Data Processing Agreement (DPA)

Effective Date: August 7, 2026

Data Processing Agreement

This Data Processing Agreement (“Agreement”) forms part of the services provided by MATILIANO and describes how personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

This Agreement applies where MATILIANO processes personal data in connection with the operation of its website, customer accounts, orders, customer support, and related services.

1. Parties

Data Controller MATILIANO

Website: www.matiliano.com

Email: info@matiliano.com

The Data Controller determines the purposes and means of processing personal data.

Data Processors

MATILIANO engages carefully selected third-party service providers that process personal data on our behalf.

These providers may include:

Website hosting provider
WooCommerce
WordPress
Mollie
PostNL
Mailchimp
Google Analytics
Meta Platforms
TikTok
IT service providers
Customer support providers
Security providers

Each processor processes personal data only where necessary to provide its services.

2. Purpose of Processing

Personal data is processed only for legitimate business purposes, including:

Processing customer orders
Payment processing
Shipping and delivery
Customer account management
Customer support
Fraud prevention
Website security
Website analytics
Marketing communications where consent has been obtained
Compliance with legal obligations

Personal data will never be processed for purposes incompatible with those described above.

3. Categories of Personal Data

Depending on the services provided, the following categories of personal data may be processed:

Customer Information

First name
Last name
Email address
Telephone number
Billing address
Shipping address
Country
Postal code

Order Information

Order numbers
Purchased products
Payment status
Delivery information
Return requests
Refund information

Technical Information

IP address
Browser type
Device information
Operating system
Cookie identifiers
Website usage information

Marketing Information

Where consent has been provided:

Newsletter subscriptions
Marketing preferences
Campaign interaction
Website behavior related to advertising

4. Categories of Data Subjects

This Agreement applies to personal data relating to:

Customers
Website visitors
Newsletter subscribers
Account holders
Customer service contacts

5. Processing Instructions

Processors may process personal data only:

On documented instructions from MATILIANO.
For the agreed purpose.
In accordance with applicable data protection legislation.
Using appropriate security measures.

Processors may not use personal data for their own commercial purposes unless they act as an independent controller under applicable law.

6. Confidentiality

Any individual authorized to process personal data must be subject to an appropriate duty of confidentiality.

Processors shall ensure that employees and subcontractors with access to personal data receive suitable training regarding privacy and data protection.

7. Security Measures

MATILIANO requires processors to implement appropriate technical and organizational measures designed to protect personal data against:

Unauthorized access
Accidental loss
Destruction
Alteration
Disclosure
Misuse

Such measures may include:

Encryption where appropriate
Access controls
Authentication procedures
Firewalls
Malware protection
Secure data transmission
Security monitoring
Regular software updates
Backup procedures

8. Sub-processors

Processors may engage sub-processors only where appropriate contractual safeguards are in place.

Processors remain responsible for ensuring that any sub-processors provide an equivalent level of protection for personal data.

9. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), appropriate safeguards must be implemented, including where applicable:

European Commission Adequacy Decisions
Standard Contractual Clauses (SCCs)
Other transfer mechanisms recognized under the GDPR

Where possible, MATILIANO stores customer data on servers located within the European Union.

10. Data Subject Rights

Processors shall assist MATILIANO in responding to requests from individuals exercising their rights under the GDPR, including requests to:

Access personal data
Correct inaccurate information
Delete personal data
Restrict processing
Object to processing
Receive a copy of their personal data
Withdraw consent where applicable

11. Personal Data Breaches

Processors shall notify MATILIANO without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of MATILIANO. Such notification shall include sufficient information to enable MATILIANO to comply with its legal obligations under the GDPR.

12. Retention and Deletion

Personal data shall not be retained longer than necessary for the purposes for which it was collected or as required by applicable law. Upon termination of the processing relationship, processors shall securely delete or return personal data unless retention is required by law.

13. Audit Rights

Upon reasonable request, processors shall make available information necessary to demonstrate compliance with applicable data protection obligations and, where appropriate, allow reasonable audits or inspections, subject to confidentiality and security requirements.

14. Liability

Each party remains responsible for complying with its obligations under applicable data protection legislation. Nothing in this Agreement limits or excludes liability where such limitation is prohibited by law.

15. Governing Law

This Agreement shall be governed by the laws of the Netherlands and interpreted in accordance with the GDPR and other applicable Dutch and European data protection legislation.

16. Contact

For questions regarding this Data Processing Agreement or our processing of personal data, please contact:

MATILIANO

Website: www.matiliano.com

Email: info@matiliano.com