WPXFacets Data Processing Agreement

Version for new initial contracts: 2026-10-03-v3. Issue date: 3 October 2026. Publication does not automatically amend an existing customer’s contract.

This Data Processing Agreement (DPA) forms part of the Customer’s agreement with SC WEBIXKIT SOLUTIONS S.R.L., trading as WPXFacets, for its dedicated managed Elasticsearch service (Service). It covers personal data processed on the Customer’s instructions for managed product search and optional Search Analytics (Customer Data).

The Customer is the controller and WPXFacets is the processor for the processing in Annex II. WPXFacets acts separately as controller for its own account, billing, business-contact, security and legal-compliance purposes, as described in its Privacy Policy. Customer Data accessed to troubleshoot or support the Customer’s Service remains covered by this DPA.

1. Applicable clauses

The parties adopt the controller–processor clauses in the Annex to Commission Implementing Decision (EU) 2021/915 (Clauses). The complete DPA comprises the unmodified English Official Journal PDF, SHA-256 a4517774d1427c3c72b76aa3882e5242d26544296bded6033dadfc7fd8b27ee3, the selections below and Annexes I–IV. The English text governs; the Clauses prevail over conflicting terms. These Article 28 clauses do not themselves provide an international-transfer mechanism.

The parties select GDPR Option 1 in Clause 1(a), omit optional Clause 5, and select general written subprocessor authorisation under Clause 7.7 Option 2. WPXFacets will email the Customer’s account address at least 30 days before a new or replacement subprocessor begins processing. The notice will identify its role, location, intended start date and objection route. The Customer may object on reasonable data-protection grounds during that period. Clauses 7.7 and 10 govern unresolved objections. Annex IV and the dated Subprocessors page identify the authorised infrastructure provider. Existing customers remain governed by their applicable agreement and change procedure; publication alone does not replace that procedure.

2. Instructions and assistance

The Customer instructs WPXFacets to provide, secure, support, retain and delete the Service within Annex II. Instructions include service configuration, indexing and deletion requests, the disclosed hosting assignment, Search Analytics enable/disable and complete-dataset deletion actions, support requests and cancellation. WPXFacets will immediately flag an instruction it considers unlawful, as required by the Clauses.

The Customer determines the purposes of processing Customer Data and is responsible for its lawful collection, disclosure to WPXFacets and use, including the applicable legal basis, visitor notices and any required consent. The Customer shall give lawful documented instructions, limit submitted data to what is necessary for the agreed Service, restrict administrator access and respond to data-subject requests with WPXFacets’ assistance. These responsibilities do not reduce WPXFacets’ duties under the Clauses concerning confidentiality, security, subprocessors, lawful transfers, assistance with rights, assessments and breaches, compliance information, audits, or return and deletion. They do not exclude mandatory liability or data-subject rights.

The Customer shall provide accurate information reasonably needed to assess its relevant processing and international transfers, including its legal establishment, intended markets, relevant monitoring activities and authorised recipients, and notify WPXFacets of material changes. The Customer is responsible for its own subsequent uses and disclosures, subject to applicable law and binding transfer clauses. A Customer declaration or instruction does not itself establish a lawful transfer mechanism.

3. Initial acceptance and contract evidence

This standard DPA applies to Customers in all countries in which WPXFacets offers the Service, including Customers selling internationally. Any required customer-specific transfer instrument and completed annexes are included and identified in the same initial contractual package before acceptance. They do not require a second DPA or another contractual acceptance in the plugin. The applicable transfer instrument depends on the actual processing and relevant legal scope, not solely on the Customer’s incorporation country or visitor nationality.

The Customer’s authorised representative accepts the Terms and this DPA together in one initial contractual acceptance at checkout or onboarding, before Customer Data is processed under the Service. The representative confirms their identity and authority to bind the Customer. No additional contractual acceptance in the plugin is required.

