Data processing agreement (Shopify merchants)

1. Parties and purpose

This agreement is entered into between, on the one hand, the brand that connects its Shopify store to its KRED account (the "Merchant"), the controller, and, on the other hand, Kred Corp, a société par actions simplifiée (French simplified joint-stock company) with a share capital of €1,000, registered with the RCS of Fort-de-France under number 107 539 876, whose registered office is at 7 rue Bethléem, Résidence Arc-en-ciel, 97233 Schœlcher (Martinique, France) ("KRED"), the processor.

In accordance with Article 28 of Regulation (EU) 2016/679 (GDPR), it sets the conditions under which KRED processes, on behalf of the Merchant, the personal data coming from its Shopify store (the "Data"). It supplements the Terms of Service and prevails over them for everything relating to the Data.

2. Description of the processing

Single purpose: linking the store's orders to the Merchant's KRED campaigns, that is attributing a sale to a creator's discount code or link (sales tracking and, if the Merchant enabled it, the creator's commission), and linking an order to a product refund claim. KRED uses the Data for no other purpose: no marketing, no profiling, no resale, and no automated decision producing legal effects on buyers.

Nature of the operations: receiving the notifications Shopify sends to KRED (paid orders, refunds, products, app uninstallation, GDPR requests); reading a single order through the Shopify API when needed; creating the creators' discount codes in the store; importing the product catalogue.

Permissions requested from Shopify: read products, read and write orders, read and write discounts. KRED does not request access to the Shopify customer record: an order only gives it the fields the order carries.

Categories of Data:

• the email address used for an order, read at Shopify only when someone claims the product refund of that order, to compare it with the one they typed. The comparison is made on hashes; the address is neither stored nor logged;
• the content of order and refund notifications: order and customer identifiers, order number, dates, amounts, currency, discount codes used, and the contact details Shopify includes in them (name, email address, phone, billing and shipping addresses);
• for orders linked to a campaign only: identifier, number, date, amounts, currency, discount codes and landing page without its parameters. None of the buyer's contact details is copied there;
• the content of the GDPR requests forwarded by Shopify (access request, erasure request): customer identifier, orders concerned and the contact details Shopify includes in them;
• the content of the uninstallation notification, which describes the store and may name its owner (name, email address, phone).

The product catalogue and the discount codes created by KRED contain no buyer personal data.

Data subjects: the customers of the Merchant's store and, for the uninstallation notification, the store owner.

3. Term

The agreement applies as soon as the Merchant connects its store and for as long as KRED holds Data, including after the app is uninstalled, until the Data is erased (article 9).

4. Instructions and confidentiality

KRED processes the Data only for the purpose in article 2 and on the Merchant's documented instructions: this agreement and the settings the Merchant chooses in KRED (sales tracking, commission, product refund). If an instruction appears to infringe the GDPR, KRED informs the Merchant immediately.

The persons authorised to process the Data at KRED are bound by confidentiality.

5. Security

• Encryption in transit: exchanges between Shopify, the browser and KRED go over HTTPS; every Shopify notification is authenticated by its signature before it is stored.
• Encryption at rest: the database is encrypted at rest by its host; the store access token is also encrypted by KRED (AES-256-GCM).
• Limited access: the database is reachable only by KRED's servers and authorised persons; in the administration console, the Shopify screens are reserved for KRED's super administrators.
• Access log: every read of a buyer's email address at Shopify and every export of an access request is logged (date, store, order, purpose, outcome; never the address itself). The log is kept 12 months. If the entry cannot be written, the read is not used.
• No email address, notification content or token is written to technical logs, alerts or error reports.

6. Sub-processors

The Merchant authorises KRED to use the following sub-processors, which may process Data solely to provide the service:

• Supabase — database hosting (EU)
• Render — hosting of the API, which receives Shopify's notifications and queries its API
• Resend — sending notification emails to KRED users (order number and amount of a product refund; never the buyer's email address)
• Sentry — technical error reports, without request content

KRED imposes equivalent data protection obligations on each of them. Any addition or replacement is published on this page in a new version of the agreement; a Merchant who objects can uninstall the app, which ends the processing (article 9). Some of these sub-processors may process Data outside the European Union; such transfers are covered by the European Commission's standard contractual clauses or an adequacy decision.

