Data processing agreement

Parties and applicability

These processing terms are intended for the agreement between the webshop using CookieROAS, the customer, and WSV Commerce B.V., the processor. The customer is identified in the agreed assignment or order confirmation.

The terms become part of the service when the parties declare them applicable and accept them. Merely viewing this page, submitting an enquiry or having an account is not acceptance. The parties can save the applicable version and add their specific instructions and arrangements to the assignment. Mandatory data protection law prevails over conflicting terms.

The customer is the controller for its own webshop data. If the customer itself acts as a processor, for example for a client webshop, it appoints WSV Commerce B.V. as a subprocessor with the required authorisation and within that controller’s instructions. Our own contact, account and business administration is covered by our privacy notice and is not automatically part of this assignment.

Subject matter, purpose and duration

The assignment concerns receiving and processing webshop measurements and available purchase data for the agreed tracking service. Processing includes collection or import, validation, normalisation, linking, storage, analysis for the order overview, supplementing eligible conversion measurements and dispatch to destinations connected by the customer. Optional monitoring includes checks and configured notifications.

The purposes are to provide insight into purchase measurements, amounts, recorded consent and dispatch status, and to support the agreed conversion measurements. This is not an instruction to bypass consent or collect unlimited personal data. Actual processing depends on the connected webshop, available data, enabled functions and received consent signals.

Processing continues during the agreed service and thereafter only for necessary winding up, return or deletion under these terms and applicable retention periods. The customer determines the intended use; the processor does not use the entrusted data for its own advertising, sale to third parties or its own model training.

Data and data subjects

Data subjects are visitors and customers of the connected webshop, including people who make purchases or interact with the webshop. Authorised contacts may be involved to the extent that their data forms part of processing on the customer’s instructions.

• Order references, order lines or product references where supplied, amounts, currencies and timestamps.
• Page, session, browser, click and campaign data and technical measurement and error information, to the extent processed by the enabled function.
• Recorded consent signals, source and timestamp, including rejected, unknown or not observed states.
• Supplied customer or matching information, such as email data or derived hashes, where permitted by the configured processing.
• Site and integration references, account identifiers and secured access details needed to perform the agreed integrations.

This list does not require the customer to supply every category. Special-category data and data relating to criminal offences are not the service’s intended input. The customer supplies only information necessary and permitted for its use. Hashes and other pseudonymised information are not automatically anonymous.

Documented instructions and responsibilities

The processor processes the data only on the customer’s documented instructions, including the accepted assignment, these terms and the settings and actions of authorised users. Instructions concerning transfers outside the EEA are included. We inform the customer if, in our opinion, an instruction infringes applicable data protection law and coordinate how to proceed.

If applicable Union or Member State law requires other processing, we inform the customer of that requirement beforehand unless that law prohibits this on important public-interest grounds.

The customer establishes its lawful basis, information for visitors and customers, required consent and authority for the connected domains and advertising accounts. Unknown consent is not consent. Settings or a paid subscription do not replace these responsibilities. We request clarification where the assignment or consent is insufficiently clear.

Confidentiality and security measures

We restrict access to people who need it for their work and ensure they are bound by confidentiality. Authorised users and administrators use access within their tasks. The customer secures its own accounts, devices and permissions and reports incorrect access or misuse.

Technical measures include organisation- and site-specific access controls, authentication, secure website connections, input limits and validation, filtering of sensitive measurement fields and protection of integration secrets. Hashing or field encryption is applied where the relevant function is configured for it. This does not mean that every field is anonymous or that the entire database is automatically encrypted.

We implement appropriate technical and organisational measures in accordance with Article 32 GDPR. We assess confidentiality, integrity, availability, recovery and regular testing, considering the state of the art, costs, nature, scope, context, purposes and risks. Recovery copies, access management, updates and incident handling form part of this. These terms contain no unverified certification, absolute security guarantee or separate availability SLA.

Service providers and subprocessors

The customer grants general written authorisation for the subprocessors identified for its assignment in the table below and the accepted assignment. Only services actually processing personal data for that assignment are subprocessors for that processing. Suppliers for our own administration and recipients selected by the webshop may have a different role.

We inform the customer in good time before engaging a new or replacement subprocessor for its data, with an opportunity to raise a reasoned data-protection objection before the new use. The parties discuss a suitable solution or ending the relevant processing if no solution is possible. For urgent security measures, we communicate as soon as possible; statutory authorisation and information duties remain applicable.

