Data Processing Agreement (DPA)

Data processing agreement pursuant to Article 28 of the GDPR. Replaces Data Processing Agreement version 1.0. This Supplementary Agreement forms part of Quickbutik's Terms of Service (version 2.0).

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

Processor: Quickbutik AB, company registration number 556980-9105, Redaregatan 48, SE-252 36 Helsingborg, Sweden ("Quickbutik")

Controller: The customer that accepts Quickbutik's Terms of Service and thereby this DPA ("Customer")

The DPA is an integral part of Quickbutik's Terms of Service. By accepting the Terms of Service, the Customer also accepts this DPA. In the event of conflict between the DPA and the Terms of Service, the DPA takes precedence in matters relating to the processing of personal data.

2. Definitions

Terms defined in the General Data Protection Regulation (EU) 2016/679 ("GDPR") have the same meaning in this DPA. In addition, the following applies:

3. Subject Matter and Scope

3.1 Purpose of the processing

Quickbutik processes personal data on behalf of the Customer for the purpose of providing the Platform's functionality, including the Native Storefront, order management, customer records, payment processing and associated support services. This includes personal data that reaches the Platform from External Storefronts, for example via the API, and personal data collected by Quickbutik Checkout and other components that Quickbutik provides for use in External Storefronts. It also includes personal data processed in External Storefronts that Quickbutik hosts (section 2.3 of the Terms of Service), but not in third-party services that the Customer's code in such a storefront uses. Processing that takes place in External Storefronts outside the Platform, for example in the Customer's own hosting, analytics or forms, is not covered by this DPA, and the providers the Customer uses for it are not Quickbutik's sub-processors.

3.2 Categories of data subjects

• The Customer's End Customers (consumers and business customers who buy from the Customer's Shop)
• Visitors to the Customer's Storefronts whose data is processed in the Platform, newsletter subscribers and others who contact the Customer through the Platform or submit content such as reviews
• Other people whose data the Customer stores in the Platform, such as its suppliers' contact persons

Quickbutik is the controller, not the processor, for personal data about the Customer and its users as account holders, as described in the Privacy Policy.

3.3 Types of personal data

The following personal data is processed:

Quickbutik does not process sensitive personal data (special categories under Article 9 of the GDPR) unless this is agreed in a separate written agreement, under which the Customer bears full responsibility for the legal basis.

3.4 Duration of the processing

The processing continues for as long as the Customer's account is active and, after termination of the Agreement, for as long as Quickbutik retains personal data under section 10 (Termination). This DPA applies throughout.

4. Customer Obligations

The Customer is the Controller of the personal data processed in the Platform and is responsible for:

• ensuring that all processing has a legal basis under Article 6 of the GDPR (and Article 9 for sensitive data)
• informing data subjects about the processing through a privacy policy in each of the Customer's Storefronts
• providing Quickbutik with documented instructions for the processing
• immediately notifying Quickbutik if instructions are incorrect or need to be changed
• entering into its own data processing agreements with third-party services that the Customer itself connects (e.g. external payment, logistics or accounting systems)
• ensuring that no sensitive personal data (special categories under Article 9 of the GDPR) or personal identity numbers are stored in the Platform without a separate written agreement
• fulfilling all other obligations under the GDPR that are not covered by this DPA

5. Quickbutik's Obligations

5.1 Processing on instructions

Quickbutik processes personal data only on the Customer's documented instructions. Without the Customer's consent, an order from a supervisory authority or a requirement of mandatory law, Quickbutik may not:

• collect or disclose personal data to third parties
• change the method or purpose of the processing
• copy or reproduce personal data beyond what is required for operations and backup

If Quickbutik considers that an instruction from the Customer infringes the GDPR or other applicable legislation, Quickbutik shall immediately inform the Customer and await new instructions.

5.2 Technical and organisational measures

Quickbutik implements appropriate technical and organisational measures in accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature of the processing. The measures include:

• Encryption: Data is encrypted in transit and at rest, including databases and backups.
• Access control: Role-based access control based on the principle of least privilege, and multi-factor authentication for internal access to production systems.
• Logging and monitoring: Security-relevant events are logged and monitored.
• Backup and recovery: Regular automated backups with recovery procedures. Backups are encrypted and stored within the EU.
• Network security: Firewalls, DDoS protection, network segmentation and regular vulnerability scanning.
• Physical security: Our main data storage and backups are in data centres within the EU operated by certified infrastructure providers. Some sub-processors process data outside the EU/EEA, as listed in Annex 1.
• Personnel: Confidentiality undertakings for staff, data protection training and periodic access reviews.

