Data Processing Agreement

Avanta Global EOOD processes Amazon seller data on the seller's instructions. This agreement sets out the scope, the sub-processors, the security measures and the deletion terms.

Data Processing Agreement (DPA)

Last updated: 24 April 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between Avanta Global EOOD, a sole-shareholder limited liability company registered in the Republic of Bulgaria, operating the AgentXray platform ("Processor", "we"), and the customer identified in the Agreement ("Controller", "you").

The DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the AgentXray SaaS platform (the "Service"). It is designed to satisfy Article 28 of Regulation (EU) 2016/679 ("GDPR").

If there is any conflict between this DPA and the rest of the Agreement on the subject of personal data protection, this DPA prevails.

1. Parties

A counter-signed PDF copy of this DPA is available on request.

2. Subject matter and duration

• Subject matter: the processing of personal data by the Processor on the Controller's behalf to provide the Service described in the Agreement.
• Duration: the DPA is effective from the date the Controller accepts the Agreement and continues for as long as the Processor processes personal data for the Controller, plus the retention periods in Section 10 below.

3. Nature and purpose of processing

The Processor processes personal data to:

• Authenticate the Controller and its users.
• Call the Amazon Selling Partner API (SP-API) on the Controller's behalf.
• Store, index, transform, analyse, and display the Controller's data inside the Service.
• Send the Controller transactional and service-related emails.
• Provide AI-assisted features when triggered by the Controller.
• Support the Controller (debugging, incident response).

The Processor does not process the Controller's personal data for its own purposes, except for (a) aggregated and anonymised analytics that cannot be linked back to any individual, and (b) security and abuse prevention.

4. Types of personal data and categories of data subjects

4.1 Categories of data subjects

• The Controller's own employees and operators who use the Service (account holders, team members).
• The Controller's business — insofar as "seller data" from Amazon Seller Central may identify the Controller as a business entity and name individual sellers.

The Service is not designed to receive buyer-facing PII. AgentXray does not request SP-API restricted roles. If the Controller nevertheless uploads or pastes buyer PII into the Service (for example, into AI prompts or free-text fields), the Controller is responsible for having a legal basis to do so, and the data becomes subject to this DPA.

4.2 Types of personal data

• Account data: email, name, password hash, internal tenant identifier, billing data.
• Amazon seller data connected via SP-API: orders, inventory, listings, financial events, account health, reports on the Controller's own selling activity.
• Usage and technical data: IP address, user-agent, session logs, error logs.
• Content created inside the Service: notes, saved lists, AI prompts and outputs.

5. Obligations of the Processor (Art. 28 GDPR)

The Processor will:

1. Process on instructions. Process personal data only on the Controller's documented instructions. The Agreement and the Service's normal functionality constitute such instructions. If the Processor is required by law to process outside the Controller's instructions, it will notify the Controller first, unless the law prohibits it.
2. Confidentiality. Ensure that any personnel authorised to access personal data are bound by confidentiality obligations.
3. Security. Implement and maintain appropriate technical and organisational measures to protect personal data, including the measures listed in Annex A.
4. Sub-processors. Use sub-processors only under Section 6.
5. Data subject rights. Assist the Controller as described in Section 7.
6. Incidents. Assist with and notify the Controller of personal data breaches as described in Section 8.
7. Audits. Make information reasonably necessary to demonstrate compliance available to the Controller as described in Section 9.
8. Return / deletion. Delete or return personal data at the end of the Service as described in Section 10.
9. DPIA / prior consultation. Provide reasonable assistance to the Controller in carrying out data protection impact assessments and prior consultations with supervisory authorities, where required.

6. Sub-processors

The Controller grants the Processor general authorisation to engage sub-processors, subject to this Section 6.

6.1 Current sub-processors

The current list is published in the Privacy Policy, Section 5, and summarised here:

• External market data provider (Amazon historical pricing and ranking data — EU)
• Resend (transactional email — EU / US)
• Anthropic (AI model provider — US)
• OpenRouter (AI model gateway — US)
• Google (OAuth authentication — Global)
• Stripe (payments, when billing is enabled — Global)
• Cloudflare (edge, DDoS, WAF — Global)
• VPS provider (primary hosting — EU)

A full current list with corporate names, addresses, and processing locations is available on request at [email protected].

6.2 Changes

The Processor will notify the Controller at least 30 days before adding or replacing a sub-processor. Notification will be by email and by updating the Privacy Policy. If the Controller reasonably objects to the change on data protection grounds, the parties will discuss in good faith; if no solution can be found, the Controller may terminate the affected part of the Service (or the whole subscription) for convenience and receive a pro-rata refund for the unused prepaid period.

6.3 Sub-processor obligations

The Processor will impose, by written contract, data protection obligations on each sub-processor that are no less protective than those in this DPA. The Processor remains fully liable to the Controller for the performance of its sub-processors' obligations.

7. Data subject rights assistance

The Processor will, taking into account the nature of the processing:

• Provide features in the Service that let the Controller directly respond to common data subject requests (export, deletion, rectification).
• Where the Controller is unable to address a request using the Service alone, assist the Controller within a reasonable time and at a reasonable cost. Requests that require non-trivial engineering work may be charged at a published hourly rate.
• Forward to the Controller, without undue delay, any data subject request the Processor receives directly that relates to the Controller's data, rather than responding itself.

8. Personal data breach notification

• The Processor will notify the Controller without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the Controller's data.
• For very serious incidents, the Processor will aim for 24-hour notification where practicable.
• Notification will include, to the extent then known: the nature of the breach, categories and approximate number of data subjects and records affected, the likely consequences, measures taken or proposed, and a point of contact.
• The Processor will cooperate with the Controller and provide reasonable information so the Controller can meet its own notification obligations (e.g. to supervisory authorities under Art. 33 GDPR and to data subjects under Art. 34).
• A notification or response under this section is not, by itself, an acknowledgement of fault or liability.

