Data Processing Agreement

pursuant to Art. 28 of Regulation (EU) 2016/679 (GDPR) · valid from 10 November 2026 · version 1

1. Parties

Controller: the client of the Lynxo service, as identified by the details in its account.
Processor: ATRIA SK s.r.o., P. Mudroňa 5, 010 01 Žilina, Company ID (IČO) 45473480, contact skacel@atria.sk.
This Agreement forms part of the Terms of Service and is concluded upon the client’s registration.

2. Subject matter, nature and purpose

The Processor provides the Controller with search, autocomplete, search statistics and, depending on the plan, an AI advisor in the Controller’s online shop. In doing so, it processes personal data of the shop’s visitors solely for this purpose and in accordance with the documented instructions of the Controller. These terms and the settings in the dashboard constitute the instructions.

3. Categories of data and data subjects

Data subjects: visitors to the Controller’s online shop.

• Search text and clicks on results. Stored only in aggregate form (counts of words and clicks), without being linked to any individual.
• IP address and browser identification. Processed only in memory for protection against misuse, for a maximum of 24 hours.
• For the AI advisor, also the text of the question written by the visitor. It may contain personal data if the visitor provides it themselves.

Special categories of personal data are not processed.

4. Duration of processing

For the duration of the contract. Aggregate statistics for a maximum of 13 months. After the contract ends, the Processor will delete the data within 30 days. Upon request, it will return the data in a commonly used format before deletion.

5. Obligations of the Processor

• It processes data only on the instructions of the Controller. Should an instruction infringe the law, it will inform the Controller.
• It ensures that persons with access to the data are bound by confidentiality.
• It implements appropriate technical and organisational measures (Art. 32 GDPR): encrypted communication (HTTPS), server access only with a cryptographic key, firewall, separate client indexes, daily backups, data minimisation (statistics without IP addresses).
• It assists the Controller in responding to data subject requests and in complying with obligations under Arts. 32 to 36 GDPR.
• It notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it.
• It makes available the information necessary to demonstrate compliance with this Agreement and allows a reasonable audit upon prior notice.

6. Sub-processors

The Controller grants general authorisation for the following sub-processors:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – server hosting in the EU (Germany).
• Anthropic PBC, San Francisco, USA – language model for the AI advisor, only if the Controller has it enabled. Only the text of the question and catalogue data are transferred, not the IP address. The transfer to the USA is safeguarded by the Standard Contractual Clauses of the European Commission.

The Processor will inform the Controller by e-mail at least 30 days in advance of any intended addition or replacement of a sub-processor. The Controller may object and terminate the contract. The Processor binds sub-processors to the same data protection obligations.

7. Obligations of the Controller

The Controller is responsible for the lawfulness of the processing, in particular for informing visitors to its shop of the use of the service in its privacy policy.

8. Final provisions

This Agreement is governed by the laws of the Slovak Republic and the GDPR. It remains in force for as long as the Processor processes personal data on behalf of the Controller. In the event of any conflict with the Terms of Service, this Agreement shall prevail in matters of personal data protection.