Data processing agreement – Eazign for WooCommerce

1. Parties and conclusion

The controller is the operator of the WooCommerce store that connects the plugin to the service ("customer"). The processor is Metacom Solutions, owner Gerald Kapp, Fasangasse 28/2, 8075 Hart bei Graz, Austria, info@eazign.at ("Eazign").

This agreement under Art. 28 GDPR is part of the terms (eazign.at/en/wordpress/terms/) and is concluded when the plugin is connected. We send a countersigned copy on request to info@eazign.at.

2. Subject, nature and purpose

Eazign provides the product designer for the customer's store, stores the designs of its end customers and creates previews and print files from them. Eazign processes the data only for this.

3. Data and data subjects

Data subjects: the store's end customers who design or order products.

Data: uploaded images, entered texts, finished designs, previews and print files (may contain names, photos of people or other personal content); order id, order number and line item ids. Eazign does not receive end customers' names, addresses or payment data. Special categories under Art. 9 GDPR are not intended.

4. Duration

While the store is connected. Afterwards Eazign deletes all data after 48 hours (see section 10).

5. Instructions

Eazign processes the data only on the customer's documented instructions, which follow from this agreement, the terms and the plugin settings. Further instructions are given by email to info@eazign.at. Eazign informs the customer if it considers an instruction unlawful.

6. Confidentiality

Persons at Eazign with access to the data are bound to confidentiality.

7. Technical and organisational measures

Transfer only encrypted (HTTPS/TLS).

Storage in the EU (AWS Frankfurt); database on an encrypted volume, files stored encrypted; the stores' REST keys additionally encrypted with AES-256-GCM.

Every plugin request is signed (HMAC); every store sees only its own data.

Separate instance and database for WooCommerce stores.

Server access only for the owner, by key; credentials in AWS Secrets Manager.

Daily backups, deleted automatically after 30 days; designs that were not ordered are deleted automatically after 90 days.

Eazign adapts the measures to the state of the art without lowering the level of protection.

8. Sub-processors

The customer approves: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg – servers, file storage and backups in the Frankfurt region (eu-central-1).

Eazign informs the customer by email at least 30 days before engaging a new sub-processor. The customer may object for an important data protection reason and terminate as of that date. Eazign binds sub-processors contractually to the same level of protection.

9. Assistance

Eazign assists the customer with data subject requests: the plugin passes exports and erasures from the WordPress tools "Export / Erase personal data" on to Eazign.

Eazign reports personal data breaches without undue delay, where possible within 48 hours of becoming aware, to the stored email address and assists with notifications and data protection impact assessments.

10. Deletion and return

The customer can download print files from their orders at any time. 48 hours after the plugin is disconnected or deleted, Eazign deletes all of the store's data; backups are overwritten after 30 days at the latest.

11. Audits

On request, Eazign provides the information needed to demonstrate compliance and allows audits after reasonable notice, as far as they do not affect operations or the confidentiality of other customers.

12. Final provisions

This agreement prevails over the terms in case of conflict. Liability follows Art. 82 GDPR and the terms. Austrian law applies.

Version

2 November 2026. The German version is binding.