Data processing agreement for agencies

Version 1.1, 31 October 2026. This English version is the master. If in doubt, it prevails.

This agreement is part of the white label terms between The CSS Partner (Gezar, a Danish sole proprietorship owned by Magnus Bo Nielsen, CVR no. 42476226, Lupinskrænten 58, 8500 Grenaa, Denmark) and the Agency. It applies from the day the Agency accepts the terms. “GDPR” means Regulation (EU) 2016/679.

1. Who is responsible for what

Most of the personal data in the service is not handled on the Agency’s behalf. The table says who decides why and how the data is used.

Data	Who is controller	Processor role of The CSS Partner?
Technical data about visitors to the White Label CSS site (such as IP address, device, pages seen, clicks on products)	The CSS Partner	No
Login data for the Agency’s own staff in the partner portal	The CSS Partner, to run the portal and the contract	No
Billing data of the Agency itself (name, address, VAT number, payment method)	The CSS Partner	No
Under Resell: account and payment data of the Agency’s clients (name, email, company, country, VAT number, Shops, subscription and payments)	The CSS Partner, as the seller	No
Under Resell: what the Agency receives about its clients (name, email, Shops, status, payments)	The Agency, as its own controller	No. We disclose the data to the Agency
Contact data and Merchant Center IDs of clients that the Agency enters or imports itself (full control, without payment through us)	The Agency	Yes
Mails we send to those clients in the Agency’s name from the Agency’s mail domain	The Agency	Yes
The Agency’s own client relationships, marketing and contracts	The Agency	No

The Agency is its own controller for its client relationships. We do not decide how the Agency uses its clients’ data.

2. When we do not process data on the Agency’s behalf

If the Agency enters no client data in the portal and sends no mails through it, we do not process personal data on the Agency’s behalf. Then clauses 3 to 9 do not apply, and each party follows the GDPR for the data it controls. The same is true for Resell customers: we process their data as controller, not for the Agency.

Product feeds and product data of the Agency’s clients are business data, not personal data. If a feed contains personal data, that is a breach of clause 3.6 of the terms.

3. Processing on behalf of the Agency

This part applies only to the two rows marked “Yes” in clause 1.

1. Subject and purpose. We process the data to run the White Label CSS for the Agency: to store the Agency’s client records and Shops, and to send the mails the Agency has switched on, in the Agency’s name.
2. Nature. Storage, display in the portal, transfer to Google’s CSS Center where needed to link a Shop, and sending mail.
3. Types of data. Name, email address, telephone number (optional), company, country, VAT number, Merchant Center ID, shop address, the status of the client’s Shops, and the mails sent with date and delivery status.
4. Data subjects. Contact persons at the Agency’s clients.
5. Duration. While the terms run, and until deletion under clause 8.
6. Instructions. We process the data only on the Agency’s documented instructions. The terms, this agreement and what the Agency does in the portal are its instructions. We tell the Agency if we think an instruction breaks the law.
7. Confidentiality. Everyone who has access to the data on our side is bound by a duty of confidentiality.
8. Security. We apply the measures in clause 6.
9. Help. We help the Agency answer requests from data subjects, and with its duties on security, breaches, impact assessments and consultation of the authority, as far as the processing allows. We tell the Agency without undue delay if a data subject contacts us about data we process for the Agency.
10. Proof. We give the Agency the information it needs to show that we meet this agreement. The Agency may audit us once a year, on 30 days’ notice, during working hours and at its own cost, with an auditor bound by confidentiality. We may instead give a written answer to the Agency’s questions, if that covers the same ground.
11. The Agency’s duties. The Agency has a legal basis for the data it enters, and informs its clients and their staff that the data is handled by us on its behalf. It does not enter data it has no right to enter.

4. Sub-processors

The Agency gives us a general permission to use the sub-processors below. We tell the Agency of a new or replaced sub-processor by email at least 30 days before it starts. The Agency may object on reasonable grounds within that time. If we cannot meet the objection, the Agency may terminate the terms with effect from the day the change starts. Each sub-processor is bound by a contract with the same data protection duties as this agreement. We are responsible for them.

