Data Processing Agreement

This Data Processing Agreement (“DPA”) applies between the Merchant using Sortby, as Controller, and inkOfPixel Srl, Piazza Castello 26, 20121 Milano, Italy, VAT 09287730965, as Processor. It forms an integral part of the Terms and Conditions and takes effect when the Merchant installs the app. No signature is required, though we will sign a counterpart on request.

It gives effect to Article 28 of Regulation (EU) 2016/679 (“GDPR”). Terms such as “personal data”, “processing”, “controller” and “processor” have the meaning given in the GDPR.

Subject matter and purpose. Reordering the products inside the Merchant’s Shopify collections according to rules the Merchant defines, and the operations that serve it: importing and periodically refreshing a copy of the product catalogue, computing sort values, and writing the resulting order back to Shopify.

Nature of the processing. Collection, storage, structuring, consultation, use and erasure, by automated means.

Duration. For as long as the app is installed. It ends on uninstallation, when the data is deleted as described in section 9.

Most of what the Processor handles is commercial information about products and is not personal data at all. Personal data arises only in the following limited cases.

• The Merchant and its staff. The myshopify.com domain of the store, the Shopify store identifier, and vendor names — which can identify a person where the merchant or the vendor is a sole trader — together with the contact address used for support correspondence.
• Any individuals whose data the Merchant places in product metafields. The Processor copies metafield values verbatim, because it cannot know in advance which of them the Merchant will want to sort by. What ends up there is determined entirely by the Merchant.

No data about the Merchant’s customers is processed. The app requests only the read_products and write_products access scopes, so Shopify does not expose customers, orders, checkouts or payment data to it. No special categories of data under Article 9 GDPR are processed, and the Processor asks the Merchant not to place such data in product metafields.

The Processor processes personal data only on documented instructions from the Controller. The Terms, this DPA, the Privacy Policy and the configuration the Merchant makes in the app together constitute those instructions.

The Processor will inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data protection law. Where the Processor is required by Union or Member State law to process data otherwise, it will inform the Controller before processing unless that law prohibits it.

The Processor ensures that persons authorised to process the personal data are bound by an appropriate obligation of confidentiality, and limits access to those who need it to operate and support the Service.

The Processor implements appropriate technical and organisational measures under Article 32 GDPR. These include:

• encryption of Shopify access and refresh tokens at rest;
• short-lived access tokens, refreshed automatically, so a leaked credential does not stay valid;
• encryption in transit: all traffic served over HTTPS with HSTS enabled;
• HMAC signature verification of every incoming webhook, so the Service acts only on genuine Shopify requests;
• a database reachable only on a private network, with no port exposed to the internet;
• authentication on internal operational dashboards, and access limited to authorised personnel;
• automatic filtering of tokens, secrets, keys and email addresses out of application logs.

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, and provides the information reasonably needed for the Controller to meet its own notification obligations.

The Controller gives a general authorisation to engage sub-processors. The Processor currently engages one:

• Hetzner Online GmbH (Germany), for server and database hosting, in its Helsinki, Finland data centre.

Shopify Inc. is not a sub-processor of the Processor: it is the platform from which the data originates and to which it is written back, under the Merchant’s own agreement with Shopify.

The Processor imposes on every sub-processor data protection obligations equivalent to those of this DPA and remains fully liable to the Controller for the sub-processor’s performance. It will inform the Controller before adding or replacing a sub-processor, giving the Controller the opportunity to object; if an objection cannot reasonably be accommodated, the Controller may terminate by uninstalling the app.

Personal data processed under this DPA is stored and processed within the European Union, on infrastructure located in Helsinki, Finland. The Processor does not transfer it outside the European Economic Area.

Should that ever change, the transfer would take place only under an adequacy decision of the European Commission or the European Commission’s Standard Contractual Clauses, with additional safeguards where appropriate, and the Controller would be informed beforehand.

Taking into account the nature of the processing and the information available to it, the Processor assists the Controller with appropriate technical and organisational measures in:

• responding to requests from data subjects exercising their rights under Chapter III GDPR;
• meeting the obligations of Articles 32 to 36 GDPR, including security, breach notification and data protection impact assessments.

The Processor also answers the data subject request webhooks Shopify forwards for the Merchant’s customers. Because no customer data is held, the response to those requests is that there is nothing to provide and nothing to erase.

On uninstallation the Processor immediately destroys the credentials it holds for the Controller’s store and stops processing it. The catalogue copy, metafields, collections and rules are retained briefly so that a reinstallation resumes without a fresh import.

That retention ends on Shopify’s shop/redact request, sent about 48 hours after uninstall, on which the Processor deletes every associated record. Where that request does not arrive, a scheduled job performs the same deletion for any store uninstalled more than 30 days earlier. Personal data processed on the Controller’s behalf is therefore erased within 30 days of uninstallation at the latest.

What remains afterwards is a single record containing the store’s myshopify.com domain, its installation state and the dates of installation and uninstallation. The Processor retains it in its own legitimate interest — recognising a returning store, evidencing the relationship, and preventing repeated free trials obtained by uninstalling and reinstalling — and not on the Controller’s instructions. The Processor deletes it on the Controller’s request.

The Controller can export its own catalogue data from Shopify at any time, so no separate return of data by the Processor is required.

The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates. Audits are to be requested in writing with reasonable notice, conducted during business hours, no more than once a year unless a breach or a supervisory authority requires otherwise, and in a way that does not compromise the confidentiality or security of other merchants’ data.

In case of conflict between this DPA and the Terms, this DPA prevails on matters of data protection. This DPA is governed by Italian law, and the jurisdiction clause of the Terms applies.

The Processor may update this DPA to reflect changes in the Service or in applicable law, informing Merchants as appropriate; changes apply to the future.

Questions, audit requests and signed-counterpart requests go to [email protected].