Data Processing Agreement (DPA)

1. Parties, scope and precedence

This Agreement is entered into between:

• the customer that has accepted the Optisleek Terms of Service and uses the service for its online store (the "Customer" or "Controller"); and
• FDN GROUP IKE (distinctive title "FDN GROUP"), a Greek private company with its registered seat at 22 Laertou St., Capital Trade Center, 555 35 Pylaia, Thessaloniki, Greece, G.E.MI. no. 043344806000, VAT no. 997827524, Tax office KEFODE THESSALONIKIS, which provides the Optisleek service ("Optisleek" or "Processor").

This Agreement applies to all processing of personal data that Optisleek carries out on behalf of the Customer in the course of providing the Optisleek service (the "Service"), as described in Annex I. It does not apply to processing that Optisleek carries out as an independent controller (for example, to manage the contractual relationship, for invoicing, or to operate the optisleek.com website), which is governed by the Optisleek Privacy Policy.

In the event of any conflict between this Agreement and the Terms of Service regarding the protection of personal data, this Agreement prevails. On all other matters the Terms of Service apply. Annexes I to III form an integral part of this Agreement.

2. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach", "supervisory authority" and any other term not expressly defined herein have the meaning given to them in Article 4 GDPR.

In addition, for the purposes of this Agreement:

• "Customer Data" means the personal data that Optisleek processes on behalf of the Customer, as described in Annex I.
• "Sub-processor" means any third party engaged by Optisleek that processes Customer Data on behalf of the Customer.
• "Tracking Script" means the Optisleek JavaScript script installed on the Customer's online store.
• "Applicable Law" means the GDPR, Greek Law 4624/2019, Greek Law 3471/2006 and any other provision of EU or Greek law on the protection of personal data that applies to the processing.

3. Roles of the parties

With respect to Customer Data, the Customer acts as controller and Optisleek acts as processor. The Customer determines the purposes and essential means of the processing by selecting, configuring and using the features of the Service.

Where the Customer itself acts as a processor on behalf of a third-party controller, it warrants that its instructions, including the appointment of Optisleek as a sub-processor, have been authorised by that controller, and it remains Optisleek's sole point of contact.

4. Subject matter, duration, nature and purpose of processing

Subject matter: the provision of the Service, namely merchandising automation, dynamic categories, product recommendation widgets, landing pages, product and category analytics and reports, feed management, and integrations with e-commerce platforms and ERP systems.

Duration: processing lasts for as long as the Customer's subscription is in force and, after it ends, for the period required to return and delete data in accordance with Section 12.

Nature: collection via the Tracking Script, receipt via integrations or file imports, storage, organisation, combination, analysis, aggregation, anonymisation, making available to the Customer through the application, and deletion.

Purpose: performing the Service features enabled by the Customer, in particular sorting and displaying products, showing recommendations, and measuring the performance of products, categories and widgets, as well as technical support, security and ensuring the proper operation of the Service.

The categories of data subjects and data, the frequency and the retention period are set out in detail in Annex I.

5. Controller's obligations

The Customer is responsible for the lawfulness of the processing of Customer Data and in particular:

• Lawful basis: ensures that a valid lawful basis under Article 6 GDPR exists for all processing it entrusts to Optisleek.
• Cookie consent: since the Tracking Script uses cookies and similar technologies, the Customer operates a consent management platform (CMP) and loads the Tracking Script only after the visitor has given consent for the relevant category, in accordance with Article 4(5) of Greek Law 3471/2006. The Customer keeps records of consent and honours its withdrawal.
• Transparency: informs the visitors and customers of its online store, through its own privacy policy and cookie policy, about the use of the Service, the data collected, the cookies __opix_uid and __opix_utm and the purposes of processing, in accordance with Articles 13 and 14 GDPR.
• Data minimisation: does not send Optisleek, whether via the Tracking Script, integrations or file imports, any data not required for the Service, such as customers' names, postal addresses, telephone numbers or email addresses, nor any special categories of data under Article 9 GDPR or data under Article 10 GDPR.
• Lawful instructions: ensures that its instructions to Optisleek comply with Applicable Law.
• Accuracy: takes care of the accuracy and quality of the data it enters into the Service.

