This Data Processing Agreement (“DPA”) forms part of the agreement governing access to or use of the PRE-ORDER platform, application, business tools or related services (the “Services”) where PRE-ORDER processes Personal Data on behalf of a business customer as a processor. It is intended to address the requirements of Article 28 of the GDPR and comparable processor obligations under applicable data-protection law.
This DPA does not govern processing for which PRE-ORDER determines its own purposes and means as an independent Controller, such as account administration, Platform security, fraud prevention, legal compliance, service analytics performed for PRE-ORDER’s own purposes, or operation of the pre-order Platform described in the Privacy Policy. Those activities are governed by the Privacy Policy and applicable law.
1. Parties and scope
1.1 “PRE-ORDER Europe” EOOD, UIC/EIK 208904127, registered at Arthur Residential Complex, Block C, Floor 3, Apartment C44, 8229 Sveti Vlas, Nessebar Municipality, Burgas District, Bulgaria (“PRE-ORDER”, “Processor”, “we”, “us” or “our”), enters into this DPA with the business or organisation that has accepted the applicable Services agreement, Seller Agreement, Business Buyer terms, order form or other commercial arrangement (“Customer”, “Controller” or “you”).
1.2 The legal identity of the Customer is the entity identified in its verified PRE-ORDER business account, signed commercial schedule, order form or other agreement. The person accepting this DPA for the Customer confirms authority to bind that entity.
1.3 This DPA applies only to Customer Personal Data that PRE-ORDER processes on behalf of Customer as a processor in connection with the Services. It does not convert processing that is legally controller-to-controller into processor processing.
1.4 If Customer acts as a processor for another controller, Customer is a “Processor” and PRE-ORDER is a “Subprocessor” for the relevant processing. References to Controller instructions include lawful instructions communicated by Customer on behalf of that controller.
1.5 In the event of conflict, mandatory data-protection law prevails, followed by any signed data-protection schedule, this DPA, the applicable commercial agreement and general platform terms, unless the parties expressly agree otherwise in writing.
2. Definitions
“Applicable Data Protection Law” means the GDPR and any national law supplementing or implementing it, plus other privacy or data-protection law that applies to the relevant processing.
“Customer Personal Data” means Personal Data processed by PRE-ORDER on behalf of Customer under this DPA.
“Data Subject”, “Controller”, “Processor”, “Processing”, “Personal Data” and “Personal Data Breach” have the meanings given in the GDPR.
“GDPR” means Regulation (EU) 2016/679.
“Subprocessor” means a third party engaged by PRE-ORDER to process Customer Personal Data on behalf of Customer.
“Services” means the PRE-ORDER platform, application, APIs, dashboards, communications, analytics, integrations and related business services made available to Customer under the applicable agreement.
“Standard Contractual Clauses” or “SCCs” means the European Commission standard contractual clauses for transfers of personal data to third countries, as amended, replaced or supplemented from time to time.
3. Roles of the parties
3.1 Customer is responsible for determining whether and to what extent it is a Controller or Processor for Customer Personal Data. Customer is responsible for its own compliance with Applicable Data Protection Law, including transparency, lawful basis, data minimisation, accuracy, retention and handling of data-subject rights.
3.2 PRE-ORDER acts as Processor only when it processes Customer Personal Data on Customer’s documented instructions for the Services. For other processing, PRE-ORDER may act as an independent Controller as explained in the Privacy Policy.
3.3 The parties acknowledge that PRE-ORDER’s pre-order Platform may involve multiple independent Controllers. For example, a Seller may independently control Buyer data required to perform a Product Contract, while PRE-ORDER may independently control data required to operate the Platform. This DPA applies only where the factual and legal relationship is processor-based.
3.4 Nothing in this DPA makes PRE-ORDER the Controller of Customer’s own business decisions, personnel records, customer lists, uploaded business datasets or instructions merely because PRE-ORDER provides technical infrastructure for processing them.
4. Customer instructions
4.1 PRE-ORDER will process Customer Personal Data only on documented instructions from Customer, including as necessary to provide, secure, support and maintain the Services, unless Union or Member State law requires other processing. If legally permitted, PRE-ORDER will inform Customer before processing required by law.
4.2 Customer’s instructions consist of this DPA, the applicable agreement, Customer’s lawful configuration and use of the Services, support requests, enabled integrations, and other written instructions accepted by PRE-ORDER.
