmitted to the AI providers listed in the annex; details are in the Privacy Policy (sections 4, 5 and 14).

3. Types of Data and Categories of Data Subjects

Types of data, insofar as the Customer processes them via the platform or provides them via connected services:

• Contact data: name, email address and phone number, if provided by the Customer or the connected service
• Address and country data, for example shipping and billing address
• Order and revenue data: order ID, order values, products, status and order count
• Content from reviews and support requests: texts, stars, name of the reviewer
• Marketing consent status, for example a newsletter subscription
• Public business contact data from the lead research: company, contact role, publicly stated name, general company contacts
• QR code scan data: time, device family, referrer host and browser language, without IP address
• Other content the Customer uploads or enters, for example CSV files and prompts

Categories of data subjects: the Customer's end customers (buyers, persons placing orders, persons with abandoned checkouts), prospects and business contacts (including from the lead research), newsletter recipients, authors of reviews and support requests, persons scanning the Customer's QR codes, and the Customer's contact persons and employees.

The platform is not intended for special categories of personal data (Art. 9 GDPR); the Customer does not submit such data.

4. Instructions

ecomDNAI processes the data only on documented instructions from the Customer, including with regard to transfers to a third country, unless ecomDNAI is required to do so by Union or Member State law. In that case, ecomDNAI informs the Customer of that legal requirement before processing, unless that law prohibits such information.

The Customer's instructions result from this DPA, the Terms and the use of the platform's features and settings (for example connecting and disconnecting a service, starting an analysis, deleting a project). The Customer gives further instructions in text form to jp@ecomdnai.com.

If ecomDNAI considers that an instruction infringes the GDPR or other data protection provisions, ecomDNAI informs the Customer without undue delay. ecomDNAI may suspend the instruction until the Customer confirms or changes it.

5. Confidentiality

ecomDNAI only uses persons for the processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to the Customer's personal data is limited to what is necessary for the operation, maintenance and security of the platform.

6. Technical and Organisational Measures (Art. 32 GDPR)

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, ecomDNAI implements appropriate technical and organisational measures. These include in particular:

• Encryption in transit: connections to the platform and to the connected services use TLS.
• Hosting in the EU: servers, database and file storage are hosted by DigitalOcean in Frankfurt (EU).
• Access restriction: only authorised administrators have access to servers and database.
• Tenant separation: row level security in the database restricts every record to the account or team it belongs to.
• Credentials for connected services (tokens, API keys) are stored so that customers cannot read them from the browser; only the server uses them.
• Logging: access and errors are logged in the server journal.
• The database and daily backups are kept on encrypted storage in Frankfurt (EU).
• Separate test and production environments.
• Webhooks (for example from Shopify) are verified by HMAC signature before processing.
• Erasure after the end of the agreement and on Shopify erasure requests (section 10).

The measures are reviewed regularly and adapted to the state of the art. ecomDNAI may replace them with equivalent or better measures; the level of protection must not decrease.

7. Subprocessors

The Customer gives ecomDNAI general authorisation to engage further processors (subprocessors). The subprocessors listed in the annex are deemed approved.

ecomDNAI contractually binds every subprocessor to data protection obligations that substantially correspond to those of this DPA (Art. 28(4) GDPR).

ecomDNAI informs the Customer in advance of intended changes (adding or replacing a subprocessor) by updating this page with a new date, and for material changes additionally by email or through the platform. The Customer may object to a change in text form within 30 days of being informed, for an important reason relating to data protection. If the parties cannot agree, the Customer may terminate the user agreement.

Services that the Customer connects itself (for example Shopify, Shopware, Google, Meta, LinkedIn, Zendesk, Freshdesk, Judge.me or email sending platforms with the Customer's own credentials) are not subprocessors of ecomDNAI; the Customer uses them under its own contracts.

Transfers to countries outside the EU or EEA only take place under the conditions of Art. 44 et seq. GDPR: on the basis of the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework (adequacy decision), as described in the Privacy Policy (section 5).

8. Assistance to the Customer

ecomDNAI assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects for access, rectification, erasure, restriction, data portability and objection (Art. 12 to 22 GDPR). If a data subject contacts ecomDNAI directly, ecomDNAI forwards the request to the Customer, insofar as it can be attributed to the Customer.