The initial record identifies the Customer, subscription, representative and authority affirmation, the exact Terms and DPA versions and hashes, any included transfer instrument and completed annexes and their hashes, the end-of-service deletion instruction in Annex II C, and the server-recorded UTC time. The agreed texts are preserved as immutable canonical bytes with stable labels. WPXFacets preserves the initial record, subsequent versions and evidence of notices and their contractual applicability. An update becoming applicable under section 4 is not recorded as a new signature or click acceptance. Each version identifies its proposed or actual effective date separately from the Customer-specific evidence of applicability.

4. Subsequent updates

WPXFacets may propose updates to the surrounding Terms and the service-specific information in this DPA, subject to the Clauses and applicable law. It will email the Customer’s designated contract contact a summary of the changes, access to the complete exact revised text, its version identifier and intended effective date, and instructions for objection or termination. Material changes require at least 30 days’ advance notice. Changes to obligations, processing scope, data categories, retention, locations, safeguards or other protections relied on by the Customer are material. Non-material corrections must not alter those protections and remain versioned.

The Customer may object on reasonable contractual or data-protection grounds by emailing support@wpxfacets.com before the effective date. The parties will seek a resolution. If the change is not resolved or the Customer does not wish to continue on the revised terms, the Customer may terminate the affected Service before the change applies, without a termination penalty for rejecting the update. WPXFacets will refund prepaid fees for the unused period of the terminated Service. Return and deletion remain governed by Clause 10; unresolved subprocessor objections remain governed by Clause 7.7.

Where this update mechanism is legally valid and the Customer continues using the Service after the notified effective date without an unresolved timely objection, the revised terms become applicable without a new signature or acceptance click. Continuing use means an informed, deliberate decision by a representative authorised to bind the Customer to continue the managed Service, evidenced by documented instructions to continue, a deliberate authorised renewal, or other conduct legally sufficient under the applicable B2B contract law. An automated plugin request, background job, automatic payment or renewal, silence alone, or an administrator’s technical access alone is not proof of that decision. WPXFacets must retain evidence supporting notice and applicability; publication alone does not make a version applicable to every Customer.

Until the mechanism’s legal validity and evidentiary requirements have been confirmed for the relevant contract and change, WPXFacets will not rely on automated continued-use inference to bind the Customer to a material update. The existing agreement continues to govern unless the parties validly agree a change.

Search Analytics already lawfully authorised does not lose eligibility merely because a Customer has not clicked acceptance of each later version that has become applicable through this mechanism. There is no separate 30-day analytics grace tied to a missing repeat click; the 30 days above is the advance notice period. If applicability is disputed or unconfirmed, WPXFacets must resolve it under the existing agreement and applicable law rather than inventing acceptance of the update.

This procedure does not modify the unmodified Clauses or replace a required instruction, consent, authorisation or international-transfer instrument. A new processing purpose requires the applicable controller instructions and legal review before use; existing analytics authorisation does not extend automatically to it. Subprocessor additions and replacements follow section 1 and Clause 7.7 regardless of continued use. Any US transfer remains subject to Annex II D.

5. Separate Search Analytics activation

The applicable contract makes the subscription eligible for Search Analytics; collection remains disabled by default. An authorised administrator must enable it separately on the connected Main environment after the Customer completes its privacy review. Secondary environments on the same subscription and managed server may read the bounded Main report where supported, but cannot collect or perform analytics lifecycle actions. Contract acceptance or an update does not constitute visitor consent or activate any feature. Product search and filtering remain available independently of Search Analytics collection.

Popular Facets is outside the managed processing described in this DPA. This agreement does not authorise sending its usage events, session keys, digests or aggregates to WPXFacets infrastructure.

