Data processing agreement
This agreement applies when a merchant ("controller") uses Findel and Dewoid ("processor") processes personal data of the merchant's shoppers on the merchant's behalf. It forms part of the terms of service, and "Dewoid" has the meaning given there.
1. Subject matter and duration
The processor provides site search, answers and search analytics for the controller's Shopify store. Processing lasts while Findel is installed on the store, and ends with the deletion described in section 8.
2. Details of the processing
| Item | Description |
|---|---|
| Data subjects | Visitors and shoppers of the controller's store who use search or whose store activity the Findel web pixel receives. |
| Categories of data | Search text and time; what search showed; clicks on search results; product views, add-to-cart and checkout events with product, variant, quantity and line price; order number of completed checkouts; a random session id held in a cookie; IP address and browser type in server logs. |
| Special categories | None are requested. Search text is free text, so a shopper could type anything into it. |
| Nature and purpose | Collecting, storing, analysing and deleting the data to run search for the store, rank results, answer questions from the store's own documents, attribute purchases to search and report search analytics to the controller. |
| Retention | 25 months, then deleted; all data for the store is deleted after uninstall as in section 8. |
3. Instructions
The processor processes the personal data only on the controller's documented instructions. The controller's instructions are these terms and the settings the controller chooses in the app. The processor tells the controller if it believes an instruction breaks data protection law.
4. Confidentiality
Everyone the processor authorises to process the personal data is bound to confidentiality. At present only the owner of Dewoid has access to it.
5. Security
The processor applies appropriate technical and organisational measures, including encryption in transit and at rest, encrypted backups, access limited to authorised people and separation of each store's data.
6. Subprocessors
The controller authorises the processor to use subprocessors for hosting, backup storage and AI processing. The current list, with each subprocessor's name and location, is available to the controller on request at support@findel.ai. The processor imposes data protection obligations on each subprocessor and remains responsible for them. The processor informs the controller of any intended addition or replacement of a subprocessor by email to the store's contact address at least 30 days in advance, and the controller may object. If the parties cannot resolve the objection, the controller may stop using Findel by uninstalling it.
7. Assistance to the controller
- Data subject requests. Shopify forwards customers' data and deletion requests to the processor. For a deletion request the processor deletes the records linked to that customer's orders, and for a data request it sends those records to the controller. It also helps the controller answer other requests from data subjects.
- Personal data breaches. The processor notifies the controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the controller's data, by email to the store's contact address, with the information the controller needs to meet its own obligations.
- Impact assessments. The processor provides the information the controller reasonably needs for a data protection impact assessment.
8. Deletion at the end
When the controller uninstalls Findel, Shopify asks the processor to delete the store's data 48 hours later. The processor then deletes all data it holds for the store, unless the store has installed Findel again in the meantime. Copies in backups expire within 30 days.
9. Information and audits
The processor makes available the information needed to show compliance with this agreement and answers the controller's written questions about it. The controller may also have the processing inspected by an independent auditor bound by confidentiality, at the controller's cost, with 30 days' notice and no more than once a year, unless a personal data breach has occurred or a supervisory authority requires it.
10. International transfers
- The data is hosted in the EU. The processor is established in Serbia, and backup storage and AI processing may take place in the USA.
- Where the controller is in the European Economic Area, the parties agree to the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), Module Two (controller to processor), for the transfer to the processor. They are incorporated into this agreement by reference, with the controller as data exporter and the processor as data importer. The optional docking clause applies; under Clause 9 the general authorisation and the notice in section 6 apply; the option in Clause 11 does not apply; the clauses are governed by the law of Ireland, and disputes go to the courts of Ireland. Annex I is completed by the terms of service and section 2, and Annex II by section 5. If the clauses conflict with this agreement, the clauses prevail.
- Where the controller is in the United Kingdom or Switzerland, the same clauses apply with the UK International Data Transfer Addendum or the adjustments required by Swiss law.
- For onward transfers to subprocessors in the USA, the processor relies on the Standard Contractual Clauses or, where the subprocessor is certified, the EU-US Data Privacy Framework.
11. Governing law
This agreement is governed by the same law as the terms of service, except that the Standard Contractual Clauses are governed as set out in section 10, and data protection law applies wherever it requires.
12. Contact
Dewoid, Serbia. Email: support@findel.ai.