Data processing addendum
This addendum forms part of the terms of service between Liam Jones, trading as ProductDocs (the "processor"), and the merchant (the "controller"). It applies whenever ProductDocs processes personal data on the controller's behalf, and is written to satisfy Article 28 of the UK GDPR and EU GDPR. It applies automatically; no signature is needed. Merchants who need a countersigned copy can email hello@productdocs.app.
1. Subject matter and duration
Processing needed to provide the ProductDocs app, for as long as the app is installed plus the retention period in the privacy policy.
2. Nature and purpose
Storing and delivering the controller's product documents; writing document information to the controller's Shopify products; reading order line items on demand to show staff which documents apply to an order; recording pseudonymous scan statistics.
3. Categories of data and data subjects
| Data subjects | Data |
|---|---|
| The controller's staff | Shopify store domain; support correspondence |
| The controller's customers | Order line items and products, read on demand and not stored; country, device family and a daily-salted hash of the IP address when a link is opened |
No special category data. No customer names, addresses, phone numbers, email addresses or payment data.
4. Processor obligations
- Process personal data only on the controller's documented instructions, which are the use of the app and these terms, unless required by law, in which case we tell the controller first where permitted.
- Ensure everyone with access is bound by confidentiality.
- Apply the security measures in section 6.
- Assist the controller with data subject requests, security, breach notification and impact assessments, to the extent the controller cannot do so through the app.
- Notify the controller of a personal data breach affecting their data without undue delay and within 72 hours of becoming aware, with the information needed for the controller's own notifications.
- Delete or return personal data at the end of the service as set out in the privacy policy, and delete sooner on request.
- Make available the information needed to demonstrate compliance, and allow audits by the controller or an auditor it mandates, on reasonable notice and no more than once a year unless required by a supervisory authority.
5. Subprocessors
The controller authorises the subprocessors listed in the privacy policy. We will give 30 days' notice by email before adding one; the controller may object on reasonable grounds, and if we cannot resolve the objection the controller may terminate the service.
6. Security measures
- TLS for all traffic; encryption at rest for the database, file storage and backups.
- Data hosted in Frankfurt, Germany.
- Every database query scoped to the owning store, enforced by database row-level security and application code.
- Uploaded files private, served only through short-lived signed links; uploads validated by type and size.
- Shopify access tokens used server-side only and deleted at uninstall.
- Secrets held in the hosting provider's encrypted configuration; production and development environments separated.
- Access to production limited to the operator, with multi-factor authentication on every provider account.
- IP addresses hashed with a daily-rotating salt before storage; raw addresses are never stored.
7. International transfers
Data is stored in the EU. Where a subprocessor processes operational data outside the UK or EU, transfers rely on the EU-US Data Privacy Framework, the UK extension to it, or standard contractual clauses with the UK addendum.
8. Liability and precedence
Liability under this addendum is subject to the limits in the terms of service. If this addendum conflicts with the terms, this addendum prevails for data protection matters.