The Customer is responsible for the consequences of any failure to comply with the above obligations and shall indemnify Optisleek against any third-party claims arising from such failure, to the extent permitted by law.

6. Processor's obligations

6.1 Processing on instructions only

Optisleek processes Customer Data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by EU or Member State law. In that case, Optisleek informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Terms of Service, this Agreement, the Customer's settings and actions in the application, and any written instruction agreed between the parties constitute documented instructions.

6.2 Notice of unlawful instructions

Optisleek immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions. Optisleek may suspend the execution of the instruction until the Customer confirms or amends it.

6.3 Confidentiality

Optisleek ensures that persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they have access only to the extent necessary to perform their duties.

6.4 Assistance with data subject requests

Taking into account the nature of the processing, Optisleek assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests to exercise data subject rights (Articles 15 to 22 GDPR). If Optisleek receives such a request directly, it forwards it to the Customer without undue delay and does not respond on the merits without the Customer's instruction.

As the Service operates mainly with pseudonymous identifiers (e.g. a browser ID), identifying a data subject may require the Customer to provide the relevant identifier.

6.5 Assistance with impact assessments and prior consultation

Optisleek provides the Customer with reasonable assistance, based on the information available to it, in carrying out data protection impact assessments (Article 35 GDPR) and any prior consultation with the supervisory authority (Article 36 GDPR), and in complying with the obligations under Articles 32 to 34 GDPR.

6.6 Records of processing

Optisleek maintains a record of the categories of processing activities it carries out on behalf of the Customer, in accordance with Article 30(2) GDPR.

6.7 Contact

For any matter relating to this Agreement, the Customer may contact Optisleek at privacy@optisleek.com. Optisleek has not appointed a Data Protection Officer (DPO); this mailbox handles all related requests.

7. Security measures

8. Sub-processors

8.1 General authorisation

The Customer grants Optisleek general written authorisation to engage sub-processors to provide the Service. The current list of sub-processors is set out in Annex III.

8.2 Notice of changes

Optisleek notifies the Customer, by email to the account administrators or through the application, at least 30 days before adding or replacing a sub-processor, stating its identity, the service and the country of processing.

8.3 Right to object

The Customer may object in writing, on reasonable data protection grounds, within the notice period. The parties will cooperate in good faith to find a solution. If no solution is found before the new sub-processor is engaged, the Customer may terminate its subscription by written notice, effective from the date the new sub-processor is engaged. If no objection is raised within the notice period, the change is deemed accepted.

8.4 Flow-down of obligations

Optisleek imposes on each sub-processor, by written contract, data protection obligations substantially equivalent to those in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organisational measures.

8.5 Liability

Where a sub-processor fails to fulfil its data protection obligations, Optisleek remains fully liable to the Customer for the performance of those obligations, in accordance with Article 28(4) GDPR and within the limits of Section 13.

9. International transfers

Customer Data is hosted on FDN Hosting infrastructure in data centres in Germany and Finland, within the European Economic Area (EEA).

Optisleek does not transfer Customer Data to a country outside the EEA unless: (a) the country benefits from an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified recipients; or (b) appropriate safeguards under Article 46 GDPR are in place, in particular Standard Contractual Clauses, combined where necessary with supplementary measures. Any such transfer is notified to the Customer in accordance with Section 8.

10. Personal data breach

Optisleek notifies the Customer of any personal data breach affecting Customer Data without undue delay and in any event no later than 48 hours after becoming aware of it.

The notification is sent to the Customer's account administrators and includes, to the extent available:

• a description of the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• contact details for obtaining further information;
• a description of the likely consequences of the breach;
• a description of the measures taken or proposed to address the breach and mitigate its possible adverse effects.

