1. Parties and scope
This agreement is between the organization identified in the acceptance record (the Controller) and GOD IS GREAT S.R.L., CUI 52248590, Trade Register J2025057132001, registered office: Strada Brândușelor nr. 10, camera 1, bl. V75A, sc. 3, et. 1, ap. 33, Sector 3, București, Romania, operating PortantisAI (the Processor). The authenticated representative confirms their authority to bind the Controller. The acceptance record identifies the workspace, representative, organization, document version and time of acceptance.
This version covers an invitation-only pilot using synthetic commerce records. Do not upload real customer data, special-category data, criminal-offence data, payment-card details or identity documents during this pilot. Account and service-security information is processed separately under the Privacy Policy. A production processing schedule must be agreed before real customer data is introduced.
This agreement supplements the service terms and prevails for the processing it covers. It does not waive statutory rights or authorize access to another workspace. Acceptance is an electronic record of agreement, not a qualified electronic signature.
2. Documented instructions
The Processor processes personal data only on the Controller's documented instructions, including authorized workspace configuration and support requests, to provide the agreed Portantis service. Processing required by law is notified in advance unless the law prohibits notice. The Processor informs the Controller if an instruction appears to infringe applicable data-protection law and suspends the disputed processing pending clarification.
The Controller determines purposes and lawful bases, provides required notices, supplies lawful instructions and ensures that its authorized users act within those instructions. This agreement is not consent from the Controller's customers and does not replace a lawful basis or required customer consent.
3. Processing schedule
Subject matter: operating the isolated Portantis pilot workspace. Nature of processing: receiving, storing, organizing, displaying, synchronizing and deleting the synthetic records and authorized support material needed for the pilot. Duration: the pilot service period and the restricted return/deletion period below.
Data subjects in scope, where support material contains personal data: the Controller's authorized business representatives and users. Data categories: business name and contact details, role, workspace identifiers, instructions and support correspondence. The Controller must remove real customer identifiers from test records. Core pilot functions are orders, inventory, purchasing and catalog management; external calling, messaging, advertising and AI processing are not authorized by this agreement alone.
4. Confidentiality and security
The Processor restricts access to authorized personnel bound by confidentiality obligations and uses measures appropriate to the processing risk under Article 32 GDPR. The pilot security baseline is authenticated access, tenant and role separation, encrypted transport, protected credentials, restricted operational access, backups and access records. This is not a certification or guarantee that an incident cannot occur.
The Controller manages its users and connected-provider permissions, protects account credentials and promptly reports suspected misuse. Neither party may use this agreement to bypass security checks.
5. Subprocessors and transfers
The Processor may use only subprocessors identified in the agreed processing schedule or subsequently authorized in writing. Before a new subprocessor processes Controller data, the Processor supplies its identity, purpose, processing location and transfer safeguards and gives the Controller an opportunity to object on reasonable data-protection grounds. A substantiated unresolved objection requires an alternative arrangement or termination of the affected processing.
The Processor imposes data-protection obligations equivalent to this agreement on subprocessors and remains responsible for their performance. Transfers outside the EEA require a valid Chapter V GDPR mechanism and any necessary supplementary measures; this agreement itself is not a transfer mechanism. Optional integrations require separate Controller instructions and an updated schedule before personal data is transmitted.
Acceptance authorizes these existing subprocessors solely for this pilot: Contabo GmbH (Germany), application and database hosting under its active Data Processing Agreement, whose data-center appendix lists Contabo France SAS in Lauterbourg; Cloudflare, Inc. (United States), network delivery, application-file storage and encrypted database backup storage under its Customer DPA and applicable EU standard contractual clauses; and Hostinger International Ltd. (Cyprus), authentication and service email under its incorporated DPA.
Cloudflare R2 uses an Eastern Europe location hint with default jurisdiction, not an EU-only storage restriction; network and support processing may be global. Hostinger account-specific mailbox location and residual-copy expiry have not been independently verified. No exclusive-EEA processing or fixed provider-copy erasure date is promised. Covered restricted transfers rely on the applicable provider DPA safeguards, not this agreement alone. The Controller can request the current supplier information and safeguards at [email protected].
Optional AI, telephony, messaging, advertising, carrier and other integrations are excluded until separately instructed and added to the processing schedule. Shopify is the Controller's source platform; connecting Shopify does not authorize every other integration.
