Data Processing Agreement

This Data Processing Agreement ("DPA") is between admorris GmbH as provider and the business customer identified in an accepted HYPRCART Order ("Customer"). It forms part of the B2B Terms of Service and any Order that references or incorporates those Terms.

This DPA becomes binding automatically, without a separate signature, when HYPRCART accepts a subscription or other Order for which the Customer has accepted the Terms. It applies to Customer Personal Data from the first processing operation and remains in effect for as long as HYPRCART processes that data on the Customer's behalf.

The Customer's electronic acceptance during subscription checkout or acceptance of a signed Order incorporates this DPA. If the parties sign a negotiated DPA, that signed document prevails for its subject matter.

"Customer Personal Data", "controller", "processor", "data subject", "processing", "personal data breach" and "supervisory authority" have the meanings in the GDPR. "Data Protection Law" means the GDPR and applicable national data-protection law.

The Customer is controller or processor, as applicable, for Customer Personal Data. admorris GmbH is the Customer's processor or subprocessor.

Each party is an independent controller only for activities whose purposes and means it determines itself, such as its own business-contact, account-administration, billing and legal-compliance records. Merchant buyer data processed for instructed hosting, security, communications or analytics remains within this DPA.

We will process Customer Personal Data only on documented Customer instructions, including the Terms, Order, Customer configuration, authorised API calls, support requests and lawful use of service functions, unless EU or Member State law requires other processing. Where lawful, we will notify the Customer before legally required processing.

We will promptly inform the Customer if, in our opinion, an instruction infringes Data Protection Law and may suspend the affected instruction while the parties resolve it. We do not determine whether Customer instructions, notices or legal bases are sufficient and the Customer remains responsible for them.

Personnel authorised to process Customer Personal Data are bound by confidentiality and receive access only as needed. We maintain technical and organisational measures appropriate to the risk under GDPR Article 32. The current measures are described in Annex 2 below.

The Customer is responsible for secure configuration, user permissions, credentials, endpoints, integrations, lawful data minimisation and its own systems. The Customer will not submit special-category data, criminal-conviction data, government identity documents, health data or payment-card authentication data unless the Order expressly supports it and the parties agree any required additional safeguards.

The Customer gives general written authorisation for the subprocessors on the current Subprocessor List. We impose data-protection obligations that provide materially the same protection required by this DPA and remain responsible for a subprocessor's performance to the extent required by law.

We will notify the Customer's account contact in writing at least 30 days before adding or replacing a subprocessor that will process Customer Personal Data. The notice identifies the provider, processing purpose, data categories, locations and applicable transfer safeguards. Updating a web page alone does not replace that notification. The Customer may object within 15 days on reasonable, documented data-protection grounds. We will resolve the objection before the proposed processing starts; if no reasonable alternative is available, either party may terminate the affected service without penalty and unused prepaid affected-service fees will be refunded. An urgent replacement requires prior specific written authorisation if the normal notice and objection process cannot be followed.

We will keep available the identity, address and privacy contact of the relevant subprocessors and further subprocessors, with their processing activities and locations, and provide the information needed for the Customer's Article 28 assessment. Vendor documents do not replace our responsibility for the processing chain.

Taking account of the nature of processing and information available to us, we will assist the Customer with appropriate technical and organisational measures for data-subject requests and with GDPR Articles 32–36 obligations, including security, breach assessment, data protection impact assessments and prior consultation.

We will promptly forward requests concerning Customer Personal Data to the Customer and provide assistance in time for its applicable statutory deadline. We will not independently disclose, erase or otherwise act on that data outside the Customer's instructions unless law requires it. Agreed assistance charges must not prevent compliance with mandatory data-subject rights.

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We do not wait for a completed investigation or final confirmation of every detail. The notice includes information then available about the nature of the breach, affected data and individuals, likely consequences, mitigation and a contact point. Missing details are supplied in phases without undue further delay.

Notification is not an admission of fault. The Customer is responsible for regulator and data-subject notifications unless law assigns that duty to us. We will take reasonable steps to contain, investigate, remediate and document the incident.

admorris GmbH is established in Austria. This DPA does not, by itself, create a restricted transfer between an EEA Customer and admorris GmbH or identify the parties as an overseas data exporter and importer. Before making a restricted transfer to a subprocessor or other recipient on the Customer's behalf, we will ensure an applicable Chapter V GDPR mechanism covers the actual transfer, recipient and processing activity.

Where EU Standard Contractual Clauses under Decision (EU) 2021/914 are required, the relevant exporter and importer must enter the applicable module, complete its party, processing, security and subprocessor annexes and select the competent authority, law and courts as the clauses require. For our onward processor-to-processor transfers this will normally be Module Three. We assess transfer risks, adopt supplementary measures where necessary and make relevant safeguard information available to the Customer. An adequacy mechanism, including the EU–US Data Privacy Framework, may be used only for a recipient and activity within its current scope. Applicable SCCs prevail over conflicting contractual terms.