4.3 If PRE-ORDER reasonably believes an instruction infringes Applicable Data Protection Law, it will inform Customer without undue delay and may suspend the affected processing until the instruction is confirmed, modified or withdrawn.
4.4 PRE-ORDER is not required to follow an instruction that would materially alter the Services, violate another user’s rights, weaken security, require unlawful disclosure, or fall outside the agreed Services without a separate written scope and, where appropriate, fees.
5. Details of processing
5.1 The subject matter, duration, nature and purpose of processing, categories of Personal Data and categories of Data Subjects are described in Schedule 1 and may be further specified in Customer’s Services configuration or commercial documentation.
5.2 Customer must not use the Services to process Personal Data that is unnecessary for the stated business purpose. Customer must not intentionally submit special-category data, criminal-conviction data, full payment-card credentials, passwords, authentication secrets or government identity documents into general free-text fields unless the relevant feature expressly requires and lawfully supports such processing.
5.3 PRE-ORDER’s demand-forecasting functions are not intended to use passwords, payment-card numbers, CVV/security codes, authentication credentials, identity documents, private payment credentials or free-text private chat content as AI model features. Where feasible, analytical datasets should use pseudonymised or aggregated information rather than direct identifiers.
6. Confidentiality and authorised personnel
6.1 PRE-ORDER will ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality or statutory confidentiality obligation and receive access only where necessary for their role.
6.2 Access will be limited using role-based or equivalent access controls appropriate to the Services. Administrative actions may be logged where necessary for accountability, security and incident investigation.
6.3 PRE-ORDER will provide relevant personnel with data-protection and security instructions appropriate to their responsibilities.
7. Security of processing
7.1 PRE-ORDER will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data, taking into account the state of the art, implementation costs, nature, scope, context and purposes of processing, and risks to individuals.
7.2 Measures may include, as appropriate to the relevant service and risk:
- access controls and least-privilege permissions;
- authentication controls and, where supported, multi-factor authentication;
- encryption in transit and appropriate protection of stored data;
- separation or pseudonymisation of analytical datasets where feasible;
- security logging, monitoring and incident-response procedures;
- secure development, change-management, vulnerability-management and backup processes;
- vendor and Subprocessor due diligence proportionate to risk;
- business-continuity and recovery measures;
- procedures for data minimisation, retention and secure deletion; and
- periodic review of the effectiveness of relevant safeguards.
7.3 Schedule 2 describes the baseline security framework at a level appropriate for contractual transparency. It does not disclose information that would itself compromise security.
7.4 Customer is responsible for securely configuring its Account, managing authorised users, protecting credentials, applying suitable permissions and using available security features.
8. Subprocessors
8.1 Customer provides general written authorisation for PRE-ORDER to engage Subprocessors where reasonably necessary to provide the Services, subject to this Section.
8.2 PRE-ORDER will impose data-protection obligations on each Subprocessor that are no less protective in substance than the obligations applicable to PRE-ORDER under this DPA for the processing entrusted to that Subprocessor.
8.3 PRE-ORDER remains responsible to Customer for the performance of its Subprocessors’ data-protection obligations to the extent required by Applicable Data Protection Law.
8.4 PRE-ORDER will maintain a current list of material Subprocessors and make it available through the Platform, legal pages, Customer account or upon reasonable request. The list may identify the Subprocessor, service function and processing location or region where appropriate.
8.5 Where required by Article 28 GDPR, PRE-ORDER will provide reasonable advance notice of a new or replacement Subprocessor. Customer may object on reasonable, documented data-protection grounds. The parties will work in good faith to address the concern, including by considering a commercially reasonable alternative. If no reasonable solution is available, either party may terminate the affected Service to the extent necessary, subject to the commercial agreement.
8.6 Stripe, where enabled for B2C payments, and any separately enabled licensed B2B payment provider may process payment data in their own contractual and regulatory roles. Where a provider acts as an independent Controller, its processing is not Subprocessor processing under this DPA merely because the provider is integrated with PRE-ORDER. Each role is determined by the actual processing arrangement.
9. International transfers
9.1 PRE-ORDER will not transfer Customer Personal Data from the EEA to a country that lacks an applicable adequacy decision unless an appropriate transfer mechanism under Chapter V GDPR is in place, such as SCCs, binding corporate rules where available, or another lawful mechanism.
