Data Processing Agreement (DPA)

1. The parties

This agreement is concluded between:

• The controller: the eshop operator, that is the customer who uses the Behio platform to run their own store. The controller determines the purposes and means of processing their end customers' personal data.
• The processor: BEHIO LLC, EIN 37-2251362, a limited liability company organized under the laws of the State of Wyoming, USA, registered office 30 N Gould St, Suite 66310, Sheridan, WY 82801, United States, operator of the Behio platform.

The processor processes personal data on behalf of the controller solely to provide the Behio platform services and to the extent described below.

2. Subject matter and duration

The subject matter is the provision of the Behio e-commerce platform: running the eshop, managing the catalog, orders, customers, invoicing, inventory and related features the controller uses within the service.

Processing takes place for the duration of the service agreement between the controller and the processor, that is for as long as the controller uses the Behio platform.

3. Nature and purpose of processing

The processor processes personal data only to enable the controller to run the eshop and use the platform's features. The nature of processing includes in particular collection, storage, organization, access, modification, transfer to authorized sub-processors and erasure of data.

The processor does not use personal data for its own purposes and does not pass it on beyond this agreement and the list of sub-processors.

4. Categories of data subjects and personal data

Categories of data subjects

• The controller's eshop end customers.
• Contact persons and buyers within the controller's B2B relationships.
• Users of accounts the controller creates in the platform.

Categories of personal data

• Identification data: first name, surname, company name, company ID and VAT ID.
• Contact data: e-mail, phone, delivery and billing address.
• Order data: order contents, purchase history, order-related communication.
• Payment metadata: payment status, transaction identifiers and payment method (card details themselves are processed by certified payment gateways, not by Behio).

The processor does not process special categories of personal data unless the controller enters them into the platform as part of the eshop content.

5. Obligations of the processor

The processor undertakes in particular to:

• Process personal data only on documented instructions from the controller, including instructions on transfers to a third country, unless required to do otherwise by EU or Member State law.
• Ensure that persons authorized to process the personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement technical and organizational measures to secure processing under Article 32 GDPR (see section 7).
• Engage further sub-processors only under the conditions in section 6 and bind them to the same level of protection.
• Assist the controller by appropriate measures in fulfilling its obligation to respond to data subjects' requests to exercise their rights.
• Assist the controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, impact assessment), taking into account the nature of processing and available information.
• Notify the controller without undue delay of any personal data breach after becoming aware of it.
• On termination of the service, at the controller's choice, erase or return all personal data and delete existing copies, unless a legal obligation requires storage.
• Make available to the controller the information needed to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits or inspections conducted by the controller or an auditor mandated by it, to a reasonable extent and by prior arrangement.

6. Sub-processors

The controller grants the processor a general authorization to engage sub-processors necessary to operate the platform (hosting, content delivery and file storage, sign-in, e-mail delivery and AI features). Payment gateways, carriers, comparison sites and other services the controller connects with its own account are not the processor's sub-processors; the controller contracts with them directly and the processor passes data to them on the controller's instruction.

The current list of sub-processors, with the purpose, processing location and transfer safeguard of each, is published at behio.com/subprocessors and forms an annex to this agreement.

Notice of changes and objection

• The processor notifies the controller by e-mail to the account owner's address at least 30 days before adding or replacing a sub-processor, and updates the list at behio.com/subprocessors at the same time.
• Within that period the controller may raise a reasoned objection at [email protected]. The parties will try to find a solution, for example processing the affected data without the new sub-processor.
• If the parties cannot agree, the controller may terminate the affected service before the change takes effect, without penalty. The processor refunds the proportionate part of the subscription for the unused period.
• If a replacement is needed immediately for security or service continuity reasons, the processor notifies it without undue delay and the controller has the same right to object.

The processor binds each sub-processor by contract to the same level of personal data protection as follows from this agreement and remains fully liable to the controller for the sub-processor's performance.

7. Technical and organizational measures

Taking into account the state of the art and the nature of processing, the processor implements in particular the following measures under Article 32 GDPR:

• Transport encryption: all communication runs exclusively over the TLS protocol.
• Encryption of sensitive data: access keys and credentials to integrations are encrypted at the application level with AES-256-GCM.
• Data isolation: every query is strictly bound to the controller's organization, access is governed by roles and permissions.
• Dedicated EU infrastructure: the application runs on our own dedicated servers in Germany, file storage is under EU jurisdiction, and traffic is protected by Cloudflare infrastructure.
• Backups: regular data backups to restore availability and access to data in case of an incident.
• Access management: only authorized persons bound by confidentiality have access to production data, to the extent necessary to run the service.
• Authentication: accounts are protected by Firebase Authentication, and sessions are bound to the individual sign-in and never shared between users.
• Logging and monitoring: we keep a security visit log and operational logs for a limited period so that we can detect and investigate abuse.
• Minimisation: we do not process payment card data, certified payment gateways do. Visit and conversation records are deleted after the periods set out in the privacy policy.
• Erasure and return: on termination of the service we erase the data or hand it over as an export, on the controller's instruction.

8. Annex: transfers to third countries

The processor is a company based in the United States. It stores personal data on servers in Germany and transfers it to third countries only in accordance with this annex.

Transfers between the controller and the processor

• Where the controller is established in the EEA and personal data is transferred to a third country, the standard contractual clauses under Commission Implementing Decision (EU) 2021/914 form part of this agreement: Module Two (controller to processor) and, where the controller is itself a processor for another controller, Module Three (processor to processor).
• Annex I of the clauses consists of sections 1 to 4 of this agreement (parties, subject matter, nature and purpose, data categories), Annex II of section 7 (technical and organisational measures) and Annex III of the list at behio.com/subprocessors.
• For Clause 9 of the clauses, the general authorisation with 30 days' notice under section 6 applies. The competent supervisory authority under Clause 13 is the authority of the EEA state in which the controller is established. The clauses are governed by the law of the Czech Republic (Clause 17), and disputes arising from them are resolved by the courts of the Czech Republic (Clause 18).
• In the event of a conflict between this agreement and the standard contractual clauses, the clauses prevail.

Transfers to sub-processors

• Sub-processors in the EU: there is no transfer to a third country.
• US sub-processors certified under the EU-US Data Privacy Framework: the transfer relies on the adequacy decision (Commission Implementing Decision (EU) 2023/1795).
• Other sub-processors outside the EEA: the processor concludes the standard contractual clauses, Module Three, with them.
• The safeguard used for each sub-processor is shown in the list at behio.com/subprocessors.

Requests from public authorities

If the processor receives a request from a public authority for access to the controller's personal data, it informs the controller unless the law prohibits it, assesses the lawfulness of the request and discloses only the minimum data necessary. On request, the processor provides the controller with the information needed for a transfer impact assessment.

9. Duration and termination

This agreement is effective for the duration of the service agreement and for as long as the processor processes personal data on behalf of the controller.

On termination of the service, the processor handles the personal data according to the controller's instruction, that is erases or returns it, unless a legal obligation requires further storage.

10. Final provisions

This agreement is governed by the law of the Czech Republic and by the GDPR. Matters not covered here are governed by the processor's privacy policy and the service's terms.

This is a template. We will issue a signed data processing agreement on request at [email protected] or via the contact form.