Data Processing Agreement

Parties and scope #

This Data Processing Agreement (“DPA”) is concluded between:

• the customer who uses Axcoda under the Terms of Service — the controller; and
• Alexander Tsyrulnikau, trading as Axcoda, ul. Wołyńska 144 lok. 26, 15-208 Białystok, Poland, NIP 7011109425 — the processor.

It applies to the personal data that Axcoda processes on the customer’s behalf when providing Axcoda Guard and the Axcoda platform, described in Annex II. It does not apply to data for which Axcoda is itself the controller (for example dashboard sign-in data), which is covered by the Privacy Policy.

This DPA is an agreement entrusting the processing of personal data within the meaning of Art. 28 GDPR (in Polish: umowa powierzenia przetwarzania danych osobowych).

How the DPA is concluded #

The DPA is concluded electronically when the customer accepts the Terms of Service and this DPA during sign-up or when a new version is accepted. We record the version and the time of acceptance. Art. 28(9) GDPR allows such an agreement to be in electronic form. The DPA lasts as long as the Terms of Service and ends with them, subject to the deletion and return section.

Standard Contractual Clauses #

The Standard Contractual Clauses between controllers and processors set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (the “Clauses”) are incorporated into this DPA, with the following choices:

• Clause 5 (docking clause) — does not apply; new customers join by accepting the Terms.
• Clause 7.7 — Option 2: general written authorisation. The processor informs the controller of intended changes to the list of subprocessors at least 14 days in advance.
• Clause 9 — the processor notifies the controller of a personal data breach without undue delay and in any case within 48 hours after becoming aware of it.
• Annexes I–IV of the Clauses are completed by the annexes of this DPA below.

If anything in this DPA or the Terms conflicts with the Clauses, the Clauses prevail. The sections below explain in plain language how we apply them.

What we promise as your processor #

These obligations implement Art. 28(3) GDPR:

1. Only on your instructions. We process the data only to provide the service as described in the Terms, the settings you choose in the dashboard and your written instructions — including for transfers outside the EEA — unless EU or Polish law requires otherwise; in that case we tell you first, unless the law forbids it. We tell you if we think an instruction breaks the law. (Art. 28(3)(a))
2. Confidentiality. Everyone authorised to process the data is bound by confidentiality. (Art. 28(3)(b))
3. Security. We apply the technical and organisational measures in Annex III. (Art. 28(3)(c), Art. 32)
4. Subprocessors. We use subprocessors only as described in the Subprocessors section, under contracts with the same data protection obligations, and remain liable for them. (Art. 28(2), 28(3)(d), 28(4))
5. Helping with data subject requests. The dashboard lets you find and delete the data stored for an order; its status history and sent messages expire after 90 days. If a buyer contacts us directly, we forward the request to you without answering it ourselves. (Art. 28(3)(e))
6. Helping you meet your obligations under Art. 32–36 GDPR — security, breach notification, impact assessments and prior consultation — taking into account the information available to us. (Art. 28(3)(f))
7. Deletion or return at the end. See End of the contract. (Art. 28(3)(g))
8. Information and audits. We make available the information needed to show compliance with Art. 28 GDPR and allow audits. See Audits. (Art. 28(3)(h))

Subprocessors #

By accepting this DPA you allow us, in general, to use subprocessors. Who they are is shown on the Subprocessors page, which is Annex IV of this DPA.

• We email the account owner at least 14 days before a new or replacement subprocessor starts processing the data.
• You may object on reasonable data-protection grounds by writing to [email protected] within that period. We will then try to find a solution, for example not to use that subprocessor for your data. If we cannot, you may terminate the contract with effect before the change, and we refund any prepaid fees for the unused period.
• Telegram and browser push services only process your data if you add a recipient using that channel. By adding such a recipient you instruct us to send alerts through that channel.

Personal data breaches #

If we learn of a personal data breach that affects your data, we email the account owner without undue delay — at the latest 48 hours after we learn of it. In that email we tell you what we know at that point: what happened, which kinds of data and roughly how many people and records are affected, what this may lead to, what we have done or propose to do, and whom to contact. Anything we find out later follows in further emails, in Art. 33(3) GDPR terms. You decide whether to notify the supervisory authority and the data subjects; we help you with the information we have.

Audits #

We answer reasonable written questions about our data protection measures and provide the documents in Annex III. If that is not enough to show compliance, you or an independent auditor bound by confidentiality may carry out an audit, no more than once a year (unless a breach or a supervisory authority requires it), with at least 30 days’ notice, during business hours and without access to other customers’ data. Each party bears its own costs of the audit.

