Profit Bid POAS tracking
Available on
For AgenciesSubscribeStart free
Profit Bid logoProfit Bid

Data Processing Agreement (DPA) — Profit Bid

This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions between S.C. AXP GLOBAL RETAIL S.R.L.(“Profit Bid”, “Processor”, “we”, “us”) and the customer (“Controller”, “you”) when you subscribe to the Profit Bid POAS analytics and profit optimization platform (the “Service”).

This DPA reflects the parties' agreement on the processing of personal data under Regulation (EU) 2016/679 (GDPR) and applicable Romanian data protection law. In the event of conflict between this DPA and the Terms regarding data protection, this DPA prevails.

1. Subject matter and duration

Processor processes personal data on behalf of Controller to provide the Service, including store synchronization, order and product analytics, conversion uploads to ad platforms, and related customer support. Processing continues for the subscription term and as required for backup, billing, and legal retention thereafter.

2. Nature and purpose of processing

  • Hosting and operating the Profit Bid web application and APIs.
  • Syncing ecommerce catalog, order, and profit data from connected storefronts.
  • Calculating POAS and generating dashboards, labels, and optimization signals.
  • Uploading conversion and audience signals to connected ad platforms (e.g. Google Ads).
  • Account management, billing, support, security monitoring, and service improvement.

3. Categories of data subjects

  • Controller's staff and authorized users of the Service.
  • End customers of Controller's ecommerce store (where order or event data is synced).
  • Visitors to Controller's storefront when click or consent events are collected via Profit Bid integrations.

4. Types of personal data

Depending on Controller configuration and connected integrations, data may include:

  • Account data: name, email, company, billing address, VAT ID, phone.
  • Order and commerce data: order IDs, amounts, products, timestamps, status, profit metrics.
  • Technical data: IP address, user agent, session or click identifiers, consent state.
  • Ad platform identifiers required for conversion matching and campaign automation.

Controller is responsible for ensuring a lawful basis and appropriate notices for end-customer data collected on the storefront, including cookies and consent where required.

5. Controller obligations

  • Ensure instructions to Processor comply with applicable data protection law.
  • Provide required privacy notices and obtain valid consent where applicable on the storefront.
  • Configure data retention and disconnect integrations when processing should stop.
  • Respond to data subject requests for data Controller determines it controls.

6. Processor obligations

  • Process personal data only on documented instructions from Controller, including as set out in the Terms, this DPA, and in-app configuration.
  • Ensure personnel authorized to process data are bound by confidentiality.
  • Implement appropriate technical and organizational measures (see Section 8).
  • Assist Controller with data subject requests, DPIAs, and supervisory authority inquiries, where applicable and reasonable.
  • Notify Controller without undue delay after becoming aware of a personal data breach affecting Controller data.
  • Delete or return personal data upon termination of the Service, subject to legal retention requirements.

7. Sub-processors

Controller authorizes Processor to engage sub-processors necessary to deliver the Service. Current categories include cloud hosting, database, email delivery, payment processing, and authentication providers. Processor remains responsible for sub-processor performance under GDPR Article 28.

Processor will inform Controller of material sub-processor changes where required by law. Controller may object on reasonable grounds relating to data protection; if unresolved, either party may terminate the affected Service components.

8. Security measures

Processor maintains measures including, as appropriate:

  • Encryption in transit (TLS) and encryption at rest for stored credentials and sensitive fields.
  • Role-based access control, audit logging, and least-privilege administration.
  • Secure development practices, vulnerability management, and incident response procedures.
  • Backups, monitoring, and business continuity controls for critical systems.

9. International transfers

Where personal data is transferred outside the European Economic Area, Processor ensures appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms approved under GDPR Chapter V.

10. Audits and information

Processor will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and allow audits mandated by law or by a supervisory authority, subject to reasonable notice, confidentiality, and frequency limits.

11. Liability

Each party's liability under this DPA is subject to the limitation of liability provisions in the Terms and Conditions, except where prohibited by applicable law.

12. Contact

Data protection inquiries: office@profit-bid.com

Processor: S.C. AXP GLOBAL RETAIL S.R.L., CUI 48715417, J02/1304/2023, Romania. See also our Privacy & Cookie Policy.