last updated: february 2026
1. scope and roles
This Data Processing Agreement (DPA) applies where Alana processes personal data on your behalf in providing the platform. For that data you are the controller and Alana is the processor. This DPA supplements our terms of service and applies to the extent required by applicable data-protection law, including the GDPR.
2. processing details
Subject matter: provision of the Alana platform. Duration: for the term of your subscription. Nature and purpose: scoring, optimizing, searching, and distributing your product catalog, plus account and support operations. Categories of data: primarily product catalog data and account/contact data of your authorized users. Data subjects: your personnel and, where applicable, end users interacting with your catalog.
3. our obligations as processor
We process personal data only on your documented instructions, including for international transfers, unless required otherwise by law. We ensure persons authorized to process the data are bound by confidentiality. We assist you, taking into account the nature of processing, in meeting your obligations to data subjects and regulators.
4. security
We implement appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest, workspace-level isolation, access controls, monitoring, and a documented incident-response process. A summary is available on our security page.
5. subprocessors
You authorize us to engage the subprocessors listed on our subprocessors page to process personal data. We impose data-protection obligations on each subprocessor no less protective than those in this DPA and remain responsible for their performance. We provide a mechanism to receive notice of changes so you may object on reasonable grounds.
6. international transfers
Where personal data is transferred across borders, we rely on an appropriate transfer mechanism, including the European Commission’s Standard Contractual Clauses (SCCs) and equivalent safeguards, incorporated by reference into this DPA.
7. data subject requests
Taking into account the nature of the processing, we assist you with appropriate technical and organizational measures, insofar as possible, to respond to data-subject requests to exercise their rights under applicable law.
8. personal data breach
We notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide information reasonably available to help you meet your notification obligations.
9. audits
We make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice and confidentiality.
10. return and deletion
On termination, and at your choice, we delete or return the personal data we process on your behalf and delete existing copies, unless retention is required by law.
11. contact
To request a countersigned copy of this DPA or ask questions, contact us at privacy@alana.shopping.