Data Processing Agreement
Last updated: 1 November 2026
This Data Processing Agreement ("DPA") forms part of the agreement between you ("Controller") and Xaldro ("Processor", "we", "us") regarding the use of Xaldro ("Service").
Xaldro, a registered trade name of a Dutch sole proprietorship (eenmanszaak), Beeklaan 38, 4702JL Roosendaal, Netherlands. KvK 97282812, VAT NL005260736B22.
1. Definitions
Terms used in this DPA have the meanings given in the EU General Data Protection Regulation (GDPR) 2016/679.
2. Subject and duration
| Item | Detail |
|---|---|
| Subject matter | Processing of Personal Data by Processor on behalf of Controller in connection with the Service. |
| Duration | For as long as the Service is provided to Controller, followed by the deletion periods in Section 8. |
| Nature and purpose | Posting Controller's Webflow Ecommerce orders, payments, refunds and tax to the Xero or QuickBooks Online account Controller connects, as contacts, invoices, payments, credit notes and refunds. |
| Processing activities | Reading Controller's Webflow sites and orders with read-only permissions; storing order, line item, refund and sync records; posting documents to Xero or QuickBooks and reading them back to check their totals; storing encrypted access tokens; keeping an activity log of account actions; sending service emails to Controller's users, including a daily summary that names the customers of the orders it lists; processing subscription payments. |
| Categories of Data Subjects | Controller's authorized users and team members; Controller's end customers (the buyers on Controller's Webflow store). |
| Categories of Personal Data | Of Controller's users: email address, Webflow user ID, and, in the activity log, the IP address and browser string of their requests. Of buyers: name, email address, the country and region of the order address, order contents and amounts. Shipping and billing addresses are not stored. No payment card data is processed by Processor. |
3. Processor obligations
Processor agrees to:
- Process Personal Data only on documented instructions from Controller (including those in the Terms of Service and this DPA).
- Ensure persons authorized to process Personal Data are bound by confidentiality.
- Implement appropriate technical and organizational measures (see Section 6).
- Assist Controller in responding to Data Subject requests.
- Notify Controller without undue delay (within 72 hours) of a Personal Data breach.
- Delete Personal Data after the end of the provision of the Service as set out in Section 8, after Controller has had the opportunity to export it.
- Make available all information necessary to demonstrate compliance with GDPR Art. 28.
4. Sub-processors
Controller authorizes Processor to engage the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting (application and database) | EU (Nuremberg, Germany) |
| Cloudflare, Inc. | DNS, and forwarding of email sent to xaldro.com addresses. Website and app traffic does not pass through Cloudflare. | Global |
| Resend, Inc. | Sending service emails, including the daily summary that contains buyer names | EU region selected |
| Stripe Payments Europe Ltd. | Subscription billing and payments (Controller's account data only) | EU (Ireland) |
| Storage of encrypted database backups. Google holds only encrypted files and cannot read them. | Global | |
| Functional Software, Inc. (Sentry) | Error reports from our servers: the error message and where in our code it happened. Before sending we remove email addresses, sign-in codes and tokens, cookies, request headers and bodies, and user identifiers, so visitors' IP addresses are never sent. Kept 30 days. | EU (Germany) |
The following receive or supply Personal Data at Controller's own choice and under Controller's own agreements with them:
| Party | Role | Location |
|---|---|---|
| Webflow, Inc. | Source of the order data Processor processes on Controller's behalf | US, with EU adequacy mechanism |
| Xero Limited | Accounting system Controller posts to (recipient of order data) | EU / global |
| Intuit Inc. (QuickBooks) | Accounting system Controller posts to (recipient of order data) | US, with EU adequacy mechanism |
Processor will notify Controller of any intended changes concerning the addition or replacement of sub-processors, giving Controller the opportunity to object within 30 days.
5. International transfers
Where Personal Data is transferred outside the EEA, Processor relies on:
- EU Commission adequacy decisions where applicable
- Standard Contractual Clauses (SCCs) for transfers to third countries
- Supplementary measures (encryption in transit and at rest) as recommended by EDPB guidance
6. Technical and organizational measures
Processor implements:
- AES-256-GCM encryption for stored Webflow, Xero and QuickBooks tokens; tokens are used only on the server and never appear in the app, API responses or the data export
- HTTPS-only connections for all data in transit
- SSH key-only access to production infrastructure; password login is disabled
- Logical separation of customer data: every database query is scoped to the customer's own account in the application layer
- Nightly database backups, kept 14 days on the EU-hosted server and 30 days as an encrypted copy in Google storage
- An activity log of account actions, visible to Controller in the Service
- Annual review of access permissions
- Incident response plan with 72-hour breach notification commitment
7. Data Subject rights
Processor assists Controller in responding to Data Subject requests for access, rectification, erasure, restriction, portability, and objection. Controller can self-serve most requests in the Service:
- Data export: JSON download from the Account dialog (Export your data), containing account, team, mappings, sites, connections (never tokens), orders, line items, sync records, refunds and the activity log
- Account deletion: from the Account dialog (Delete account), carried out at once (see Section 8)
For requests Controller cannot self-serve, email dpa@xaldro.com.
8. Retention and deletion
- Order, sync, refund and mapping data are kept while Controller's account exists. Removing a site deletes that site and the orders and sync records stored for it; if Webflow does not confirm the removal of Processor's webhooks on that site, the site's Webflow token is kept for up to 7 days to retry, then deleted.
- On account deletion by Controller, all Personal Data held for the account (sites, orders, sync records, refunds, mappings, team, activity log and sign-in links) is deleted at once, Processor's access to Xero and QuickBooks is revoked, and Processor's order webhooks are removed from Controller's Webflow sites.
- When the Service loses all access to Controller's Webflow (uninstall or revoked access), Controller is notified once by email and the same deletion is carried out 30 days later, unless access is restored before then.
- The activity log is kept until Controller deletes entries or clears it, or until the account is deleted.
- Webhook dedupe records are deleted after 90 days; used or expired sign-in and invite links 30 days after they were created.
- After 14 days without an active plan, Processor removes its order webhooks from Controller's sites and receives no further order data until Controller subscribes again.
- Webflow tokens are forgotten as soon as Webflow reports them invalid. Xero and QuickBooks tokens the ledger rejects are kept encrypted and marked for reconnection until Controller reconnects, removes the connection, or deletes the account.
- Deleted data leaves the backups within 30 days.
- Documents already posted to Controller's Xero or QuickBooks are Controller's records in Controller's own ledger and are not changed or deleted by Processor.
9. Audits
Controller may, no more than once per 12 months and with 30 days written notice, audit Processor's compliance with this DPA. Processor will respond to reasonable written audit questionnaires (e.g., SIG-Lite) within 30 days.
10. Termination
This DPA terminates automatically when the Terms terminate or when Processor ceases processing Personal Data on Controller's behalf, whichever is later.
11. Governing law
Dutch law governs this DPA. Disputes are subject to the competent court in the Netherlands.
Contact
For DPA signature requests, sub-processor questions, and Article 17 deletion requests: dpa@xaldro.com
For everything else: hello@xaldro.com