Data processing agreement
In force from 5 December 2026. Version 1.0.
Under Art. 28 of Regulation (EU) 2016/679 (GDPR), version 1.0. This agreement forms part of the Portican terms of service and the client accepts it by registering a store. On request we will send the client a signed copy.
Entry into force and changes. This version takes effect 30 days after notice of it is sent to clients by email. For a client who registers later, it takes effect on the date of registration. We notify clients of every further change by email, and it takes effect 30 days after the notice is sent. A client who does not accept a change may terminate the agreement as of the date it takes effect.
1. Parties
Controller: the Portican client who runs the store (the “client”), as identified by the details given on registration.
Processor: Nydrok LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA, EIN 36-5152970. Representative in the EU under Art. 27 GDPR: Matúš Mikčo, Duplín 119, 091 01 Stropkov, Slovak Republic, matus@portican.com.
2. Subject matter, nature and purpose
The processor processes personal data of the client’s customers solely in order to run the client’s Portican store: displaying the store, receiving and handling orders, customer accounts, communication with customers, shipping, documents, backups, support and the assistant in the admin. It processes data only within the scope of the features the client has switched on.
3. Scope
| Data subjects | customers and prospective customers of the client’s store, recipients of shipments, the store’s staff and partners with access to the admin |
|---|---|
| Categories of data | name, contact details, billing and delivery addresses, orders, payment status (without payment card details), correspondence, login and technical data |
| Special categories (Art. 9) | the client does not enter them into the store; if the client needs to process them (for example with a healthcare product range), the client will give notice in advance and the parties will agree on additional measures |
| Duration | for the term of the contract and the periods under clause 11 of the terms of service |
4. Rights and obligations of the client
The client is responsible for the lawfulness of the processing and for the instructions it gives. It has the right to give instructions, to check compliance with this agreement and to object to the engagement of sub-processors under Section 6.
5. Obligations of the processor
The processor:
- processes the data only on documented instructions from the client, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in such a case it informs the client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The instructions are these terms, the store settings and the client’s written instructions. If, in its opinion, an instruction infringes the law, it informs the client immediately;
- binds every person with access to the data to confidentiality;
- takes the technical and organisational measures set out in Annex 1;
- engages sub-processors only in accordance with Section 6;
- assists the client in fulfilling its obligations towards data subjects under Chapter III GDPR (access, rectification, erasure, restriction of processing, portability, objection) through the admin features and the export;
- assists the client with security, notification of personal data breaches, data protection impact assessments and prior consultation;
- notifies the client of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, with the information available to it;
- after the end of the contract, at the client’s choice, deletes the data or returns it to the client by export and then deletes it, including existing copies. The periods are set out in clause 11 of the terms of service: after the contract ends the client has 90 days of access to the admin with the option to export, the data is then kept for a further 90 days without the client’s access, and then deleted. Copies in backups expire no later than 90 days after deletion. Deletion does not apply to data the processor must retain under Union or Member State law, in particular documents and accounting records;
- makes available to the client the information necessary to demonstrate compliance and allows for and contributes to audits, including inspections. An audit may be conducted by the client or by an auditor mandated by the client who is bound by confidentiality. It is carried out first by way of a written questionnaire; the client announces an on-site inspection at least 30 days in advance and bears its cost, unless it reveals a breach.
6. Sub-processors
The client gives general authorisation for the engagement of the sub-processors listed in Annex 2. The processor informs the client by email at least 30 days in advance of any intended addition or replacement of a sub-processor. This also applies to a new provider of the language model for the assistant and of the other tools in the admin. The client may object within 14 days; if the parties do not reach agreement, the client may terminate the contract without penalty as of the date of the change.
Nydrok LLC must have a contract with every sub-processor to which it discloses personal data of the client’s customers, imposing on it the same data protection obligations to the extent of Art. 28(4) GDPR, and remains liable to the client for the sub-processor’s performance. The fal.ai tools listed in Annex 2 are not intended for processing customers’ personal data.
7. Transfers outside the European Union
The stores’ server and database are in the European Union (netcup, Vienna, Austria). Images, private files, exports and backup copies are stored by Cloudflare in its R2 storage (Annex 2). The processor is established in the USA, and the platform administrator also accesses the service remotely from countries outside the EEA (Annex 2). This therefore constitutes a transfer of data to a third country.
- The transfer from the client to the processor is governed by the standard contractual clauses under Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), as an appropriate safeguard under Art. 46(2)(c) GDPR. The client is the data exporter; Nydrok LLC is the data importer and processor. The clauses are incorporated into this agreement by reference, with the following options: Clause 7 (docking clause) applies; Clause 9(a), Option 2 (general authorisation, 30 days’ prior notice); Clause 11 without an independent dispute resolution body; Clause 13: the competent supervisory authority is that of the Member State in which the client is established (Annex I.C); Clause 17, Option 1, the law of the Slovak Republic; Clause 18, the courts of the Slovak Republic. The annexes to the clauses are formed by Sections 1 to 3 and Annexes 1 and 2 of this agreement.
- Transfers to sub-processors outside the EEA are secured by Nydrok LLC through the supplier’s certification under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), standard contractual clauses in the contract with the supplier, or a Commission adequacy decision for the supplier’s country.
- Should the clauses, the framework or the adequacy decision cease to be valid, the processor will without delay move to another instrument under Chapter V GDPR and inform the client.
8. Governing law
This agreement is governed by the law of the Slovak Republic. Disputes are decided by the courts of the Slovak Republic.
Annex 1: Technical and organisational measures
| Area | Measure |
|---|---|
| Location | the stores’ server and database with netcup GmbH in Vienna (Austria); images, private files, exports and backup copies in Cloudflare R2 storage |
| Transmission | encrypted HTTPS connections, protection against attacks via Cloudflare |
| Backups | a backup every night, verified by restoring it into a temporary database; 7 daily and 4 weekly copies on the server; an off-server copy in Cloudflare R2, kept for 90 days |
| Integration secrets | AES-256-GCM encryption, masked in the admin |
| Separation of stores | each store has its own channel and permissions; export and deletion only for that store |
| Access | username and password; two-factor authentication (TOTP with backup codes) mandatory for platform administrators, optional for store staff or required by the store |
| Assistant in the admin | the language model receives a customer’s personal data only after the staff member’s express consent; the consent is logged and applies only to the person who gave it and to the processing location disclosed (inside or outside the EU); at most 20 disclosures in one conversation |
| Deletion | a store is deleted manually by the platform administrator after the periods expire, confirmed by typing the store’s identifier; documents and accounting records are kept for the period required by law |
| Server logs | store access logs for at most 7 days |
| Payment cards | card details are processed only by Stripe; Portican does not hold them |
Annex 2: Sub-processors and countries of access
| Sub-processor | Activity | Place of processing | Transfer instrument |
|---|---|---|---|
| netcup GmbH, Karlsruhe, Germany | server, database, backups on the server | EU, Vienna (Austria) | not required |
| Cloudflare, Inc., USA | website delivery, protection against attacks, R2 storage (images, private files, store exports, backup copies) | worldwide network; R2 storage according to the jurisdiction set for the buckets | Section 7, point 2 |
| Mailgun Technologies, Inc., EU region | sending the stores’ email (default provider) | EU | Section 7, point 2 |
| Amazon Web Services, Inc. (Amazon SES) | fallback email sending when Mailgun is down, or the primary service if the platform administrator switches to it | region as configured, EU (Frankfurt) by default | Section 7, point 2 |
| OpenAI OpCo, LLC, USA | assistant in the admin: conversation with the staff, images and files the staff attach, and, after the staff member’s express consent, the name, email, phone and address of the customer of a specific order; writing and translating content (blog, product pages, catalogue translations); reading product images; podcast voice from text | USA | Section 7, point 2 |
| Features & Labels Inc. (fal.ai), USA | generating and editing product and ad images, podcast voice from text | USA and other countries | the tools are not intended for personal data (see below) |
| OpenStreetMap Foundation (Nominatim service), United Kingdom | converting the address a customer enters in the store into a location when calculating distance-based shipping prices; only if the store sets up this feature | United Kingdom | Commission adequacy decision |
Stripe is not listed here: payments from the store’s customers are received by the merchant through its own Stripe account (the payment is created with the store’s key on the merchant’s account), so Stripe is the merchant’s contractual partner, not a sub-processor of Nydrok LLC. Nydrok LLC uses Stripe only for subscription payments and for commission payouts to partners (Stripe Connect), which does not involve data about the stores’ customers.
OpenAI and fal.ai. They process data only when the store’s staff use the relevant tool. Only the assistant’s language model may receive customers’ personal data, and only after the staff member’s express consent. The assistant first tells the staff member that the data will go to the language model’s server, and whether that server is inside or outside the EU. Only after consent may it send the model the name, email, phone and address of the customer of a specific order. The consent is logged (who consented and when, the processing location, which data and for which order) and applies only to the person who consented and only to the disclosed processing location; if the location changes, the assistant asks again. In one conversation the assistant discloses customer data at most 20 times. The fal.ai tools are intended for product photos and ad images; staff must not enter customer data or photos of people into them.
Countries of remote access by the administrator: the USA (seat of Nydrok LLC) and other countries outside the EEA from which the platform administrator temporarily accesses the service remotely. Nydrok LLC keeps the current list in its record of processing activities and provides it to the client before access begins and on every change. For these countries Nydrok LLC will prepare a written transfer impact assessment under Clause 14.