Merchant agreement
Data Processing Agreement
This agreement forms part of the ProfNerve Terms whenever ProfNerve processes personal data on behalf of a merchant.
1. Roles and scope
The merchant is controller of customer personal data and Carlos Bondia Casino, operating ProfNerve, acts as processor whereProfNervehandles that data on the merchant's behalf. Processing covers ecommerce analysis, reports, statistics, security and merchant-requested support.
2. Processing details
Processing may include authorised API collection, temporary retrieval, organisation, calculation, analysis, transmission to approved subprocessors, aggregation and deletion. Data subjects are merchant customers and prospective customers.
Current customer-data categories are technical customer identifiers and historical order counts. Orders, products and store statistics may also relate to individuals. ProfNerve does not request Shopify customer names, addresses, phone numbers or email addresses for the audit.
3. Instructions and confidentiality
ProfNerve processes personal data only on documented merchant instructions expressed through these terms, configured integrations and use of the service, unless law requires otherwise. Access is limited to authorised persons subject to confidentiality.
4. Security
ProfNerve applies encryption in transit, provider encryption and safeguards at rest, server-restricted integration credentials, authentication, ownership enforcement, least-privilege access, safe logging and vulnerability remediation appropriate to the processing risk.
5. Subprocessors
The merchant authorises Shopify, Supabase, Vercel and OpenAI as subprocessors where relevant. ProfNerve remains responsible for selecting providers with appropriate contractual and security commitments and will communicate material changes where reasonably possible.
6. Transfers, assistance and incidents
Restricted international transfers rely on a recognised legal safeguard. ProfNerve will reasonably assist with data-subject requests, security obligations and regulator enquiries. Confirmed personal-data breaches will be communicated without undue delay.
7. Return and deletion
Raw Shopify customer and order responses are not retained as customer lists. After disconnection or termination, related personal data is deleted or irreversibly anonymised within 30 days unless law requires limited retention. Verified Shopify privacy webhooks are documented access or deletion instructions.
8. Compliance information
ProfNerve will provide information reasonably necessary to demonstrate compliance and cooperate with proportionate audits, subject to confidentiality, security and reasonable notice. Contact privacy@profnerve.com. Agreement version 2026-09-05.