Data Processing Terms

/01

General provisions

1. 1.1

   These data processing terms (the 'Processing Terms') are issued by steezr s.r.o., Company ID 22354883, with its registered seat at K Rybníčkům 282/19, Strašnice, 100 00 Praha 10, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague under file no. C 415229 ('steezr' or the 'processor').

2. 1.2

   The Processing Terms apply whenever steezr, while providing services to a client, processes personal data controlled by the client, in particular when hosting, managing, maintaining, developing, migrating, or supporting the client's systems. They constitute a data processing agreement within the meaning of Article 28(3) of Regulation (EU) 2016/679 (the 'GDPR').

3. 1.3

   The Processing Terms form part of every contract between steezr and the client and supplement the Terms and Conditions available at steezr.com/terms. If the parties conclude a separate written data processing agreement, that agreement prevails.

4. 1.4

   Personal data of the client's contact persons that steezr processes to perform the contract and communicate is processed by steezr as a controller. The Processing Terms do not apply to it; it is governed by the Privacy Policy at steezr.com/privacy-policy.

/02

Definitions

1. 2.1

   For the purposes of the Processing Terms, the following words have this meaning:

   • Controller: the client, who determines the purposes and means of the processing.
   • Processor: steezr.
   • Sub-processor: another processor that steezr engages in the processing for the client.
   • Personal data, processing, data subject, and personal data breach: as defined in Article 4 of the GDPR.
   • Contract: the contract between steezr and the client for the provision of services.
   • Services: the activities steezr carries out for the client under the contract.

/03

Subject matter, duration, nature, and purpose of the processing

1. 3.1

   The subject matter of the processing is personal data that the client or its users enter into systems that steezr builds, runs, manages, or migrates for the client, and data that steezr gains access to while providing the services.

2. 3.2

   The processing lasts for the duration of the services and ends with the deletion or return of the data under Article 12.

3. 3.3

   The nature of the processing is in particular storage, hosting, backup, display, modification, transfer, migration, automated processing, and access for the purposes of maintenance, support, and development.

4. 3.4

   The purpose of the processing is solely the provision of the services under the contract. steezr does not process the client's personal data for its own purposes.

5. 3.5

   Categories of data subjects and personal data that the processing usually concerns:

   • data subjects: the client's customers, users, employees, suppliers, and other contacts
   • identification and contact details
   • user account, order, and contract data
   • payment data, excluding full payment card numbers
   • system usage data and operational logs
   • content that the client or its users store in their systems
   • special categories of personal data under Article 9 of the GDPR only where the parties have agreed so in writing
6. 3.6

   The specific scope of the processing for a given engagement may be detailed in the quote or the contract.

/04

Controller's instructions

1. 4.1

   steezr processes personal data only on the client's documented instructions. The contract, the Processing Terms, and further written instructions given by the client through its contact person are considered instructions.

2. 4.2

   If steezr considers an instruction to infringe the GDPR or other data protection law, it informs the client without undue delay. It may suspend the instruction until the matter is clarified.

3. 4.3

   The client is responsible for ensuring that a legal basis exists for the processing, that data subjects have been properly informed, and that its instructions comply with the law.

/05

Processor obligations

1. 5.1

   steezr ensures that persons authorized to process personal data are bound by confidentiality.

2. 5.2

   steezr implements the technical and organizational measures under Article 6.

3. 5.3

   steezr complies with the conditions for engaging sub-processors under Article 7.

4. 5.4

   steezr assists the client in fulfilling its obligations towards data subjects under Article 9 and its obligations under Articles 32 to 36 of the GDPR, in particular regarding security, breach notification, and data protection impact assessments.

5. 5.5

   steezr deletes or returns the personal data at the end of the processing under Article 12.

6. 5.6

   steezr makes available to the client the information necessary to demonstrate compliance with Article 28 of the GDPR and allows audits under Article 11.

7. 5.7

   steezr maintains records of the categories of processing activities carried out for the client to the extent required by Article 30(2) of the GDPR.

/06

Security

1. 6.1

   steezr applies in particular the following measures, proportionate to the nature of the data and the risks of the processing:

   • access control based on the principle of least privilege, and removal of access when cooperation ends
   • multi-factor authentication for administrator access where the platform supports it
   • encryption of data in transit (TLS) and encryption of backups and storage where the platform supports it
   • separation of development, testing, and production environments, and use of test or anonymized data outside production where possible
   • regular updates of systems, libraries, and dependencies, and monitoring of security vulnerabilities
   • backups and verification of their restorability to the extent of the agreed service
   • logging of access and changes in production systems
   • secure development practices, including code review and management of secrets outside the source code
2. 6.2

   The specific measures depend on the platform and the scope of the services. For systems operated by a third party (for example Shopify or a cloud provider), that third party is responsible for the security of the infrastructure under its own terms.

3. 6.3

   The client is responsible for security on its side, in particular for managing its own user accounts, strong passwords, its employees' permissions, and the security of the devices from which it accesses the systems.