9.2 Where SCCs are required for a transfer involving PRE-ORDER as data exporter or importer, the parties will ensure that the appropriate SCC module and completed annexes are in place through a legally effective transfer arrangement before that transfer. Relevant details may be recorded in this DPA, the Subprocessor list or a separate transfer schedule.
9.3 PRE-ORDER will take supplementary measures where reasonably required by Applicable Data Protection Law and the circumstances of the transfer, including technical, contractual or organisational safeguards.
9.4 Customer is responsible for ensuring that its own transfers to PRE-ORDER, Sellers, Buyers, affiliates or other recipients have a lawful transfer basis where required.
10. Assistance with data-subject rights
10.1 Taking into account the nature of processing, PRE-ORDER will provide reasonable assistance to Customer through appropriate technical and organisational measures, insofar as possible, for responding to requests to exercise data-subject rights under Applicable Data Protection Law.
10.2 If PRE-ORDER receives a request relating solely to Customer Personal Data for which Customer is the Controller, PRE-ORDER may direct the requester to Customer and will not independently respond on Customer’s behalf unless authorised or legally required.
10.3 Customer remains responsible for verifying the requester, determining the applicable legal response and meeting statutory deadlines. PRE-ORDER may require reasonable information to locate the relevant data and verify that a request concerns Customer-controlled processing.
10.4 If a request also concerns processing for which PRE-ORDER is an independent Controller, PRE-ORDER may respond separately under its Privacy Policy.
11. Assistance with compliance, DPIAs and consultations
11.1 Taking into account the nature of processing and information available to PRE-ORDER, PRE-ORDER will provide reasonable assistance with Customer’s obligations concerning security, Personal Data Breaches, data-protection impact assessments and prior consultation with a supervisory authority where the relevant obligation relates to the processing under this DPA.
11.2 Customer is responsible for deciding whether a DPIA is required for its use of the Services. PRE-ORDER may provide available information about architecture, security controls, data flows and relevant processing needed for that assessment.
11.3 PRE-ORDER may conduct its own DPIA screening or risk assessment for platform processing, including behavioural analytics, profiling, systematic monitoring, dataset combination and AI-based processing, where required by law or risk.
12. Personal Data Breaches
12.1 PRE-ORDER will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data processed under this DPA.
12.2 The notification will include information reasonably available to PRE-ORDER that Customer may need to comply with Articles 33 and 34 GDPR, which may include:
- a description of the nature of the breach, including categories of data and affected data subjects where reasonably known;
- known or reasonably estimated scope;
- likely consequences;
- measures taken or proposed to contain, investigate and remediate the incident;
- a contact point for follow-up; and
- additional information in phases where not all details are available at once.
12.3 PRE-ORDER’s notification of an incident is not an admission of fault or liability. Customer is responsible for determining whether notification to a supervisory authority or affected individuals is required, unless PRE-ORDER has a separate legal obligation as Controller.
12.4 Customer must notify PRE-ORDER without undue delay of any compromise of Customer credentials, integration keys, Customer systems or other event that may affect the security of the Services or Customer Personal Data.
13. Return and deletion of data
13.1 On termination or expiry of the affected Services, and at Customer’s choice where required by Article 28 GDPR, PRE-ORDER will delete or return Customer Personal Data processed solely on Customer’s behalf, unless applicable law requires retention.
13.2 Customer should export information it needs before account closure using available tools or reasonable support channels. Return is subject to technical feasibility, security, third-party rights and the agreed Services.
13.3 Deletion from active systems may be followed by deletion from backups according to normal backup-rotation cycles, provided data in backups remains protected and is not restored for ordinary business use except where necessary for recovery.
13.4 PRE-ORDER may retain data for which it acts as an independent Controller, including records needed for legal compliance, security, fraud prevention, accounting, dispute resolution or establishment, exercise or defence of legal claims. Such retention is governed by the Privacy Policy, not this DPA.
14. Audit and information rights
14.1 PRE-ORDER will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR obligations applicable to PRE-ORDER as Processor.
14.2 Customer should first use available compliance materials, questionnaires, summaries, independent reports or other documentation made available by PRE-ORDER. If those materials are insufficient, Customer may request a reasonable additional audit concerning processing under this DPA.
14.3 Audits must be proportionate, normally no more than once per 12-month period unless required by a supervisory authority or following a material security incident, conducted during normal business hours, on reasonable notice, and subject to confidentiality and security requirements. Audits must not compromise another customer’s data, PRE-ORDER security, trade secrets or legally protected information.
