Data Processing Agreement

This agreement governs the data we process on your behalf: data of people who visit your shop, collected by the Quomerce script (session tracking, funnel, errors, session recordings) and by the Quomerce apps for shop platforms (e.g. Shopify). For this data, you are the controller and we are the processor within the meaning of Art. 28 GDPR.

This agreement is part of the Terms of Service, and you enter into it together with them — it does not need to be signed separately. If your organisation requires a signed version, write to privacy@quomerce.com and we will send it back electronically signed, with the same content.

1. Parties

Controller — the Customer within the meaning of the Terms of Service, i.e. the entity for which the Quomerce Account is maintained.

Processor — Quomerce sp. z o.o., registered office in Łódź, ul. Henryka Sienkiewicza 85/87 lok. 1, 90-057 Łódź, entered in the register of entrepreneurs of the KRS under number 0001251814, NIP 7252368482, REGON 545168861 (“Quomerce”).

Capitalised terms have the meaning given to them in the Terms of Service. The terms “personal data”, “processing”, “personal data breach” and others have the meaning given in the GDPR, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council.

2. Subject matter and duration

The Controller entrusts Quomerce with processing the personal data described in section 3 to the extent and for the purpose necessary to provide the session tracking Service and its related features (reports, alerts, AI assistant, export, access through the API and MCP).

This agreement remains in force for as long as Quomerce processes Entrusted Data, i.e. for the term of the service agreement and, after it ends, until the data is deleted in accordance with section 10.

3. Nature, purpose, type of data and categories of data subjects


Categories of data subjects	Visitors to the Controller’s website on which the Quomerce script or a Quomerce app for a shop platform is installed (the shop’s customers and prospective customers).
Type of data	Pseudonymous session and device identifiers; addresses of visited pages (with parameters outside the allowlist removed); traffic source (UTM, the name of the ad-click parameter, referring domain); on-page events (page views, clicks, scrolls, form interactions without the values typed); commerce events (product, cart, checkout, payment method, order ID and value); technical errors; session recording (page structure and appearance and cursor movements, with form fields masked); browser, operating system and device type, screen resolution, language; country determined from the IP address (the IP address itself is not stored); cookie consent status.
Special categories of data	Not entrusted. The Controller does not knowingly send them (see section 5).
Nature of processing	Collection, storage, structuring, aggregation, analysis, making available to the Controller and its Users, deletion.
Purpose	Showing the Controller how customers use the shop, where they abandon purchases and what technical errors they run into, together with alerts about those errors.

4. Quomerce’s obligations

Quomerce:

processes Entrusted Data only on the Controller’s documented instructions. The instructions are this agreement, the Terms of Service and the settings the Controller or its Users save in the Service (for example enabling tracking, the parameter allowlist, masking rules, deleting a website). If EU or Polish law requires us to process data beyond those instructions, we will inform the Controller before processing begins, unless that law prohibits it;
promptly informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law;
ensures that persons authorised to process Entrusted Data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;
applies the technical and organisational measures described in section 7;
does not use Entrusted Data for its own purposes — in particular for advertising, sale, profiling of individuals or training artificial intelligence models — and does not combine data of different customers. Aggregated technical statistics from which neither the Controller nor any individual can be singled out (for example system load or the number of events per second) are not personal data;
maintains the record of categories of processing activities referred to in Art. 30(2) GDPR.

5. The Controller’s obligations

The Controller is responsible for ensuring that the processing it instructs has a legal basis. In particular, the Controller:

informs visitors to the shop that it uses Quomerce in its privacy policy — a template clause is in the documentation;
obtains consent to storing and reading information on the user’s device where Art. 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej) or the law of the visitor’s country requires it, and passes its status to the Quomerce script (the consent function described in the documentation). Without consent, the script stores no persistent identifier, and sessions without consent are included in neither reports nor recordings;
does not place special categories of data, document numbers, passwords or full payment card details in page addresses, event names or fields sent to Quomerce, and marks fields that may contain such data for masking;
assesses whether its processing requires a data protection impact assessment (Art. 35 GDPR). On request, we will provide the information needed to carry it out.

6. Sub-processing (subprocessors)

The Controller gives Quomerce general authorisation to engage further processors. The current list, with the scope and place of processing, is on the Subprocessors page.

We give notice of an intended addition or replacement of a subprocessor at least 14 days in advance, by e-mail to the Account owner and on the Subprocessors page. During that time the Controller may raise a reasoned objection. If we do not agree on a solution, the Controller may terminate the service agreement with immediate effect before the change takes effect, and we will refund the fee for the unused, prepaid period.

