Thenia Data Processing Agreement

Last updated: 6 November 2026

1. Parties, Subject and Duration

1.1 This Data Processing Agreement forms part of the Terms between the Store as controller and OPTIMAL TRADE E.E., 19th km Spaton Avenue, 190 04 Spata, Attica, Greece, Greek Tax ID 801579680, Pallini Tax Office, GEMI 159506203000, hello@thenia.io as processor.

1.2 Processing comprises customer and order analysis, repeat-purchase timing estimates, emails and campaigns, coupons and sales measurement, throughout Account operation and for up to 90 days thereafter.

2. Data Subjects and Categories

2.1 Data subjects include Store customers, subscribers and visitors arriving through Thenia emails.

2.2 Data comprise email, name, phone, city, order and product history, carts, product views, opens, clicks, coupons, consent and unsubscribe records. Special-category data and card data are not intended to be processed.

3. Instructions, Confidentiality and Access

3.1 The Company processes data solely on documented Store instructions, including Terms and Application settings, unless required by law, and informs the Store where permitted. It alerts the Store to instructions it believes infringe the GDPR.

3.2 Authorized personnel are bound by confidentiality and may access Store Accounts only for support, operations and security, with logging. Data are not sold, repurposed or used for AI training.

4. Assistance and Controller Duties

4.1 The Company assists the Store in responding to requests to exercise data-subject rights by providing, in the Application (Settings → Privacy & data), tools to export all data of a customer in a structured, commonly used and machine-readable format and to erase that customer. The same tools are available through WordPress's personal data export and erasure tools where the Store uses a version of the plugin that supports them. Every message contains an unsubscribe link. The Company also assists, where required, with data protection impact assessments and prior consultations.

4.2 The Store is responsible for legal grounds, customer notices and cookie consent.

4.3 Customer erasure is carried out by anonymisation: identifying information and browsing, cart, sign-up and stated-preference data are deleted, while order and message records are retained solely in a form that does not identify the individual, for statistical purposes and calculation of the Commission. The email address is retained solely as a cryptographic hash in the suppression list, so that no message is sent to it again and its data are not re-imported on synchronisation. Unused discount coupons created by Thenia for the customer are also deleted from the WooCommerce store. Erasure in Thenia does not delete data held by the Store in its own system.

4.4 A data-subject request received directly by the Company is forwarded to the Store without undue delay and in any event within three business days. The Company does not respond on the merits or act on the request except on the Store's documented instruction. Each request fulfilled is recorded without personal data of the data subject.

5. Subprocessors

5.1 The Company gives 15 days’ notice of new subprocessors. The Store may object for justified reasons within 10 days; if unresolved, it may close without penalty. Equivalent obligations are imposed downstream and the Company remains responsible.

5.2 Stripe handles only the Store’s own payment data. DPF reliance is subject to the recipient’s active certification.

6. Security Measures

6.1 Measures include HTTPS and HSTS, disk encryption, AES-256-GCM encryption for Store keys, scrypt password hashing with attempt limits, administrator TOTP, strict tenant isolation, security headers, signed webhooks and signed unsubscribe links.

6.2 Encrypted backups are created daily and retained 30 days, with point-in-time restoration within the last seven days. Measures are reviewed according to risk. Where a backup is restored, every completed customer erasure is applied again before the restored data are used.

7. Personal Data Breaches

7.1 The Company notifies the Store without undue delay and no later than 48 hours after becoming aware of a personal data breach, providing available details and assistance for any required supervisory-authority notification within 72 hours.

8. End of Processing

8.1 Exports are available until termination. Data are deleted 90 days after closure and from backups within a further 30 days, except hashed suppression lists and legally required records. The shorter Terms period applies to never-activated Accounts.

9. Audits

9.1 The Company provides information necessary to demonstrate compliance. Up to one onsite audit annually may be conducted with 30 days’ notice, at reasonable times, under confidentiality and at Store expense, without prejudice to mandatory GDPR Article 28 audit rights.

10. Transfers and Governing Language

10.1 International transfers use the EU–US Data Privacy Framework where applicable and Decision 2021/914 SCCs with appropriate role modules and supplementary measures. If the DPF is invalidated or inapplicable, transfers may continue under SCCs where lawful.

10.2 The Greek text prevails.