14.4 Customer bears its own audit costs and PRE-ORDER may charge reasonable costs for extensive assistance beyond ordinary compliance support, unless the audit identifies a material breach by PRE-ORDER or Applicable Data Protection Law requires otherwise.
14.5 PRE-ORDER will cooperate with competent supervisory authorities to the extent required by law.
15. Customer obligations
Customer must:
- ensure that Customer Personal Data is collected and disclosed to PRE-ORDER lawfully, fairly and transparently;
- provide required privacy information and obtain consent where consent is the appropriate legal basis;
- give only lawful, documented instructions;
- limit uploaded data to what is necessary for legitimate business purposes;
- ensure accuracy and maintain appropriate retention rules;
- configure permissions and remove access for persons who no longer require it;
- avoid entering sensitive or secret information into unsupported fields;
- promptly address data-subject requests and regulatory obligations for which Customer is responsible; and
- notify PRE-ORDER of material changes in processing that may affect the agreed instructions or risk profile.
16. AI and analytical processing
16.1 If Customer enables AI-supported forecasting or analytics that process Customer Personal Data on Customer’s behalf, such processing remains subject to this DPA and Customer’s instructions.
16.2 PRE-ORDER’s AI functions are designed as decision-support tools. They are not intended to autonomously make legally binding decisions about individuals, determine access to essential services, autonomously make financial decisions about individuals, or autonomously start production without human confirmation.
16.3 Where feasible, data used for demand analytics or model development will be pseudonymised, aggregated or otherwise separated from direct identifiers. Customer must not intentionally provide special-category data for demand forecasting unless expressly agreed and lawfully supported.
16.4 PRE-ORDER may maintain logs relating to model version, input-factor groups, forecast output, confidence or uncertainty, applicable constraints and human accept/modify/reject decisions where appropriate for transparency, auditing and validation.
16.5 Nothing in this DPA requires PRE-ORDER to disclose model weights, source code, trade secrets or information that would compromise security, provided sufficient information is made available to satisfy applicable processor obligations.
17. Records and accountability
17.1 PRE-ORDER will maintain records of processing activities required from processors under Applicable Data Protection Law, including relevant categories of processing performed on behalf of controllers, transfers and security measures.
17.2 Customer is responsible for its controller or processor records, including identifying purposes, lawful bases, categories of data, recipients, retention and transfer mechanisms applicable to its use of the Services.
17.3 The parties will provide each other with reasonably necessary contact and compliance information to support accountability and regulator cooperation.
18. Liability and relationship to the main agreement
18.1 Each party remains responsible for its own obligations under Applicable Data Protection Law. Nothing in this DPA limits rights of data subjects or powers of supervisory authorities.
18.2 Contractual liability between the parties for breaches of this DPA is subject to the liability provisions of the applicable main agreement, except to the extent such limitation is prohibited by law or a signed data-protection schedule expressly provides otherwise.
18.3 A party that receives a claim, complaint or regulatory inquiry materially relating to the other party’s obligations will, where legally permitted, inform the other party and reasonably cooperate in responding.
19. Term and termination
19.1 This DPA becomes effective when the applicable Services agreement or DPA is accepted and remains in effect for as long as PRE-ORDER processes Customer Personal Data on behalf of Customer.
19.2 Provisions that by their nature should survive termination, including confidentiality, deletion/retention, audit records, liability and international-transfer protections, continue for as long as relevant Customer Personal Data remains subject to them.
20. Governing law and notices
20.1 Subject to mandatory data-protection law and any applicable Standard Contractual Clauses (SCCs), this DPA is governed by Bulgarian law. Any dispute arising out of or in connection with this DPA is subject to the jurisdiction of the competent courts of Bulgaria, except where mandatory data-protection law or applicable SCCs require otherwise.
20.2 This clause does not restrict mandatory rights of data subjects or supervisory authorities under the GDPR or other Applicable Data Protection Law.
20.3 Data-protection notices to PRE-ORDER may be sent to info@b2b-agency.cc. Customer notices may be sent to the verified contact in the Customer Account or applicable agreement.
20.4 The English text is the reference version to the extent permitted by law. Any mandatory local-language interpretation rules remain unaffected.
