This Data Processing Agreement ("DPA") forms part of the agreement between the customer creating a PANOpeak account ("Controller", "you") and PANOpeak ("Processor", "we"), and applies whenever PANOpeak processes personal data on your behalf in connection with the PANOpeak repricing service (the "Service"). It is accepted electronically: a workspace admin must accept the version shown in Settings → Data Processing Agreement before any marketplace can be connected, and that acceptance, version, timestamp, and who accepted, is recorded and available to you on request. This constitutes execution of the DPA between the parties under Art. 28(3) GDPR.
1. Definitions
"GDPR" means Regulation (EU) 2016/679. "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Personal Data Breach" have the meanings given in the GDPR. "Sub-processor" means a third party engaged by PANOpeak to process Personal Data in providing the Service.
2. Subject matter and duration
The subject matter of this DPA is the Processing of Personal Data by PANOpeak as necessary to provide the Service: storing and relaying your marketplace connections, computing and executing price changes within the guardrails you configure, and providing you with the resulting analytics, notifications and audit trail. This DPA runs for as long as PANOpeak processes Personal Data on your behalf under the Service, for the life of your account or subscription, plus any period afterward during which PANOpeak retains data under Section 5 (for example, the 30-day erasure grace period).
3. Nature and purpose of processing
PANOpeak processes Personal Data to: authenticate and relay requests to the marketplaces you connect; store and reconcile your listings, prices and the competing offers visible on those listings; execute price changes you have authorised, within your configured floor and ceiling; generate the notifications, reports and exports the Service provides; and maintain security and audit logs of the above.
4. Categories of data subjects
Personal Data processed under this DPA may relate to: your workspace's authorised users (your staff, by name and work email); and, incidentally, individuals identifiable from public marketplace offer data, for example, a sole trader competing seller whose registered trading name is also their personal name. PANOpeak does not process data about the end consumers who buy from your marketplace listings; that relationship is between you and the marketplace.
5. Categories of personal data, and retention
Account holder name, work email, and (where used) two-factor authentication metadata; marketplace API credentials and OAuth tokens, stored encrypted; catalogue, pricing and competing-offer data reachable through your marketplace connections; and audit-log entries recording actions taken in the Service. Operational history (listings, price history, competitor snapshots) is retained for the window your plan includes, 30, 90 or 730 days depending on plan, and ages out automatically thereafter; no plan retains it beyond 730 days. On a workspace deletion request, data is retained for a 30-day cancellable grace period and then permanently deleted. Full retention detail is in our Privacy Policy.
6. PANOpeak's obligations as Processor
- Process Personal Data only on your documented instructions, including with regard to transfers, unless required to do otherwise by EU or member state law.
- Ensure that persons authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures under Art. 32 (Section 9 below) and assist you, at your reasonable request, in meeting your own Art. 32–36 obligations, including data protection impact assessments.
- Assist you in responding to data subject requests, to the extent the Service allows you to do this yourself; where it does not, we will respond to your instruction within a reasonable time given the one-month statutory deadline you are working to.
- Notify you without undue delay after becoming aware of a Personal Data Breach affecting your data, with the information reasonably available to us at the time and as it develops.
- At the end of the provision of the Service, delete or return all Personal Data at your choice, and delete existing copies, except where EU or member state law requires PANOpeak to retain it (for example, invoicing records).
- Make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice and no more than once per year absent cause.
- If, in our reasonable opinion, an instruction you give us infringes the GDPR or another applicable data protection provision, we will inform you of this before carrying it out, unless the law requires us to comply regardless.
7. Sub-processors
You give general authorisation for PANOpeak to engage the sub-processors listed below. Sub-processors are versioned: the list that applies is the one you accepted, shown with its version number in Settings → Data Processing Agreement. Adding a sub-processor to a list already in force is not permitted; it requires a new version, which we will give you advance notice of before it takes effect, so you have the opportunity to object.
We impose data protection obligations on each sub-processor that are no less protective than those set out in this DPA, and where a sub-processor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that sub-processor's obligations.
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway | Compute, primary data store and job queue state | EU (Amsterdam) |
| Cloudflare | DNS, CDN, WAF and bot protection | EU network, US company (Standard Contractual Clauses) |
| Stripe | Billing and payments | EU + US (Standard Contractual Clauses) |
| Resend | Transactional email | EU |
A draft next version (1.1) adds eMAG Marketplace SA (Romania, EU) and TikTok Shop (EU + third countries, under Standard Contractual Clauses) for customers who connect those marketplaces, once a pending legal determination on whether they act as sub-processors or as independent recipients of your instructed data is resolved. It is not yet in force and processes nothing under this DPA until it is published and you have had notice.
8. International transfers
We choose EU-resident sub-processors wherever practical. Stripe processes billing data partly in the United States; that transfer is covered by the European Commission's Standard Contractual Clauses. We will update this section if the transfer basis for any sub-processor changes.
9. Security measures
Technical and organisational measures currently in place include: TLS in transit everywhere; encryption of marketplace credentials at rest; per-tenant row-level security in the database, so one workspace's data is not reachable through another's session; hashed passwords, never stored in plain text; role-based access control inside each workspace (viewer, analyst, admin); an append-only audit log of security-relevant actions; and a documented incident process. Secrets management via a dedicated secrets manager, and a formally paged on-call rotation, are in progress (tracked as Ops items in our own build); we will update this section as each lands rather than describe a control before it exists.
10. Your obligations as Controller
You are responsible for having a lawful basis for the Personal Data you instruct us to process (including any data reachable through the marketplace credentials you provide), for the accuracy of your instructions, and for responding to data subject requests where the Service gives you the self-serve means to do so directly.
11. Liability and term
Liability under this DPA is subject to the limitation of liability in our Terms of Service. This DPA terminates automatically when the underlying agreement for the Service ends, subject to Section 6's provisions on deletion or return of data.
12. Governing law
This DPA is governed by the laws of the Netherlands, consistent with our Terms of Service.