Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms and governs Shopiens' (Wisepops's) processing of personal data on behalf of the Customer.
1. Roles and scope
The Customer is the controller and Shopiens (Wisepops) is the processor of the personal data we process on the Customer's behalf: visitor data collected through the Shopiens tracker and our Shopify pixel, and order facts read from the Customer's Shopify store. Sections B and C of our Privacy Policy describe the subject matter, nature and purposes of the processing, the types of personal data, the categories of data subjects and the retention periods, and form the description of processing under this DPA.
We process that data only to provide the analytics service, to support the Customer and to improve the service, and only on the Customer's documented instructions, which comprise the Terms, this DPA, and the Customer's configuration and use of the product, unless Union or Member State law to which we are subject requires otherwise; in that case we inform the Customer of that legal requirement before processing, unless that law forbids it. We tell the Customer promptly if, in our opinion, an instruction infringes data-protection law.
2. Sub-processors
The Customer authorises the sub-processors listed at /subprocessors. Before a new or replacement sub-processor starts processing personal data, we notify the Customer by email to its account owners, and the Customer may object on reasonable data-protection grounds. We impose on each sub-processor, by contract, data-protection obligations equivalent to those in this DPA, and we remain fully liable to the Customer for each sub-processor's performance of those obligations.
3. Security measures
We apply technical and organisational measures appropriate to the risk, including: strict logical isolation so each customer can access only their own data; the keys we issue to your AI assistant kept only in a form that cannot be turned back into the key, and the logins for services you connect kept in encrypted storage; masking of visitor IP addresses before they are stored in our analytics data; access controls on production systems; and encryption of data in transit.
We ensure that everyone we authorise to process the Customer's personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.
4. International transfers
Personal data may be processed in the United States by our hosting provider (AWS). More generally, where any sub-processor listed at /subprocessors processes personal data outside the European Economic Area or the United Kingdom, the transfer relies on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum, as applicable.
5. Assistance
Taking into account the nature of the processing, we assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects. On the Customer's request, we delete a visitor's data from our live systems within 30 days; a Shopify order record carrying the visitor's identifier loses it within the same 30 days; archived copies are deleted at the end of the 25-month retention period. Taking into account the nature of the processing and the information available to us, we also assist the Customer with data protection impact assessments and with prior consultations of a supervisory authority.
6. Personal-data breaches
We notify the Customer without undue delay after becoming aware of a personal-data breach affecting their data, with the information reasonably available to us to support the Customer's own notification obligations.
7. Deletion and return
When the service ends, or earlier when the Customer asks us to delete a site's data, we delete the Customer's personal data for that service or site from our live systems within 30 days, and from archived copies at the end of the 25-month retention period, unless law requires us to keep it; the Customer may ask for an export of the data first. We delete a Shopify store's order records the same way when it uninstalls our app. Otherwise, the data follows the documented retention periods set out in the Privacy Policy (25 months for identifiable visitor data and for individual Shopify orders).
8. Audit
We make available to the Customer the information necessary to demonstrate compliance with this DPA, including our security documentation and our responses to reasonable written questionnaires. We also allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on at least 30 days' written notice and at most once a year, except when a supervisory authority requires an audit or after a personal-data breach affecting the Customer's data.
9. Duration
This DPA applies for as long as we process personal data on the Customer's behalf.