RollingPOS

Data processing agreement

Version of October 23, 2026. This agreement is part of the RollingPOS terms accepted by each merchant.

1. Roles

The merchant (the record store holding the account) is the controller of its customers’ data. [Mathieu Abeille Consultant / company name], publisher of RollingPOS, acts as a processor under Article 28 GDPR and processes this data only on the merchant’s instructions, given through its use and settings of the service.

2. Subject, duration and purposes

Providing the point of sale, inventory and multichannel order management software: receiving and tracking orders, keeping stock in sync, receipts, transactional emails sent at the merchant’s request, the merchant’s customer list and newsletter (sent only to customers who agreed). The agreement lasts as long as the merchant’s account.

3. Data and data subjects

The merchant’s customers and buyers: name, sales platform username, email, shipping address, country, order content and amounts, newsletter choice and its proof. No sensitive data, no card data.

4. Processor commitments

  • Process the data only for the purposes above; never sell, rent or use it for its own purposes.
  • Ensure confidentiality: only people who need it to run the service have access, under a confidentiality obligation.
  • Implement appropriate security: encrypted connections (TLS), each merchant’s data isolated down to the database, role-based access control, passwords of at least 12 characters and lockout after repeated failures, logging of views and exports of personal data, backups. [Specify: encryption at rest of the database and backups at the hosting provider.]
  • Retention: buyer identity erased from orders 3 years after the order; customers with no purchase or contact for 3 years anonymized; amounts and items kept for the merchant’s accounting.
  • Help the merchant answer data subject requests (access, export, erasure, objection), in particular through the customer export and erasure features.
  • Notify the merchant of any personal data breach affecting it without undue delay and no later than 48 hours after becoming aware of it, with the information it needs for its own notification.
  • Apply erasure requests sent by connected platforms (for example Shopify).
  • At the end of the contract, delete the merchant’s data within [30] days after letting it export them, unless the law requires retention.
  • Make available to the merchant the information needed to demonstrate compliance with these obligations.

5. Sub-processors

The merchant authorizes the following sub-processors: application and database hosting: [provider, country]; file storage: [provider, country]; email delivery: [provider, country]. RollingPOS informs the merchant of any change, which it may object to. Each sub-processor is bound by equivalent obligations.

6. Transfers

Data is hosted in the European Union. [To be confirmed.] Any transfer outside the EU would be covered by appropriate safeguards.

7. Contact

For any question or request about data: mathieu.abeille@gmail.com. See also our privacy policy.