Schedule 1 — Processing details
| Item | Description |
|---|---|
| Subject matter | Processing of Customer Personal Data to provide PRE-ORDER pre-order workflows, business tools, communications, analytics, integrations, support and related Services as configured by Customer. |
| Duration | For the term of the applicable Services and thereafter only for deletion, return, backup rotation, legal retention or other purposes permitted by this DPA and law. |
| Nature of processing | Collection, receipt, hosting, storage, organisation, structuring, retrieval, consultation, transmission, display, analytics, pseudonymisation, aggregation, support, deletion and other operations necessary to provide the configured Services. |
| Purposes | Providing and supporting Customer-requested functionality; managing Customer-controlled content and business workflows; communications; configured analytics; integrations; security and troubleshooting as processor where applicable. |
| Data subjects | Customer personnel and authorised users; business contacts; Customer’s buyers, customers, suppliers, representatives or other persons whose Personal Data Customer submits or instructs PRE-ORDER to process; recipients or delivery contacts where relevant. |
| Personal Data | Names, business contact details, user identifiers, roles, account-related metadata, company-related contact information, order and SKU data linked to individuals, delivery/contact information, communications and attachments, support data, behavioural or event data where processed on Customer’s behalf, technical/session data and other data submitted through configured Services. |
| Sensitive data | Not intended as a standard category. Customer must not intentionally submit special-category data, criminal-conviction data, full payment-card credentials, authentication secrets or identity documents through unsupported fields. |
| Frequency | Continuous or event-driven according to Customer’s use of the Services. |
| Transfers | As described in Section 9 and the applicable Subprocessor information. |
| Deletion/return | As described in Section 13, subject to lawful retention and controller processing outside this DPA. |
Schedule 2 — Baseline technical and organisational measures
| Control area | Baseline approach |
|---|---|
| Governance | Documented data-protection and security responsibilities; access according to role and operational need; confidentiality obligations. |
| Identity and access | Account authentication; role-based or equivalent permissions; privileged access restriction; access removal when no longer required; MFA where supported or risk-appropriate. |
| Data protection by design | Data minimisation; separation of direct identifiers from analytics where feasible; pseudonymisation/aggregation for AI and analytics where appropriate. |
| Encryption and transport | Protected communications in transit using contemporary secure protocols; appropriate safeguards for stored data according to system design and risk. |
| Logging and monitoring | Security, administrative and relevant application logging; monitoring and investigation of suspicious events; audit trails where appropriate. |
| Secure development | Controlled development and release processes; testing; dependency and vulnerability management; change controls appropriate to the platform lifecycle. |
| Incident management | Detection, triage, containment, investigation, remediation and notification workflows. |
| Availability and recovery | Backups and recovery arrangements appropriate to service criticality; continuity measures and resilience planning. |
| Vendor management | Risk-based review of service providers/Subprocessors and contractual data-protection requirements. |
| Retention and deletion | Retention according to purpose and legal obligations; deletion or anonymisation after applicable periods; backup rotation. |
| Personnel | Confidentiality obligations and role-appropriate security/data-protection awareness. |
| Physical/infrastructure security | Reliance on appropriate physical and environmental controls of relevant hosting/infrastructure providers and controlled access to operator-managed facilities or devices. |
Schedule 3 — Subprocessor and transfer information
PRE-ORDER will maintain current Subprocessor information separately because infrastructure and service providers may change over time. Customer may request the current list at info@b2b-agency.cc or access it through the legal or account area where published.
For each material Subprocessor, PRE-ORDER should make available, as appropriate: provider name; service function; categories of processing; processing location or region; and applicable transfer mechanism where Personal Data is transferred outside the EEA.
Payment providers, including Stripe for B2C and any separately enabled licensed B2B provider, may act in independent contractual and regulatory roles. Their data-protection status depends on the actual processing arrangement and must not automatically be treated as Subprocessor processing.
Schedule 4 — Customer compliance checklist
- Identify whether Customer is Controller or Processor for each dataset submitted to PRE-ORDER.
- Document the lawful basis and required transparency notice.
- Configure user roles and remove obsolete access.
- Limit data to what is necessary; avoid unsupported sensitive data.
- Review enabled integrations and international transfers.
- Define retention rules and export needs before account closure.
- Complete a DPIA where Customer’s use is likely to result in high risk.
- Maintain a process for data-subject requests, incidents and regulator communications.
- Review the current Subprocessor list where the processing requires Article 28 oversight.