Article 28 GDPR · Data Processor Agreement · Standard Contractual Clauses (SCC)
Article 1 — Nature of Processing & Roles of the Parties
This Data Processing Addendum ("DPA") applies automatically to the processing of personal data related to end-customers of the Merchant's e-commerce storefront. In this context:
- Merchant / Client: Acts as the Data Controller under GDPR.
- SHARPEFY LTD (Hivendly): Acts as the Data Processor providing hosting, software infrastructure, and database operations.
Article 2 — Obligations of the Data Processor
SHARPEFY LTD strictly undertakes to:
- Process customer data solely upon the documented instructions of the Merchant.
- Ensure all personnel authorized to access customer records maintain confidentiality agreements.
- Implement state-of-the-art technical security measures: end-to-end TLS encryption, AES-256 database storage encryption, daily redundant backups, and segregated tenant database architecture.
- Notify the Merchant without undue delay, and at latest within 48 hours, upon confirmation of any security incident or data breach impacting storefront data.
- Assist the Merchant in fulfilling customer GDPR access or erasure requests.
- Securely return or purge all customer database records within 60 days of SaaS contract termination.
Article 3 — Authorized Sub-processors
The Merchant grants general authorization for SHARPEFY LTD to engage accredited infrastructure sub-processors: Amazon Web Services EMEA SARL (Cloud Hosting), Cloudflare, Inc. (CDN & Edge Security), and Stripe Payments Europe Ltd (Payment processing infrastructure).