We bind each subprocessor by a contract imposing data protection obligations at least equal to those in this agreement. We are liable to the Controller for its acts as for our own.

7. Security

Quomerce applies measures appropriate to the risk (Art. 32 GDPR), including:

Minimisation in the script. Values typed into form fields are not collected; password and payment fields and fields marked by the Controller are masked in the recording; digit strings resembling phone numbers and e-mail addresses are replaced with placeholders; only allowlisted parameters remain in page addresses, and ad-click identifiers are never stored; on checkout, thank-you and account pages the recording masks all text; the IP address is used only to determine the country and is neither stored nor logged; the full user-agent string is not stored, only the device type, browser and operating system; sessions of automated browsers are not recorded.
Encryption of all communication (TLS) between the browser, the data collection service and the application.
Customer isolation. Every query to the event database is bound to the website identifier derived from the user’s permissions, not from the content of the query; access is read-only, with limits on time and number of rows.
Access control. Owner, manager and viewer roles in the Account; passwords stored as one-way hashes; API tokens stored as hashes, with an expiry date and the option to revoke them; Quomerce staff access limited to support needs and recorded in the administrative action log.
Limited retention according to section 10, with automatic deletion of whole data partitions.
Processing in the EEA (section 9), availability monitoring and technical logs without IP addresses or visitor data.

We may change these measures as long as this does not lower the overall level of protection.

8. Assistance to the Controller

Taking into account the nature of the processing, Quomerce assists the Controller:

in responding to data subject requests (access, erasure, objection). Data in Quomerce is pseudonymous. The Controller can delete a visitor’s data itself in the application (by visitor identifier), or give us a session identifier, an order ID, or a time period and page — we will then find and delete the matching data within 14 days of the request. A request that comes directly to us will be passed on to the Controller without our answering it on our own behalf;
with data protection impact assessments and prior consultations with the supervisory authority;
in meeting the obligations under Art. 32–36 GDPR.

9. Place of processing and data transfers

Entrusted Data is stored in the European Economic Area. If a subprocessor processes it outside the EEA (see the list of subprocessors), the transfer relies on a Commission decision finding an adequate level of protection (including the EU-US Data Privacy Framework, if the recipient is covered by it) or on Standard Contractual Clauses, together with a transfer impact assessment.

10. Retention and deletion of data

During the agreement, data is deleted automatically:

Data	Period
Session recordings	2 days, and then — depending on what happened in the session — up to 7, 14 or 30 days in total (longest for sessions with an order, a cart, a checkout or an open issue)
Events, errors and orders	The period set for the Website: 400 days by default; the Controller may shorten it to 30 days
Session summaries and aggregated funnel statistics	400 days

Deleting a website in the Service orders the deletion of all of its data from the event store; this is carried out within 7 days. Uninstalling a Quomerce app from a shop (e.g. Shopify) stops data collection but does not delete the data — deleting the website does. After the agreement ends, the Controller has 30 days to download the data (section 17.5 of the Terms of Service), and we then delete the Entrusted Data within a further 30 days, unless EU or Polish law requires it to be kept.

11. Personal data breaches

Quomerce notifies the Controller of a breach of Entrusted Data without undue delay, and no later than 48 hours after becoming aware of it, by e-mail to the Account owner. The notification contains the information referred to in Art. 33(3) GDPR that is known to us, and is supplemented as we learn more. Notifying the supervisory authority and the data subjects is the Controller’s responsibility; we will help with it.

12. Audits

Quomerce makes available to the Controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR — first of all a description of the security measures, the list of subprocessors and answers to a security questionnaire.

If this is not enough, the Controller may carry out an audit itself or through an independent auditor bound by confidentiality, with at least 21 days’ prior notice, during business hours, no more than once a year (unless the audit follows a personal data breach or is requested by the supervisory authority), and in a way that does not compromise security or the data of other customers. Each party bears its own costs of the audit.

13. Liability

The parties’ liability for damage resulting from the processing of Entrusted Data is governed by Art. 82 GDPR. As between the parties, the limitations of liability in the Terms of Service apply, to the extent permitted by law.

14. Final provisions

Matters not governed by this agreement are governed by the Terms of Service and the GDPR. In case of conflict between the Terms of Service and this agreement regarding personal data protection, this agreement prevails. We amend this agreement in the manner provided in the Terms of Service for amendments to them.

This agreement is drawn up in Polish and English. In case of any discrepancy, the Polish version prevails.