Data Processing Agreement

Version 2026-10-21 · Processor: Razvan Toma (Dragos Razvan Toma), trading as EPR EU Rep, Calle Fernando Vizcaíno Casas 14, 28023 Madrid, Spain · VAT ES Y4319918A · hello@epreurep.com

This agreement applies when you (the merchant) connect an online shop or marketplace account to the EPR EU Rep client portal, or upload a sales file there: Shopify (through our app "EPR Autopilot: EU Packaging"), WooCommerce, Amazon or a spreadsheet. It forms part of our Terms and of the mandate you signed with us, and you accept it when you connect a shop or upload a file. Article 28 of the EU General Data Protection Regulation (GDPR) applies.

1. Definitions

Personal data, processing, controller, processor, sub-processor and personal data breach have the meaning given in Article 4 GDPR. Order data means the data about your orders that your shop or marketplace makes available to us through the connection. Counts means the number of units shipped per product, per month and per delivery country, and the number of orders per delivery country.

2. Roles

You are the controller of the personal data of your customers. We process it as your processor, only to provide the service described in section 3, and only on your documented instructions, which are this agreement, our Terms and your mandate. If we think an instruction breaks data protection law, we tell you.

3. Scope and purpose

Item	What it is
Purpose	Working out the packaging and products you placed on each country's market, so that we can prepare and file your extended producer responsibility (EPR) declarations and registrations.
Data we read	Per order: date, status, products and quantities (SKU, name, product ID), and the country of the shipping address (the billing country if there is no shipping address). We do not request your customers' names, emails, phone numbers, street addresses or postcodes.
Data we keep	Only the counts. Orders are read in memory and not stored; no data that identifies a customer is kept.
Data subjects	Your customers who placed the orders.
Duration	As long as the connection is active, plus the retention in section 7.

We do not use the data for any other purpose, do not sell or share it for advertising, do not combine it with other merchants' data, and do not make automated decisions about your customers.

4. Confidentiality and security

Only the owner of EPR EU Rep has access to connection data; no other staff or contractors do. Access is protected by strong passwords and two-factor authentication.
Access tokens for your shop are encrypted (AES-256-GCM) with a key held as a server secret, and are never shown in any page or file. All data is encrypted in transit (HTTPS/TLS) and stored encrypted at rest by our hosting provider.
Connections, reads, synchronisations and disconnections are logged with the time and the account concerned, and the log is reviewed regularly.
We keep a written security incident response plan with roles, severity, escalation, evidence collection and notification steps, reviewed every six months.

5. Sub-processors

You authorise these sub-processors: Cloudflare, Inc. (hosting of the portal and connection services, data storage). We tell you by email at least 30 days before adding or replacing a sub-processor that handles order data, and you may object by disconnecting your shop. We bind each sub-processor to obligations no less protective than these.

6. Transfers outside the EU

Cloudflare may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework (Cloudflare is certified) and, where needed, the European Commission's standard contractual clauses.

7. Retention and deletion

When you disconnect a shop in the portal, or uninstall our Shopify app, we delete its access token and its counts within 48 hours.
On a Shopify "shop redact" request we delete everything we hold for that shop. Requests about a single customer ("customer redact", "customer data request") concern data we do not hold; we confirm this to you on request.
Figures you have adopted into a declaration we filed for you are kept as part of that declaration, for as long as EPR and commercial law require records to be kept (see our Privacy Policy, section 5).

8. Assistance and breaches

We help you answer requests from your customers and from authorities as far as they concern data we process for you. We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.

9. Audits

On request we give you the information needed to show compliance with this agreement, and allow reasonable audits, at your cost, with 30 days' notice.

10. Law

This agreement is governed by Spanish law and the GDPR. If it conflicts with our Terms on data protection, this agreement prevails.