WareRushAI
EnglishMagyar
Login

Data Processing Agreement

Effective: 2026-10-27

This agreement under Article 28 GDPR governs how Planet Home Kft., as processor (the "Processor"), processes personal data uploaded to a WareRushAI workspace by the Subscriber, as controller (the "Controller"). It is concluded by accepting the Terms of Service and lasts for the term of the subscription.

1. Subject matter

  • Purpose and nature: providing the WareRushAI service — storage, display, search, AI processing, e-mail notifications, and transfer to integrations requested by the Controller (e.g. Shopify).
  • Data subjects: the Controller’s staff (users), partners, customers, suppliers and their contact persons.
  • Categories of data: name, company, position, e-mail, phone, address, order and delivery data, and personal data that may appear in uploaded photos. Special categories are not intended to be processed and must not be uploaded.
  • Duration: the term of the subscription plus up to 90 days (up to a further 35 days in backups).

2. Processor obligations

  • Processes data only on the Controller’s documented instructions (the Terms, this agreement and the operations the Controller performs in the software), and informs the Controller if an instruction infringes the law.
  • Ensures that persons with access are bound by confidentiality.
  • Implements appropriate technical and organisational measures (encryption in transit and at rest, role-based access, workspace isolation, logging, regular backups within the EU).
  • Assists the Controller with data subject requests (through export, correction and deletion functions, or on request) and with obligations under Articles 32–36 GDPR.
  • Notifies the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it.
  • At the end of the contract, at the Controller’s choice, makes the data available for export and then deletes it, unless law requires retention.
  • Makes available the information necessary to demonstrate compliance and allows audits agreed in advance; on-site audits are at the Controller’s cost.

3. Sub-processors

The Controller grants general authorisation to engage sub-processors. Current sub-processors: Google Cloud EMEA Limited (hosting, database, AI; EU regions), Resend Inc. (e-mail delivery; SCC), Stripe Payments Europe Ltd. (subscription payments only).

The Processor gives at least 15 days’ notice by e-mail before engaging a new sub-processor; the Controller may object, and if no agreement is reached may terminate. Sub-processors are bound by equivalent data protection obligations.

4. International transfers

Data is stored in the European Union. Transfers to third countries (e.g. the United States) take place only on the basis of an adequacy decision or the European Commission’s Standard Contractual Clauses.

5. Controller obligations

The Controller is responsible for having a legal basis for the personal data it uploads, for informing data subjects, and for granting roles in the software on a need-to-know basis.

6. Final provisions

In data protection matters this agreement prevails over the Terms of Service. Effective: 2026-10-27.