DATA PROCESSING AGREEMENT (DPA)

Last updated October 26, 2026

This data processing agreement (the "DPA") supplements the Terms of Service (the "Terms") entered into between:

• Bewizit, a French SARL with a share capital of €2,500, registered office at 2 rue de Vienne, 75008 Paris, France, registered with the Paris Trade and Companies Register under number 813 538 956, publisher of Order Invoicer ("Bewizit" or the "Processor"); and
• the legal entity or professional using the Services (the "Customer" or the "Controller").

It applies as soon as the Terms are accepted, with no further formality. If it conflicts with the Terms on the protection of personal data, the DPA prevails.

The French version of this DPA is the authoritative one; this English version is provided for convenience.

1. DEFINITIONS

The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them by Regulation (EU) 2016/679 (the "GDPR").

• Customer Data: the personal data that Bewizit processes on behalf of the Customer as part of the Services, described in Annex 1.
• Connected Platforms: the third-party software the Customer connects to Order Invoicer (e-commerce platforms, invoicing or accounting software, payment providers).
• Sub-processor: any third party to which Bewizit entrusts the processing of Customer Data.
• Applicable Law: the GDPR, French law no. 78-17 of January 6, 1978 ("Informatique et Libertés") and any regulation supplementing or replacing them.

2. ROLES OF THE PARTIES

2.1. For Customer Data, the Customer is the controller and Bewizit its processor within the meaning of article 28 of the GDPR. Where the Customer itself acts on behalf of a third party (agency, accountant, integrator), Bewizit is a sub-processor and the Customer warrants that it holds that third party's authorization.

2.2. Bewizit processes, as a controller, the data relating to the Customer's account and its users (identity, email, billing, support, login logs). That processing is governed by our Privacy Policy, not by this DPA.

3. CUSTOMER INSTRUCTIONS

3.1. Bewizit processes Customer Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's configuration of its connectors in Order Invoicer (choice of Connected Platforms, synchronization rules, sending of invoices) constitute those instructions.

3.2. Bewizit informs the Customer without delay if it believes an instruction infringes Applicable Law, and may then suspend its execution.

3.3. Bewizit does not sell Customer Data, use it for advertising or for its own purposes, or combine it with other customers' data.

3.4. Bewizit may produce aggregated and anonymized statistics on the use of the Services (order volumes, error rates) from which no individual can be identified.

4. CUSTOMER OBLIGATIONS

The Customer:

• warrants that it has a legal basis for having the Customer Data processed, and that it has informed the data subjects (in particular its own customers) of this processing;
• is solely responsible for the accuracy of the Customer Data and for the configuration of its Connected Platforms;
• does not submit to the Services data falling under article 9 or 10 of the GDPR;
• secures its access (credentials, API keys, Connected Platform tokens).

Connected Platforms are chosen by the Customer and contract directly with it: they are not Sub-processors of Bewizit.

5. CONFIDENTIALITY AND PERSONNEL

Bewizit limits access to Customer Data to the people who need it to provide the Services or support, and ensures they are bound by a confidentiality obligation that survives the end of their engagement. Customer data is accessed for support only at the Customer's request or to resolve an incident affecting it.

6. SECURITY

Bewizit implements the technical and organizational measures described in Annex 2, appropriate to the risk within the meaning of article 32 of the GDPR. It may update them, provided the overall level of protection is not reduced.

7. SUB-PROCESSORS

7.1. The Customer gives Bewizit a general authorization to engage Sub-processors. Those in place at the date of this DPA are listed in Annex 3.

7.2. Bewizit imposes on each of them data protection obligations at least equivalent to those of this DPA and remains liable to the Customer for their performance.

7.3. Bewizit notifies the Customer of any addition or replacement of a Sub-processor by email to the account address, at least 15 days before it processes Customer Data. Within that period, the Customer may object in writing on reasonable data protection grounds. The parties then seek a solution in good faith; failing that, the Customer may terminate the affected Services at no cost, and Bewizit refunds pro rata any amounts prepaid for the unused period.

7.4. In an emergency (failure or security incident of a Sub-processor), Bewizit may make the replacement immediately and informs the Customer as soon as possible, the right to object remaining open.

8. TRANSFERS OUTSIDE THE EUROPEAN UNION

8.1. Customer Data is mainly stored in the European Union (Supabase database, EU region; Vercel functions, Paris region).

8.2. Some Sub-processors listed in Annex 3 process Customer Data from the United States. These transfers rely on the EU–US Data Privacy Framework (adequacy decision of July 10, 2023) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (decision 2021/914, module 3, processor to processor).

9. DATA SUBJECT RIGHTS

9.1. If Bewizit directly receives a request from a data subject relating to Customer Data, it forwards it to the Customer within 5 business days and does not answer it itself, except to say it has been forwarded.

9.2. Bewizit helps the Customer, through the features of the Services or on request, to respond to requests for access, rectification, erasure, restriction, portability and objection. This assistance is free within a reasonable effort; beyond that (repeated or voluminous requests), it may be invoiced on a prior quote, without that cost hindering data subjects' exercise of their rights.

10. PERSONAL DATA BREACH

10.1. Bewizit notifies the Customer of any breach of Customer Data without undue delay and, where possible, within 48 hours of becoming aware of it, at the account email address.