/07

Sub-processors

1. 7.1

   The client grants steezr a general authorization to engage sub-processors. steezr engages sub-processors in particular in these categories:

   • hosting and cloud infrastructure providers
   • email and notification service providers
   • monitoring, error tracking, and backup tools
   • e-commerce and payment platforms chosen for the engagement (for example Shopify and payment gateways)
   • artificial intelligence model providers where they are part of the agreed service
   • tools for request management and client communication
   • vetted steezr subcontractors taking part in development or support
2. 7.2

   steezr states the current list of sub-processors for a given engagement in the quote or the contract, or provides it to the client on request sent to hello@steezr.com.

3. 7.3

   steezr notifies the client at least 14 days in advance of the intended engagement or replacement of a sub-processor. The client may object in writing on reasonable grounds relating to data protection. If no solution is found within 30 days, the client may terminate the affected service without penalty.

4. 7.4

   steezr imposes on sub-processors, by contract, data protection obligations equivalent to these Processing Terms and remains liable to the client for the performance of the sub-processors' obligations.

5. 7.5

   A platform or service provider that the client chose and with which the client has its own contractual relationship (for example the client's own Shopify or cloud provider account) is not a sub-processor. Such a provider is the client's processor directly.

/08

Transfers to third countries

1. 8.1

   steezr processes personal data preferably within the European Union and the European Economic Area.

2. 8.2

   Personal data is transferred to a third country only where an appropriate safeguard under Chapter V of the GDPR is in place, in particular an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.

3. 8.3

   Where a transfer is required by a platform the client chose, the client is responsible for assessing the transfer.

/09

Data subject rights

1. 9.1

   If steezr receives a request from a data subject concerning personal data controlled by the client, it forwards it to the client within 3 business days and does not respond to it itself without the client's instruction.

2. 9.2

   steezr provides the client with reasonable assistance in handling the request, in particular locating, exporting, correcting, restricting, or deleting data in the systems it operates for the client. Assistance beyond the usual scope is billed at the hourly rate or drawn from retainer hours.

/10

Personal data breaches

1. 10.1

   If steezr discovers a breach of the security of the client's personal data, it notifies the client without undue delay, and no later than 48 hours after becoming aware of it.

2. 10.2

   The notification contains the available information on the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases as it becomes available.

3. 10.3

   steezr assists the client in investigating the breach, mitigating its consequences, and fulfilling notification duties towards the supervisory authority and data subjects. Notifications to the supervisory authority and data subjects are made by the client.

/11

Audits

1. 11.1

   The client may verify compliance with these Processing Terms no more than once every 12 months, with written notice at least 30 days in advance and during business hours. The audit is carried out by the client or by an independent auditor appointed by it who is bound by confidentiality and is not a competitor of steezr.

2. 11.2

   steezr first provides written answers, documentation, and the available reports and certifications of sub-processors. An on-site audit takes place only if these materials are insufficient or a supervisory authority requires it.

3. 11.3

   The audit must not unreasonably disrupt steezr's operations or endanger the confidentiality of other clients' data. The client bears the costs of the audit, including steezr's time billed at the hourly rate, unless the audit reveals a material breach of the Processing Terms by steezr.

/12

End of processing

1. 12.1

   When the services end, steezr, at the client's choice, returns the personal data in a structured, commonly used format or deletes it, within 30 days of termination. If the client does not make a choice within 30 days, steezr deletes the data.

2. 12.2

   Data in backups is deleted within the regular backup rotation cycle, and no later than 90 days. Until then, backups are used for no purpose other than restoration and are protected by the measures under Article 6.

3. 12.3

   steezr may retain personal data to the extent required by European Union or Czech law, and only for the period it prescribes.

4. 12.4

   For systems operated by the client or by a third party chosen by the client, the client ends the processing by removing steezr's access.

/13

Liability

1. 13.1

   steezr's liability for harm arising from a breach of these Processing Terms is limited under Article 14 of the Terms and Conditions. The limitation does not apply where the law does not permit it.

2. 13.2

   Each party is responsible for fulfilling the obligations the GDPR imposes on it as a controller or processor. A fine imposed by a supervisory authority is borne by the party whose breach led to it.

3. 13.3

   The client indemnifies steezr against third-party claims and penalties arising from the client lacking a legal basis for the processing, giving steezr an unlawful instruction, or failing to fulfil its obligations as a controller.

/14

Final provisions

1. 14.1

   The Processing Terms are governed by the law of the Czech Republic and the GDPR. Disputes are decided by the general court with local jurisdiction according to steezr's registered seat.

2. 14.2

   steezr may amend the Processing Terms, in particular because of changes in the law or in the services. It notifies clients with ongoing services at least 30 days before the change takes effect. A client who does not agree with the change may terminate the affected service as of its effective date.

3. 14.3

   The Processing Terms are drawn up in Czech and English. In case of a conflict, the Czech version prevails.

4. 14.4

   These Processing Terms take effect on 1 January 2026.