zrsPOS — Data Processing Agreement (DPA)

Version 1.0 (draft for legal review) · 15 September 2026

Status. This is the operating draft the zrsPOS service is run under today. It is written to reflect what the service actually does. Before it is signed by a third-party merchant it should be reviewed by counsel qualified in Portuguese and EU data protection law. Until then, its commitments are honoured unilaterally by the Processor.

This Data Processing Agreement forms part of the zrsPOS Terms of Service between:

• Controller: the merchant that installs zrsPOS on its Shopify store ("Merchant"); and
• Processor: José Reffóios, trading as zrsPOS, support@zrspos.com, Portugal ("zrsPOS"),

and applies to the processing of personal data by zrsPOS on the Merchant's behalf under Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019.

1. Subject matter and purpose

zrsPOS issues, corrects, prints and archives Portuguese fiscal documents (faturas, faturas simplificadas, faturas-recibo, notas de crédito, and Global Blue tax-free forms where enabled) for sales made through the Merchant's Shopify POS, by orchestrating the Merchant's own certified invoicing system (SAGE). Processing is limited to what that requires.

2. Nature and duration

Automated processing triggered by the Merchant's Shopify events (orders, refunds, returns) and by the Merchant's staff using the zrsPOS admin and POS extensions. Processing lasts for the term of the Merchant's subscription plus the retention period in section 9.

3. Personal data and data subjects

Data subjects: the Merchant's customers (buyers at the till), and travellers for whom a tax-free form is issued.

Categories of personal data:

No payment card data, no special categories of data.

Legal basis available to the Controller: compliance with a legal obligation (Portuguese invoicing and VAT law) for fiscal documents; performance of a contract and the traveller's request for tax-free forms.

4. Controller's instructions

zrsPOS processes personal data only on the Merchant's documented instructions, which are: the configuration the Merchant sets in the zrsPOS admin, and the events the Merchant's Shopify store sends. zrsPOS will inform the Merchant if, in its opinion, an instruction infringes data protection law. zrsPOS does not use the data for its own purposes and never sells it.

5. Confidentiality

Only persons who need access in order to operate the service have it. Each is bound by confidentiality obligations. Access is reviewed at least every six months.

6. Security measures (Art. 32)

As set out in the zrsPOS Data Loss Prevention Strategy and Security Incident Response Policy, which form part of this DPA:

• Tenant isolation enforced in code: every record is bound to the Merchant's store, and an automated test prevents any database query from reaching another tenant's data unnoticed.
• Merchant credentials (SAGE key, Shopify token, Global Blue login) encrypted at the application layer under a key unique to the Merchant, itself sealed under a master key held only in the hosting environment.
• TLS on every connection; storage and backups encrypted at rest by the hosting provider.
• Authenticated, tenant-tagged request logging; per-tenant rate limiting; no shared operator accounts; two-factor authentication on every infrastructure account.
• Development and testing use a separate database with synthetic data only.

7. Sub-processors

The Merchant gives general authorisation to the following sub-processors. zrsPOS will notify the Merchant at least 30 days before adding or replacing one; the Merchant may object on reasonable data-protection grounds, in which case either party may terminate the affected service.

8. International transfers

Personal data is stored and processed in the European Union. Where a sub-processor processes data outside the EU/EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.

9. Retention and deletion

• Fiscal documents (identity, address, transaction and fiscal data) are retained for the period Portuguese tax law requires the Merchant to keep them (currently 10 years). This retention is the Merchant's legal obligation; zrsPOS holds the records on the Merchant's behalf.
• Contact fields (email, phone) are not part of the fiscal record and are erased on request (section 10) and on termination.
• Operational data (raw event payloads, rendered receipts, configuration, credentials, encryption key) is erased within 48 hours of the Merchant uninstalling zrsPOS, in response to Shopify's shop/redact notice.
• On termination the Merchant may request an export of its fiscal records before erasure of everything not under legal retention.

10. Data subject rights

zrsPOS assists the Merchant in responding to data subject requests. Through Shopify's mandatory compliance webhooks:

• Access (customers/data_request): zrsPOS records the request and provides the Merchant with the personal data it holds for the named orders within 30 days.
• Erasure (customers/redact): zrsPOS erases the email and phone on the affected documents. Name, NIF and address remain on the fiscal document because their retention is a legal obligation of the Merchant; zrsPOS records this outcome and the basis for it so the Merchant can answer the data subject.

Requests received directly by zrsPOS are forwarded to the Merchant without undue delay.

11. Personal data breach

zrsPOS notifies the Merchant without undue delay, and in any case within 24 hours of confirming that a breach affects the Merchant's data, with the information the Merchant needs for its own notification to the CNPD (within 72 hours) and, where required, to data subjects. Handling follows the Security Incident Response Policy.

12. Assistance, audits and records

zrsPOS assists the Merchant with data protection impact assessments and prior consultations where the processing warrants them. zrsPOS keeps records of its processing activities and makes available the information necessary to demonstrate compliance. The Merchant may audit zrsPOS's compliance with this DPA once a year on 30 days' notice, or without notice following a breach, by written questionnaire in the first instance and by inspection where the questionnaire is insufficient.

13. Term and consequences of termination

This DPA lasts as long as zrsPOS processes personal data for the Merchant. On termination zrsPOS deletes or returns the data as described in section 9, except where retention is required by law.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, except that nothing limits liability for a party's own breach of the GDPR. In case of conflict, this DPA prevails over the Terms of Service on matters of personal data.

Annex A — Processing summary (Art. 28(3))

Annex B — Technical and organisational measures (Art. 32)

The measures below are in force. They are described in full in the zrsPOS Data Loss Prevention Strategy and the Security Incident Response Policy, which form part of this DPA; a copy of either is provided on request to support@zrspos.com.

Annex C — Sub-processors

The list in section 7 is the complete list of sub-processors authorised at the date of this version, reproduced here for signature:

The Merchant's own SAGE installation is not a sub-processor of zrsPOS: it is the Merchant's own system, acting under the Merchant's control, and the certified issuer of the documents.

Changes to this Annex follow the notice and objection process in section 7.