You are the controller of your customers' data. We are your processor. This document is the Article 28 agreement that says so properly, and it is part of your contract without you having to ask for it.
Awaiting counsel review. The commitments below are what the system does today; the executable wording is with Lithuanian counsel. A signable copy will be available here and on request.
You are controller; we are processor. We process only on your documented instructions, and using the service is that instruction. If we ever think an instruction breaks data protection law, we will say so rather than quietly comply.
Subject matter: one-to-one messaging with your shoppers. Categories: your customers and their contact, consent, browsing and order records. Purpose: sending and answering messages, and measuring recovery. Duration: while your account is active, plus the consent-proof retention period.
Encryption in transit and at rest, least-privilege access with individual accounts, audit logging of staff access to conversation data, EU hosting, and separation between merchants. Our staff access shopper conversations only to fix a fault or answer your request.
Named publicly on the subprocessor page, each under equivalent obligations. 30 days' notice before we add or replace one, and a right to object.
If a shopper comes to us with an access, correction or deletion request, we route it to you and help you answer it – within the service, not by email attachment. Opt-outs we handle immediately ourselves, because that one cannot wait for a queue.
Without undue delay and in any case within 24 hours of us becoming aware, with what we know at that point rather than a polished statement a week later.
Information to support your own records and impact assessments, and reasonable audit rights. The consent ledger is exportable at any time, so most of what an auditor asks for you can produce yourself.
On termination you export everything – conversations, consent records, statements – and we delete our copies within the stated window, except where law requires us to keep proof of consent for longer. We will tell you exactly what is kept and for how long.
Need a signed copy for your records, or have your own DPA you would rather use? legal@trynellie.com.