Wheelluck
Data Processing Agreement
Effective date: 14 November 2026
This Data Processing Agreement ("DPA") is part of the Terms of Service between Pulsaron Software B.V., Strevelsweg 781, 3083 LS Rotterdam, the Netherlands, KvK 89912462 ("Pulsaron", the "Processor") and the business that uses our Services (the "Merchant", the "Controller"). It applies whenever Pulsaron processes personal data on the Merchant's behalf, and meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Terms not defined here have the meaning given in the GDPR or the Terms of Service.
1. Roles
The Merchant is the controller of the personal data of its shoppers that the Services process. Pulsaron is the processor. For data about the Merchant itself and its staff, Pulsaron is a controller, as described in the Privacy Policy.
2. Details of processing
| Subject matter | Providing the Services the Merchant uses: showing popups and other storefront widgets, collecting form submissions, measuring campaigns and attributing orders, and sending data to services the Merchant connects |
| Duration | As long as the Merchant uses the Services, and afterwards until the data is deleted under section 9 |
| Nature of processing | Collection, storage, organisation, analysis, transfer to connected services on the Merchant's request, and deletion |
| Purpose | Only to provide the Services to the Merchant |
| Data subjects | Visitors and customers of the Merchant's online store |
| Categories of personal data | Random visitor identifier and interaction data (popups shown, closed or clicked, codes copied, page address, country, and whether the visitor is in a test or control group used to measure a campaign); order data (order ID and number, total, currency, discount code used); form submissions (email address, phone number, answers to form questions, the page the form was sent from, and marketing and SMS consent with the consent text and the time it was given); technical data (IP address and browser details) |
| Special categories | None. The Services are not designed to process special categories of personal data, and the Merchant will not use them to collect such data |
3. Instructions
Pulsaron processes personal data only on the Merchant's documented instructions. These Terms, this DPA and the Merchant's settings and actions in the Services are those instructions. Pulsaron will tell the Merchant without delay if it believes an instruction breaks the GDPR or other data protection law. Where the law requires Pulsaron to process data in another way, it will tell the Merchant first, unless the law forbids that.
4. Confidentiality
Pulsaron ensures that everyone authorised to process the personal data is bound by confidentiality.
5. Security
Pulsaron takes appropriate technical and organisational measures to protect the personal data, including those listed in Annex 1, and reviews them regularly.
6. Sub-processors
The Merchant gives general authorisation for Pulsaron to use sub-processors. The current list is in the Privacy Policy. Pulsaron announces a new or replacement sub-processor there at least 14 days before it starts processing. The Merchant can object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Merchant may end the affected Service and receive a refund of the unused part of any prepaid period.
Pulsaron imposes data protection obligations on each sub-processor by written contract that are no less protective than this DPA, and remains responsible to the Merchant for its sub-processors' performance.
7. Assistance
Taking into account the nature of the processing, Pulsaron helps the Merchant:
- respond to requests from data subjects exercising their rights. If a data subject contacts Pulsaron directly about the Merchant's data, Pulsaron forwards the request to the Merchant and does not answer it without the Merchant's instruction;
- meet its obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority.
8. Personal data breaches
Pulsaron notifies the Merchant without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Merchant's data. The notice describes, as far as known, the nature of the breach, the data and data subjects affected, the likely consequences and the measures taken or proposed. Pulsaron adds information as it becomes available.
9. Deletion and return
When the Merchant stops using a Service, the Merchant can ask Pulsaron to return the personal data in a common machine-readable format or to delete it. Pulsaron does so within 30 days of the request, and also deletes the data when a platform sends a data-deletion request for the Merchant's store. Until then, Pulsaron keeps the data so the Merchant can reconnect without losing its campaigns, and processes it for no other purpose. Copies in backups are deleted as the backups expire. Pulsaron may keep data where the law requires it.
10. Audits
Pulsaron makes available to the Merchant the information needed to show compliance with Article 28 of the GDPR. If that information is not enough, the Merchant, or an independent auditor it appoints who is bound by confidentiality, may audit Pulsaron's compliance with this DPA once a year with at least 30 days' written notice, during business hours and without disrupting Pulsaron's operations. Each party bears its own costs, unless the audit shows a material breach by Pulsaron. Audits requested by a supervisory authority are not limited in this way.
11. International transfers
Pulsaron hosts the personal data in the European Union. Pulsaron transfers it outside the European Economic Area only to the sub-processors listed in the Privacy Policy, under an adequacy decision, the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
12. Liability and precedence
Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow them. If this DPA conflicts with the Terms of Service or a product-specific condition, this DPA prevails on the processing of personal data.
Annex 1: Technical and organisational measures
- Hosting: servers and databases in a data centre in the European Union (Lithuania).
- Encryption in transit: all traffic to and from the Services uses TLS. Requests between a store and the Services are signed and verified.
- Encryption at rest: platform access tokens and API keys are encrypted in the database.
- Separation: each store's data is kept separate by store, and every request is checked against the store it belongs to.
- Access control: access to production systems is limited to staff who need it for their work.
- Data minimisation: IP addresses are used to derive the country and to prevent abuse, and are not stored with interaction data. Error reports leave out personal data such as IP addresses.
- Logs: technical logs are kept for up to 90 days.