Annex I — Parties

Controller

The Customer identified in the applicable subscription and billing record:

Field	Contract value
Legal name and address	Legal company name and complete billing address captured at B2B checkout
Contact	Account holder name and work email
Business identifier	Validated EU VAT ID or non-EU business tax or registration ID
Relevant activities	Operating a WooCommerce storefront using the Service
Signature and date	Initial joint Terms and DPA acceptance record for this subscription and its exact document versions

Processor

Field	Contract value
Legal name and trading name	SC WEBIXKIT SOLUTIONS S.R.L.; WPXFacets
Tax identifiers	Romanian CUI 45239327; EU VAT ID RO45267408
Trade Registry	J2021003824130; historic reference J13/3824/17.11.2021; EUID ROONRC.J2021003824130
Registered address	Str. Arțarului, nr. 25, Camera nr. 4, Sat Siminoc, Oraș Murfatlar, Județul Constanța, Romania
Data-protection contact	support@wpxfacets.com
Relevant activities	Providing and operating the dedicated managed Service and optional Search Analytics
Legal representative	Gavrilov Alexandru-Gabriel
Signature	Gavrilov Alexandru-Gabriel, authorised legal representative of SC WEBIXKIT SOLUTIONS S.R.L. Electronic countersignature for this exact version 2026-10-03-v3, dated 3 October 2026.

Annex II — Processing

A. Subject matter, operations and purposes

WPXFacets receives, validates, indexes, stores and retrieves the Customer’s catalogue and search configuration to provide product search and filtering. Storefront search requests are processed through the Customer’s website and its scoped gateway on the dedicated node. Where the Customer separately enables Search Analytics, WPXFacets normalises, screens, aggregates, stores and reports eligible deliberate first-page search terms and result counts to identify searches yielding no products. WPXFacets also secures, supports, retains and deletes this data on documented instructions.

WPXFacets does not use Customer Data for another customer, a shared corpus, advertising, profiling or automatic relevance changes.

B. Data subjects and data categories

Data subjects are storefront visitors submitting searches, individuals whose personal data the Customer includes in catalogue or configuration content, and administrators involved in access to the Service. Personal data is not required or expected in catalogue fields; the Customer controls the submitted content.

Catalogue and configuration data comprise the fields and content submitted for indexing. Search requests can contain free-text terms and selected filters, processed to return results; optional Search Analytics storage is described separately below. These request contents are not included in operational logs or stored task state.

Search Analytics stores readable normalised/display terms, a SHA-256 term hash used as an aggregation key, UTC day, language, search/zero-result/filtered-zero-result counters, result-count sum/minimum/maximum and schema version. The hash does not anonymise the readable term. No visitor, account, session, cookie, IP-address or user-agent identifier is stored with an analytics record. This restriction concerns analytics records; it does not exclude authentication metadata or technically necessary network traffic from service operation.

Special-category and criminal-conviction data are not intentionally requested. Free text may nevertheless contain personal or sensitive information. Common sensitive patterns are rejected before analytics storage, but screening cannot remove every personal detail. The Customer must not intentionally submit special-category or criminal-conviction data unless the parties first document the instruction and agree additional safeguards.

C. Duration, retention and deletion

Catalogue processing continues during the subscription and the limited offboarding period below. Search Analytics collection occurs only while separately enabled. Search Analytics aggregates are retained for a maximum of 90 UTC calendar days, calculated from the aggregate’s original UTC calendar day. WPXFacets automatically deletes expired aggregates independently of the Customer’s WordPress plugin or website traffic.

Disabling Search Analytics, disconnecting or uninstalling the plugin, or expiry of Service access stops new collection without extending the retention of existing data. Reactivation does not reset the original day or age of an aggregate. These actions do not themselves request immediate complete-dataset deletion. The Customer may request earlier deletion of the complete dataset through the separate confirmed action while the Service is reachable, or instruct WPXFacets by contacting support@wpxfacets.com after loss of access.

