Data Processing Addendum

Overview

This Data Processing Addendum ("DPA") describes how AppVitals processes personal data on your behalf and supplements our Terms of Service. It reflects the requirements of the GDPR and similar data-protection laws. If you require a signed copy for your records, contact us at [email protected].

This page is a summary of our processing terms; a countersigned DPA is available on request for business customers.

Roles of the parties

For the Shopify Partner data and any customer personal data you connect to the Service, you are the data controller and AppVitals is your data processor, processing that data only on your documented instructions (which include your configuration and use of the Service). For your own account and billing data, AppVitals acts as controller as described in the Privacy Policy.

Subject matter and duration

The subject matter is the provision of the Service. Processing lasts for the term of your use of the Service. The nature and purpose of processing is providing analytics, rank tracking and notifications. The types of data include your Shopify Partner app, subscription, transaction and event data and related merchant identifiers; the categories of data subjects are your app's merchants and end customers.

Our obligations as processor

As your processor we will: process personal data only on your instructions; ensure persons authorized to process data are bound by confidentiality; implement appropriate technical and organizational security measures; assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification and impact-assessment obligations; and, at your choice, delete or return the data at the end of the Service.

Sub-processors

You authorize us to engage the sub-processors listed below to help provide the Service. We impose data-protection obligations on each sub-processor and remain responsible for their performance. We will give notice of intended changes to sub-processors so you have the opportunity to object on reasonable data-protection grounds.

International transfers

Where processing involves transferring personal data outside the EEA, UK or your jurisdiction, we rely on appropriate safeguards such as the Standard Contractual Clauses or an equivalent approved mechanism.

Security measures

We maintain measures appropriate to the risk, including encryption in transit, hashed credentials, signed session tokens, strict per-organization isolation, access controls and least-privilege administration. A current description is available on request.

Data-subject requests and breach notification

We will promptly notify you if we receive a request from a data subject relating to data we process for you, and assist you in responding. We will notify you without undue delay after becoming aware of a personal-data breach affecting your data and provide information reasonably needed for you to meet your notification obligations.

Deletion and return

On termination of the Service, or on your request, we will delete or return the personal data we process on your behalf, unless retention is required by law. Deleting an organization in the app removes its associated connected data.

Audit

On reasonable request and subject to confidentiality, we will make available information necessary to demonstrate compliance with this DPA and support audits as required by applicable law.

Contact

To request a signed DPA or ask questions about our processing, contact [email protected].

Operator

See also