Shopify app data processing addendum

1. Parties and roles

"We" means SAAS SEO AGENCY LLC, which runs AffiliateTracking. "You" means the merchant who installs the app on a Shopify store. For personal data about your shoppers, affiliates and referred friends that the app processes for your store ("store personal data"), you are the controller and we are your processor. Terms such as controller, processor, personal data and data subject have the meaning they have in the GDPR. This addendum also applies under the UK GDPR, the Swiss data protection act and US state privacy laws, with their terms read in.

2. What we process

• Subject matter and purpose: running the app for your store: attributing orders to affiliates, working out and reversing commission, fraud checks held for your review, the affiliate portal, referral rewards, product gifts, payouts you approve, emails you set up, support and security.
• Duration: while the app is installed, and until deletion under section 9.
• Data subjects: your shoppers and customers, your affiliates, creators and applicants, the friends they refer, and your staff who use the app.
• Personal data: customer ID, email, name and shipping address from orders, the order's IP address (stored as a hash), order and line item details, referral click data (landing page, referrer, hashed IP, browser and device type), and affiliate data (name, email, social profiles, signup form answers, payout details, tax forms and details, shipping address for gifts, messages and files). Where a check only needs a match, we store a keyed hash instead of the value.
• Special categories: none. The app isn't designed to process special category data, and you agree not to collect it through the app's signup forms.
• Retention: as listed in the privacy policy, enforced by a daily job.

3. Your instructions

We process store personal data only on your documented instructions. These terms, your settings in the app and the actions your staff take in it are your instructions. We'll tell you if we think an instruction breaks data protection law. We may also process data where the law requires it, and if so we'll tell you first unless the law forbids that.

We never sell store personal data, never use one store's data for another merchant, and follow Shopify's API License and Terms of Use for all data we get from Shopify.

4. Confidentiality

Only staff who need access to support you or run the app can reach store personal data, and they're bound by confidentiality. Today only our founder can reach the production server, with an SSH key and no passwords. Our support team sees a store's data only when you add us as staff in your Shopify admin. The app shows customer details masked, and every reveal, privacy request download and API read of them is logged.

5. Security

We keep technical and organisational measures in place to protect store personal data, including:

• TLS for all traffic over the internet, and HSTS on our domains. Inside the server, the app reaches its database over a private network that can't be reached from outside.
• Encryption at rest: the database is stored on an encrypted volume (LUKS2), and each backup is encrypted with a key that isn't kept on the server.
• Shopify access tokens, third-party keys and affiliate payout details sealed with AES-256-GCM.
• A separate database schema per store, with tests that check one store can't read another's data.
• Verification of every Shopify webhook and request signature before any data is used.
• A server with no ports open for the app: all traffic reaches it through an encrypted Cloudflare Tunnel. The app, its database and our test system run in separate, isolated containers. Server access is by SSH key only, with no passwords and no root login.
• Logs that carry IDs, not names, emails, addresses or payout details.
• Test systems that use fictional data only.
• Daily encrypted database backups, kept for 14 days, with restores tested. There's no point-in-time recovery, so in the worst case up to one day of data could be lost.
• A written incident response policy.

We may update these measures as long as the overall level of protection doesn't go down.

6. Sub-processors

You give general authorisation for us to use the sub-processors on our sub-processor page. We bind each one by written terms that protect store personal data at least as well as this addendum, and we remain responsible for them. Before we add or replace a sub-processor, we update that page and email your store address. You can object by emailing us. If we can't resolve your objection, you can uninstall the app, and you won't be charged for any period after that.

Services you connect through your own account, such as PayPal, Wise, Tremendous, Klaviyo, Mailchimp, Omnisend or Zapier, are your providers, not our sub-processors. We send them data on your instruction.

7. Helping with requests

We help you answer requests from data subjects. Shopify sends customer data requests and deletion requests to the app through its privacy webhooks, and the app handles them as described in the privacy policy: a data request produces a file you download in the app, and a deletion request removes the person's identity from your store's data. We finish each one within 30 days of receiving it. If a data subject contacts us directly, we pass the request to you. We also give you reasonable help with data protection impact assessments and with consulting a supervisory authority, as far as they relate to the app.

8. Security incidents

If we become aware of a breach of security leading to the accidental or unlawful loss, change, disclosure of or access to store personal data, we'll notify you at your store address without undue delay, and no later than 72 hours after we confirm that your store's data was affected. We'll tell you what happened, what data and people are affected as far as we know, what we've done to contain it, and who to contact. We'll update you as we learn more, and notify Shopify where Shopify's terms require it.

9. Deletion at the end

When you uninstall, we email you an export link that works for 7 days. Shopify then sends us its store deletion request. Once the export link has expired, we delete store personal data, including your store's database schema and files, within 30 days of Shopify's request. We keep one record that your store was installed and deleted, with the dates. Encrypted backups that still hold store personal data are deleted within 14 days after that. Tax records are kept only for the period the law requires.

10. Audits and information

We'll give you the information you reasonably need to show that this addendum is being followed, including answers to security questionnaires. If that isn't enough, or a supervisory authority requires it, you can audit our compliance once a year, with at least 30 days' written notice, during business hours, at your own cost, and under a confidentiality agreement. Audits can't access other merchants' data.

11. Transfers outside the EEA and UK

We host store personal data on a server in Germany, in the EU. We're a US company, and two of our sub-processors, Cloudflare and Resend, are in the US, so store personal data is also accessed from and sent to the US. Where data moves from the European Economic Area, the UK or Switzerland to us, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, controller to processor) apply and are incorporated by reference, with you as data exporter and us as data importer. For the clauses: option 2 of clause 9 (general authorisation) applies, with the notice in section 6. The optional clause 7 and the optional wording in clause 11 don't apply. Under clauses 17 and 18, the law and courts of Ireland apply. Annex I is sections 1 and 2 of this addendum, Annex II is section 5, and Annex III is the sub-processor page. For UK transfers, the UK International Data Transfer Addendum to those clauses applies. For Swiss transfers, references to the GDPR include the Swiss data protection act, and the Swiss Federal Data Protection and Information Commissioner is the competent authority where it applies. When store personal data goes on to our sub-processors in the US, the Standard Contractual Clauses in their data processing terms apply to that transfer.

12. CCPA terms

For personal information covered by the California Consumer Privacy Act and similar US state laws, we act as your service provider (or processor). We process it only for the business purposes in section 2. We don't sell or share it, don't keep, use or disclose it outside our direct business relationship with you or for any other purpose, and don't combine it with personal information we get from other sources, except as those laws allow. We comply with those laws and give the same level of privacy protection they require. We'll tell you if we can no longer meet them, and you can take reasonable steps to stop and fix unauthorised use.

13. General

If this addendum and the terms of service conflict on personal data, this addendum wins. If the Standard Contractual Clauses conflict with either, the clauses win. Liability under this addendum is subject to the limits in the terms of service, except where the law doesn't allow them. This addendum ends when we no longer hold store personal data.

SAAS SEO AGENCY LLC
145 W 25th St, Fl 7
New York, NY 10001, United States
Email: support@affiliatetracking.co

Related: privacy policy, terms of service, sub-processors.