Data Processing Agreement (DPA)

1. Parties and purpose

This Data Processing Agreement (DPA) governs the access to and processing of data carried out by Melopo ("Melopo Radar", the Processor) on behalf of, and following the instructions of, the user or company that owns the connected store (the Controller).

This agreement becomes binding when the Controller accepts the Terms of Service or installs the Melopo Radar plugin on their WooCommerce store.

2. Nature, purpose and categories of data

• Subject matter and nature: providing the technical monitoring service, diagnosing WooCommerce errors and running automatic fix tools.
• Types of data: catalog data (titles, descriptions, prices, SKUs, images), aggregated order metrics (number of sales, revenue at risk, no card data), security audit events and IP addresses of login attempts.
• Categories of data subjects: the store's admin users, and end customers to the extent they interact with the catalog or orders.

3. Melopo Radar's obligations as Processor

In accordance with article 28.3 of the GDPR, Melopo Radar expressly undertakes to:

1. Process personal data only on the Controller's documented instructions.
2. Ensure that the people authorised to process the data have committed to confidentiality.
3. Implement appropriate technical and organisational security measures, including encryption in transit (TLS 1.3), cryptographic signing of commands and least-privilege access control.
4. Respect the subcontracting conditions described on the Subprocessors page.
5. Help the Controller, as far as possible, respond to requests from data subjects exercising their rights.
6. Security breach notification: notify the Controller without undue delay and, at the latest, within 48 hours of any security breach affecting their data.
7. At the Controller's choice, delete or return all data once the service ends.
8. Make available to the Controller the information needed to demonstrate compliance with these obligations, and allow reasonable audits.

4. The Controller's obligations

The customer guarantees that the data provided to Melopo Radar was collected lawfully and that they have the legal basis required by the applicable regulations to process it with cloud tools.