OPEX Data Processing Agreement

Version and effective date: October 1, 2026.

This agreement applies when OPEX processes personal data for a merchant. The merchant is the controller and OPEX is the processor unless applicable law assigns different roles.

Processing details

Processing covers customer identity and contact details, order history, loyalty activity, preferences, and technical identifiers needed for loyalty, personalization, analytics, and consented merchant communications. Processing lasts only while the services are active plus the documented retention periods.

OPEX obligations

Process personal data only on documented merchant instructions and to provide enabled OPEX services.
Keep personnel with access to personal data bound by confidentiality obligations.
Apply access controls, encryption, backups, monitoring, retention, and incident-response safeguards.
Assist merchants with access, deletion, correction, and regulatory requests relating to customer data.
Delete or return personal data when services end, except where retention is legally required.

Subprocessors and transfers

OPEX may use infrastructure, database, storage, email, SMS, WhatsApp, monitoring, and support providers only under written data-protection obligations. OPEX remains responsible for their processing and will provide notice of material subprocessor changes through its service or published legal notices.

Security incidents and requests

OPEX will investigate confirmed incidents, take reasonable containment and remediation measures, and notify affected merchants without undue delay when their personal data is involved. Merchants can contact OPEX through the support channels shown in the service for privacy requests.