Data processing agreement

SIA "Advento.pro", registration no. 40203689734, Latvia. Last updated: 14 October 2026.

This data processing agreement ("DPA") is part of the Advento App terms of service ("Terms"). You accept it, for your business, when you tick the box at sign-up or install Advento App from the Shopify App Store. It applies for as long as we process personal data for you. It meets Article 28(3) of the EU GDPR and of the UK GDPR.

1. Parties and roles

1. You, the business that holds the Advento App account, are the controller. SIA "Advento.pro", registration no. 40203689734, Jēkabpils nov., Viesīte, Brīvības iela 6-7, LV-5237, Latvia ("Advento", "we") is the processor.
2. If this DPA and the Terms disagree about personal data, this DPA wins. Where the EU Standard Contractual Clauses or the UK Addendum apply, they win over both.
3. For your own staff's account data (name, email, sign-in records, billing contact) we are a separate controller, as described in our privacy policy.

2. What we process, and why

We process personal data only to run Advento App for you: to read your connected platforms, work out your profit and leaks, show them to your team and send the emails and alerts your team chooses. The details are in Annex 1.

3. Your instructions

1. We process personal data only on your documented instructions. The Terms, this DPA and the settings you choose in the app (which platforms you connect, who you invite, which emails go out) are your instructions.
2. If the law makes us process data in another way, we tell you first, unless the law forbids it.
3. If we think an instruction breaks data protection law, we tell you straight away and may pause that instruction until you confirm or change it.

4. Confidentiality

Everyone at Advento who can reach your data is bound by a duty of confidentiality, and only the people who need it to run or support the service get access. Every time a member of our staff opens your workspace, it is logged.

5. Security

We keep the technical and organisational measures in Annex 2, and review them at least once a year. We may improve them, but never lower the overall protection.

6. Sub-processors

1. You give us general authorisation to use sub-processors. The current list is in Annex 3 and on our sub-processors page.
2. We tell you by email at least 30 days before we add or replace a sub-processor. You can object on reasonable data protection grounds within that time. If we cannot meet your objection, you can end the Terms and we refund any period paid in advance and not used.
3. Each sub-processor is bound by a written contract with data protection duties no weaker than this DPA. We remain responsible to you for them.

7. Help with people's requests

1. We help you answer requests from people using their rights under data protection law.
2. Shopify's customer data requests and customer deletion requests are handled automatically. Other requests we answer within 10 working days of you asking us.
3. If a person contacts us directly about data we process for you, we pass the request to you and do not answer it ourselves unless you ask us to.

8. Personal data breaches

1. If we become aware of a personal data breach affecting your data, we tell you without undue delay and within 48 hours.
2. We give you what we know of the details Article 33(3) GDPR asks for: what happened, the kinds and rough numbers of people and records, the likely effects, and what we have done and will do. We send more as we learn it.
3. We help you meet your own duties to tell the authorities and the people affected.

9. Impact assessments

We give you the information you reasonably need for a data protection impact assessment, or for a prior consultation with a supervisory authority, about Advento App.

10. Deletion and return at the end

1. You can download your data in the app at any time, and delete your workspace yourself at any time. If you delete it, it is deleted at once.
2. If the service stops (the trial ends without a plan, a payment fails, or you cancel), we keep your data for 30 days, out of use, so you can come back. After 30 days it is deleted.
3. Data read for a free money scan is deleted 7 days after the scan, unless you start a plan or ask for the free Monday report.
4. Backups expire within 35 days. We keep nothing after that, unless the law requires us to.

11. Audits

1. We make available the information needed to show we meet this DPA. Once a year, on request, we answer a reasonable written security questionnaire.
2. An on-site audit takes place only if the law or a supervisory authority requires it, or after a personal data breach affecting your data. It needs 30 days notice, happens in working hours, is at your cost, and is carried out by you or an independent auditor bound by confidentiality.

12. International transfers

1. We store your data only in the EU, in Railway's EU West region (Netherlands).
2. Transfers outside the UK and EU go only to the sub-processors in Annex 3, and rely on an adequacy decision (including the EU-U.S. Data Privacy Framework and its UK Extension) or, where there is none, the EU Standard Contractual Clauses (module 3, processor to processor) with the UK Addendum.

13. Liability and term

Each party's liability under this DPA is as set out in the Terms. This DPA lasts as long as we process personal data for you, and ends when that data has been deleted.

Annex 1: processing details

Annex 2: security measures

• Encryption: all traffic over TLS. Platform connection tokens encrypted at rest and never shown on a screen.
• Keeping workspaces apart: every query is limited to one workspace, enforced in the database with row level security.
• Read only access: we ask each platform for read access only, and the smallest scope that works.
• Data minimisation: we never request shoppers' names, emails, phone numbers or addresses. Customer numbers are kept only as one-way hashes.
• Access control: least privilege for staff; sign-in by one-time email code or a trusted sign-in provider, never a stored password; owners choose which areas each team member sees; staff access to a workspace is logged.
• Logs: an audit log of sign-ins, connections, plan changes, exports and deletions; secrets are never written to logs.
• Limits: rate limits on sign-in and on the API.
• Backups: regular database backups in the EU, expiring within 35 days.
• Incidents: a written incident response plan; you are told of a breach within 48 hours.
• Development: source code holds no real customer data; test data is made up.
• People: staff are bound by confidentiality and trained in handling data.
• Review: these measures are reviewed at least once a year.

Annex 3: sub-processors

The current list, with changes announced 30 days ahead, is on our sub-processors page.

Contact

SIA "Advento.pro", registration no. 40203689734
Jēkabpils nov., Viesīte, Brīvības iela 6-7, LV-5237, Latvia
Privacy: [email protected]