7. Data subject rights

It is for the Merchant to inform its customers and answer their requests. KRED assists through the GDPR requests Shopify forwards to it:

• erasure request from a customer: KRED erases their contact details from every notification it keeps for the store and keeps only identifiers, dates, amounts and discount codes;
• access request from a customer: KRED extracts what it holds about that customer and sends it to the Merchant;

in both cases within 30 days of receiving the request. A person who contacts KRED directly is referred to the Merchant, and the Merchant is informed.

8. Personal data breach

KRED notifies the Merchant of any personal data breach affecting the Data within 48 hours at most of becoming aware of it, by email to the users of its KRED account. The notification describes, as far as they are known, the nature of the breach, the categories and approximate number of persons and records concerned, its likely consequences and the measures taken or proposed; missing information is sent as soon as it is known. KRED helps the Merchant notify the supervisory authority and, where applicable, the data subjects.

9. Retention and return or deletion of the Data

• Email address read at a claim: not kept.
• Contact details in an order or refund notification: erased as soon as the notification is processed, normally right after it is received. A notification whose processing fails is cut down to identifiers 30 days after it is received.
• Processed notifications: deleted 90 days after they are received. An access request is kept until its answer has been prepared.
• Access log: 12 months; it contains no contact details.
• Orders linked to a campaign: until the store is erased; those carrying a creator commission, cut down to the commission ledger described below, ten years after the close of the financial year of their last write.

When the app is uninstalled, KRED erases the store access token. Shopify then sends KRED, 48 hours after the uninstallation, a request to erase the store: KRED then deletes its catalogue, its discount codes, the notifications received and the pending connection requests; the erasure request itself, which carries only the store's identifiers, is deleted 90 days after it is received. If no sale of the store carries a creator commission, KRED also deletes the store, its orders, its refunds and the product refund claims.

If sales of the store carry a creator commission, KRED keeps, under its accounting obligations (article L123-22 of the French Commercial Code), only the ledger of these commissions: for each of these orders, its Shopify identifier and number, its date, its currency, its amounts, its payment status, the attributed discount code, the creator and the campaign, the commission and its status, the order's refunds (identifiers, dates, amounts) and, where applicable, the product refund claim on it; for the store, its .myshopify.com address, its currency and its installation and uninstallation dates. This ledger contains no buyer contact details. The store's other orders, their refunds and claims are deleted. The ledger is deleted ten years after the close of KRED's financial year (on 30 September) in which it was last written (erasure of the store, settlement or cancellation of a commission), and never while a commission is still awaiting settlement.

Also kept: the access log, until the end of its 12 months, as proof of lawful access, without any contact details; the acceptance of this agreement (brand, user, version, store address, date), with the brand's account. Earnings credited to creators stay in their history.

10. Assistance, documentation and audits

On request, KRED provides the Merchant with the information needed to demonstrate compliance with this agreement and to carry out a data protection impact assessment. The Merchant may have an audit carried out once a year, on written request sent at least 30 days in advance, at its own cost and under a confidentiality undertaking.

11. Merchant obligations

The Merchant warrants that it has a legal basis for the processing entrusted to KRED, informs its customers of this processing (in particular in its privacy policy) and documents any additional instruction in writing.

12. Acceptance, versions and governing law

The Merchant accepts this agreement by ticking the box provided for that purpose before its store is linked to its KRED account: KRED records the user who accepted it, the brand, the version and the date. When the installation starts from the Shopify App Store, Shopify authorizes the app first: KRED then keeps the store access token, encrypted, without using it, for 24 hours at most while awaiting this acceptance, and receives no order notification before the link. Any new version is published on this page with its number and date and offered for acceptance at the next connection of a store; the accepted version keeps applying until then. This agreement is governed by French law.

Contact: contact@trykred.com