Sub-processor	What it does	Where
The CSS Partner’s own servers	Host the portal, the database and the comparison site	Denmark (reached through Cloudflare)
Resend	Sends mails in the Agency’s name	Region eu-west-1 (Ireland)
Cloudflare	DNS, security and certificates for the Agency’s domain, and delivery of the site	Global network
Cloudflare R2	Stores encrypted backups of the database. The key that opens them is held only by us	EU
Google Drive	Stores encrypted backups of files and database dumps. The key is held only by us	Location not fixed to the EU. The transfer rests on Google’s data protection terms and standard contractual clauses
Stripe	Payments and invoices for the Agency’s white label fee and, under Resell, for the Resell customers	EU and USA

Apart from Google Drive, Google is not our sub-processor. When we link a Shop in Google’s CSS Center, Google processes the Merchant Center data under its own terms with the Agency’s client and with us as a CSS. Stripe handles payment data as an independent controller for some purposes, such as fraud prevention and its legal duties.

5. Transfers outside the EU and EEA

1. Our own server is in Denmark. Resend stores in Ireland. Backups in R2 are kept in the EU. Encrypted copies in Google Drive may be kept outside the EU and are covered by the transfer tools in clause 5.1. Cloudflare and Stripe are US companies with a presence in the EU. Where a sub-processor transfers data to a country without an adequacy decision, the transfer rests on the European Commission’s standard contractual clauses (Decision (EU) 2021/914) or another transfer tool in the GDPR.
2. If the Agency is established outside the EU and EEA, and its country has no adequacy decision, the Commission’s standard contractual clauses are part of this agreement for the data we send to the Agency. For data we disclose as controller, Module 1 applies. For data we send back as processor, Module 4 applies. Annex information follows from this agreement and from clause 1. Danish law applies where the clauses leave the choice open, and Retten i Randers is the court.

6. Security

We protect the data with these measures:

• encrypted connections (TLS) between the browser, the site and the portal,
• logins by one-time link, signed session cookies and a role for each user (owner, admin, employee, reader), where a deactivated user loses access at once,
• the portal, the site and the backend are separate, and the browser talks only to the Agency’s own site address,
• keys and secrets are kept on the server only, never in the browser,
• a mail guard that stops any mail not switched on by the Agency, and any mail from an unverified sender,
• logs of mails sent,
• access to client data only for the people who need it to run the service.

We review the measures when the service or the risks change. We do not lower the level of protection during the term.

7. Personal data breach

We tell the Agency without undue delay when we become aware of a breach of the data we process on its behalf. The message says what happened, what data and how many people may be affected, what we think the consequences are, and what we have done. We send further information as we learn it. The Agency decides whether to notify the authority and the data subjects.

8. Deletion and return at the end

1. When the terms end, we stop processing the Agency’s client records and mails.
2. On request made before the end, or within 30 days after, we give the Agency an export of the client records in a common format (CSV).
3. We delete the client records and the mail logs that we process on the Agency’s behalf within 30 days after the terms end, or within 30 days after the wind-down period under clause 5.5 of the terms, if that is later. Copies in backups are deleted automatically no later than 35 days after they are made, in R2, and no later than 190 days after in Google Drive.
4. We keep what the law requires us to keep as controller, such as invoices and accounting records for 5 years under Danish bookkeeping rules. That data is not processed on the Agency’s behalf.
5. We confirm the deletion by email on request.

9. Liability, law and changes

1. Liability follows clause 8 of the terms. A data protection claim by a data subject does not change that between the parties, except where the law says otherwise.
2. Danish law applies. Disputes go to Retten i Randers (Randers District Court), as in the terms.
3. We may change this agreement for the future on 60 days’ written notice, if the law, a sub-processor or the service changes. The Agency may terminate before the change takes effect.
4. If this agreement and the terms conflict about personal data, this agreement goes first.
5. Questions about personal data go to kontakt@gezar.dk.