1. Parties and roles
This Data Processing Agreement ("DPA") is entered into between the merchant registering on Trusteed ("Controller", "you", "the Merchant") and Felix Pumeda Seoane, Tax ID 43692169N, Camino de San Xes 23, San Xes - Lobeira, 32850 Ourense, Spain ("Processor", "Trusteed", "we"). Contact: support@trusteed.xyz.
This DPA is incorporated by reference into clause 9 of the Terms of Service and is accepted the moment you accept those Terms at registration: no separate signature is required. It applies whenever Trusteed processes end-buyer personal data on the Merchant's behalf in the flows described in section 2.
2. Object, duration, and nature of processing
Object: enabling the technical integration between the Merchant's store and third-party AI agents via the MCP protocol and platform connectors, completing the order, and keeping an auditable record of the transaction when the checkout flow involves an end-buyer's data.
Duration: for as long as the relationship lasts under the Terms of Service and, after it ends, for as long as needed to return or delete data under section 10, or as required by law.
Nature: collection, recording, temporary storage, consultation, transmission and, where applicable, erasure of data, depending on the Merchant's configuration and use of the Service.
The Merchant's catalog is synced from whichever platform you use (Shopify, WooCommerce, PrestaShop, Odoo, or Magento), using the credentials you provide and under your instruction. That catalog flow does not access end-buyer personal data; only store name, currency, country, and product listings. Details for each integration live in section 11 of the Privacy Policy.
3. Data categories and data subjects
Data subjects
- The Merchant's end buyers, when the checkout flow requires it.
- The Merchant's own dashboard users (admins, operators).
Data categories
- Buyer identification and contact data (name, email, shipping address), only if the checkout flow requires it.
- Order data (items, quantities, amounts, status).
- Technical and security data: IP, user agent, timestamps, session identifiers, tool-call audit logs.
We do not process card numbers, CVVs, or sensitive payment authentication data. Full detail per processing activity, legal basis, and retention period is in section 14 of the Privacy Policy.
4. The Merchant's instructions
Trusteed processes personal data only on the Merchant's documented instructions, unless required otherwise by law, in which case we will notify you before processing, unless that law prohibits it on important public-interest grounds.
Those instructions are given, at minimum, through your account and store configuration, the MCP tools and buckets you enable, and the platform integrations you connect. If we believe an instruction infringes the GDPR or other data-protection law, we will tell you without undue delay.
5. Confidentiality
We ensure that personnel authorized to process personal data have committed to confidentiality or are under an equivalent statutory obligation.
6. Technical and organizational measures (Art. 32 GDPR)
- Platform credentials encrypted at rest (AES-256-GCM).
- Session tokens stored as hashes, never in the clear.
- Transaction evidence with the buyer's email and address as HMACs: pseudonymization with the key held in a managed HSM (AWS KMS), destroyed after 12 years. Detail in section 14 of the Privacy Policy.
- Log minimization: hashed tool parameters, no PII payloads unless necessary.
- Role-based access control and privilege separation.
- Rate limiting on critical endpoints, including authentication.
- No storage of payment card data whatsoever.
6a. Sub-processors
You authorize the use of sub-processors necessary to operate the Service. The current list, with per-entry access scope and transfer mechanism (including what we explicitly do NOT use), is maintained in section 15 of the Privacy Policy, which is the single source: if we engage a new sub-processor, it appears there before it processes any of your data. We don't duplicate it here to avoid keeping two lists that could drift apart.
We impose on every sub-processor data-protection obligations equivalent to this DPA. If a sub-processor changes materially, we will notify you with reasonable notice and you may object for justified cause; if there is no reasonable alternative, you may terminate the Service.
7. International transfers
When a sub-processor involves a transfer outside the EEA, the mechanism applied (standard contractual clauses, Decision 2021/914; or the EU-U.S. Data Privacy Framework where the provider is certified) is documented next to each entry in section 15. A copy of the standard contractual clauses applied is provided in writing to whoever requests it at support@trusteed.xyz.
8. Assistance to the Merchant
We assist you, taking into account the nature of processing, in responding to your buyers' rights requests (access, rectification, erasure, objection, portability) when you cannot handle them yourself. The Service has a DSAR request flow you can use as an operational mechanism. It does not replace your own responsibility as Controller toward the data subject.
We also assist with data protection impact assessments (DPIAs) when reasonably necessary, with prior consultations with authorities where applicable, and with documentation of our security measures when you need it.
9. Breach notification
We will notify you without undue delay after becoming aware of a security breach affecting personal data processed under this DPA, including the nature of the incident, the categories and approximate volume of data and data subjects affected, measures taken or proposed, and a point of contact. Assessing whether to notify the supervisory authority and/or data subjects, and doing so within GDPR deadlines, is your responsibility as Controller.
10. Return or deletion of data at the end of the Service
At your choice, where technically possible, we will return or delete the personal data processed on your behalf once the Service ends, unless the law requires us to keep it. When you disconnect a store, synced data is removed via hard delete with CASCADE: no soft delete, no leftover records.
Audit and security logs may be kept for a limited period on the basis of a legitimate security interest, minimized and access-restricted, unless you instruct otherwise and it is compatible with our legal obligations.
11. Audits
We make available to you the information necessary to demonstrate compliance with Art. 28 GDPR. You may audit through document review and questionnaires, or through an on-site audit or an independent third party, on reasonable notice, subject to confidentiality and to a scope limitation that does not compromise security or other merchants' data. Audits are limited to a reasonable frequency, absent an incident.
12. Liability
Each party is liable for its own GDPR breaches in its respective role (Controller or Processor). The liability limitations in the Terms of Service do not apply where the law prohibits it.
