1 Introduction

This Data Processing Agreement ("DPA") supplements the Ecomas Terms of Service and applies where Ecomas processes personal data on behalf of the customer. This DPA reflects the parties' agreement with regard to the processing of personal data in accordance with applicable data protection laws.

2 Definitions

• Controller: The entity that determines the purposes and means of processing personal data (the customer).
• Processor: The entity that processes personal data on behalf of the controller (Ecomas).
Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• Data Subject: The identified or identifiable natural person to whom personal data relates.
• Sub-Processor: A third-party processor engaged by Ecomas to process personal data.

3 Roles and Responsibilities

• The customer acts as the data controller and determines the purposes and means of data processing.
• Ecomas acts as the data processor and processes personal data only on documented instructions from the controller.
• Ecomas shall not process personal data for any purpose other than providing the agreed service.
• Both parties shall comply with their respective obligations under applicable data protection laws.

4 Scope of Processing

• Subject matter: Processing of personal data through the Ecomas SaaS platform.
• Duration: For the duration of the service agreement.
• Nature and purpose: Providing ecommerce support workflows, AI chat, customer conversations, integrations, and related platform features.
• Types of data: Account data, commerce records, conversation data, customer profiles, order information, and technical data.
• Categories of data subjects: Customers, end customers, support agents, and platform users.

5 Controller Obligations

• Ensure it has a lawful basis for processing personal data and has provided appropriate notices to data subjects.
• Provide documented instructions to Ecomas for data processing activities.
• Ensure that the processing instructions comply with applicable data protection laws.
• Respond to data subject requests and cooperate with supervisory authorities as required.

6 Ecomas Obligations as Processor

• Process personal data only on documented instructions from the controller, unless required by law.
• Ensure that persons authorized to process personal data have committed to confidentiality.
• Implement appropriate technical and organizational security measures.
• Assist the controller in responding to data subject rights requests.
• Delete or return all personal data at the end of the service relationship.
• Make available all information necessary to demonstrate compliance and allow for audits.

7 Sub-Processors

• The controller provides general authorization for Ecomas to engage sub-processors for platform operations.
• Ecomas shall maintain a list of sub-processors and notify the controller of any changes with reasonable advance notice.
• The controller may object to the engagement of a new sub-processor within a reasonable timeframe.
• Ecomas shall impose data protection obligations on sub-processors that are no less protective than this DPA.

8 International Data Transfers

• Personal data may be transferred to and processed in countries outside the European Economic Area.
• Transfers shall be made subject to appropriate safeguards, including Standard Contractual Clauses where required.
• Ecomas shall ensure that any international transfer complies with applicable data protection laws.

9 Security Measures

• Encryption of personal data in transit and at rest using industry-standard protocols.
• Access controls, authentication mechanisms, and least-privilege principles for data access.
• Regular security assessments, vulnerability scanning, and penetration testing.
• Logging and monitoring of access to personal data and platform systems.
• Business continuity and disaster recovery procedures.

10 Data Breach Notification

• Ecomas shall notify the controller of a personal data breach without undue delay after becoming aware.
• Notification shall include the nature of the breach, categories and approximate number of data subjects, likely consequences, and measures taken.
• Ecomas shall cooperate with the controller in investigating and mitigating the breach.
• Ecomas shall document all breaches and maintain a breach register.

11 Data Subject Rights

• Ecomas shall assist the controller in fulfilling data subject rights requests (access, rectification, erasure, restriction, portability, objection).
• Ecomas shall forward any data subject requests received directly to the controller without undue delay.
• Ecomas shall implement technical measures to support the controller in responding to requests efficiently.

12 Audit Rights

• The controller has the right to audit Ecomas's compliance with this DPA, subject to reasonable notice.
• Ecomas shall make available all information necessary to demonstrate compliance.
• Audits may be conducted by the controller or an independent third-party auditor approved by both parties.
• Ecomas shall promptly inform the controller if an instruction is considered to infringe applicable data protection law.

13 Data Retention and Deletion

• Ecomas shall retain personal data only for as long as necessary to provide the service and fulfill the purposes of processing.
• Upon termination of the service, Ecomas shall delete or return all personal data at the controller's choice, unless retention is required by law.
• Ecomas shall certify the deletion of personal data upon the controller's request.

14 Term and Termination

This DPA shall remain in effect for the duration of the service agreement. It shall automatically terminate when Ecomas ceases to process personal data on behalf of the controller. Provisions relating to confidentiality, data retention, and audit rights survive termination.

15 Contact Us

For questions about this Data Processing Agreement or to exercise your data rights, please contact us: