Data Processing Agreement

1. About this agreement

1. 1.1
   This Data Processing Agreement forms part of the agreement between Checky Pro B.V. ("Checky Pro", "we") and the merchant that uses the Platform ("you"), as set out in article 1.3 of our Terms of Service. You accept it together with the Terms of Service. Capitalised terms have the meaning given to them in the Terms of Service.
2. 1.2
   Where this agreement and the Terms of Service conflict on the processing of personal data, this agreement prevails.
3. 1.3
   In this agreement, "personal data", "processing", "controller", "processor", "sub-processor" and "personal data breach" have the meaning given to them in the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

2. Roles

1. 2.1
   You are the controller, and we are your processor, for the personal data of your Shoppers that we process to provide the Checkout and Payments to you, as described in Annex 1.
2. 2.2
   We process that personal data only on your documented instructions. Your instructions are this agreement, the Terms of Service and the settings you choose in the Dashboard.
3. 2.3
   We are a controller ourselves, and not your processor, where we use Shopper data for our own purposes: preventing fraud and misuse across the Platform, keeping the Platform secure, measuring how the Checkout is used, and complying with legal obligations that apply to us. That processing is described in our Privacy Policy.
4. 2.4
   Our acquiring partners and the Card Schemes are controllers in their own right for the data they receive to provide payment services. They are not our sub-processors.
5. 2.5
   Payment providers that you contract yourself, and integrations that you enable in the Checkout, such as your store platform, email marketing, analytics or advertising tags, receive data on your instruction and under your responsibility. They are not our sub-processors.

3. Our obligations as processor

1. 3.1
   We process the personal data only on your documented instructions, including with regard to transfers to a country outside the European Economic Area, unless the law requires us to process it otherwise. In that case we tell you before processing, unless the law prohibits it.
2. 3.2
   We tell you immediately if, in our opinion, an instruction infringes data protection law.
3. 3.3
   We ensure that everyone who is authorised to process the personal data is bound by confidentiality.
4. 3.4
   We take the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk. We may change these measures, provided the level of security does not decrease.
5. 3.5
   Taking into account the nature of the processing, we help you to respond to requests from Shoppers who exercise their rights. Where a Shopper contacts us directly, we pass the request on to you without undue delay and do not respond to it ourselves, unless you instruct us to.
6. 3.6
   We help you to comply with your obligations on security, personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us.

4. Sub-processors

1. 4.1
   You give us general written authorisation to engage sub-processors. The sub-processors we use are listed in Annex 3.
2. 4.2
   We inform you at least 30 days before we add or replace a sub-processor, by email or in the Dashboard. You may object on reasonable grounds within that period. Where we cannot meet your objection, you may terminate the agreement with effect from the date of the change.
3. 4.3
   We impose on each sub-processor, by contract, the same data protection obligations as in this agreement. We remain fully liable to you for the performance of their obligations.

5. Personal data breaches

1. 5.1
   We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach that concerns your Shopper data.
2. 5.2
   Our notification describes, as far as we know at that moment, the nature of the breach, the categories and approximate number of Shoppers and records concerned, the likely consequences and the measures we have taken or propose. We provide further information as it becomes available.
3. 5.3
   You decide whether to notify the supervisory authority and the Shoppers concerned. We do not notify them on your behalf, unless the law requires us to or you ask us to.

6. Transfers outside the European Economic Area

1. 6.1
   We host the Platform within the European Economic Area.
2. 6.2
   Where a sub-processor processes personal data outside the European Economic Area, we transfer it only to a country covered by an adequacy decision of the European Commission, or on the basis of the standard contractual clauses adopted by the European Commission.

7. Information and audits

1. 7.1
   We make available to you the information necessary to demonstrate compliance with this agreement, including a summary of our most recent penetration test and our PCI DSS self-assessment.
2. 7.2
   Where that information is not sufficient, you may have an audit carried out by an independent auditor bound by confidentiality, at most once a year, with at least 30 days' notice and at your own cost. The audit takes place during business hours and without disrupting our operations.

8. End of the processing

1. 8.1
   When the agreement ends, we make your transaction and order records available for export, as set out in article 34.5 of the Terms of Service. You may choose instead to have us delete the data without export.
2. 8.2
   Within 90 days after the end of the agreement, we delete the personal data we processed for you, including copies, unless the law requires us to keep it.
3. 8.3
   Data that we keep as a controller for our own purposes, as described in article 2.3, is kept and deleted as set out in our Privacy Policy.

9. Liability and duration

1. 9.1
   Our liability under this agreement is limited as set out in article 29.2 of the Terms of Service.
2. 9.2
   This agreement applies for as long as we process personal data for you, and the obligations that by their nature continue after the end remain in force.

Version 1.1 · Effective 1 November 2026 · Checky Pro B.V., Brandweerstraat 20, 7514 AE Enschede, the Netherlands · Chamber of Commerce 42000293

10. Annex 1 — Description of the processing

1. 10.1
   Subject matter and purpose: providing the Checkout and Payments to you: presenting the checkout page, taking orders, routing payments to acquiring partners, passing orders to your store, handling refunds, pre-dispute alerts and disputes, and the reporting in your Dashboard.
2. 10.2
   Duration: for as long as the agreement lasts, and after that as set out in article 8.
3. 10.3
   Nature of the processing: collecting, recording, storing, transmitting, displaying and deleting.
4. 10.4
   Categories of data subjects: your Shoppers, and people whose details your Shoppers enter, such as a delivery recipient.
5. 10.5
   Categories of personal data: name, email address, telephone number, billing and delivery address; basket contents, orders and payment records; payment method and payment status; refund and dispute information; masked card identifiers provided by payment providers; IP address and device details; and information exchanged in support conversations.
6. 10.6
   Special categories of personal data: none. We do not receive full card numbers or security codes.

11. Annex 2 — Security measures

1. 11.1
   Encryption of personal data in transit.
2. 11.2
   Access to personal data based on role and need, and logging of that access.
3. 11.3
   Hosting within the European Economic Area.
4. 11.4
   Card numbers and security codes are entered in fields of our payment providers and do not reach our systems.
5. 11.5
   Penetration testing of the Platform, and a PCI DSS self-assessment questionnaire (SAQ D).
6. 11.6
   Confidentiality obligations for everyone with access to personal data.
7. 11.7
   A procedure for detecting, handling and notifying personal data breaches.

12. Annex 3 — Sub-processors