10.2. The notification states, as far as possible: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact. Information not yet available is provided as it becomes available.

10.3. Notifying the CNIL (or any competent supervisory authority) and the data subjects is the Customer's responsibility, with Bewizit's assistance. Bewizit does not communicate publicly about a breach affecting the Customer without consulting it, unless required by law.

10.4. Notification is not an admission of liability.

11. ASSISTANCE

At the Customer's request, and to the extent it does not have access to them itself, Bewizit provides the information reasonably needed to carry out a data protection impact assessment or to consult the supervisory authority about processing carried out through the Services.

12. AUDIT

12.1. On request, Bewizit makes available to the Customer the information needed to demonstrate compliance with this DPA: answers to a reasonable security questionnaire, documentation of its security measures, and its Sub-processors' certification reports (e.g. SOC 2) where they allow them to be shared.

12.2. If that information is not enough to establish compliance, or at the supervisory authority's request, the Customer may have an audit carried out, at most once a year, with 30 days' written notice, during business hours, without disrupting the operation of the Services. The audit is carried out at the Customer's expense, by itself or by an independent auditor who is not a competitor of Bewizit and is bound by confidentiality. It does not cover other customers' data or the Sub-processors' infrastructure, whose compliance is demonstrated by their own reports.

12.3. Audit results are confidential. Bewizit remedies any non-compliance found within a timeframe agreed between the parties.

13. DURATION, RETURN AND DELETION

13.1. This DPA applies for as long as Bewizit processes Customer Data.

13.2. Customer Data is retained for the whole duration of the subscription.

13.3. Deleting a connector is the Customer's instruction to delete the Customer Data attached to it. Bewizit deletes it from its database immediately. Residual copies (backups, caches, Sub-processor logs) disappear when their rotation cycle expires, and remain subject to this DPA until then.

13.4. The Services do not offer an export of Customer Data: it comes from the Customer's Connected Platforms, which keep the original. The Customer is responsible for retrieving any data it needs from those platforms before deleting a connector.

13.5. Invoices and accounting documents issued in the Connected Platforms remain in those platforms and are not affected by the deletion.

14. LIABILITY

Each party's liability under this DPA is subject to the limitations set out in the Terms (section 14), save for any mandatory provision to the contrary, in particular article 82 of the GDPR towards data subjects.

15. GOVERNING LAW AND JURISDICTION

This DPA is governed by French law. Any dispute falls under the exclusive jurisdiction of the Commercial Court of Paris, under the conditions of the Terms.

16. CHANGES

Bewizit may amend this DPA to follow changes in Applicable Law or in the Services. It informs the Customer at least 30 days in advance, unless the change is required by law. An amendment cannot reduce the level of protection of Customer Data.

17. CONTACT

• Questions about this DPA and notifications: privacy@orderinvoicer.com
• Data Protection Officer: dpo@orderinvoicer.com

ANNEX 1 — DESCRIPTION OF THE PROCESSING

Subject matter and purpose. Synchronize orders, refunds, customers and payments from the Customer's e-commerce platforms to its invoicing and accounting software: creating customers, issuing invoices and credit notes, reconciling payments, sending invoices to end customers, monitoring and retrying synchronization errors.

Nature of the operations. Collection from Connected Platforms (APIs and webhooks), recording, structuring, transformation, transmission to Connected Platforms, sending by email, storage, deletion.

Data subjects.

• The Customer's end customers (buyers, consumers or businesses);
• Billing or shipping recipients and contacts;
• The Customer's staff where they appear in the synchronized data.

Categories of data.

• Identity: first and last name, company name, VAT or company registration number of business customers;
• Contact details: billing and shipping addresses, email, phone;
• Order: number, date, products, quantities, prices, taxes, discounts, shipping costs, status, order notes;
• Payment: payment method, amount, date, transaction identifier (never a full card number);
• Documents: invoices, credit notes and their PDFs;
• Technical data: identifiers of objects in the Connected Platforms, synchronization logs.

Sensitive data. None is expected. Order notes typed freely by buyers may contain some without the parties' knowledge.

Frequency. Continuous, as events occur in the Connected Platforms.

Duration. The whole duration of the subscription; immediate deletion when the connector is deleted (section 13).

ANNEX 2 — TECHNICAL AND ORGANIZATIONAL MEASURES

Hosting and encryption

• PostgreSQL database hosted in the European Union, encrypted at rest (AES-256), with encrypted daily backups;
• Communications encrypted with TLS 1.2 or higher;
• Connected Platform tokens and API keys stored in the database encrypted at rest.

Access control

• Data isolated per customer organization, enforced server-side on every request;
• Bewizit staff access limited to what is strictly necessary, with strong authentication (2FA) on administration tools;
• Access revoked when a staff member leaves.

Development and operations

• Code review and automated tests before every production release;
• Error and performance monitoring, with incident alerts;
• Logging of access and administrative actions.

Organization

• Confidentiality undertakings from staff and contractors;
• Personal data breach response procedure;
• Sub-processors selected on the basis of their guarantees (DPA, SOC 2 or ISO 27001 certifications).

ANNEX 3 — SUB-PROCESSORS