Data Processing Agreement for the ARLing Shopping Assistant.

This agreement governs the processing of personal data under Article 28 of Regulation (EU) 2016/679 (GDPR) between the controller and the processor when the ARLing Asistent service is used. It is a template document: the e-shop fills in its identification details when ordering the service, and the rest of the text applies unchanged.

Contracting parties

Controller: [name of the e-shop], Company ID [fill in], with its registered office at [fill in the address] (hereinafter the "controller").

Processor: ARLing s. r. o., Company ID 56583486, VAT ID SK2122352100, with its registered office at Ivanská cesta 19112/32E, 821 04 Bratislava, Slovak Republic, e-mail andrej@arling.sk (hereinafter the "processor").

1Subject of the agreement

For the controller, the processor operates the ARLing Asistent chat widget, which answers visitors' questions about products on the website of the controller's e-shop. This agreement sets out the conditions under which the processor processes personal data on behalf of the controller in this activity.

2Duration

The agreement applies from the activation of the widget on the controller's website (completion of the setup from the product feed) until the end of the contractual relationship on the use of the ARLing Asistent service, regardless of how it ends.

3Nature and purpose of the processing

The processor processes personal data solely for the purpose of providing the chat assistant function: receiving a visitor's question, finding relevant products in the controller's feed and generating an answer. The processing is automated, without human intervention by the processor in individual conversations.

4Categories of personal data and data subjects

The data subjects are visitors to the controller's website who use the chat widget.

Categories of data processed:

• Content of chat messages, if a visitor includes personal data in a question (for example a name or contact details). This content is processed only while one question is being handled and is not stored anywhere: neither the processor nor any of its subcontractors keeps a history or the content of conversations.
• Technical data necessary for the operation and security of the widget: the visitor's IP address (short-term, for protection against abuse, see Article 6), the language of the widget and the domain from which the request came.
• Aggregate counters not linked to a specific person: the number of conversations and the number of product clicks per day, for the purpose of billing the monthly limit.

The processor keeps no database of conversations and no visitor profiles.

5Obligations of the processor

The processor undertakes to:

1. process personal data only on the basis of documented instructions from the controller and for the purpose stated in Article 1,
2. ensure that the persons authorised to process personal data are bound by confidentiality,
3. take appropriate technical and organisational measures under Article 32 GDPR (Article 6 of this agreement),
4. comply with the conditions for engaging another processor under Article 7 of this agreement,
5. within its possibilities, help the controller fulfil its obligation to respond to requests from data subjects to exercise their rights,
6. help the controller ensure compliance with the obligations under Articles 32 to 36 GDPR (security, notification of incidents, impact assessment),
7. after the end of the provision of the service, delete or return all personal data under Article 8 of this agreement,
8. make available to the controller the information necessary to demonstrate compliance with this agreement and allow audits under Article 9.

6Security measures

The service runs on Cloudflare infrastructure (Workers, Vectorize, D1): encrypted transmission (TLS) between the widget, the processor and the subcontractor, separation of the data of individual controllers by the e-shop identifier, access to administration restricted to the processor only, and no permanent storage for the content of conversations. The visitor's IP address is used short-term only, for protection against an excessive number of requests (rate limiting), and is not part of any permanent database.

7Subcontractors (other processors)

The controller agrees to the engagement of these subcontractors:

• Cloudflare, Inc. (and its affiliated companies in the EU), the provider of the infrastructure (Workers, Workers AI, Vectorize, D1, KV) on which the whole service runs. Cloudflare concludes its own data processing agreement with its customers, with standard contractual clauses (SCC), and is certified under the EU Cloud Code of Conduct. The exact geographical location of the processing (exclusively the EU) is not publicly guaranteed by Cloudflare, so a transfer outside the EU is covered by standard contractual clauses.

The processor informs the controller of every intended change of subcontractors at least 30 days in advance at the e-mail address given when ordering the service; the controller may object within this period.

8Deletion and return of data

Since the content of conversations is not stored on an ongoing basis, after the end of the contractual relationship the processor deletes within 30 days: the record of the controller's e-shop (domain, feed URL, contact e-mail), the stored product embeddings and the aggregate daily counters. At the controller's request, the processor provides an export of the aggregate counters before the deletion.

9Audit and inspection

On request, the processor provides the controller with the information necessary to demonstrate compliance with this agreement (for example a description of the technical measures under Article 6). Once a year, after notice given at least 14 days in advance, the controller may ask for reasonable cooperation in verifying compliance, in a way that does not endanger the security or the operation of the service for the processor's other customers.

10Notification of incidents

The processor notifies the controller without undue delay, at the latest within 48 hours of discovering it, of any security incident that may have affected the personal data processed under this agreement, together with the available information on its nature and extent.

11Contact

In matters of this agreement and the protection of personal data, contact the processor at andrej@arling.sk.

Version 1.0, effective from 4 September 2026. ARLing s. r. o. may amend the wording of this agreement; it informs the controller of a change at least 30 days in advance at the contact e-mail address.