6. Assistance and rights requests
Taking account of the nature of processing and information available, the Processor assists the Controller with data-subject requests, security, breach notifications, impact assessments and prior consultation. Requests received directly are forwarded to the Controller without undue delay unless prohibited by law. The Processor does not respond on the Controller's behalf without instructions except where legally required.
Requests must identify the relevant workspace and data. Identity and authority are verified before disclosure or deletion. Shopify privacy webhooks and support requests enter the verification and case-handling process; receipt of a webhook is not proof that all retained data has been deleted.
7. Personal-data breaches
The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data. An initial notice is sent using the recorded business contact even when investigation is incomplete; available facts and later updates are supplied progressively.
Notices describe the nature of the breach, affected categories and approximate numbers where known, likely consequences, mitigation and the response contact. The Processor preserves relevant evidence, contains the incident and cooperates with the Controller. The Controller determines any supervisory-authority and individual notifications, including the GDPR 72-hour authority deadline where applicable; this does not give the Processor 72 hours to delay notifying the Controller.
8. Return, deletion and retention
On termination the Controller may request return of the data before deletion. The Processor follows the Controller's verified instructions to return or delete data and copies unless applicable law requires retention. The operational schedule below applies to this pilot. No indefinite retention is authorized.
Data retained under a legal obligation is isolated, access restricted and used only for that purpose until the obligation ends. Backup copies remain protected, are not used for ordinary operations and must expire under the agreed schedule. If restored for recovery, outstanding deletion instructions must be reapplied before ordinary processing resumes.
Disconnecting or uninstalling an integration stops future access through that connection; it is not a representation that all historical data, backup copies or legally required evidence have already been erased. A minimal agreement and request-completion record may be retained to establish compliance and legal rights, with a documented purpose and retention review.
9. Pilot retention schedule
The GOD IS GREAT S.R.L. service operator owns a monthly manual retention review and records the outcome and next review date. Pilot business records, associated files, processing-job payloads and integration metadata are kept only while needed for the active pilot. On verified termination or erasure instructions, ordinary live copies are returned or deleted within 30 days, subject to a specifically documented legal obligation or dispute hold. Access is revoked promptly and unneeded account and membership profile data is removed within the same 30-day period. This pilot is not authorization to retain real customer records.
Temporary rights-request exports and working copies are deleted within seven days of verified delivery, or sooner if no longer needed. Routine service correspondence is deleted from operator-controlled mailboxes within 90 days after resolution unless needed for an active request or a documented hold. Provider-held residual copies follow the applicable provider agreements and restricted recovery processes; the operator follows up on verified erasure requests rather than representing a mailbox deletion as physical erasure of every copy.
Protected Shopify access records are retained through the first monthly review after they become 90 days old. Specific incident, privacy-case or legal holds must identify their purpose, owner and next review date. Minimal agreement and completed-request evidence is retained for three years after termination to demonstrate instructions, performance and legal rights, unless a specific documented obligation or dispute requires longer. Three years is an operator policy, not a claimed universal statutory minimum. Unnecessary payloads are not retained merely because a minimal evidence record is needed.
Encrypted database recovery copies expire by successful backup rotation: four full backup generations and six differential generations, with weekly full and daily differential backup cycles. This is a generation-based criterion, not a guaranteed number of calendar days. Missed backup or expiry cycles require operator investigation; a documented recovery or legal hold is restricted and reviewed. Backups are unavailable for ordinary use. Before an isolated recovery is reopened to ordinary processing, outstanding verified deletion instructions are reapplied. No unrelated merchant backup policy is changed by this pilot.
Return and deletion are handled as verified cases covering the relevant application owners, private files, processing history, service correspondence and recovery copies. A core database deletion is not a certificate for all other copies. The operator records executed steps, any justified restricted retention and follow-up dates and provides the Controller with the resulting status. Contact [email protected] for a request, an objection to retention or the applicable schedule.
10. Information and audit
The Processor makes available information needed to demonstrate compliance with this agreement and allows and contributes to reasonable audits, including inspections, by the Controller or its mandated independent auditor. Parties coordinate confidentiality, security and timing without preventing legally required oversight or urgent investigation.
Material changes to processing or this agreement require a new documented agreement where required. Previously accepted text and acceptance evidence are preserved. Privacy and security requests: [email protected]. Romanian law applies subject to mandatory applicable law and the rights of supervisory authorities and data subjects.