Back to home

    Data Processing Agreement (DPA)

    English translation for information only. Only the French version of this document is legally binding. In case of any discrepancy, the French version prevails.

    Data Processing Agreement (DPA)

    Version of 19 October 2026.

    1. Parties and purpose

    This agreement governs the processing of personal data that CrossbordIA carries out on behalf of its customers, in accordance with Article 28 of the GDPR. It supplements the Terms of Use and the Terms of Sale accepted by the customer, and prevails over them as regards data protection.

    • Processor: CrossbordIA SAS, 47 rue Vivienne, 75002 Paris, SIREN 103 738 084, represented by Stephane Caillot, President (président) — contact@crossbordia.fr.
    • Controller: the customer (merchant, exporter or freight forwarder) who uses CrossbordIA, its website, its API or its Shopify application.

    The agreement applies from the acceptance of the Terms of Use and for the entire duration of use of the service.

    2. Description of the processing

    ElementDescription
    PurposePreparing, at the customer's request, the customs invoice for a shipment outside the European Union (recipient, delivery address); classifying the customer's products (product data, without personal data)
    Data processedName, delivery address, telephone number and email address of the recipient of an order; order number
    Data subjectsThe merchant's customers who are recipients of a shipment outside the EU
    SourceOrder read in Shopify via the CrossbordIA application, or entered by the customer
    TimingOnly when the customer generates an invoice for that order; the list of orders synchronised every hour contains no personal data
    Retention periodInvoice and printed data kept for 10 years (accounting record, Article L123-22 of the French Commercial Code), then deleted
    Nature of the operationsReading, recording on the invoice, storage, making available to the customer, deletion

    3. Obligations of CrossbordIA

    CrossbordIA undertakes to:

    1. process the data only on the documented instructions of the customer, that is to say the use of the service as described above; if an instruction appears to it to be contrary to the GDPR, it shall inform the customer thereof;
    2. guarantee the confidentiality of the data: only authorised persons within CrossbordIA have access to it, under an obligation of confidentiality;
    3. take the security measures referred to in Article 32 of the GDPR (section 5);
    4. engage a sub-processor only under the conditions of section 4;
    5. assist the customer in responding to requests to exercise the rights of data subjects;
    6. assist the customer in complying with its obligations relating to security, notification of breaches and, where applicable, impact assessment;
    7. at the end of the service, delete or return the data at the customer's choice, subject to legal retention obligations (section 6);
    8. make available to the customer the information necessary to demonstrate compliance with these obligations and to allow audits (section 6).

    CrossbordIA never uses this data for other purposes: neither prospecting, nor resale, nor the training of artificial intelligence models.

    4. Sub-processors

    The customer authorises CrossbordIA to engage the sub-processors below. CrossbordIA informs the customer of any addition or replacement at least 30 days in advance; the customer may object and, failing agreement, terminate without charge. Each sub-processor is bound by contract to the same obligations.

    Sub-processorRoleHosting location
    Lovable Labs AB (Supabase infrastructure)Hosting of the website, the database and the invoicesUnited Kingdom (London, Amazon Web Services eu-west-2), a country covered by an adequacy decision of the European Commission
    Railway Corp.Hosting of the Shopify connectorEuropean Union (europe-west4, Netherlands)

    The artificial intelligence services used for classification receive only product data, never the recipients' data: they are not sub-processors for this processing.

    Any other transfer outside the European Economic Area is governed by the Standard Contractual Clauses of the European Commission.

    5. Security, breaches and rights of data subjects

    Security measures: encryption of connections (HTTPS) and of stored data; access limited to authorised persons, with strong authentication; access logging; regular backups; separation of test environments, which never use real data; deletion of links upon uninstallation of the Shopify application.

    Data breach: CrossbordIA notifies the customer without delay, and no later than 48 hours after becoming aware of it. The notification describes the nature of the breach, the categories and approximate number of persons and data affected, the likely consequences and the measures taken, so as to enable the customer to notify the CNIL (French data protection authority) within 72 hours.

    Rights of data subjects: if a person contacts CrossbordIA directly (access, rectification, erasure, objection), CrossbordIA forwards the request to the customer within 5 working days and assists it in responding.

    6. End of the contract, audits and governing law

    End of the service: upon closure of the account or uninstallation of the application, CrossbordIA deletes the recipients' data within 30 days, except for invoices, which the law requires to be kept for 10 years; the customer may request an export of them before deletion.

    Audits: CrossbordIA provides on request, within 30 days, the information proving compliance with this agreement. An on-site audit, at the customer's expense, is possible once a year with 30 days' notice.

    Governing law: French law; Paris courts, as provided for in the Terms of Sale.

    For customers who accept the Terms of Use online, the agreement applies by reference from the Terms of Use, without a handwritten signature. A signed copy may be obtained on request to contact@crossbordia.fr.