Effective date: 14 November 2026
These Data Processing Terms are part of our Terms & Conditions. They apply when a merchant uses OmniCart to process personal data, and they set out the agreement between the merchant and PIXOBIT SOLUTIONS SRL that article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") requires.
In these terms, "you" means the merchant, who is the controller of the personal data in their Store, and "we" or "us" means PIXOBIT SOLUTIONS SRL, which processes that data on your behalf as processor. Other words, such as "Service", "Store" and "Shopper", have the meaning given in our Terms & Conditions. Where these terms and the Terms & Conditions differ on the processing of personal data, these terms apply.
1. What we process
- Subject matter: hosting and running your Store on the Service.
- Duration: for as long as your Store exists on the Service, and afterwards only as described in section 10.
- Nature and purpose: storing, organising, displaying, transmitting, backing up and deleting personal data, as needed to provide the Service to you, and as you instruct through your use of it.
- Types of personal data: contact and account details, delivery and billing addresses, orders and order history, payment status (not full card details), messages and files exchanged through your Store, reviews and comments, form submissions, and technical data such as IP addresses.
- Categories of data subjects: your shoppers and visitors, your Store's other users, and the people you give access to your Store's admin.
2. Your instructions
We process personal data only on your documented instructions. These Data Processing Terms, the Terms & Conditions and the way you set up and use your Store are your instructions. We may process personal data otherwise only where the law requires it; in that case we will tell you first, unless the law prevents it. If we believe an instruction infringes data protection law, we will tell you.
3. Confidentiality
We make sure that the people we authorise to process personal data are bound by a duty of confidentiality.
4. Security
We take appropriate technical and organisational measures to protect personal data, as article 32 of the GDPR requires. They include encrypted connections, hashed passwords, access limited to authorised staff, two-factor authentication available for accounts, and measures to back up the Service. We review them as the Service and the risks change.
5. Sub-processors
You give us general authorisation to engage other processors ("sub-processors") to help provide the Service, such as hosting, email delivery and AI providers. We impose on each sub-processor data protection obligations that offer the same level of protection as these terms, and we remain responsible to you for their work.
We keep a list of our current sub-processors, which we will send you on request. We will tell you in advance, by email or in the Service, before we add or replace a sub-processor. You may object on reasonable data protection grounds; if we cannot resolve your objection, you may cancel your Membership and we will refund the fees you prepaid for the unused part of your term.
Services you choose to connect to your Store yourself, such as payment providers, shipping carriers or Google services, are not our sub-processors. Their providers process data under your own agreements with them.
6. Transfers outside the European Economic Area
If personal data is transferred outside the European Economic Area for the Service, we make sure the transfer is protected, for example by a European Commission adequacy decision or by the Standard Contractual Clauses approved by the European Commission.
7. Helping you meet your obligations
Taking into account the nature of the processing and the information available to us, we help you, by appropriate measures and as reasonably possible:
- to respond to requests from people exercising their data protection rights. Much of this you can do yourself in your Store's admin; if a request reaches us directly, we will pass it on to you;
- to meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority (articles 32 to 36 of the GDPR).
8. Personal data breaches
If we become aware of a personal data breach affecting your Store's data, we will notify you without undue delay, with the information we have about it, and we will keep you updated as we learn more, so that you can meet your own obligations to report it.
9. Information and audits
We will make available to you the information reasonably necessary to show that we meet our obligations under article 28 of the GDPR. We will also allow and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable advance notice, no more than once a year unless a supervisory authority requires otherwise, during normal business hours, at your cost, and under a duty of confidentiality. An audit may not give access to other customers' data or put the security of the Service at risk. Where possible, we may answer an audit request with documents and information instead of an inspection.
10. Deletion and return of data
While your Store is suspended, we keep its data so that you can reopen it, as described in our Terms & Conditions, unless you ask us to delete it.
When your Store is closed permanently, or at any time you ask us to, we will delete the personal data we process for you, after giving you a reasonable opportunity to save a copy using the export tools the Service offers. We keep copies only where the law requires us to. Data in backups is deleted when the backups are replaced in the normal course.
11. Your responsibilities
You are responsible for the lawfulness of the processing you instruct, including having a legal basis for it, giving your shoppers the information the law requires (for example in your own privacy policy), and answering their requests. Do not use the Service to process special categories of personal data, such as health data, unless the law allows it and the Service is suitable for it.
12. Liability
Each party's liability under these terms is subject to the limitations in our Terms & Conditions, to the extent the law allows.
13. Contact
For anything about these terms or the processing of your Store's data, write to PIXOBIT SOLUTIONS SRL at contact@omnicartshop.com.