5.3 Records of processing

Quickbutik maintains a record of all categories of processing carried out on behalf of the Customer in accordance with Article 30(2) of the GDPR. The record is kept up to date and made available to the supervisory authority on request.

5.4 Duty to notify

Quickbutik shall notify the Customer without undue delay if:

• the processing for any reason infringes the GDPR or this DPA
• Quickbutik is contacted by a supervisory authority, a data subject or a third party in a matter concerning the Customer's personal data
• Quickbutik intends to make changes that may affect the security of the processing

6. Sub-processors

6.1 General prior authorisation

The Customer hereby grants Quickbutik a general prior authorisation to engage sub-processors for the processing of personal data. The current list of sub-processors is set out in Annex 1.

6.2 Changes to sub-processors

Quickbutik informs the Customer at least 30 days in advance of any planned engagement of new sub-processors or replacement of existing ones. The information is sent to the Customer's registered email address and published at quickbutik.com/en/legal/platform/dpa.

6.3 Right to object

The Customer has the right to object to a new sub-processor within 30 days of the notification. The objection must be in writing and state reasonable grounds. If Quickbutik is unable to accommodate the objection, the Customer has the right to terminate the Agreement with immediate effect without charge and to receive a refund of the remaining prepaid subscription time.

6.4 Requirements for sub-processors

Quickbutik ensures that each sub-processor is bound by data protection obligations equivalent to those in this DPA. Quickbutik is liable to the Customer for the sub-processors' processing as for its own.

7. Transfers to Third Countries

Quickbutik does not transfer personal data to countries outside the EU/EEA unless at least one of the following conditions is met:

• The recipient country is covered by a valid adequacy decision of the European Commission (Article 45)
• Appropriate safeguards have been implemented, such as the European Commission's Standard Contractual Clauses (SCC), with supplementary measures where required (Article 46)
• Binding Corporate Rules (BCR) approved by a supervisory authority (Article 47)

If a sub-processor is established outside the EU/EEA, this is stated in Annex 1 together with the transfer mechanism applied.

Quickbutik notifies the Customer without undue delay of legal developments affecting the lawfulness of a transfer (e.g. the invalidation of an adequacy decision).

8. Personal Data Breaches

8.1 Notification

Quickbutik notifies the Customer of a personal data breach without undue delay and no later than 48 hours after Quickbutik has become aware of the breach. The notification is sent to the Customer's registered email address.

8.2 Content of the notification

The notification shall contain:

• a description of the nature of the breach, including the categories and approximate number of data subjects and personal data records concerned
• contact details for further information
• a description of the likely consequences
• a description of the measures taken and proposed

If complete information is not available at the time of notification, it shall be supplemented on an ongoing basis without undue delay.

8.3 Measures and assistance

Quickbutik takes immediate measures to mitigate the damage and assists the Customer in fulfilling its obligations towards the supervisory authority and data subjects (Articles 33–34 of the GDPR).

8.4 Contact in the event of a breach

The Customer reports suspected personal data breaches to security@quickbutik.com.

9. Data Subject Rights, Audits and DPIA

9.1 Assistance with data subject requests

Quickbutik assists the Customer by appropriate technical measures so that the Customer can fulfil its obligation to respond to requests from data subjects (right of access, erasure, portability etc. under Articles 15–22 of the GDPR). Quickbutik responds to the Customer's request for assistance within 10 business days.

9.2 Data protection impact assessment and prior consultation

Quickbutik assists the Customer with data protection impact assessments (DPIA) and prior consultation with the supervisory authority (Articles 35–36 of the GDPR) where required, taking into account the nature of the processing and the information available to Quickbutik.

9.3 Audits

The Customer has the right, itself or through a qualified third party, to audit Quickbutik's processing of personal data. The following applies to audits:

• The Customer notifies Quickbutik at least 30 days in advance
• The audit is conducted during normal business hours and in a manner that minimises disruption to Quickbutik's operations
• Any third party conducting the audit must be bound by confidentiality
• Quickbutik provides relevant documentation and enables the necessary inspections
• The Customer bears the cost of the audit, unless the audit reveals material deficiencies in Quickbutik's compliance
• Audits are limited to no more than once per 12-month period, unless a confirmed personal data breach warrants further review

Quickbutik may in the first instance satisfy the audit requirement by providing written documentation of its technical and organisational measures, including evidence from sub-processors' certifications (e.g. AWS ISO 27001). An on-site inspection is required only if the documentation does not satisfy the Customer's legitimate requirements.

