Data Processing Agreement
under Art. 28 GDPR between the shop (controller) and the operator of VipUp (processor)
Draft, not a legal text. This version has not yet been legally reviewed and is not in force.
1. Subject matter
Acting on the shop’s instructions, the processor checks publicly available details about people who have placed an order with the shop (identity, public reach, public interests).
2. Types of data and data subjects
Name, email address, city and country from orders; the outcome of the check with supporting sources and quotes. Data subjects are buyers of the shop.
3. Retention and deletion
Results are deleted after the retention period configured in the account (default 30 days, maximum 90 days). Blocked email addresses are never checked.
4. Sub-processors
The list of sub-processors will follow with the final legal text.