After effective loss of subscription entitlement, WPXFacets keeps the VPS running for seven calendar days for renewal or resolution of a payment issue. Customer access and new collection are blocked during this period, while WPXFacets-managed retention cleanup continues. A pending cancellation remains eligible until the paid period ends; the cancellation request does not start this period early. A failed payment starts it only if subscription entitlement is actually lost. Plugin uninstall, disconnection or Analytics disablement does not trigger VPS destruction while the subscription remains active.

The seven-day period does not add to the maximum 90 UTC calendar-day Analytics retention. Aggregates expiring during that period are deleted when they expire. Reactivation before the deadline stops the scheduled end-of-service destruction but never resets aggregate age. If entitlement is not reactivated by the deadline, WPXFacets automatically destroys the VPS and verifies effective deletion of Customer Data, including any existing copies, subject to the Customer’s choice and the obligations in Clause 10. WPXFacets confirms completed deletion to the Customer. Server power-off is not deletion and does not suspend the retention limit or justify indefinite storage.

As a documented instruction given with the initial joint acceptance, the Customer chooses deletion of its Customer Data at the end of this period unless it has validly instructed an earlier deletion or return under Clause 10. This instruction is recorded distinctly in the initial evidence. It is not a waiver of the Customer’s choice of return or deletion. The Customer may change that choice before deletion by contacting support@wpxfacets.com; WPXFacets records the revised instruction and coordinates the legally required return and deletion of remaining copies before irreversible destruction. The routine seven-day schedule cannot override Clause 10 or mandatory law. Any legally required storage remains limited to its necessary purpose and duration under the Clauses.

Automatic expiry, earlier complete-dataset deletion and end-of-service return/deletion remain distinct. WPXFacets keeps no managed index backups; any other existing copies must nevertheless be identified and dealt with under the applicable deletion instruction. No commercial or self-service export facility is promised by this DPA, and that does not reduce Clause 10 duties.

D. Locations and international transfers

WPXFacets assigns and discloses the dedicated node’s location to the Customer before processing. The EU locations are Nuremberg and Falkenstein in Germany and Helsinki in Finland. For a Customer whose contracting company is established in the United States, WPXFacets assigns Ashburn, Virginia or Hillsboro, Oregon only after the conditions below are satisfied; provisioning is held while they are unmet. WPXFacets chooses the site and records the assignment. The Customer is not required to choose a Hetzner region. Singapore is not offered under this DPA.

Before any US-node processing, WPXFacets must determine and document whether GDPR Chapter V applies to each actual data flow. Where it applies, WPXFacets must establish the applicable lawful transfer mechanism and any required transfer assessment and safeguards. WPXFacets must also verify the selected site’s actual provider chain, contractual authorisation, security and overseas-processing risks, and disclose the assignment to the Customer in advance. Where the documented facts establish that a provider flow is not a Chapter V transfer, no transfer instrument is required for that flow; this does not remove the other obligations or resolve a separate disclosure to the Customer. Listing US locations does not by itself authorise processing.

Catalogue, search requests and enabled Search Analytics data are processed on the assigned node; a US node processes that data and technically necessary traffic in the United States. Search Analytics terms are not sent to the WPXFacets WordPress control plane. The website/account system and subscription, environment and DPA acceptance records are processed separately in the EU.

Disclosure of personal data by WPXFacets to a Customer outside the EEA must be assessed separately under Chapter V, including when the managed node remains in the EU. Any required transfer instrument must be concluded before that disclosure. This DPA’s Article 28 clauses and the Customer’s US establishment do not supply that instrument.

E. Data-subject requests

The Customer receives and assesses requests as controller; WPXFacets assists under the Clauses. Search Analytics stores no visitor identifier, so the parties may be unable to link a row reliably to a person. The current technical deletion action removes the complete Search Analytics dataset, not an individual query row. Where deletion is required and a record cannot reliably be isolated, complete-dataset deletion is the supported operation. This limitation does not waive data-subject rights or the parties’ assistance duties.

