Data Processing Agreement
Last updated: 2026-10-19
This agreement applies when ScaleX (Julien Roques EI) ("Processor") processes personal data on behalf of a merchant using Velto ("Controller"), in line with Article 28 of the GDPR.
Subject and duration
The Processor processes shoppers' personal data only to provide the Velto applications the Controller turns on, for as long as Velto is installed, and deletes it as described below.
Categories of data and data subjects
- Data subjects: the Controller's shoppers and customers.
- Data: names, emails, phone numbers (if collected), customer account IDs, order numbers and items, reviews and photos, consent records, one-way IP hashes.
Processor's obligations
- Process data only on the Controller's documented instructions, given through the app's settings.
- Ensure that people with access are bound by confidentiality.
- Apply appropriate security measures: encryption in transit and at rest, verified requests, restricted database access, encrypted API keys, access logging.
- Help the Controller answer data subjects' requests and meet its obligations (security, breach notification, impact assessments).
- Notify the Controller without undue delay after becoming aware of a personal data breach.
- Delete all personal data at the end of the service, through Shopify's deletion requests, unless the law requires keeping it.
- Make available the information needed to demonstrate compliance.
Sub-processors
The Controller authorizes the following sub-processors. The Processor informs the Controller of any change and the Controller may object.
- Vercel Inc. (hosting)
- Supabase Inc. (database, EU region)
International transfers
Where data is transferred outside the European Economic Area, the transfer relies on the EU Standard Contractual Clauses or an adequacy decision, through the sub-processors' terms.
Contact
ScaleX (Julien Roques EI), 69 A chemin de Fray Join, 82700 Finhan, France (SIREN 920 374 493) — julien.roques22@gmail.com.