Where it is not possible to provide all information at the same time, it may be provided in phases without undue further delay. Optisleek takes the necessary containment measures, cooperates with the Customer and assists it in meeting its obligations to notify the supervisory authority and communicate the breach to data subjects (Articles 33 and 34 GDPR). A notification does not constitute an acknowledgement of fault or liability.

11. Information and audits

On written request, Optisleek makes available to the Customer all information necessary to demonstrate its compliance with Article 28 GDPR and this Agreement, in particular a description of its security measures and sub-processors.

Where such information is reasonably insufficient, the Customer may conduct an audit, including an inspection, itself or through an independent auditor bound by confidentiality who is not a competitor of Optisleek, subject to the following conditions:

• written notice at least 30 days in advance, describing the subject matter and scope of the audit;
• no more than once per calendar year, unless required by a supervisory authority or following a personal data breach affecting the Customer;
• conducted during business days and hours, without disrupting Optisleek's operations or service to other customers, and without access to other customers' data;
• at the Customer's cost, including reasonable costs of Optisleek staff time;
• all information obtained by the Customer or the auditor is treated as confidential.

12. Return and deletion of data

On expiry or termination of the subscription, the Customer may export its data using the Service's available export features within 30 days. After that period, Optisleek deletes Customer Data, including copies, within 60 days. Backups are deleted in their normal rotation cycle and, until then, remain protected and are not actively processed.

This does not apply to data that must be retained under EU or Member State law, which Optisleek keeps only for the purpose and period required by law, subject to the same confidentiality protections. Fully anonymised data is not personal data and is not subject to deletion. On request, Optisleek confirms deletion in writing.

13. Liability

Each party's liability arising out of or in connection with this Agreement is subject to the limitations and exclusions of liability in the Terms of Service. In particular, Optisleek's total liability is limited to the total fees paid by the Customer in the 12 months preceding the event giving rise to liability, and Optisleek is not liable for indirect or consequential loss or loss of profit, except in cases of intent or gross negligence and where the law does not permit limitation.

This limitation does not affect either party's liability towards data subjects under Article 82 GDPR.

14. Term and termination

This Agreement enters into force upon acceptance of the Terms of Service and remains in force for as long as Optisleek processes Customer Data, including the return and deletion period under Section 12. It cannot be terminated separately from the subscription.

Provisions which by their nature should survive termination, in particular those concerning confidentiality, data deletion and liability, remain in force. Optisleek may amend this Agreement by giving at least 30 days' notice by email or in the application, in accordance with the Terms of Service; amendments required by law or by a decision of a supervisory authority may take effect sooner.

15. Governing law and jurisdiction

This Agreement is governed by Greek law, without prejudice to the mandatory provisions of the GDPR. The courts of Thessaloniki have exclusive jurisdiction over any dispute arising out of or in connection with it.

The competent supervisory authority for Optisleek is the Hellenic Data Protection Authority, 1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr.

Annex I — Description of processing

Annex II — Technical and organisational measures

• Encryption in transit: all communications with the application, the API and the Tracking Script take place over TLS.
• Access control: role-based access and the principle of least privilege; prompt revocation of rights no longer needed; hashing of passwords.
• Multi-factor authentication: for administrative access to infrastructure and systems, where supported.
• Logging and monitoring: logging of administrative actions and security events, with monitoring for unusual activity.
• Backups: regular backups and the ability to restore the availability of and access to data.
• Physical security: hosting in EU data centres (Germany, Finland) with controlled physical access.
• Data segregation: logical segregation of each customer's data per account.
• Vulnerability management: regular software updates and application of security patches.
• Minimisation: the Service is designed to operate on pseudonymous identifiers rather than directly identifying data; anonymisation or deletion at the end of the retention period.
• Personnel: confidentiality undertakings and awareness of data protection and security matters.
• Incident management: a process for detecting, assessing, containing and notifying security incidents, in accordance with Section 10.
• Sub-processors: selection based on sufficient security guarantees and written contracts in accordance with Section 8.

Annex III — Sub-processors