Data Processing Agreement

Data controller: the customer that accepts the Terms of Service. Data processor: KDI ApS, Danish company registration number (CVR) 46525892, Thors Allé 1, 4673 Rødvig Stevns, Denmark.

This agreement governs the personal data the processor processes on the controller's behalf when providing Recortex, as described in Annex A, in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR). How the processor handles personal data as controller — accounts, sign-in, its own correspondence — is described in the Privacy Policy and is not covered here.

The processor processes the personal data only on documented instructions from the controller: this agreement, the Terms of Service, Annex C, and the controller's own choices in Recortex (which systems it connects, which accounts it selects, what it writes in its Playbook). The processor informs the controller immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

Only persons who need access to provide Recortex have access to the personal data, and they are bound by confidentiality.

The processor implements the technical and organisational measures in Annex C, appropriate to the risk (GDPR Article 32).

The controller gives general authorisation for the sub-processors in Annex B. The processor notifies the controller by email at least 30 days before adding or replacing a sub-processor. The controller may object within that period; if the parties cannot agree, the controller may end the agreement before the change takes effect. The processor imposes the same data protection obligations on each sub-processor by contract and remains responsible to the controller for them.

Personal data is transferred outside the EU/EEA only as set out in Annex B, on the basis of the EU Standard Contractual Clauses in the relevant sub-processor's data processing agreement.

Taking into account the nature of the processing, the processor assists the controller with requests from data subjects (GDPR Articles 12–23) and with its obligations under Articles 32–36, including by passing on without delay any request it receives directly.

The processor notifies the controller without undue delay after becoming aware of a personal data breach, with the information the controller needs to meet its own obligations (GDPR Article 33(3)), and keeps the controller informed as more becomes known.

When the agreement ends, the processor deletes all personal data processed for the controller within 30 days, unless law requires it to be kept. The controller may ask for its data to be returned before then. Deleted data can remain in the hosting provider's daily backups for up to 7 days.

During the agreement, figures computed from connected systems are kept for 24 months and then deleted, and a Shopify store's data is deleted within 30 days after Recortex is uninstalled in Shopify †. A connection error, an expired access or a disconnected system does not end the agreement.

The processor makes available the information necessary to demonstrate compliance with this agreement. The controller, or an auditor it appoints who is bound by confidentiality, may carry out an inspection with reasonable notice, at the controller's cost, no more than once a year unless a breach gives reason to.

This agreement applies for as long as the processor processes personal data for the controller. Liability follows the Terms of Service. Danish law applies, and disputes are settled by the Danish courts.

† Shopify and e-conomic cannot be connected yet. The processing below that concerns them applies from the day each becomes available. Meta works only in a separate, restricted review environment run for Meta's review of Recortex; general access awaits Meta's approval. Google Ads can be connected only by the customers taking part in the Google Ads pilot. Klaviyo can be connected only by the customers taking part in the Klaviyo pilot.

Purpose. To show the controller whether its marketing pays for itself and to propose actions, from figures read from the systems it connects and from what it writes in its Playbook.

Nature. Reading from connected systems; on the controller's documented instruction — its owner's approval of one exact change in Recortex — writing one value to Meta, the daily budget of a campaign or ad set, within the controller's limits, and reading it back; on the same kind of instruction, writing one value to Klaviyo — the planned send time of a campaign that is still a draft, or a flow's status set to draft, only for a flow in which Klaviyo marks no message as transactional and every step can be classified — and reading it back (never sending, scheduling or setting anything live); summing into daily and monthly figures, storing those figures, computing findings and proposed actions, displaying them to the controller's users, and — for recommendations built on Shopify figures — having their wording phrased by a sub-processor (Annex B). No automated decisions about individual people, no profiling, no sale of data, no training of AI models.

Meta ad data is account-level (spend and the purchase value Meta attributes to its own ads, per day) and contains no personal data. The record of an approved budget change contains the email address of the controller's user who approved it. Google Ads data is account-level (cost and the conversion value Google Ads reports, per day, and the account's id, name, currency and time zone) and contains no personal data. Klaviyo data is account-level (per month, the conversion value and number of conversions Klaviyo attributes to all campaigns together and to all flows together; the account's id, organisation name, currency and time zone; the chosen metric) and contains no data about the controller's customers. The record of an approved Klaviyo change names the campaign or flow and its status and planned send time before and after, and contains the email address of the controller's user who approved it.

Duration. For the term of the Terms of Service, and until deletion under section 9.

† The measures marked † concern connected systems. They apply to Meta, Google Ads and Klaviyo now, and to Shopify and e-conomic from the day each becomes available.

• Read-only access to connected systems, with two exceptions, each written only on the controller's documented instruction (its owner's approval of that exact change) and read back: a Meta daily budget, within the controller's limits; and in Klaviyo, a draft campaign's planned send time or a flow's status set to draft. A flow is set to draft only if Klaviyo marks none of its messages as transactional and every step can be classified, checked when the change is proposed and again just before it is made. Recortex's own code refuses every other request to Klaviyo, although the permission Klaviyo grants is wider. Nothing else is ever written. †
• Data minimisation: only the fields listed in Annex A are requested; figures are stored as daily or monthly totals. †
• Nothing from Google Ads, Klaviyo or e-conomic — no figures and nothing calculated from them — and no figures from Meta are sent to an AI service. The AI sub-processor may see the size of a proposed change to ad spend as a percentage of the ad spend Meta reports, never an amount. † Text sent to the AI sub-processor is checked for identifier patterns (email addresses, identification numbers, account and token formats) and not sent if one is found.
• Encryption in transit (TLS) everywhere; database storage encrypted at rest by the hosting provider.
• Access credentials for connected systems are stored in a separate encrypted store readable only by the service itself, and are deleted at once on disconnect or uninstall; for Google Ads, Recortex also asks Google to revoke the access; for Klaviyo, Recortex also asks Klaviyo to revoke the access. †
• Each customer's data is isolated from every other customer's by the database's own row-level security, not only by the application.
• No access credential is written to the processor's own logs or error records, and none travels in a web address. †
• The 24-month period in section 9 is enforced by a scheduled job; deletion at the end of the agreement is carried out by the processor within the 30 days.