9. Audits

The Processor will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA, including:

• This DPA.
• The Privacy Policy.
• Annex A (technical and organisational measures).
• Incident Response Plan summary (on request, under NDA).
• Summaries of penetration tests or third-party audits, if and when they exist.

If the Controller reasonably believes those materials are insufficient, the Controller may request an audit. Audits will be conducted:

• Once per year at most (more frequently if required by a supervisory authority or following a security incident).
• With at least 30 days' written notice.
• During business hours, in a way that does not disrupt the Service for other customers.
• By the Controller or an independent third-party auditor bound by confidentiality, mutually agreed.
• At the Controller's expense, except where the audit reveals material non-compliance by the Processor, in which case the Processor will bear the reasonable cost.

10. Return or deletion upon termination

On termination or expiry of the Agreement, and at the Controller's choice:

• The Processor will return the Controller's personal data in a machine-readable format, or
• Delete it.

Default behaviour (if the Controller expresses no preference) is: deletion 90 days after termination, per the Privacy Policy retention schedule.

Backups are overwritten on a rolling 30-day cycle and will expire after that window; data in backups is not restored or re-used during the period between termination and backup rotation.

Records the Processor is legally required to keep (e.g. invoices for 10 years) are retained only for that legal purpose, access-restricted, and not used for any other purpose.

11. International transfers

Where personal data is transferred outside the European Economic Area (EEA) or the UK to a country that does not have an adequacy decision, the transfer is covered by the Standard Contractual Clauses (SCCs) issued by the European Commission (2021/914/EU), Module Two (controller-to-processor) or Module Three (processor-to-processor), as applicable, with the following selections pre-filled:

• Clause 7 (docking clause): applies.
• Clause 9 (sub-processors): Option 2 — general written authorisation with 30 days' notice of changes.
• Clause 11 (redress): independent dispute resolution body clause — not used.
• Clause 17 (governing law): law of the Controller's country of establishment in the EEA, or, if the Controller is not established in the EEA, the law of Bulgaria.
• Clause 18 (forum and jurisdiction): courts of the country whose law governs the SCCs under Clause 17.
• Annex I.A (Parties): Controller and Processor as in Section 1 of this DPA.
• Annex I.B (Description of transfer): as in Sections 3 and 4 of this DPA.
• Annex I.C (competent supervisory authority): the Controller's lead supervisory authority, or the Bulgarian CPDP if the Controller has none in the EEA.
• Annex II (technical and organisational measures): as in Annex A of this DPA.

For transfers to the UK, the UK IDTA / UK Addendum to the SCCs applies on the same terms.

Where a sub-processor is certified under the EU-US Data Privacy Framework or a successor framework with an adequacy decision, the framework applies in addition to (and not in place of) the SCCs, unless the Controller instructs otherwise.

12. Liability

Liability under this DPA is subject to the liability caps and exclusions in the Agreement (Terms of Service, Section 11), except as follows:

• No provision of this DPA or the Agreement excludes or limits a party's liability under Article 82 GDPR toward a data subject.
• The parties' administrative-fine allocation under the SCCs (Clause 12) is respected.

13. Governing law

This DPA is governed by the law of the Republic of Bulgaria, matching the Terms of Service, Section 13, except where the SCCs require otherwise for cross-border transfers.

Annex A — Technical and organisational measures

The Processor maintains the following controls (described in more detail in our internal Security Controls document, available on request under NDA):

1. Pseudonymisation and encryption of personal data - TLS 1.2+ for all data in transit, with HSTS. - Application-level encryption (Fernet — AES-128-CBC with HMAC-SHA256) for all sensitive credential material: Amazon SP-API refresh tokens, access tokens, and LWA client secrets. The key is held in the service environment and never in the database. - PBKDF2-HMAC-SHA256 password hashing at 600,000 iterations with a per-user salt. - The Processor does not claim full-disk encryption at the hosting layer: a written attestation has been requested from the hosting provider and not received, so the underlying disk is treated as unencrypted and sensitive fields are protected at the application layer instead.

2. Ongoing confidentiality, integrity, availability, resilience - Multi-factor authentication on the administrative accounts that control the Processor's infrastructure — verified 2026-08-03 on the Google Workspace tenant (2-step verification) and the DNS/CDN provider account (TOTP with backup codes). Enrolment on the remaining operator accounts is tracked in the Processor's internal access policy. - Role-based access within the application (admin / user separation). - Firewalled hosting with only required ports exposed. - Cloudflare WAF in front of the application. - SSH key-only access to servers; fail2ban; no password logins. - Security patches applied at least weekly. - Centralised application and security logs with retention.

3. Availability and restoration after an incident - Daily database backups: pg_dump → gzip → age encryption → off-site copy to Cloudflare R2 with an upload integrity check. Local copies retained 7 days, off-site copies 30 days. A scheduled watchdog checks backup freshness daily and alerts on staleness. - Documented Incident Response Plan, reviewed every 6 months. - Target Recovery Time Objective (RTO): 4 hours. Target Recovery Point Objective (RPO): 24 hours.

4. Regular testing and evaluation - Internal code review before production deploys. - Dependency scanning for known CVEs. - Incident Response Plan tabletop review every 6 months. - Penetration tests and independent audits when required (currently on request).

5. Organisational measures - Confidentiality commitments from all personnel with data access. - Principle of least privilege. - Credentials rotated quarterly for high-privilege API keys. - Written access policy (see internal Password & Access Policy).

If any part of this DPA conflicts with mandatory applicable law, that part will be replaced by a provision that most closely matches the parties' original intent and complies with the law; the rest of the DPA remains in force.