Data Processing Agreement (DPA)

Last updated: 13 October 2026  ·  Version 1.0  ·  privacy@synqo-one.com

This is a translation provided for convenience. In case of any discrepancy, the Italian version prevails.

1. Parties and subject matter

This agreement is entered into pursuant to Art. 28 of Regulation (EU) 2016/679 ("GDPR") between:

• the Customer, i.e. the company or professional holding a Synqo One account, acting as controller;
• 3.0 SRL, Via Canaletta 49, 40027 Mordano (BO), VAT no. 03685161204, which provides Synqo One and acts as processor (the "Processor").

This agreement forms part of the Terms of Service and is accepted together with them. It governs the personal data that the Processor processes on behalf of the Customer in providing Synqo One. It does not cover the data of the account of the Customer and its users, for which 3.0 SRL is the controller (see the Privacy Policy).

2. Nature, purpose and duration

The Processor processes the data solely to provide the Service requested by the Customer: synchronising products, stock, prices and orders across the sales channels connected by the Customer, calculating costs and margins, showing orders and statistics, and enabling the Customer to ship orders. The processing lasts as long as the contract, subject to the provisions of point 10.

3. Data subjects and data processed

• Data subjects: the buyers who purchase from the Customer on the connected channels (for example Amazon, Shopify, WooCommerce, Discogs, Temu).
• Order data, retained: order identifier, date and status, products, quantities and amounts. No buyer contact data.
• Shipping data, not retained: the buyer's name, company, delivery address and telephone number, read from the channel only when an administrator of the Customer opens them in order to ship, shown and not saved in any archive, backup or log.

No special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR) are processed.

4. Customer's instructions

The Processor processes the data only on documented instructions from the Customer. The Terms of Service, this agreement and the settings the Customer chooses in the Service (for example which channels to connect) constitute instructions. If an instruction appears to infringe the GDPR or other provisions, the Processor informs the Customer immediately. The Processor does not use the data for its own purposes, for advertising or profiling, and does not sell or disclose it.

5. Confidentiality

Only persons authorised by the Processor who need the data for the Service (support, maintenance, security), and who are bound by confidentiality, have access to the data.

6. Security measures

The Processor adopts the measures of Art. 32 GDPR, including:

• encrypted connections (HTTPS, TLS 1.2 or higher) to the Customer and to the sales channels;
• encrypted server disks (256-bit AES), with the key kept on a separate server;
• a firewall with only the web ports open, a database not reachable from the internet, and administrative access only through an encrypted private network and SSH keys;
• data of different customers separated at database level (row-level security);
• sales channel credentials stored in encrypted form;
• shipping data visible only to the Customer's administrators with two-step verification enabled, with a maximum number of openings per day and each opening recorded;
• a security log retained for 90 days;
• daily backups encrypted before leaving the server, kept in the EU;
• regular security updates and a written incident response plan.

Details are set out in the Security Policy. The Processor may update these measures without reducing the level of protection.

7. Sub-processors

The Customer authorises the Processor to engage the following sub-processors:

• Hetzner Online GmbH (Germany) — servers and disks, in Finland (EU);
• Backblaze, Inc. — storage of encrypted backups, in the EU (the Netherlands); Backblaze does not hold the key to read them.

The sales channels (Amazon, Shopify, WooCommerce, Discogs, Temu and others) are not sub-processors: they are the sources from which the Customer has chosen to have the data read, and they process the data of their own users under their own terms. The Processor binds each sub-processor to data protection obligations equivalent to these. It notifies the Customer of the addition or replacement of a sub-processor at least 30 days in advance; the Customer may object on reasonable grounds and, if no solution is found, withdraw from the contract.

8. Assistance to the Customer

The Processor assists the Customer, within the limits of what it processes, in responding to requests from data subjects (access, erasure and the other rights under Arts. 15–22 GDPR), in assessing the impact of the processing and in consulting the supervisory authority. If a data subject contacts the Processor directly, the request is forwarded to the Customer without delay. For shipping data the answer is simple: the Processor does not retain it.

9. Data breaches

The Processor informs the Customer without undue delay, and in any case within 48 hours of discovery, of any breach concerning the data processed on its behalf. The notification describes, as far as is known: the nature of the breach, the data subjects and data concerned, the likely consequences and the measures taken or proposed. Information not yet available is provided as soon as it becomes known. The Processor also informs the sales channels concerned within the terms of their respective agreements.

10. End of the contract

At the end of the contract the Processor deletes the data processed on behalf of the Customer within 30 days. Copies in backups expire within the following 30 days, according to the normal rotation. Before deletion, the Customer may request an export of its order data by writing to privacy@synqo-one.com. Data that the Processor is required to retain by law is excluded.

11. Audits

The Processor makes available to the Customer the information necessary to demonstrate compliance with this agreement. The Customer may request an audit, including through an auditor bound by confidentiality, with at least 30 days' notice and no more than once a year, except in the event of a data breach or a request from an authority. Audits are carried out without compromising the security and confidentiality of other customers' data.

12. Transfers outside the EU

The data processed on behalf of the Customer remains in the European Union. Any future transfer will take place only with the safeguards of Chapter V of the GDPR (for example Standard Contractual Clauses) and with prior notice to the Customer as set out in point 7.

13. Final provisions

In the event of conflict between this agreement and the Terms of Service, this agreement prevails as regards the protection of personal data. This agreement is governed by Italian law; the place of jurisdiction is the one indicated in the Terms of Service.

14. Contact