The Customer can handle many requests itself: deleting projects and content, disconnecting connected services or deleting the account.

Taking into account the nature of the processing and the information available, ecomDNAI also assists the Customer with the obligations under Art. 32 to 36 GDPR (security of processing, notification of breaches, data protection impact assessment, prior consultation).

9. Notification of Personal Data Breaches

ecomDNAI notifies the Customer of a personal data breach affecting the Customer's data without undue delay, where possible within 48 hours of becoming aware of it, to the email address of the Customer's account.

The notification contains, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. ecomDNAI provides information that is not yet available without undue delay as it becomes available.

Notifying the supervisory authority and communicating with data subjects (Art. 33 and 34 GDPR) is the responsibility of the Customer as controller; ecomDNAI assists the Customer in doing so.

10. Erasure and Return after the End of the Agreement

After the end of the user agreement, ecomDNAI erases the personal data processed on behalf of the Customer, unless Union or Member State law requires storage. The Customer can download or copy results and projects via the platform's features before the end of the agreement.

Credentials and stored data from connected services are erased when the service is disconnected or the account is deleted. The retention periods of the Privacy Policy (section 6) apply to the remaining account data. ecomDNAI carries out Shopify erasure requests (customers/redact, shop/redact).

ecomDNAI keeps billing records and invoice data for the statutory periods; they concern the Customer itself, not its end customers.

11. Evidence and Audits

On request, ecomDNAI makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

The Customer or an auditor appointed by the Customer and bound to confidentiality may carry out audits by prior arrangement and with reasonable advance notice, without disproportionately disrupting operations.

ecomDNAI informs the Customer without undue delay of audits and measures by a supervisory authority insofar as they concern the Customer's data.

12. Liability and Final Provisions

Liability towards data subjects is governed by Art. 82 GDPR. Between ecomDNAI and the Customer, the liability provisions of the Terms apply.

In the event of conflicts between this DPA and the Terms, the provisions of this DPA prevail in matters of data protection.

Changes to this DPA are made in the same way as changes to the Terms (section 14 of the Terms). If a provision is invalid, the validity of the remaining provisions is not affected.

German law applies. The German version of this DPA is authoritative.

Annex: Subprocessors

Last updated: 17.10.2026. The information corresponds to the Privacy Policy (sections 4 and 5).

• DigitalOcean, LLC

  Purpose: Hosting, database and file storage

  Seat / data location: USA; servers and storage in Frankfurt (EU)

• Google (Gemini, Google Veo, Gemini TTS)

  Purpose: AI processing: text and images (Gemini), video (Veo), synthetic voice (Gemini TTS)

  Seat / data location: Processing outside the EU possible

• OpenAI (GPT)

  Purpose: AI processing

  Seat / data location: Processing outside the EU possible

• Anthropic (Claude)

  Purpose: AI processing

  Seat / data location: Processing outside the EU possible

• OpenRouter, Inc.

  Purpose: AI fallback when the primary provider is unavailable

  Seat / data location: USA

• Serper.dev

  Purpose: Search results for analyses and AI features

  Seat / data location: Processing outside the EU possible

• DataForSEO

  Purpose: Search and SEO data for analyses and AI features

  Seat / data location: Processing outside the EU possible

• Firecrawl / Mendable AI, Inc.

  Purpose: Website analysis: fetching the submitted pages, search terms in product search

  Seat / data location: USA

• image.thum.io

  Purpose: Screen captures of the submitted pages

  Seat / data location: USA

• Pangolin (scrapeapi.pangolinfo.com)

  Purpose: Public data from Amazon product pages and Google search results

  Seat / data location: Processing outside the EU possible

• Keepa

  Purpose: Price and sales-rank history of Amazon products (ASIN only)

  Seat / data location: Processing outside the EU possible

• Resend, Inc.

  Purpose: Sending transactional emails (for example invitations, password links, system notices)

  Seat / data location: USA

• Stripe Payments Europe Ltd.

  Purpose: Payment processing

  Seat / data location: Ireland