End of the contract #

When the contract ends or you delete your account, we delete the personal data processed on your behalf, as described in the Privacy Policy: shop data is deleted after the 30-day period in which you can restore the account. At your choice, we return the data before deletion: you can export it as JSON from the dashboard before you close the account, or ask us at [email protected] to send it to you within the 30-day restore period. Copies disappear from backups when the backups rotate, within 30 days. We keep only the limited records listed in the Privacy Policy, for the periods given there, and data that EU or Polish law requires us to keep.

Changes to this DPA #

Changes to the list of subprocessors follow the Subprocessors section. Any other change to this DPA is sent to the account owner and takes effect for your account only after you accept it in the dashboard; until then the previous version applies. If you do not accept a change required by law, either party may terminate the contract.

Liability #

Liability under this DPA follows the Terms of Service, without limiting the rights of data subjects under Art. 82 GDPR.

Annex I — List of parties #

• Controller: the customer identified by the account details given at sign-up (name, address, tax number), represented by the account owner. Contact: the account owner’s email address.
• Processor: Alexander Tsyrulnikau, trading as Axcoda, ul. Wołyńska 144 lok. 26, 15-208 Białystok, Poland, NIP 7011109425. Contact: [email protected].

Annex II — Description of the processing #

Categories of data subjects

• Buyers of the controller’s TikTok Shop.
• The controller’s staff and other people the controller adds as notification recipients (their Telegram accounts, email addresses or devices).

Categories of personal data

• Order, package, return and cancellation identifiers; statuses and status history; deadlines; amounts and currency; the first product of an order (ID and name) and the number of items; tracking number and carrier; return and cancellation reasons (codes and texts) as provided by TikTok; the fact that a buyer is waiting for a reply in chat and for how long.
• Shop identifiers, shop name and region; product, SKU and stock data; shop health metrics.
• Recipients: Telegram chat ID and name, email address or browser push subscription, language, time zone, quiet hours; the Telegram name of a person who taps a button.
• Not stored: buyer names, addresses, phone numbers, email addresses and chat message texts. They may be contained in data received from TikTok, but are removed when it is received and are never saved (see Annex III, data minimisation).

Sensitive data: none. The service is not designed to process special categories of data (Art. 9 GDPR) or data about criminal convictions.

Nature of the processing: collection from the TikTok Shop API and TikTok webhooks on the controller’s authorisation; filtering; storage; calculation of deadlines, alerts, digests and shop-health metrics; transmission of alerts to the channels chosen by the controller; deletion.

Purpose: to provide Axcoda Guard — alerts about order deadlines, returns, chats, stock, products and shop health — to the controller.

Duration: for the term of the contract and until deletion under End of the contract. Individual retention periods are listed in the Privacy Policy.

Frequency: continuous.

Annex III — Technical and organisational measures #

• Data minimisation: TikTok webhook events are stored only after the integration service has removed buyer contact fields and chat message texts from them; from every TikTok event and API response, the Guard app saves only an allow-list of fields, which contains no buyer contact data or message texts. Only fields allowed by the selected detail level are sent to notification channels.
• Encryption in transit: HTTPS with HSTS on all public endpoints; TLS with certificate verification between services and databases.
• Encryption at rest: TikTok tokens with AES-256-GCM (envelope encryption, key rotation); recipient addresses and two-factor secrets encrypted at application level. Backups are encrypted.
• Access control: separation of customer data on every request; separate databases and roles per service; internal services not reachable from the internet; outgoing traffic through an allow-list; staff access only with personal accounts, mandatory two-factor authentication, allowed networks, step-up authentication and a recorded reason for sensitive actions; access reviewed at least once a year and revoked within 24 hours when someone leaves.
• Logging: tamper-protected audit, sign-in and security logs without buyer data, kept for at least one year.
• Availability and resilience: encrypted backups in the EU, kept for up to 30 days; monitoring of scheduled jobs; deleted accounts are not restored from backups.
• Testing: automated tests that check no personal data markers reach the database, logs or channels; dependency updates.
• Organisation: confidentiality agreements before anyone gets access to customer data; the owner is responsible for security and reviews these measures at least once a year.
• Environments: production data is not copied to development or test environments.

More: Security.

Annex IV — List of subprocessors #

The list published on the Subprocessors page, as updated under this DPA.