Data processing agreement

1. Parties and formation

1.1 This data processing agreement (the “DPA”) is entered into between the business that uses Add Your Shop (the “Merchant”, “you”), acting as controller, and SBrusse SRL, Rue Auguste Baccus 14, boîte 2, 1350 Orp-Jauche, Belgium, enterprise number 0644.917.861 (“we”, “us”), acting as processor.

1.2 The DPA forms part of our Terms of service (the “Terms”) and is formed when you accept them. Terms defined in the Terms (such as Shop, Customer, Order and Merchant Content) have the same meaning here; “personal data”, “processing”, “controller”, “processor”, “personal data breach” and “supervisory authority” have the meaning given in the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).

1.3 The DPA covers the personal data that we process on your behalf to run your Shop (“Customer Personal Data”). Where the UK GDPR applies to that processing, references to the GDPR include the UK GDPR.

2. Details of the processing

• Subject matter: operating your Shop, as described in the Terms.
• Duration: the term of the Terms, then until the data has been returned and deleted under clause 11.
• Nature of the processing: collection through the Shop, recording, storage, organisation, consultation, transmission to you (for example by order email) and to Stripe for payment, retrieval, and erasure.
• Purposes: taking and managing Orders; processing payments through your Stripe account; sending order notifications to you and confirmations to Customers; organising pickup, delivery or shipping; handling Customer questions and the refunds you ask for; keeping the Shop secure and preventing fraud.
• Data subjects: your Customers, and the recipients of deliveries named by them.
• Categories of personal data: name; email address; phone number; delivery address; Order contents, amounts and history; chosen pickup slot or delivery method; messages and notes entered by Customers (such as a gift message); payment status and the limited payment details made available by Stripe (such as card brand and the last four digits); age confirmation for age-restricted products; technical data such as IP address and browser information, for security and fraud prevention.
• Special categories of data: the Shop is not designed to collect them. If a Customer volunteers such information in a free-text field (for example an allergy), it is processed only to prepare the Order.

We also use Order references and amounts, without Customer contact details, to calculate and invoice our commission and to keep our accounts. For that purpose we act as a controller, as described in our Privacy policy.

3. Your obligations

As controller, you are responsible for the lawfulness of the processing, for having a legal basis for it, for informing your Customers (in particular through the privacy notice of your Shop) and for the instructions you give us. Do not ask us to collect more data than you need for your Orders.

4. Instructions and confidentiality

4.1 We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country, unless we are required to do otherwise by European Union or Member State law; in that case, we inform you of that legal requirement before processing, unless the law prohibits it. The Terms, this DPA, the settings of your Shop and your written requests constitute your instructions.

4.2 We inform you immediately if, in our opinion, an instruction infringes the GDPR or other data protection provisions.

4.3 Everyone we authorise to process Customer Personal Data has committed to confidentiality or is under an appropriate legal obligation of confidentiality, and only processes it as needed for the Service.

5. Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by article 32 of the GDPR. They are described in Annex 1. We may update them as technology evolves, provided that the overall level of security is not reduced.

6. Sub-processors

6.1 You give us a general authorisation to engage the sub-processors listed in Annex 2.

6.2 We inform you by email at least 30 days before we add or replace a sub-processor. You can object within that period, on reasonable grounds relating to data protection. We will then discuss your concerns with you in good faith; if we cannot resolve them, you can end the Terms before the change takes effect, at no cost.

6.3 We impose on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA. We remain fully responsible to you for the performance of their obligations.

7. Assistance

7.1 Data subject requests. If a Customer contacts us to exercise their rights, we forward the request to you without undue delay and do not answer it ourselves, except to tell the Customer that we have done so. Taking into account the nature of the processing, we help you respond, in particular by providing the relevant data or an export.

7.2 Other obligations. We help you comply with your obligations under articles 32 to 36 of the GDPR — security, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority — taking into account the nature of the processing and the information available to us.

7.3 Authorities. If a supervisory authority or another public authority contacts us about Customer Personal Data, we inform you, unless the law prohibits it.

8. Personal data breaches

8.1 We notify you of any personal data breach affecting Customer Personal Data without undue delay, and in any case within 48 hours of becoming aware of it.

