Data Processing Addendum

Last updated 13 November 2026

This Data Processing Addendum ("DPA") forms part of the Box to Shelf terms of service between the business that installs Box to Shelf ("Merchant", the controller) and BRAINWAVE S.R.L., CUI 47608048, Trade Register no. J40/2465/2023, registered office [TO CONFIRM: full registered address], Bucharest, Romania ("Processor"). It applies when Box to Shelf processes personal data for the Merchant. It meets Article 28(3) of the EU General Data Protection Regulation ("GDPR") and of the UK GDPR. The Merchant accepts it by installing Box to Shelf. No signature is needed, but on request we will provide a signed copy.

1. Details of the processing

2. Instructions

The Processor processes personal data only on the Merchant's documented instructions. Those instructions are these terms and this DPA, and the Merchant's use of the app's features. The same applies to transfers to a third country. The only exception is where EU or Member State law requires otherwise, in which case the Processor will tell the Merchant first unless that law forbids it. The Processor will tell the Merchant if it believes an instruction breaks data protection law.

3. Restrictions on use

The Processor will not use Merchant data, or any information derived from it, for any purpose other than providing Box to Shelf to the Merchant. In particular, it will not use the data to train, fine-tune or improve any AI or machine-learning model. It will not sell, rent or share the data, and will not combine it with other merchants' data. Where US state privacy laws apply, the Processor acts as a "service provider" or "processor": it will not sell or share personal information, will not retain, use or disclose it outside the direct business relationship with the Merchant, and will comply with those laws and tell the Merchant if it can no longer do so.

4. Confidentiality

Only people who need access to provide or support the service can access Merchant data, and they are bound by confidentiality obligations. Today that is the Processor's administrator only.

5. Security (Article 32)

The Processor maintains at least these measures:

• TLS encryption in transit. Fernet (AES-128 with HMAC-SHA256) encryption at rest for stored documents and Shopify access tokens, with key rotation;
• verification of every Shopify request (session-token signatures, HMAC on webhooks and app loads), and minimal API permissions with no customer or order access;
• a hardened container: non-root user, read-only file system, no added capabilities, memory limits, and network exposure only through the reverse proxy;
• a separate private email-in address per shop, signed delivery from the email gateway, and an optional allow-list of senders;
• automatic deletion of documents after 30 days, and of all shop data on uninstall;
• logs that never contain document contents or tokens;
• a documented incident-response process with a 24-hour notification target;
• hosting in an ISO 27001-certified data centre in Germany.

6. Sub-processors

The Merchant gives general authorisation for the Processor to use the following sub-processors:

The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA, and stays responsible for them. It will announce any new or replacement sub-processor on this page and in the app at least 14 days in advance. The Merchant may object on reasonable data-protection grounds within that period. If we can't resolve the objection, the Merchant may end the terms and receive a refund of any fees paid in advance for the remaining period.

7. Help with data subject requests and compliance

Taking into account the nature of the processing, the Processor will help the Merchant answer requests from data subjects (for example by finding, exporting or deleting a document) and meet its duties under Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation). If a data subject contacts the Processor directly, it will pass the request to the Merchant without undue delay and won't answer it except on the Merchant's instructions. The Processor also handles Shopify's customers/data_request, customers/redact and shop/redact requests.

8. Personal data breaches

The Processor will notify the Merchant of a personal data breach affecting Merchant data without undue delay, and in any case within 24 hours of becoming aware of it. It will give the information required by Article 33(3) as soon as it is available, and keep the Merchant updated. It will also notify Shopify within 24 hours, as Shopify's API Terms require, and will take reasonable steps to contain the breach and reduce its effects. Notification is not an admission of fault.

9. Deletion and return

• Documents, the lines read from them and the review details are deleted 30 days after receipt.
• When the Merchant uninstalls Box to Shelf, all Merchant data is deleted immediately, and deletion is confirmed again on Shopify's shop/redact request. In any case this happens within the 30 days that Shopify's API Terms require.
• Before uninstalling, the Merchant can ask for an export of its data (terms, section 5). Uninstalling is the Merchant's instruction to delete rather than return the data.
• Copies kept by sub-processors are deleted on their own schedules (for Anthropic, within 30 days, subject to its usage-policy exceptions). Backups roll over as described in the privacy policy.

10. Information and audits

The Processor will make available the information needed to show that it complies with Article 28, including this DPA, its records of processing and security documentation. It will answer reasonable written security questionnaires. Where that is not enough, the Merchant (or an independent auditor bound by confidentiality) may audit once a year, with 30 days' notice, during business hours and at the Merchant's cost, in a way that doesn't expose other merchants' data.

11. International transfers

• The Processor is in the EU (Romania), and the data is stored in Germany.
• Transfers to Anthropic in the United States are made under the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, module 3, processor to processor) and the UK International Data Transfer Addendum, as included in Anthropic's Data Processing Addendum. Other sub-processors rely on the EU–US Data Privacy Framework where certified, or on the Standard Contractual Clauses.
• Where the Merchant is outside the EEA and not covered by an adequacy decision, the Standard Contractual Clauses module 4 (processor to controller) apply between the Processor and the Merchant and are incorporated by reference. Clause 17 option: the law of Romania, with the courts of Romania (Clause 18).
• For UK Merchants, the UK is covered by an EU adequacy decision, and the Processor (in the EEA) is covered by the UK's adequacy regulations for the EEA.

12. Liability and precedence

Each party's liability under this DPA is subject to the limits in the terms of service, except where the law doesn't allow it. This DPA prevails over the terms on data protection. Where they apply, the Standard Contractual Clauses prevail over both.

13. Contact

Privacy and security: [email protected]. BRAINWAVE S.R.L., [TO CONFIRM: registered address], Bucharest, Romania.

Terms of service · Privacy policy