Data Processing Agreement
Last updated: 19 October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("you") and Web Extreme Ltd., Ivan Peichev St. 10, Sofia, Bulgaria ("we"). It applies whenever we process personal data on your behalf through asksebastian.ai and meets the requirements of Article 28 GDPR. If it conflicts with the Terms on personal data, this DPA prevails.
1. Roles
For personal data in your account's seller data and content, you are the controller and we are the processor. For your account, billing and support data we act as an independent controller under our Privacy Policy.
2. Details of processing
| Subject matter | Providing the Service: syncing, storing, analyzing and reporting on Amazon seller data, AI assistance, monitoring and listing management. |
|---|---|
| Duration | The term of your account plus the deletion periods in section 9. |
| Nature and purpose | Collection from Amazon APIs, storage, structuring, analysis, AI processing, display, transmission to Amazon on your instruction, and deletion. |
| Data subjects | Your users; buyers and other people whose data appears in your Amazon data; your business contacts mentioned in content you create. |
| Categories of data | Names, email addresses and user identifiers; order data Amazon provides to your account, such as order identifiers and delivery locations; questions and content you enter. No special categories of data are intended. |
3. Our obligations
- We process personal data only on your documented instructions — these terms and your use of the Service — unless the law requires otherwise, in which case we tell you unless prohibited.
- Everyone we authorize to process the data is bound by confidentiality.
- We implement the security measures in section 4.
- We help you respond to data subject requests and with data protection impact assessments and consultations, taking into account the nature of the processing.
- We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
4. Security measures
- TLS encryption in transit; encryption at rest of Amazon tokens, two-factor secrets and other credentials.
- Account isolation enforced at the database layer, failing closed when no account context is present.
- Role-based permissions, per-store access limits, two-factor authentication and revocable, store-limited API keys.
- Restricted, need-to-know production access; logging of security events and of changes sent to Amazon.
- Backups and recovery procedures; regular review and updating of these measures.
More detail is on our Security page.
5. Subprocessors
You authorize us to use the subprocessors listed in our Privacy Policy. We bind each subprocessor to data protection obligations at least as protective as this DPA and remain responsible for them. We will notify you by email at least 30 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected Service and receive a refund of prepaid fees for the remaining period.
6. International transfers
Where personal data is transferred outside the European Economic Area, we ensure an adequacy decision applies or use the European Commission's Standard Contractual Clauses with our subprocessors, with supplementary measures where needed.
7. Data subject requests
If we receive a request from a data subject about your data, we forward it to you and do not respond ourselves except to confirm the forwarding, unless you instruct otherwise.
8. Audits
On request we provide the information reasonably needed to demonstrate compliance with this DPA. If that is not sufficient, you may audit our compliance once a year, with at least 30 days' notice, during business hours, at your cost and under confidentiality, or appoint an independent auditor to do so.
9. Deletion and return
You can export reports and data from the Service at any time. After your account ends, we delete personal data processed on your behalf within 30 days and from backups within 90 days, unless the law requires us to keep it.
10. Liability and governing law
The limitations of liability in the Terms of Service apply to this DPA to the extent permitted by the GDPR. This DPA is governed by the laws of the Republic of Bulgaria, and the courts in Sofia, Bulgaria have jurisdiction.
Contact
Questions about this DPA or a signed copy: support@webextreme.bg.