Data processing agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the customer that accepts it when creating a Shelf by Markapp account (the “Customer”, controller) and MARKAPP SINGLE MEMBER P.C. (MARKAPP ΜΟΝΟΠΡΟΣΩΠΗ ΙΚΕ, “Markapp”, “we”), a Greek private company registered in the General Commercial Registry (GEMI) under number 179276637000, VAT ID EL802596347, registered office I. Kapodistriou 33, Vello, Corinth 20002, Greece (the “Processor”). It applies to personal data the Processor processes for the Customer when providing Shelf, and forms part of the Terms of service.

2. Subject matter and nature

The Service measures brands in AI answers. It is not designed to process personal data of the Customer’s customers. Personal data processed for the Customer is limited to: the Customer’s users (names, work emails, roles, sign-in data); any personal data the Customer chooses to include in questions, notes or uploaded files (which the Customer should avoid); and website logs or exports the Customer chooses to upload for the readiness audit.

3. Processor obligations

• Process personal data only on the Customer’s documented instructions, including these terms.
• Ensure that people authorised to process it are bound by confidentiality.
• Apply the security measures in section 6.
• Use sub-processors only as set out in section 5.
• Help the Customer respond to data subject requests and meet its obligations on security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing.
• Notify the Customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting the Customer’s data.
• At the end of the Service, delete the Customer’s personal data after the 90-day export window, unless the law requires longer storage.
• Make available the information needed to show compliance with Article 28 GDPR and allow for reasonable audits, on 30 days’ notice and no more than once a year.

4. Customer obligations

The Customer ensures it has a lawful basis for any personal data it gives the Processor and does not upload personal data it does not need to.

5. Sub-processors

The Customer authorises the following sub-processors. The Processor informs the Customer of any intended change at least 30 days in advance by email or in the app, and the Customer may object on reasonable grounds.

• Render Services, Inc.: hosting and database (EU, Frankfurt).
• GitHub, Inc.: result storage and measurement jobs.
• Revolut: payments.
• Brevo (Sendinblue SAS): account emails.
• Anthropic, OpenAI, Google, Perplexity and DataForSEO: AI answers and search data (receive brand and market questions, not user data).

6. Security measures

• Encryption in transit (HTTPS) and at rest at the hosting provider.
• Salted scrypt password hashes; signed sessions that expire after 12 hours.
• Strict separation of customer accounts; least-privilege access for staff.
• Rate limits on sign-up, sign-in and checkout; protection against cross-site requests.
• Audit log of staff actions; backups at the hosting provider.
• Card data handled only by Revolut.

7. International transfers

Where a sub-processor processes personal data outside the EEA, the transfer relies on the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework where the sub-processor is certified.

8. Term and precedence

This DPA lasts as long as the Processor processes personal data for the Customer. If it conflicts with the Terms of service on data protection, this DPA prevails.

9. Contact

Data protection contact: adtech@markappmedia.site.