Annex III — Technical and organisational measures

• Isolation and access: one dedicated virtual server per subscription; connected sites access only assigned indexes. Main-only analytics collection and lifecycle operations are enforced by the control plane and gateway. Reports are restricted to authorised administrators; secondary access is limited as described in section 5.
• Network protection: Elasticsearch listens only on loopback. Provider and host firewalls restrict inbound access; internal database, cache and container ports are not publicly exposed. Administrative SSH uses a hardened bastion, an allowed source and passphrase-protected ED25519 keys; root login and password authentication are disabled. Elasticsearch identities have restricted privileges and bootstrap credentials are removed during provisioning.
• Transport and authorisation: TLS protects HTTP traffic. The Customer plugin holds no Elasticsearch credentials and communicates through the scoped gateway. Short-lived signed entitlements bind access to the exact assigned target and permitted operations; invalid assignments or capabilities fail closed before Elasticsearch access.
• Confidentiality and minimisation: personnel access is limited to service need and subject to confidentiality. Operational logs and stored task state contain no search terms. Analytics terms are normalised, length-bounded and screened, stored as daily aggregates without visitor identifiers, and subject to retention cleanup and confirmed complete-dataset deletion.
• Assistance and verification: provisioning checks required network, service and access controls. Security incidents are investigated through operational channels, with breach notification and assistance under Clause 9. Compliance information and audits remain governed by Clause 7.6; assistance with rights and assessments remains governed by Clause 8.

Disclosed limitations: node data is not encrypted at rest. WPXFacets provides no managed index snapshots or backups, holds no ISO 27001/SOC 2 or equivalent certification, and does not currently operate an independently audited recurring control-effectiveness programme. Hetzner’s infrastructure certifications do not certify WPXFacets. These limitations do not remove the security and other obligations in the Clauses.

Annex IV — Infrastructure subprocessor

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, provides physical infrastructure, virtual-server and storage hosting for the dedicated node. Its processing duration follows the Service and controlled deletion period. Hetzner operates the physical infrastructure, hypervisor and network; WPXFacets operates the guest system, Elasticsearch, gateway and application access controls.

EU processing takes place at the assigned site in Annex II D. Any US processing is subject to that section’s conditions. Hetzner’s published onward-provider list names Hetzner US LLC, NTT Global Data Centers Americas, Inc. and QTS Investment Properties Hillsboro, LLC for US infrastructure.

According to Hetzner’s written confirmations, Hetzner Online GmbH remains the contractual provider and operates Hetzner Cloud. Hetzner US LLC provides local infrastructure and server-related arrangements, including contracts with the colocation providers, but does not receive or process Customer Data or data stored on the servers. NTT and QTS provide colocation without access to server data. Hetzner states that Customer Data and server data are not disclosed to other US companies and that support access is carried out only by employees located in the EU. These statements describe the provider flow; they are not a blanket finding that every WPXFacets data flow is outside Chapter V.

Hetzner states that Cloud-server backups and logs are stored in the US when the server location is in the US, and otherwise in the EU. This describes the location of such copies if present, not the existence of WPXFacets-managed index backups. WPXFacets must identify and address any actual copies under Annex II C. The provider makes encryption of server data the account customer’s responsibility; WPXFacets’ current measures and limitations are disclosed in Annex III. Hetzner’s existing DPA remains the provider agreement, and Hetzner confirms that no additional DPA is required for choosing a US Cloud location. Location authorisation does not replace any required Chapter V mechanism or WPXFacets’ security duties.

WPXFacets must document the actual assigned-site chain and effective safeguards before Customer Data is processed there. The above providers are Hetzner’s infrastructure/onward providers, not separate direct appointments by WPXFacets. Internal colocation agreements have not been disclosed to WPXFacets; no US-site audit, executed SCC or DPF certification is asserted by this DPA.

The Subprocessors page supplies the current list and dated history; additions and replacements remain subject to section 1 and Clause 7.7.