zrsPOS — Data Processing Agreement (DPA)

Version 1.1 · 22 October 2026

This Data Processing Agreement ("DPA") is entered into between:

• Controller: the merchant that installs zrsPOS on its Shopify store ("Merchant"); and
• Processor ("zrsPOS"):
  • Name: [Nome], trading as zrsPOS
  • Address: [morada]
  • Tax number (NIF): [NIF]
  • Contact: support@zrspos.com
  • Data protection officer: none appointed (not required for this processing)

It applies to the processing of personal data by zrsPOS on the Merchant's behalf under Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019. It is an annex to the zrsPOS Terms of Service and applies from the moment the Merchant installs zrsPOS. Its commitments stand on their own: they do not depend on any other clause of the Terms.

1. Subject matter and purpose

zrsPOS has the Merchant's own certified invoicing software (SAGE) issue and correct Portuguese fiscal documents (faturas, faturas simplificadas, faturas-recibo, credit and returns documents) for sales made through the Merchant's Shopify POS, prints them and keeps copies, closes the Merchant's tills, and, where the Merchant enables it, prepares Global Blue tax-free forms through the Merchant's own Global Blue account. Processing is limited to what that requires.

2. Nature and duration

Automated processing triggered by the Merchant's Shopify events (orders, refunds, returns) and by the Merchant's staff using the zrsPOS admin, the POS extensions and the zrsTaxFree tablet app. Processing lasts for as long as zrsPOS is installed on the Merchant's store, plus the retention periods in section 9.

3. Personal data and data subjects

Data subjects: the Merchant's customers (buyers at the till), travellers for whom a tax-free form is prepared, and the Merchant's staff whose actions are recorded.

Categories of personal data:

The passport scan. The zrsTaxFree tablet sends an image of the passport's machine-readable zone to zrsPOS's server, which reads it by text recognition in memory and returns the fields for the Merchant's staff to confirm. The image is not stored.

No payment card data, no special categories of data.

Legal basis available to the Controller: compliance with a legal obligation (Portuguese invoicing and VAT law) for fiscal documents; performance of a contract and the traveller's request for tax-free forms.

4. Controller's instructions

zrsPOS processes personal data only on the Merchant's documented instructions, which are: the configuration the Merchant sets in the zrsPOS admin, the events the Merchant's Shopify store sends, and the actions of the Merchant's staff in the POS extensions and the zrsTaxFree app. On those instructions zrsPOS, in particular:

• looks customers up in the Merchant's SAGE by NIF or e-mail and, when one is not found, creates a customer record there with name, NIF, e-mail, phone and address;
• writes the issued document's reference to the Shopify order, saves a NIF captured at the till on the order and (when a customer is attached to the sale) on the Shopify customer, and saves the traveller's name, country and document number on the order for Tax Free sales;
• sends the traveller's data to Global Blue to prepare a tax-free form, using the Merchant's Global Blue account;
• e-mails a document to the customer when the Merchant chooses to, in the Merchant's name, from zrsPOS's address or from the Merchant's own verified sending address.

zrsPOS will inform the Merchant if, in its opinion, an instruction infringes data protection law. zrsPOS does not use the data for its own purposes and never sells it.

5. Confidentiality

Only persons who need access in order to operate the service have it. Each is bound by confidentiality obligations. Access is reviewed at least every six months.

6. Security measures (Art. 32)

As set out in the zrsPOS Data Loss Prevention Strategy and Security Incident Response Policy, and summarised in Annex B:

• Tenant isolation enforced in code: every record is bound to the Merchant's store, and an automated test prevents any database query from reaching another tenant's data unnoticed.
• Merchant credentials (SAGE key, Shopify token, Global Blue login) encrypted at the application layer under a key unique to the Merchant, itself sealed under a master key held only in the hosting environment.
• TLS on every connection zrsPOS controls; the connection to the Merchant's SAGE uses TLS when the Merchant's SAGE endpoint offers it, which zrsPOS strongly recommends. The "Direct" printer mode, meant for demos and tests, sends receipts unencrypted to the printer's public address through a port the Merchant opens on its router; the other printer modes need no open port and connect to zrsPOS over TLS. Storage and backups encrypted at rest by the hosting provider.
• Authenticated, tenant-tagged request logging; per-tenant rate limiting; no shared operator accounts; two-factor authentication on every infrastructure account.
• Development and testing use separate sandbox environments and, with the merchant's agreement, that merchant's own data.

7. Sub-processors

The Merchant gives general authorisation to the sub-processors listed in Annex C. zrsPOS will notify the Merchant at least 30 days before adding or replacing one; the Merchant may object on reasonable data-protection grounds, in which case either party may terminate the affected service.

The following receive personal data because the Merchant uses them, and are not sub-processors of zrsPOS:

• Shopify, the Merchant's store platform and the source of the order data, under the Merchant's own agreement with Shopify.
• Global Blue, the Merchant's own Tax Free provider, under the Merchant's own contract with Global Blue, only when the Merchant enables the Tax Free feature.
• The Merchant's SAGE installation (and whoever hosts it for the Merchant), the Merchant's own certified invoicing system, under the Merchant's control.

