Data Processing Agreement (DPA)
This Data Processing Agreement (the "Agreement") is entered into between the Merchant using the bepleez service (the "Controller") and bepleez SASU, registered with the Paris Trade and Companies Register under number 130 785 983, with its registered office at 4, square Emmanuel Chabrier, 75017 Paris, France ("bepleez" or the "Processor"). It forms an integral part of the Terms of Service and is accepted by the Merchant at sign-up. It implements Article 28 of Regulation (EU) 2016/679 (the "GDPR").
1. Purpose and scope
This Agreement governs the personal data processing that bepleez performs on behalf of the Merchant to deliver the Service: generating, presenting and executing negotiation offers to buyers on the Merchant's store (Section 3.1 of the Privacy Policy).
It does not apply to processing for which bepleez acts as controller, in particular improving its negotiation model from aggregated and anonymized data (Section 3.2 of the Privacy Policy), nor to managing the Merchant's account and commercial relationship.
2. Description of the processing
- Nature and purpose: analyzing negotiation messages and context, generating personalized offers within the limits configured by the Merchant, presenting offers in the widget, issuing the coupon and Deal Token upon acceptance, and tracking conversion.
- Categories of data subjects: buyers and visitors of the Merchant's store who interact with the negotiation widget.
- Categories of data: messages exchanged during the negotiation, offers made and accepted, stated intent, technical identifiers (session, IP address, browser) and, only where the Merchant provides them, customer data (email, purchase history, loyalty status) and order data linked to conversion.
- Sensitive data: none. The Service is not designed to process special categories of data (Article 9 GDPR), and the Merchant undertakes not to provide any.
- Duration: the period during which the Merchant uses the Service, followed by the return and deletion period set out in Section 9.
3. Merchant instructions
bepleez processes personal data only on the Merchant's documented instructions. The Terms, this Agreement and the Merchant's configuration of the Service (negotiation strategies, margin guardrails, enabled agents, data provided) constitute those instructions. If bepleez considers that an instruction infringes the GDPR or other applicable data-protection law, it will inform the Merchant immediately.
4. Confidentiality
bepleez ensures that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
5. Security
bepleez implements the appropriate technical and organizational measures required by Article 32 GDPR, described on our Security page: encryption in transit and at rest, role-based access control, cryptographic signing of Deal Tokens, audit trails for negotiation and acceptance events, and continuous monitoring of production systems.
6. Sub-processors
The Merchant gives bepleez general authorization to engage sub-processors to deliver the Service. The current list is available in Section 5 of the Privacy Policy.
bepleez will notify the Merchant, by email or through the dashboard, of any addition or replacement of a sub-processor at least 30 days before it takes effect. The Merchant may object on reasonable data-protection grounds within that period; failing agreement, the Merchant may terminate the Service without penalty.
bepleez contractually imposes on each sub-processor data-protection obligations at least equivalent to those in this Agreement, and remains liable to the Merchant for their performance.
7. Transfers outside the European Union
Some sub-processors (notably AI model and hosting providers) may process data outside the European Economic Area. Each transfer is covered by an adequacy decision (including the EU-U.S. Data Privacy Framework where the provider is certified) or by the Standard Contractual Clauses adopted by the European Commission.
8. Assistance to the Merchant
Taking into account the nature of the processing, bepleez assists the Merchant through appropriate technical and organizational measures, insofar as possible:
- in responding to data subject requests (access, rectification, erasure, objection, restriction, portability). Any request received directly by bepleez concerning a negotiation on the Merchant's store is forwarded to the Merchant without delay;
- in meeting its obligations regarding security, personal data breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).
Personal data breach: bepleez notifies the Merchant of any personal data breach affecting it without undue delay and no later than 48 hours after becoming aware of it, with the information available to enable the Merchant to meet its own notification obligations.
9. End of processing
At the end of the Service, bepleez deletes the personal data processed on the Merchant's behalf within 30 days, unless the Merchant requests its return within that same period, and subject to any legal retention obligation. Data that has already been aggregated and anonymized is no longer personal data and is not affected.
10. Audit
On written request to privacy@bepleez.com, bepleez makes available to the Merchant the information necessary to demonstrate compliance with this Agreement. The Merchant may conduct, or have an independent auditor bound by confidentiality conduct, an audit no more than once a year with 30 days' notice, except in the event of a confirmed data breach. Audit costs are borne by the Merchant.
11. Merchant obligations
As controller, the Merchant undertakes to have a legal basis for the processing it entrusts to bepleez, to inform the buyers on its store of that processing (in particular in its own privacy policy), and to provide bepleez only with the data necessary for the Service.
12. General provisions
This Agreement remains in force for as long as bepleez processes personal data on the Merchant's behalf. In the event of any conflict between this Agreement and the Terms on a data-protection matter, this Agreement prevails. It is governed by French law, and any dispute falls under the jurisdiction set out in the Terms.
Contact: privacy@bepleez.com