During the service term, the Customer may retrieve Customer Data through available export tools, APIs or a support-assisted export. Following termination, we will make exportable data available for at least the agreed or legally required retrieval period, normally at least 30 days where the EU Data Act applies.

At the Customer's choice, and subject to mandatory retention, we will delete or return Customer Personal Data after service completion and delete remaining copies. Data may remain inaccessible in encrypted or access-restricted backups until normal overwrite cycles complete. During that period this DPA continues to protect it. We may retain minimal records necessary to demonstrate compliance, resolve claims and meet legal duties.

The instruction applies to relevant live systems, analytics facts, subject-linked rollups, archives, search projections, exports and subprocessor copies, not only the primary database. Mandatory retention is limited to the data and period actually required by law; we identify that exception to the Customer. Retained backups are restricted to recovery, expire under the applicable schedule, and must not restore erased data to ordinary use without reapplying the deletion or restriction. We provide applicable deletion and backup-expiry information on request.

We will make available information necessary to demonstrate compliance and allow for and contribute to audits, including inspections by the Customer or an auditor it mandates. Routine audits may normally be coordinated once per 12 months on 30 days' notice; additional or urgent audits remain available where reasonably necessary to verify compliance, investigate an incident or meet a supervisory-authority requirement.

The parties will use proportionate arrangements to protect other customers' data, confidential information and system security without preventing a meaningful audit. An external auditor must be suitably qualified and bound by confidentiality. Any agreed extraordinary assistance costs must not frustrate mandatory audit rights. Supervisory-authority powers remain unaffected.

The Terms' liability allocation applies to this DPA to the maximum extent lawful. It does not limit liability to data subjects or authorities where such limitation is prohibited. This DPA ends when we no longer process Customer Personal Data, except that confidentiality, deletion, audit and transfer protections survive as needed.

This DPA prevails over the Terms for data-processing subject matter. The SCCs prevail over this DPA for a covered transfer. Austrian law and the venue stated in the Terms apply without restricting data-subject or supervisory-authority rights.

Subject matter and purpose

Providing, securing, supporting and terminating the ordered HYPRCART commerce platform, including storefronts, administration, communications, integrations, APIs, search, hosting and Customer-instructed analytics and reporting.

Duration

The service term plus the agreed export, deletion and backup-overwrite periods.

Nature of processing

Collection, receipt, organisation, structuring, storage, hosting, adaptation, retrieval, consultation, use, transmission, indexing, rendering, backup, support, restriction, export and deletion on Customer instructions.

Data subjects

Customer staff, contractors and contacts; Customer buyers and prospective buyers; account holders; recipients; suppliers; reviewers and question authors; app developers and other individuals whose data the Customer submits.

Personal data

Identity and contact data; account, role and authentication data; addresses; customer profiles and groups; cart, order, fulfilment, refund and commerce records; product reviews and questions; communication and consent records; device and security data; integration identifiers; Customer-defined fields; and instructed analytics events, pseudonymous visitor/session references and subject-linked reporting or export records.

Sensitive data

Not intended by default. Incidental data may appear in free text. Supported payment processing uses payment providers so HYPRCART does not store raw card data.

Frequency

Continuous or as initiated by Customer users, storefront visitors, integrations and automated Customer configurations during the service term.

Controller instructions

The Terms, Order, service configuration, authorised actions, API calls, imports and support instructions.

• Access control: authenticated accounts, organisation and role scoping, least-privilege administrative access, separate operator controls and optional/mapped multi-factor safeguards.
• Encryption and transport: TLS for data in transit; provider-managed encryption at rest for primary cloud storage and databases; secrets kept outside application source.
• Tenant separation: organisation-scoped database and application access controls, buyer-safe API boundaries and separation of public projections from authoritative private data.
• Availability and resilience: managed cloud infrastructure, backups, recovery controls, cache/projection rebuild paths, queue retry handling and bounded failure isolation.
• Secure development: version control, review and automated type/test/build checks, dependency management, environment separation, controlled deployment and rollback procedures.
• Logging and monitoring: access, security, operational and audit signals with purpose-based retention, redaction controls and incident investigation procedures.
• Data minimisation: scoped service contracts, limited public projections, customer-controlled fields and permissions, tokenised/provider-hosted payment functions and bounded diagnostic payloads.
• Incident management: triage, containment, remediation, evidence preservation, recovery and Customer notification procedures.
• Personnel and vendors: confidentiality obligations, need-to-know access, provider due diligence, contractual data-protection obligations and maintained subprocessor records.
• Deletion: account/service deletion workflows, export and transition process, retention controls and eventual backup overwrite.

Measures may evolve with technology and risk, provided the overall protection is not materially reduced during the service term.