Data Processing Addendum

This Data Processing Addendum (“DPA”) applies when a merchant (“Merchant”) uses the Shopify app Textile Compliance for Shopify (“the app”), operated by Igor Kazazic, Sweden (“Provider”). It forms part of the agreement between them, which consists of Shopify’s terms for installing and paying for the app and this DPA. It applies automatically when the Merchant installs the app. A signed copy is available on request by email.

1. Roles

For personal data that the Merchant enters or that the app reads from the Merchant’s Shopify store, the Merchant is the controller and the Provider is the processor. The Provider is the controller of its own account, billing and security records, as described in the privacy policy.

2. What is processed

• Purpose: to check the Merchant’s textile product data, summarise units shipped to California and keep the Merchant’s records, history and reports.
• Duration: while the app is installed, and until deletion under section 8.
• Personal data: the Shopify staff identifier of people who make changes, and any personal data the Merchant chooses to enter in notes or evidence files. The app does not store customer names, email addresses, phone numbers, street addresses or payment details. Order data is limited to order reference, date, quantity and destination state and country.
• People concerned: the Merchant’s staff, and any people named in the data the Merchant enters.

3. Instructions

The Provider processes personal data only on the Merchant’s documented instructions, which are the Merchant’s use of the app’s features and this DPA. If the Provider believes an instruction breaks data protection law, it will say so. The Provider does not sell the data, use it for advertising or combine it with other sources.

4. Confidentiality and security

Only the Provider has access to the data, and is bound to keep it confidential. The Provider applies the measures described on the security page and keeps them appropriate to the risk.

5. Sub-processors

The Merchant authorises these sub-processors: Shopify (platform, sign-in and billing) and Railway (hosting of the app, database and file storage). The Provider will give notice by email or on the app’s plans page before adding or replacing a sub-processor, and the Merchant may object on reasonable data protection grounds. The Provider requires its sub-processors to protect data to the same standard as this DPA and remains responsible for them. Where data is transferred outside the EU/EEA, the Provider relies on an adequacy decision or the standard contractual clauses.

6. Assistance

Taking into account the nature of the processing, the Provider helps the Merchant answer requests from individuals (access, correction, deletion) and meet its security, breach notification and impact assessment duties. The app’s Settings page lets the Merchant export all of its data. Requests that reach the Provider directly are passed to the Merchant, unless the law requires otherwise.

7. Personal data breach

If the Provider becomes aware of a personal data breach affecting the Merchant’s data, it notifies the Merchant without undue delay and within 72 hours of confirming it, with the information needed for the Merchant to meet its own duties. The steps are described on the security page.

8. Return and deletion

When the app is uninstalled, Shopify sends a deletion request and the Provider deletes the Merchant’s data. If that request never arrives, the data is deleted 30 days after uninstall. The Merchant can export its data first. Copies in backups are overwritten under the hosting provider’s backup rotation. The Provider may keep what the law requires it to keep, such as billing records.

9. Audits

The Provider will give the Merchant the information needed to show that it follows this DPA and will allow reasonable reviews of it, with notice and no more than once a year unless there has been an incident. The Provider will answer security questionnaires in good faith.

10. Liability and law

Liability under this DPA is subject to the limits in the agreement between the parties. Swedish law applies, and disputes are resolved by the courts of Sweden, without limiting any rights a data subject has under data protection law.

Contact

Igor Kazazic, Sweden. igorkazazic1989@gmail.com.