Data processing agreement

Last updated 26 October 2026

This data processing agreement ("DPA") forms part of the terms of service between Bullito, trading as ROASaurus, Ceintuurbaan 211, 3051 KC Rotterdam, the Netherlands, Chamber of Commerce (KvK) number 68137303 (the "Processor") and the business that uses ROASaurus (the "Customer", the controller). It applies when the Processor processes personal data on the Customer's behalf and meets the requirements of article 28 of the General Data Protection Regulation (GDPR). Terms such as "personal data", "processing" and "personal data breach" have the meaning given in the GDPR. "End Customers" are the visitors and customers of the Customer's online stores.

1. Subject and duration

• Subject and purpose: tracking visits and orders in the Customer's stores, matching orders to ad clicks, sending conversion events to the platforms the Customer connects, and providing analytics.
• Nature: collection, storage, matching, hashing, analysis, transmission and deletion.
• Data subjects: End Customers.
• Personal data: online identifiers (visitor id, cookie values, ad click ids, IP address, user agent), browsing and checkout events, order data (order id, products, amounts) and contact data from orders (name, email address, phone number, addresses).
• Special categories: none. The Customer does not send them.
• Duration: as long as the Processor processes personal data for the Customer.

2. Instructions

The Processor processes personal data only on the Customer's documented instructions. The terms, this DPA and the settings the Customer chooses in the dashboard, including which platforms to send data to, are those instructions. The Processor tells the Customer if it believes an instruction breaks data protection law, and only processes otherwise when EU or Dutch law requires it, after telling the Customer unless that law forbids it.

3. Confidentiality and security

Everyone at the Processor with access to the personal data is bound to confidentiality. The Processor takes the technical and organisational measures in annex 1 and may improve them, as long as the level of security does not go down.

4. Sub-processors

The Customer gives general permission for the sub-processors in annex 2. The Processor emails the Customer at least 30 days before adding or replacing one. The Customer can object on reasonable data protection grounds within that period; if the parties find no solution, the Customer can end the agreement before the change applies. The Processor binds each sub-processor to the same data protection obligations as this DPA and remains responsible for them.

Ad, analytics, affiliate, email and store platforms that the Customer connects (such as Meta, TikTok, Google, Awin, Segment, Klaviyo and Shopify) are not sub-processors. Data reaches them on the Customer's instruction, under the Customer's own agreement with each platform.

5. Transfers outside the EEA

The Processor stores the personal data in the European Economic Area. Transfers outside it happen only with a sub-processor in annex 2 and only with appropriate safeguards: an adequacy decision, such as the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses.

6. Assistance

The Processor helps the Customer, as far as reasonably possible, to answer requests from data subjects exercising their rights, and with data protection impact assessments and prior consultations. Requests that reach the Processor directly are forwarded to the Customer. Shopify's customer and shop deletion requests are carried out automatically.

7. Personal data breaches

The Processor notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach that affects the Customer's data. The notice describes what happened, the data and data subjects concerned, the likely consequences and the measures taken, and is updated as more becomes known.

8. Deletion at the end

When the agreement ends, or when the Customer removes a store, the Processor deletes the personal data concerned within 30 days, unless the law requires it to be kept. Backups are overwritten within 14 days after that.

9. Audits

The Processor gives the Customer the information needed to show compliance with this DPA. If that is not enough, the Customer may have an audit carried out once a year, by an independent auditor bound to confidentiality, with 30 days' notice and at the Customer's own cost.

10. Customer obligations

The Customer is responsible for having a legal basis for the processing, for informing End Customers and asking for consent where required, and for the lawfulness of its instructions.

11. Liability and precedence

The limitation of liability in the terms of service applies to this DPA. If this DPA and the terms conflict about personal data, this DPA prevails.

Annex 1: Technical and organisational measures

• Hosting in a professional data centre in Amsterdam, the Netherlands.
• TLS encryption for all traffic to and from the service.
• Ad platform access tokens encrypted at rest with AES-256-GCM; passwords hashed with scrypt.
• Emails, phone numbers, names and addresses hashed with SHA-256 before they are sent to ad platforms.
• Respect for visitor consent signals, unless the Customer switches this off: for visitors who declined marketing cookies, no visitor id is set and no click ids or campaign tags are stored from their browsing; their browser events are kept without a visitor id, IP address or user agent and are not sent to ad platforms. Paid orders are still sent server-side to the ad platforms the Customer connects, with the order's customer details hashed and the IP address and user agent recorded with the order. On Shopify, the order's landing page address is part of the order data and is used only in the Customer's reports.
• The database is not reachable from the internet; the server firewall only allows HTTPS, HTTP (redirected to HTTPS) and SSH.
• Server access only through SSH keys, with password logins disabled and repeated failed logins blocked; automatic security updates.
• Strict separation of each customer's data in the application; access to the dashboard only with a personal account.
• Nightly database backups, kept for 14 days.

Annex 2: Sub-processors