8.2 Our notification describes, as far as we know it at the time: the nature of the breach, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point. Where we cannot provide all this information at once, we provide it in stages, without further undue delay.

8.3 We take the necessary measures to contain the breach and help you meet your own obligations, including the notification of the supervisory authority within 72 hours where required. As controller, you decide on notifying the authority and the people concerned; we do not do so on your behalf unless you ask us to or the law requires it.

9. International transfers

We transfer Customer Personal Data outside the European Economic Area only on your instructions, which you give by accepting this DPA for the sub-processors listed in Annex 2, and only with the safeguards required by chapter V of the GDPR: an adequacy decision, such as the one covering companies certified under the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), or the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914). For data covered by the UK GDPR, the UK Extension to the Data Privacy Framework or the UK addendum to those clauses applies.

10. Information and audits

10.1 We make available to you the information necessary to demonstrate compliance with article 28 of the GDPR, including this DPA, the description of our security measures, the list of sub-processors and our answers to reasonable security questionnaires.

10.2 If that information is not sufficient, you may carry out an audit, or have it carried out by an independent auditor bound by confidentiality, once a year — or more often if a supervisory authority requires it or after a personal data breach. The audit must be requested in writing at least 30 days in advance, take place during business hours, avoid unnecessary disruption, and respect the confidentiality of our other customers' data and of our security. Each party bears its own costs.

10.3 For our sub-processors' infrastructure, we rely on the certifications and audit reports they make available (Cloudflare and Stripe, for example, publish independent certifications and audit reports).

11. Return and deletion

11.1 When the Terms end, we stop processing Customer Personal Data, except as needed to carry out this clause. During the 30 days after the end, you can ask us for an export of your Order data in a common format.

11.2 At the latest at the end of those 30 days, we delete Customer Personal Data, including copies, unless European Union or Member State law requires us to keep it. Backups that contain it are deleted in our normal backup cycle and are not used in the meantime, except to restore our systems.

11.3 On request, we confirm the deletion in writing.

12. Stripe

Payments are processed by Stripe under your own agreement with Stripe, which includes Stripe's data processing terms; for some purposes, such as fraud prevention and legal compliance, Stripe acts as an independent controller. When we create payments or process refunds in your Stripe account, we act on your instructions. Stripe is listed in Annex 2 for transparency; its processing for its own purposes is governed by Stripe's privacy policy, not by this DPA.

13. Liability, duration and changes

13.1 Each party is liable for its own breaches of the GDPR in accordance with article 82 of the GDPR. Between us, the limitations of liability in the Terms apply, except where the law does not allow them.

13.2 The DPA applies for as long as we process Customer Personal Data. In the event of a conflict with the Terms, the DPA prevails on matters of data protection.

13.3 We may change the DPA in accordance with clause 14 of the Terms, with at least 30 days' notice by email and the right to end the contract before the change applies, unless a change is required by law. The DPA is drafted in English and a French version is provided; if the two versions differ, the English version prevails, and clause 1.4 of the Terms applies. It is governed by Belgian law, and disputes are settled by the courts designated in the Terms.

Annex 1. Security measures

• Encryption in transit: all connections to the Shops, to our website and to our tools use HTTPS (TLS).
• Encryption at rest: the Shop database, hosted by Cloudflare, is encrypted at rest (AES-256).
• Access control and least privilege: access to Customer Personal Data is limited to the people who need it for the Service, with personal accounts, strong passwords and two-factor authentication on administrative accounts; access is removed when it is no longer needed.
• Separation: each Merchant's data is logically separated from that of other Merchants.
• Logging: administrative access and changes to our infrastructure are logged.
• Backups: data is backed up regularly so that it can be restored after an incident.
• Payments: card details are collected and processed by Stripe, which is certified as a PCI DSS Level 1 service provider; we do not store card numbers.
• Network protection: the Shops are served through Cloudflare's network, including its protection against denial-of-service attacks.
• Minimisation: we collect only the data needed for Orders, and delete it in accordance with clause 11.
• Incidents and vulnerabilities: we have a procedure to detect, assess and contain incidents and to notify you within the time set in clause 8. Vulnerabilities can be reported to security@addyour.shop.
• Providers: we choose providers that offer sufficient guarantees, and we review this list when our services change.

Annex 2. Sub-processors