10. Termination and Deletion

Upon termination of the Agreement, Quickbutik shall:

• continue to process personal data during the 30-day transition period specified in the Terms of Service, solely to enable data export and as needed under Additional Terms that continue to apply
• after the transition period, delete all personal data processed on behalf of the Customer within 90 days, and no later than 120 days after termination. Data required while Additional Terms continue to apply, such as the Quickbutik Checkout Terms, is kept for as long as those terms apply, including provisions that survive under them (section 5.5 of the Terms of Service). Input and Output retained by AI providers for abuse monitoring, as described in Annex 1, may be kept for the periods stated there. Backups are overwritten according to Quickbutik's regular rotation schedule and are until then used only for recovery
• at the Customer's request, provide written confirmation that deletion has been carried out

The deletion obligation does not apply to data that Quickbutik is required to retain by law (e.g. bookkeeping legislation). Such data is processed solely for that purpose and remains subject to the confidentiality and security measures of this DPA.

11. AI Processing of Personal Data

Where Quickbutik uses AI features that process personal data (e.g. the Quick assistant and other AI agents provided by Quickbutik), the following applies. The terms AI Services, Input and Output have the meanings given in the Quickbutik AI Services Additional Terms.

• The processing is carried out solely to provide the Platform's functionality on behalf of the Customer
• Personal data is not used to train AI models
• The Customer instructs Quickbutik to anonymise personal data so that it can be used in aggregated form under section 7.3 of the Terms of Service
• Quickbutik's MCP server has a GDPR mode that can be activated for the Customer's Shop. When GDPR mode is active, AI features that access Customer Data through the MCP server, such as the Quick assistant, receive End Customers' names and contact details in customer and order records in masked form. Other Customer Data, such as free text in orders and product reviews, is not masked. When GDPR mode is not active, the AI Services may process such personal data as described in this section
• If the Customer connects its own AI agent or AI service to the Platform, for example via MCP, the provider of that service is engaged by the Customer and is not a sub-processor of Quickbutik
• The Customer is responsible for informing its End Customers about AI-based processing in accordance with Articles 13–14 of the GDPR and the AI Act
• Automated decisions with legal effect (Article 22 of the GDPR) require the Customer's active configuration and the Customer is responsible for the legal basis
• The AI providers that process personal data as sub-processors are listed in Annex 1

12. Liability

Quickbutik is liable to the Customer for damage arising from Quickbutik's failure to fulfil its obligations under this DPA or from acting outside the Customer's documented instructions.

Quickbutik is exempt from liability if Quickbutik proves that it is not in any way responsible for the event giving rise to the damage.

The Customer shall indemnify Quickbutik against claims brought against Quickbutik that arise from the Customer's incorrect or deficient instructions.

The limitation of liability in section 13 of the Terms of Service applies to claims between the Parties under this DPA, except that the exclusion of loss of data in section 13.2 does not apply to personal data breaches for which Quickbutik is responsible under this DPA. It does not limit liability towards data subjects or supervisory authorities that cannot be limited under the GDPR (including Article 82).

13. Contact

14. Disputes and Governing Law

This DPA shall be interpreted and applied in accordance with Swedish law. Disputes are resolved in accordance with section 17 of the Terms of Service (Helsingborg District Court as the court of first instance).

This DPA is drafted in English, which is the legally binding version. Section 17.3 of the Terms of Service applies to translations.

Annex 1: List of Sub-processors

Last updated: 12 November 2026

The current version is published on an ongoing basis at quickbutik.com/en/legal/platform/dpa. The list also includes providers that Quickbutik uses for customer support and internal work, or for account security such as two-factor authentication, which may process personal data in connection with the Customer's support cases or user accounts. For data where Quickbutik is the controller, these providers act as Quickbutik's processors.

Adyen acts as a sub-processor only for the processing that Quickbutik directs in Quickbutik Checkout, such as configuration, risk and payout instructions. For payment processing and fraud prevention as its own services under the Adyen terms in the Quickbutik Checkout Terms, Adyen, like the Payment Method providers, processes data as an independent controller under its own terms and privacy statement.

The AI providers (Anthropic Ireland, Limited, OpenAI Ireland Ltd. and Cloudflare) may retain Input and Output for a limited time to operate their services and detect abuse, and longer where required by law or where content is flagged for violating their usage policies. Current retention periods: Anthropic deletes Input and Output within 30 days, or keeps them for up to 2 years if they are flagged as violating its usage policy. OpenAI keeps Input and Output in its abuse monitoring logs for up to 30 days. Cloudflare does not keep Input or Output after processing, except in storage services that Quickbutik uses to provide the AI Services.

Changes to this list are notified to the Customer in accordance with section 6.2 of the DPA (30 days' notice).