Data Processing Addendum (DPA)
Last updated: September 29, 2026
This DPA forms part of the Terms of Service between DIFVISION S.A.S. ("Primiox", "Processor") and the Merchant ("Controller", "you") and governs Primiox's processing of personal data of your Shoppers ("Shopper Data") on your behalf. Where this DPA conflicts with the Terms on data protection, this DPA controls.
1. Roles
You are the controller of Shopper Data and are responsible for its lawfulness, including having a valid legal basis and giving your Shoppers the required notices and choices. Primiox is the processor and processes Shopper Data only on your documented instructions (the Terms, your configuration and use of the Service, and lawful written instructions).
2. Scope of processing
- Subject matter / duration: providing the Service for the term of the Terms.
- Nature / purpose: hosting and processing Shopper Data to operate your store (orders, accounts, carts, wishlists, communications, analytics you enable).
- Data subjects: your Shoppers and their contacts.
- Categories of data: identifiers (name, email, phone), addresses, order and payment metadata (not full card data), and data you choose to collect. Do not send us special categories of data unless the Service is designed for it and you have a lawful basis.
3. Primiox obligations
Primiox will: (a) process Shopper Data only on your instructions and as needed to provide the Service or comply with law (and will tell you if law requires otherwise, unless prohibited); (b) ensure persons authorized to process are bound by confidentiality; (c) apply appropriate technical and organizational security measures (§6); (d) assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification and impact-assessment obligations; (e) at your choice, delete or return Shopper Data at the end of the Service (subject to legal retention); and (f) make available information needed to show compliance and allow reasonable audits.
4. Subprocessors
You authorize Primiox to engage subprocessors (e.g. hosting, payment, email, analytics providers) to process Shopper Data. Primiox will impose data-protection obligations on them no less protective than this DPA and remains responsible for their performance. A current list is available at contact@difvision.com; we will give reasonable notice of new subprocessors and you may object on reasonable data-protection grounds.
5. Data-subject requests
If Primiox receives a request from a Shopper (access, deletion, etc.), it will, where legally allowed, redirect them to you and assist you in responding, since you are the controller.
6. Security
Primiox maintains measures appropriate to the risk, including encryption in transit, access controls and least-privilege, network protection, logging and monitoring, and personnel confidentiality. Measures may evolve provided protection is not materially reduced.
7. Breach notification
Primiox will notify you without undue delay after becoming aware of a personal-data breach affecting Shopper Data, with the information reasonably available to help you meet your notification duties. Notification is not an acknowledgement of fault.
8. International transfers
Where Shopper Data is transferred across borders, the parties will rely on a lawful transfer mechanism (e.g. Standard Contractual Clauses / adequacy). You instruct Primiox to make such transfers as needed to provide the Service.
9. Deletion / return
On termination, Primiox will delete or, at your request and where technically feasible, return Shopper Data within a reasonable period, except copies required to be kept by law.
10. Liability
Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.