Auftragsverarbeitungsvertrag (DPA)

Diese Vereinbarung ist auf Englisch und Griechisch verfügbar. Unten steht der englische Text.

Version 1.0 · 16 October 2026

This agreement sets out how INWEBPRO processes personal data on behalf of the stores that use ThunderBar, in accordance with Article 28 of the General Data Protection Regulation (GDPR). It applies together with the Terms of Service and the Privacy Policy for as long as the subscription lasts, and is accepted by signing up for or using the service. If you need a signed copy, write to info@thunderbar.io.

1. Parties

Controller: the business that has a ThunderBar account and uses it on its online store ("the store").
Processor: INWEBPRO (InWebPro Ltd), Ir. Polytechneiou 73A, 124 62 Chaidari, Greece ("INWEBPRO").

2. Subject matter and purpose

INWEBPRO processes data only to provide the ThunderBar service to the store: product search and suggestions, statistics and reports, measuring sales from search, availability alerts (if the store turns them on), and the security of the service and its protection against abuse. It does not use the data for its own purposes, does not sell it and does not share it with its other customers.

3. Whose data and which data

Data subjects: the visitors and customers of the store's online shop (and its staff, when they use the online shop from its physical stores). We do not process special categories of data or card details.

Data	Retention
Searches: the words, how many results were found, device type, approximate country	For the duration of the contract
Clicks, "add to cart" and wishlist from results and recommendations	For the duration of the contract
Orders from search or recommendations: order number, products, amounts, status, payment method (no name, address, phone or email)	For the duration of the contract
Random visitor identifier (`tb_vid`, only with personalisation) and a hashed identifier for logged-in customers	Cookie 12 months; in statistics for the duration of the contract
IP address with searches, clicks and cart events, for security and abuse prevention only	In full for 7 days, then network only, deleted after 90 days
Email for "Notify me when it is back" (if the store turns it on)	At most 90 days

4. INWEBPRO's obligations

It processes the data only on the store's instructions. Instructions are the use of the service, the store's settings in its dashboard and anything it asks us in writing.
Everyone with access to the data is bound by confidentiality.
It applies the security measures in section 7.
It helps the store respond to visitors' requests (access, erasure etc.) and, where needed, with impact assessments.
It informs the store of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information it has.
It gives the store the information it needs to verify compliance with this agreement.

5. The store's obligations

It has a legal basis for the processing and informs its visitors in its own privacy and cookie policy (among other things about tb_vid and tb_attr, which are described in our Privacy Policy).
If it declares the IP addresses of its physical stores, it declares only addresses of its own.
It tells us without delay about visitors' requests that concern ThunderBar data.

6. Sub-processors and transfers

The service runs on our own servers within the European Union (or, if agreed, on a server of the store itself). Emails are also sent from there, unless the store chooses its own mail server.

Anthropic (Claude, USA), for the AI features: the text of a search when a complex phrase needs to be understood (without visitor identifiers) and aggregated data for reports and texts. No IP addresses, emails, names or order details. The transfer takes place under the provider's commercial terms and data processing agreement.
Public IP address registries (e.g. RIPE NCC): only to check a suspicious network, the registry may be asked who holds it. Only the network address is sent.
Google Analytics 4 and the Meta Pixel, if the store uses them, receive events directly from the visitor's browser into the store's own accounts; INWEBPRO does not receive them.

For any new sub-processor that processes visitors' data, we will inform stores by email at least 30 days in advance. The store may object and, if no solution is found, terminate the subscription without charge for the remaining period.

7. Security measures

Servers in a physically secured data centre within the EU; encrypted connections (HTTPS).
Role-based access (owner, admin, view only) and staff access only where needed; hashed passwords, lockout after failed attempts.
Minimisation: no customer names, emails or addresses in statistics; visitor identifiers are random or hashed; IP addresses only for security, with the retention in section 3.
Encrypted passwords for stores' mail servers, rate limits, logging of administrative actions, backups.

8. End of the contract

When the subscription ends, and after the store has had the opportunity to download its statistics (CSV), INWEBPRO deletes the store's data within 30 days. Backups are cleared in their normal rotation. We keep nothing unless the law requires it.

9. Liability and changes

Each party is responsible for its own obligations under the GDPR. Otherwise the Terms of Service apply. If anything material changes in this agreement, we will inform stores by email before it takes effect.

10. Contact

INWEBPRO (InWebPro Ltd), Ir. Polytechneiou 73A, 124 62 Chaidari, Greece · info@thunderbar.io