Data Processing Agreement

This is a configurable DPA template for professional review. It is not legal advice and must be completed between the operator and the seller/controller. The parties, processing purposes, duration, data categories and safeguards must be verified for each deployment.

The seller may act as controller for buyer and order data processed through marketplace integrations, while the operator may act as processor for that data. For seller account, workspace and billing data, the operator may act as controller. The parties must document each processing activity rather than assuming one universal role.

The processor will process personal data only on documented instructions, implement appropriate technical and organizational measures, ensure confidentiality, assist with data-subject requests and security incidents where required, and delete or return data at the end of the service subject to legal retention obligations.

The processor must maintain the actual subprocessor list, obtain authorization where required, impose equivalent obligations and provide notice of changes. Current deployment providers are listed at /subprocessors. Providers must not be enabled before the list and legal documents are updated.

The processor will maintain company-level access controls, encrypted marketplace credentials, revocable sessions, audit logging and secure production transport. The parties must agree on incident notification timing, contact channels and cooperation. No certification is claimed.

Where a provider processes outside the EEA, the parties must identify the applicable transfer mechanism and safeguards. The operator must verify the provider’s current processing locations and terms before enabling the service.

Financial records may need to be retained under accounting law. Generic deletion must not erase legally required invoices or credit notes. The parties must define retention, export and return procedures.

Add the operator legal entity, seller entity, effective date, notice addresses and signatures after legal review. Until completed, this page is a template and does not create an executed DPA.