Data Processing Agreement (DPA)

Effective date: 2026-10-16

This Data Processing Agreement ("DPA") forms part of the Terms of Service between YAStuning OƜ ("Processor", "we") and the customer ("Controller", "you") and applies whenever we process personal data on your behalf. It is concluded under Article 28 GDPR. Where it conflicts with the Terms, this DPA prevails for matters of personal data processing.

1. Roles

For personal data contained in the store and catalog data you connect, you are the controller (or a processor acting for your client) and we are the processor. Data about your account and users is processed by us as a controller under the Privacy Policy and is outside this DPA. The same applies to the store statistics described in Section 2.12 of the Privacy Policy.

2. Details of processing (Art. 28(3))

  • Subject matter and purpose: processing of store and catalog data to provide the Service you use, including audits, suggestions, changes to your store, feeds, content and, where you enable it, AI-visibility monitoring.
  • Duration: the term of the Terms of Service, until the data is deleted or returned under Section 9.
  • Nature: collection, storage, analysis, processing by AI providers, changes to your store where you enable them and, where you enable AI-visibility monitoring, disclosure of catalog data to answer-engine providers, including outside the EEA.
  • Types of personal data: personal data contained in your catalog content, such as names of individuals.
  • Categories of data subjects: individuals named in your catalog content.

You must not connect special categories of data (Art. 9 GDPR), the customer data of your store or individual orders.

3. Instructions

3.1 We process personal data only on your documented instructions, including your settings in the Service and with regard to transfers outside the EEA, unless EU or Member State law requires otherwise; in that case we inform you before processing unless that law prohibits it.

3.2 We inform you if, in our opinion, an instruction infringes data protection law.

4. Confidentiality

Persons authorised to process the personal data are bound by confidentiality.

5. Security (Art. 32)

We implement the technical and organisational measures required by Article 32 GDPR. A description is available to you on request, under confidentiality (Terms of Service, Section 16).

6. Sub-processors (Art. 28(2), (4))

6.1 You give general authorisation for us to engage sub-processors. The current list is published at Sub-processors.

6.2 We impose on each sub-processor by contract data-protection obligations equivalent to those in this DPA.

6.3 We inform you in advance of any intended addition or replacement of a sub-processor and give you a reasonable period to object on reasonable data-protection grounds. If we cannot resolve your objection, you may terminate the affected Service. This does not apply to the model providers that Perplexity AI uses to answer queries, which Perplexity AI may change without notice; if you do not accept this, do not enable AI-visibility monitoring.

6.4 We remain liable to you for our sub-processors' performance of their data-protection obligations, as Article 28(4) GDPR requires, subject to Section 12.

7. Data subject requests (Art. 28(3)(e))

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as possible, in responding to requests under Chapter III GDPR. We refer to you any data subject who contacts us about your data.

8. Assistance and breach notification (Art. 28(3)(f), 33)

8.1 We assist you in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to us.

8.2 We notify you without undue delay after becoming aware of a personal data breach affecting your data.

9. Deletion and return (Art. 28(3)(g))

9.1 At the end of the Service, at your choice, we delete or return the personal data we process on your behalf and delete existing copies, unless EU or Member State law requires us to store it. If you make no choice, we delete it.

9.2 Copies in backups are deleted on the normal backup cycle and remain protected under this DPA until then.

9.3 AI providers, including OpenAI, Perplexity AI and Google, keep requests and answers for the periods set in their terms and delete them afterwards. Until then they are bound by data-protection obligations under their agreements with us. Sections 9.1 and 9.2 apply to our systems.

10. Audits (Art. 28(3)(h))

We make available the information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, subject to reasonable notice, confidentiality and frequency limits, at your expense and without unreasonably disrupting our operations.

11. International transfers

Where a sub-processor processes personal data outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses (Decision 2021/914) concluded with that sub-processor or, where the recipient is certified, on the EU-U.S. Data Privacy Framework.

12. Liability

Liability under or in connection with this DPA, including for sub-processors, is subject to the limitations and exclusions of liability in Section 11 of the Terms of Service and counts towards the cap set there.

13. Term, law and acceptance

This DPA applies for as long as we process personal data on your behalf and is governed by the law of Estonia. Acceptance of the Terms of Service constitutes acceptance of this DPA.