Annex to the Terms of use · effective from 21 October 2026
This is an English translation; the Lithuanian version prevails: Duomenų tvarkymo sutartis.
This agreement forms part of the Terms of use. It applies when bugivugi processes personal data on the Customer's behalf (GDPR Art. 28).
1. Parties
- Controller – the Customer who accepted the Terms of use.
- Processor – MB eDelfinas, company code 306945862, registered office Taikos pr. 24, 91222 Klaipėda, Lithuania, brand bugivugi.
2. Subject, duration and nature of processing
2.1. The Processor processes personal data only as needed to provide the Service, for as long as the Terms of use apply and for the 14-day recovery period afterwards.
2.2. What data is processed, whose and for what purpose is set out in Annex 1.
3. Processor's obligations
3.1. Process data only on the Controller's documented instructions: the Terms of use, the Service settings and written requests. If an instruction, in the Processor's opinion, infringes the GDPR, the Processor informs the Controller immediately.
3.2. Ensure that persons processing the data are committed to confidentiality.
3.3. Apply the technical and organisational security measures in Annex 2 (GDPR Art. 32).
3.4. Help the Controller respond to data subject requests: provide, correct or delete data where the Controller cannot do so itself in the interface.
3.5. Help the Controller meet its obligations under GDPR Art. 32–36: security, breach notifications, impact assessments.
3.6. Provide the information needed to demonstrate compliance with this agreement and allow reasonable audits agreed 30 days in advance, no more than once a year and at the Controller's expense.
4. Subprocessors
4.1. The Controller gives general authorisation to engage the subprocessors listed in Annex 3.
4.2. The Processor notifies the Controller by email 30 days before engaging a new or replacing a subprocessor. During that time the Controller may object on reasonable grounds and, if no agreement is reached, terminate the contract.
4.3. Each subprocessor is bound by a contract with data protection obligations no less strict than these. The Processor is liable to the Controller for its subprocessors.
5. Transfers outside the EEA
Data is transferred outside the EEA only under the safeguards of GDPR Chapter V: a European Commission adequacy decision, the EU–US Data Privacy Framework or standard contractual clauses.
6. Breaches
On becoming aware of a personal data breach, the Processor notifies the Controller without undue delay and no later than within 48 hours: what happened, which data and persons are affected, the likely consequences and the measures taken.
7. End of the agreement
After the Terms of use and the 14-day recovery period end, the Processor deletes the Controller's personal data, except data it must keep by law. Data disappears from backups within 30 days. Until then the Controller can export its data.
8. Liability
The limitations in the Terms of use apply to the parties' liability to the extent the GDPR allows.
Annex 1. Description of processing
| Area | Data subjects | Data | Purpose | Retention |
|---|---|---|---|---|
| Orders from connected marketplaces and stores | Customer's buyers | Order number, items, amount; name, address and contacts – only for the courier feature | Sales and profit calculation, shipping | While the contract applies plus 14 days |
| AI responder | Customer's buyers and website visitors | Messages, name, phone or email (if provided), Facebook or Instagram ID | Answering questions, handing the conversation over to the Customer | Chats – 60 days |
| Email marketing | Customer's buyers and subscribers | Email, name, consent record, opens and clicks | Sending the Customer's emails and statistics | Until the Customer deletes them or the person unsubscribes |
| Social media | People who write or comment | Name, profile ID, message or comment | Replying and filtering spam | 60 days |
| Files uploaded by the Customer | People mentioned in the files | Depends on the content | Responder knowledge base and products | Until the Customer deletes them |
Special categories of data are not processed.
Annex 2. Security measures
- Login with a one-time code by email (valid 10 minutes), request and attempt limits; the session token is stored on the server only as a hash.
- Access keys and tokens are encrypted with AES-256-GCM and bound to the specific Customer, and the encryption key is kept in the server environment, not in the database.
- Requests between system components are signed and verified; public endpoints are checked by signature or token.
- Every data request is filtered by Customer ID, and agent memory is kept separately for each Customer and deleted together with the account.
- Servers in Lithuania (Hostinger, Vilnius), database in Sweden (Supabase, Stockholm), backups in the EU; administrative access is protected with strong passwords and, where possible, a second factor.
- Regular backups.
- System error notifications without keys or tokens; execution data containing personal data is not stored.
- Access to data is granted only to those who need it for their work and only after committing to confidentiality.
Annex 3. Subprocessors
Current list: Subprocessors