We impose the same relevant data-protection obligations on the subprocessor for the entrusted processing and remain responsible to the customer for their performance. The table and links to supplier documents do not state that every possible supplier contract has already been concluded on the customer’s behalf.

Advertising platforms and international transfers

Google Ads, Meta and other destinations selected by the customer receive data only within the activated integration and assignment. A platform’s role depends on the service, its terms and the processing concerned. Merely listing a selected advertising platform on this page does not automatically make it a subprocessor of WSV Commerce B.V. The customer arranges the necessary account authorisations and platform agreements.

Our own Google Analytics website analysis and business mailbox are separate processing activities for our own organisation. This assignment does not automatically enable them for visitors to the customer’s webshop. Integration availability or a logo does not prove an active data transfer.

For transfers outside the EEA, the parties apply Chapter V GDPR. Where required, the applicable basis, such as a valid adequacy decision or standard contractual clauses with the necessary assessment and supplementary measures, is established and documented. An EU server or email-sending region does not prove that all storage, support and further processing takes place exclusively in the EU.

Data subject rights and other assistance

The customer handles requests from its visitors and customers. If we directly receive a request concerning data we process for the customer, we refer the person to the customer and inform the customer where appropriate. We do not independently decide such a request outside the assignment or a legal obligation.

Considering the nature of processing, we support the customer through appropriate technical and organisational measures in responding to privacy rights. To the extent relevant to our processing and available information, we also assist with security obligations, personal data breach notifications, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR.

Personal data breaches and incident information

When we become aware of a personal data breach concerning data we process for the customer, we notify the customer without undue delay through the agreed contact route. We do not wait for the entire investigation to finish before an initial notification.

Information includes, where available, the nature of the breach, affected data and categories of people, likely consequences, measures taken or proposed and a contact point. Missing information follows in phases as it becomes available. We cooperate with investigation, mitigation and the information needed for the customer’s assessment.

The customer assesses its notification obligations to supervisory authorities and data subjects. A statutory period that may apply to a controller’s notification is not a general waiting period for our notification as a processor. Report a suspected incident to info@cookieroas.eu without sending passwords, access tokens or unnecessary customer information.

Annex: retention and deletion

The table below describes the separate data categories and technical retention arrangements. Agreed visible order history is not the retention period for every underlying measurement, audit record or recovery copy. Different settings and instructions are recorded for the assignment.

This overview describes the inspected configuration and adopted policy on 5 November 2026. Settings, purpose limitation, pending processing and statutory retention obligations may differ. The commercial 7/90 days of visible history are not a universal deletion period. Suppliers may have their own processing and backup periods.

Scheduled deletion is performed through the relevant cleanup processes and may depend on processing, queues or a valid retention obligation. The customer may request clarification of applicable settings and the handling of its deletion instruction. A configured period or an empty dashboard does not, on its own, prove that every copy has already been removed.

Return and deletion when processing ends

After the processing services end, the processor deletes or returns the personal data at the customer’s choice and deletes existing copies unless applicable law requires retention. The parties record the choice, required export format, closing of integrations and execution of deletion. Requests may be made through info@cookieroas.eu.

Recovery copies and earlier migration, export or test copies are included in that handling insofar as they contain entrusted personal data. They do not fall outside these terms because they are outside the live database. For copies that cannot immediately be deleted individually, access restrictions, prohibition of other use and applicable phase-out or deletion are established. Previous deletion instructions must be respected after a restore.

We explain relevant remaining copies and legal exceptions and confirm the completed handling using available verification information. This provision introduces no unverified universal backup-deletion period and does not change existing retention duties for our own business administration.

Verification, audits and changes

We make available the information necessary to demonstrate compliance with these processing terms and cooperate with audits, including inspections, by the customer or its authorised auditor. The parties coordinate appropriate execution while protecting confidential information, security and other customers’ data. These practical arrangements do not restrict a supervisory authority’s statutory investigation powers.

The parties assess relevant changes to the assignment, data categories, measures, suppliers or transfers and record necessary amendments. New website text is not automatically a new instruction or a replacement of previously accepted arrangements. These terms contain no separate restriction of statutory GDPR rights or liability.

Also read our privacy notice for our own processing and the general terms for the service.