8. International transfers

zrsPOS's hosting and database run in the European Union. Some sub-processors are US companies and may process data in the United States. For those transfers zrsPOS relies on the EU-US Data Privacy Framework where the sub-processor is certified under it, and otherwise on the European Commission's Standard Contractual Clauses in the sub-processor's data processing terms.

9. Retention and deletion

While zrsPOS is installed:

• Raw Shopify events are kept in full for 90 days (for retries and audit), then reduced to a non-personal skeleton (order number, totals, lines, location, payment method).
• Issuing records: e-mail and phone are removed from a finished issuing record's request and response bodies after 90 days.
• Receipt print jobs: the receipt's content is deleted after 30 days. For a fiscal document a record that its receipt was printed stays, so a later print is marked as a copy.
• Till closes (totals, counted cash, the identifier of whoever closed) are kept as business records, like the documents they summarise.
• Tax Free passport data is removed 7 days after the Tax Free session ends. zrsPOS's copy of an issued Tax Free form is kept for reprints until a redaction request for that order or the uninstall.
• Fiscal documents (identity, address, transaction and fiscal data) are kept for the period Portuguese tax law requires the Merchant to keep them (currently 10 years). This retention is the Merchant's legal obligation; zrsPOS holds its copy on the Merchant's behalf. The certified originals are in the Merchant's own SAGE.
• Contact fields (e-mail, phone) are not part of the fiscal record and are erased on request (section 10) and after the uninstall.

After the Merchant uninstalls zrsPOS, Shopify sends the shop/redact notice 48 hours later. zrsPOS then deletes the Merchant's configuration, credentials and encryption key, printers and devices, document layouts and till-close settings, sending address (also removed from the e-mail provider), raw Shopify events, the content of print jobs, and all Tax Free sessions and form copies, and erases the contact fields from the fiscal documents and issuing records it keeps under the legal retention above. Till closes are kept. Deleted data may remain in the database provider's encrypted backups until they roll over. If the Merchant reinstalls zrsPOS before the notice arrives, nothing is deleted.

zrsPOS keeps no archive and offers no export after the uninstall. The Merchant can take reprints and downloads of its documents while zrsPOS is installed; its legal archive is its own SAGE.

10. Data subject rights

zrsPOS assists the Merchant in responding to data subject requests. Through Shopify's mandatory compliance webhooks:

• Access (customers/data_request): zrsPOS records the request, alerts its team by e-mail, and provides the Merchant with the personal data it holds for the named orders within 30 days.
• Erasure (customers/redact): zrsPOS erases the e-mail and phone everywhere it copied them for the affected orders (documents, issuing records, raw events, store-credit vouchers), reduces the raw events to their non-personal skeleton, and removes the Tax Free passport data and its copy of the Tax Free form. Name, NIF and address remain on the fiscal document because their retention is a legal obligation of the Merchant; zrsPOS records this outcome and the basis for it so the Merchant can answer the data subject. The customer record zrsPOS created in the Merchant's SAGE is managed by the Merchant.

zrsPOS's log of these requests keeps the customer's Shopify id, the order numbers and a one-way fingerprint of the e-mail address, never the address itself.

Requests received directly by zrsPOS are forwarded to the Merchant without undue delay.

11. Personal data breach

zrsPOS notifies the Merchant without undue delay, and in any case within 24 hours of confirming that a breach affects the Merchant's data, with the information the Merchant needs for its own notification to the CNPD (within 72 hours) and, where required, to data subjects. Handling follows the Security Incident Response Policy.

12. Assistance, audits and records

zrsPOS assists the Merchant with data protection impact assessments and prior consultations where the processing warrants them. zrsPOS keeps records of its processing activities and makes available the information necessary to demonstrate compliance. The Merchant may audit zrsPOS's compliance with this DPA once a year on 30 days' notice, or without notice following a breach, by written questionnaire in the first instance and by inspection where the questionnaire is insufficient.

13. Term and consequences of termination

This DPA lasts as long as zrsPOS processes personal data for the Merchant. On termination zrsPOS deletes the data as described in section 9, except where retention is required by law.

14. Liability and precedence

Each party is liable for the damage caused by its own breach of this DPA or of the GDPR, as provided by Article 82 GDPR and Portuguese law. Nothing in this DPA limits either party's liability towards data subjects or for its own breach of the GDPR. This DPA prevails over the Terms of Service, and over any other agreement between the parties about zrsPOS, on matters of personal data.

Annex A — Processing summary (Art. 28(3))

Annex B — Technical and organisational measures (Art. 32)

The measures below are in force. They are described in full in the zrsPOS Data Loss Prevention Strategy and the Security Incident Response Policy; a copy of either is provided on request to support@zrspos.com.

Annex C — Sub-processors

The complete list of sub-processors authorised at the date of this version:

Shopify, Global Blue and the Merchant's own SAGE are not sub-processors of zrsPOS (section 7).

Changes to this Annex follow the notice and objection process in section 7.