CG Shops: Data Processing Agreement

This agreement is between you, the merchant, as controller, and Aspar Software EOOD (CG Shops) as processor under Art. 28 of the General Data Protection Regulation (GDPR). It forms part of the Terms of Service and is accepted together with them.

1. What we process

We host and run your shop, and to do that we process the personal data in it:

• your shoppers’ names, emails, phone numbers, addresses and accounts, and their orders, payment and delivery records;
• the emails your shop sends;
• sessions and logs;
• the AI assistants connected to your shop;
• the data of your admin users;
• the data of your staff and helpers whom you add to the team.

The purpose is to provide the service. We process this data for as long as the contract runs, and until deletion under clause 10. The shop must not hold special categories of data (for example health data) unless we have agreed to that in writing.

2. Your instructions

We process the data only on your documented instructions. Those are the Terms, this agreement, and the way you set up and use your shop, including the services you connect to it.

• If the law obliges us to do something else, we tell you first, unless the law forbids that.
• If we think an instruction breaks data-protection law, we tell you.

3. Confidentiality

Only the few of our operators who need access have it, and they are bound by confidentiality. We use our service accounts in your shop only for these purposes:

• to set up, update and check the shop;
• to help you when you ask;
• to deal with incidents;
• when the law requires it.

We enter your shop admin only when you allow it. We may ask you for access for a set time and with a reason, and you approve or reject it on the page “Support access” in your admin. You can also give access yourself and stop it at any time. Without your permission we enter only for an incident, that is an outage of the shop or a suspected security breach, for at most one hour, and we tell you at once. We enter with a separate “CG Shops support” user, which cannot change passwords, two-factor authentication, admins, payment or bank details, and cannot export data. We record every request, permission, entry, page and change; you see them in your admin and get an email when we enter and leave. We keep the records for 2 years, or longer if they are needed for a dispute or to look into an incident.

4. Security

We apply the measures listed at the end of this agreement and keep them at least at that level.

5. Sub-processors

• You allow us to use the sub-processors marked in the table below.
• We tell you by email at least 30 days before we add or replace one. You can object within 15 days. If we cannot meet your objection, you may end the contract before the change, and we refund your prepaid fees.
• We impose the same data-protection obligations on each sub-processor, and we remain liable to you for them. We keep the list up to date. If you ask, we tell you which processors our sub-processors use in turn.
• Services that you connect yourself (payment providers, couriers, analytics, AI clients) are your own providers, not our sub-processors.

6. Transfers outside the EEA

Your shop’s data is stored in the EU: in Google Cloud in Frankfurt, Germany; its photos and digital files in Cloudflare R2, in the EU; the encrypted backups at Backblaze, in the EU (Amsterdam, Netherlands). Where a sub-processor processes it outside the EEA, we rely on an adequacy decision of the European Commission (for the USA, the EU-US Data Privacy Framework) or on the Commission’s standard contractual clauses.

7. Helping you

• Your admin lets you find, export, correct and erase a shopper’s data.
• If a shopper sends a request to us, we pass it on to you within 5 working days.
• As far as we reasonably can, we help you to answer requests from data subjects, and with security, breach notifications and impact assessments.

8. Breaches

We tell you without undue delay, and at the latest within 48 hours of learning of a breach that affects your shop’s data. We tell you:

• what happened;
• which data and which people are affected;
• the likely consequences;
• what we are doing about it;
• who to contact.

We record every breach, and we help you to notify the КЗЛД and the people affected.

9. Checks

We give you the information you need to show that we meet this agreement, and we allow audits, including inspections, by you or by an independent auditor bound by confidentiality. You give us 30 days’ notice. Audits take place no more than once a year, unless there has been a breach or an authority requires it. Each of us bears its own costs.

10. End of the service: export, then deletion

At your choice, we return your shop’s data or delete it. You can ask for an export (your catalogue, customers, orders and pictures, without passwords or keys) at any stage, until the last day we give you in our warnings, 7 days before the deletion. We make an export only if you ask for one, and we do not delete the shop before you have received it. If we cannot produce it despite trying, we tell you before the deletion, with the reason, and give you what we could produce. We keep an export only so that you can download it, for 30 days at most.

We delete your shop and all its data on the date set by the Terms: if you leave, on the date we give you at least 30 days ahead; if your shop was closed for non-payment and not reopened, 180 days after it was closed. You can ask us in writing to delete it sooner. Backup copies expire within 30 days after the deletion at Google, and within 7 months at Backblaze, where they are encrypted. We keep nothing unless the law requires us to. We confirm the deletion to you in writing.

11. Other terms

The liability limits in the Terms apply, except for intent and gross negligence and as Art. 82 GDPR requires. Bulgarian law applies.

Security measures

• each shop has its own container and database;
• no open ports: traffic arrives only through an encrypted tunnel, over HTTPS;
• the credentials we hold are encrypted, and passwords are stored as bcrypt hashes;
• admins can use two-factor sign-in;
• AI assistants act only after an admin approves them, and risky actions need confirmation;
• database backups are taken nightly, encrypted, in Google Cloud in the EU, and kept for 14 days, with recovery to any point in time within the last 7 days;
• a second nightly backup, of the databases and files, is encrypted on our side, at Backblaze in the EU (Amsterdam, Netherlands), and kept for up to 6 months;
• the service is monitored and alerts us;
• changes go through code review and tests, versions are pinned, and we can roll back;
• few operators, bound by confidentiality.

This is a translation. If the Bulgarian and English texts differ, the Bulgarian text prevails.