Data Processing Agreement (DPA)

Effective date: 17 September 2026 Last updated: 17 September 2026

# Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Kepio Terms of Service when Kepio processes personal data on behalf of a business customer as a processor.

Provider / Processor: kepio.eu Perikleous 38C, 56224, Thessaloniki, Greece VAT: EL135768757 Privacy contact: info@kepio.eu

The business customer accepting this DPA acts as controller or, where applicable, as a processor acting for another controller.

1. Subject matter and duration

Kepio processes data that the customer imports, uploads or connects to the service only to the extent necessary to provide the features enabled by the customer, such as e-commerce integrations, profitability analytics, reports, support and related functionality.

Processing continues for the duration of the relevant service or while the data lawfully remains in the service, subject to legal retention duties, backup cycles and the deletion/return instructions below.

2. Nature and purpose of processing

Processing operations may include collection through APIs or imports, storage, organisation, calculation, correlation of business metrics, retrieval, display, export, synchronisation, technical support and deletion.

The purposes are limited to providing, securing, maintaining and supporting the Kepio functionality requested by the customer. Kepio does not use Customer Data processed solely as processor for incompatible purposes of its own.

3. Categories of data and data subjects

Depending on enabled integrations, Customer Data may include limited transaction information such as:

• order identifiers and timestamps,
• product identifiers, SKU, product name and quantity,
• order status and financial amounts,
• payment/shipping method labels,
• shipping country at country-code level,
• other fields technically necessary for the enabled connector.

Kepio designs supported store connectors to avoid, where technically feasible, importing end-customer names, email addresses, telephone numbers and full postal addresses when they are not required for profitability analytics.

Potential data subjects may include customers or other business contacts of the merchant, depending on the data the merchant chooses to connect.

The customer must not use Kepio for special categories of personal data, criminal-conviction data or children's data unless expressly agreed in writing and appropriately assessed in advance.

4. Documented instructions

Kepio processes Customer Data only on the customer's documented instructions, including this DPA, the Terms, account and integration settings, and lawful support requests.

If Kepio believes an instruction infringes applicable data-protection law, Kepio may inform the customer and suspend the affected processing until a lawful instruction is clarified.

5. Customer responsibilities

The customer is responsible for:

• the lawfulness of collection and transfer of Customer Data,
• an appropriate legal basis and transparency notice,
• the accuracy of its instructions,
• permissions and rights in connected third-party accounts,
• avoiding the import of data that is unnecessary for the intended use.

6. Confidentiality and personnel access

Kepio limits access to Customer Data to authorised persons who need access to operate, secure or support the service. Such persons are subject to appropriate confidentiality obligations.

7. Security measures

Kepio applies measures appropriate to the nature of the service and risk, including where applicable:

• HTTPS/TLS,
• password hashing,
• prepared database statements,
• CSRF protections,
• session security controls,
• role/access controls,
• encryption of supported integration credentials/tokens before storage,
• audit/error logging and operational monitoring,
• backup and recovery procedures for the production environment,
• minimisation of data requested by connectors where technically feasible.

The customer acknowledges that no system can guarantee absolute security and must protect its own credentials, devices and accounts.

8. Subprocessors

The customer grants general authorisation for subprocessors necessary to provide the service, provided Kepio imposes appropriate data-protection obligations where required.

Current public information about subprocessors and third-party services is available on the Subprocessors & Third-Party Services page. Where a registry is available within Kepio, it provides additional provider, purpose, region and transfer-mechanism information.

Kepio may update the list when production infrastructure materially changes. The customer may contact info@kepio.eu with a reasonable objection based on data-protection grounds.

9. International transfers

Where Customer Data is transferred outside the EEA and a transfer mechanism is required, Kepio or the relevant subprocessor must rely on a lawful mechanism such as an adequacy decision, Standard Contractual Clauses or another valid mechanism under applicable law.

Specific mechanisms depend on the provider, service and processing region and should be recorded or made available by the relevant provider.

10. Data-subject requests

Taking into account the nature of the processing, Kepio provides reasonable technical and organisational assistance to help the customer respond to access, rectification, erasure, restriction, objection or portability requests relating to Customer Data.

If Kepio receives a request relating to Customer Data for which the customer is controller, Kepio may refer the request to the customer unless the law requires otherwise.

11. Personal-data breaches

Kepio notifies the customer without undue delay after becoming aware of a personal-data breach affecting Customer Data for which it acts as processor and provides available information reasonably necessary for the customer's assessment and notification obligations.

Such notice is not an admission of fault or liability.

12. DPIAs and supervisory authorities

Taking into account the information available to it and the nature of processing, Kepio provides reasonable assistance with security, DPIA and prior-consultation obligations where they apply to the customer's use.

13. Deletion or return of data

At the end of the service or following a lawful customer instruction, Kepio deletes or returns Customer Data processed as processor unless applicable law requires retention or limited copies temporarily remain in backups until their normal replacement cycle.

The Privacy Center may provide export and request workflows. Deletion of an entire company may require review to protect other company users and to meet tax, accounting, security or dispute-retention obligations.

14. Information and audits

Kepio makes available information reasonably necessary to demonstrate compliance with the processor obligations in this DPA.

Where an audit is required, the parties will agree a reasonable scope, timing, confidentiality and method designed to avoid undue disruption of the service and exposure of other customers' data. Available policies, reports or other documented information may be used first where sufficient.

15. Order of precedence

If this DPA conflicts with the general Terms regarding processing of Customer Data as processor, this DPA prevails for that issue.

16. Acceptance and changes

This DPA becomes binding for the business account when an owner/admin accepts it through Kepio or when the parties accept it by another valid method.

Kepio may update the DPA for service or legal changes. When a materially new version is published, Kepio may require renewed acceptance before new store connections or other processor functions.

17. Contact

For privacy/DPA matters: info@kepio.eu

This DPA is a production-oriented contractual template and is not a legal certification. Final review by qualified legal counsel or a DPO is recommended before broad commercial use.