Last updated: 28 September 2026
This data processing agreement ("DPA") is part of the terms of service between the customer ("controller") and Progresso ICT, Mooieweg 106, 6836 AJ Arnhem, the Netherlands, KvK 61820423 ("processor"). It applies to personal data the controller has processed through Snapdex, as required by Article 28 of the General Data Protection Regulation (GDPR).
1. Subject, nature and purpose
The processor stores and indexes the controller's product catalogues and images, and answers searches with photos sent by the controller or by the controller's end users (for example shoppers using the Shopify app), only to provide Snapdex.
- Personal data: whatever personal data is contained in product data, product images and search photos, for example a person visible in a photo, and email addresses or user ids the controller puts in product metadata.
- Data subjects: the controller's staff, customers and end users, and any person shown in images.
- Duration: as long as the terms of service apply, plus the deletion period in section 8.
The controller must not send special categories of personal data (Article 9 GDPR), and must not use Snapdex to identify natural persons (see the acceptable use rules in the terms).
2. Instructions
The processor processes personal data only on documented instructions of the controller. The terms, this DPA and the controller's use of the portal and API are those instructions. The processor informs the controller if it believes an instruction infringes the GDPR.
3. Confidentiality
Everyone at the processor with access to personal data is bound to confidentiality.
4. Security
The processor takes appropriate technical and organisational measures, including:
- encryption of data in transit;
- servers and storage in the European Union;
- access to production systems only for people who need it, with individual accounts;
- API keys stored only as a hash, and teams isolated from each other in every request;
- search photos processed in memory and not stored.
5. Subprocessors
The controller gives general authorisation for the subprocessors on the subprocessors page. The processor announces a new or replacing subprocessor at least 30 days in advance by email. The controller can object on reasonable grounds within that period; if no solution is found, the controller can end the affected service. The processor imposes the same data protection obligations on each subprocessor and remains responsible for them.
6. Assistance
Taking into account the nature of the processing, the processor helps the controller to respond to requests from data subjects, and with data protection impact assessments and prior consultations where they concern Snapdex. Most requests can be handled directly through the portal and API (exporting, correcting and deleting products and images).
7. Personal data breaches
The processor notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the controller's data. The notification describes what is known about the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken.
8. Deletion and return
When the controller deletes data, a team or an account, or the agreement ends, the processor deletes the personal data straight away and removes it from backups within 30 days, unless EU or Dutch law requires it to be kept. Before deletion the controller can retrieve its product data through the API.
9. Audits
The processor makes available the information needed to demonstrate compliance with this DPA. The controller may have an audit carried out once a year by an independent auditor bound to confidentiality, at its own cost, announced at least 30 days in advance.
10. Transfers
The processor processes personal data in the European Union. It transfers personal data outside the EEA only with appropriate safeguards under Chapter V GDPR and after informing the controller.
11. Liability and precedence
The limitation of liability in the terms of service applies to this DPA. If this DPA and the terms conflict on the protection of personal data, this DPA prevails.