Data processing agreement (DPA)

1. Parties and roles

The seller is the controller of their customers' data. Kera Consulting (SAS, 6 rue Parmentier, 78800 Houilles, France), publisher of Slygo, acts as processor: it processes this data only on the seller's behalf and on the instructions described here.

2. Subject, nature and purpose

Calculating and showing the seller the estimated net profit of their sales, per order, product and channel: receipt through connections (Shopify…) or file imports, storage, calculation, display and export.

3. Data and data subjects

Data subjects: the seller's customers.

• Data processed: order number and date, products and quantities, amounts (prices, shipping, fees, refunds), status and, where applicable, the shipping country.
• Excluded data: Slygo does not request customers' names, email addresses, phone numbers or postal addresses, and the seller undertakes not to import them.
• Advertising spend: aggregated per campaign and per day, it does not relate to any identifiable person.

4. Duration

For as long as the seller's account exists. When the account is deleted, or at the seller's request, the data is deleted; the seller may export it beforehand.

5. Kera Consulting's obligations

• Process the data only on the seller's documented instructions (this agreement and the use of the app), and inform the seller if an instruction appears to infringe the GDPR.
• Ensure confidentiality: only authorised persons bound by confidentiality have access.
• Never sell, rent or use the data for other purposes, including advertising.
• Assist the seller in responding to data subject requests and with their security and impact assessment obligations.
• Make available the information needed to demonstrate compliance with this agreement, and allow an audit on reasonable request, at the seller's expense, with thirty days' notice.

6. Security measures

• Hosting in the European Union (OVHcloud in France, Supabase in Ireland), encrypted communications (HTTPS).
• Each seller's data isolated by database access rules (Row Level Security), tested automatically.
• Access tokens to connected services encrypted at rest (AES-256-GCM), never sent to the browser.
• Server access restricted to a dedicated module, secrets kept out of the code and the image.
• Signature checked on every notification received from connected services.
• Read-only access to connected services.

7. Sub-processors

The seller authorises the following sub-processors:

• OVH SAS (OVHcloud), app hosting, France;
• Supabase Inc., database and authentication, data centre in Ireland (EU);
• Resend Inc., sending sign-in and notification emails.

Kera Consulting informs the seller of any addition or replacement at least thirty days in advance by email or in the app; the seller may object by deleting their account. Each sub-processor is bound by obligations equivalent to this agreement.

8. Transfers outside the EU

The data is hosted in the European Union. If a sub-processor established outside the EU accesses it (for support, for example), the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

9. Data breaches

Kera Consulting notifies the seller of any personal data breach within forty-eight hours of becoming aware of it, with the information available (nature, data concerned, likely consequences, measures taken), so that the seller can notify the supervisory authority in time.

10. End of processing

When the account ends, Kera Consulting deletes the data of the seller and their customers, unless retention is required by law, and revokes access to connected services. Technical backups are erased according to their rotation cycle.

11. Contact

For any question about this agreement or the data: support@slygo.fr.