Data Processing Agreement

1. How this DPA forms part of our agreement

This DPA is part of the TrueROAS Terms of Service (section 5.2) and applies automatically to every customer who uses TrueROAS, including stores on WooCommerce, Shopify and custom platforms. You do not need to sign anything. If you need a countersigned copy for your records, email rasmus@trueroas.com.

If this DPA and the Terms of Service disagree about personal data, this DPA applies.

2. Roles

You are the controller of the personal data about your website visitors, customers and leads that TrueROAS processes for you ("Customer Personal Data"). We are your processor for that data.

For your own account details, such as your name, email address and billing information, we are the controller. Our Privacy Policy covers that data.

3. What we process

Purpose: measuring which ads and channels lead to your orders and leads, showing this in your dashboard and reports, sending conversion events to the ad platforms you connect, and answering questions about your store data in the AI assistant.

People concerned: visitors to your website, and your customers and leads.

Types of personal data:

• Online identifiers: IP address, device and browser details, cookie IDs and ad click IDs (such as fbclid, gclid and ttclid)
• Visit data: pages viewed, referrer, UTM parameters and visit times
• Approximate location (country and city) based on the IP address
• Order and lead data: order ID, products, order value, currency and date
• Contact details sent with orders or leads: name, email address, phone number and address

Special categories: TrueROAS does not need special categories of personal data (GDPR Article 9) and you must not send them to us.

Duration: for as long as you use TrueROAS, plus the deletion period in section 9.

4. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are this DPA, the Terms of Service, and the settings and integrations you choose in TrueROAS. If EU or member state law requires other processing, we tell you first unless that law forbids it. If we believe an instruction breaks data protection law, we tell you.

5. Our commitments

• Confidentiality: everyone at TrueROAS who can access Customer Personal Data is bound by confidentiality.
• Security: we apply the measures in section 13 and keep them up to date (GDPR Article 32).
• Requests from people: if a person contacts us about their data, we pass the request to you and help you answer it. We can find and delete a person's data by email address or order ID.
• Compliance help: we help you with data protection impact assessments and consultations with authorities where they concern TrueROAS (GDPR Articles 35 and 36).
• Proof: we give you the information you need to show that we meet GDPR Article 28 (see section 10).

6. Subprocessors

You give us general authorisation to use subprocessors. The current list, with what each one does and where it stores data, is on our Subprocessors page.

We update that page at least 30 days before a new subprocessor starts processing Customer Personal Data. Email rasmus@trueroas.com to get these updates by email. If you object on reasonable data protection grounds and we cannot solve it, you can end your subscription before the change takes effect.

Each subprocessor is bound by a written contract with data protection duties no weaker than this DPA. We remain responsible to you for their work.

7. Platforms you connect

When you connect an ad platform (such as Meta, Google, TikTok, Pinterest, Snapchat, Microsoft Ads or AppLovin) or a store or marketing platform (such as WooCommerce, Shopify or Klaviyo), we send data to it or receive data from it because you instructed us to. These platforms are not our subprocessors. They handle the data under your own agreement with them.

We hash email addresses and phone numbers (SHA-256) before we send them to ad platforms.

8. Where your data is stored

TrueROAS is run from Stockholm, Sweden. GDPR applies to all of our processing, and the Swedish Authority for Privacy Protection (IMY) is our supervisory authority.

Customer Personal Data is stored on Google Cloud in the European Union. Some subprocessors process it in the United States. Every transfer outside the EU/EEA is covered by one of these safeguards:

• The EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), for providers certified under it
• The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), for all other transfers

In addition, all data is encrypted in transit and at rest.

9. Retention and deletion

We keep Customer Personal Data while you use TrueROAS, for the periods set out in our Privacy Policy.

You can ask us at any time to delete one person's data or all of your store's data. We do this within 30 days of your request.

When your subscription ends, tell us whether you want a copy of your data or want it deleted, and we do it within 30 days of your request, unless EU or member state law requires us to keep it. Deleted data is removed from our systems and cannot be restored.

10. Audits and information

We answer reasonable security and privacy questionnaires. If you need more, you or an independent auditor bound by confidentiality may audit our compliance with this DPA once a year, with 30 days' notice, at your cost and during business hours. For our subprocessors, we rely on their own certifications and audit reports.

11. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we tell you without undue delay and within 48 hours. We share what we know (what happened, which data and how many people are affected, and what we are doing about it) and keep you updated as we learn more.

12. Liability, term and governing law

Liability under this DPA follows the limits in the Terms of Service, unless data protection law says otherwise. This DPA lasts as long as we process Customer Personal Data for you. It is governed by Swedish law, and disputes go to the courts of Sweden, as in the Terms of Service. We post changes to this DPA on this page with a new date.

13. Security measures

• Encryption: data travels over HTTPS (TLS) and is encrypted at rest by Google Cloud.
• Login: the dashboard requires a login, and team members only see the stores they have been given access to.
• Staff access: only people who need it to run and support TrueROAS can access Customer Personal Data.
• Separation: each store's data is kept under its own store record and shown only to that store's users.
• Hashing: email addresses and phone numbers are hashed before they are sent to ad platforms.
• Monitoring: we log errors and get alerts when systems fail.
• Certified hosting: our hosting providers (Google Cloud and Vercel) hold ISO 27001 and SOC 2 certifications.

14. Contact

Perm Solutions AB (TrueROAS)

Högalidsgatan 34D, 117 30 Stockholm, Sweden

Company registration number: 559237-2535

Email: rasmus@trueroas.com