Data Processing Addendum

Who this addendum is for

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you, the seller, and Swifty LLC ("ShopFast"). It applies whenever ShopFast processes personal data on your behalf to provide the Service, mainly the personal data of your buyers and of visitors to your store. You are the controller of that data and ShopFast is your processor. If you process it as a processor for someone else, ShopFast is your sub-processor, and you confirm that the controller has authorised you to use ShopFast.

You accept this DPA when you accept the Terms; it needs no signature. If you need a signed copy, write to [email protected] and we countersign one.

Definitions

• Data protection law means every law on personal data that applies to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection.
• Personal data, processing, controller, processor, data subject and personal data breach have the meanings the GDPR gives them.
• Store data means the personal data ShopFast processes on your behalf under this DPA.
• Sub-processor means a provider ShopFast engages that processes store data.
• Standard Contractual Clauses means the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, and the UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.

Details of the processing

• Subject matter: providing the Service to you under the Terms.
• Duration: as long as you use the Service, and afterwards until the store data is deleted under this DPA.
• Nature of the processing: collecting, storing, organising, retrieving, using, transmitting, displaying, restricting and deleting store data, as the Service's features require: hosting your store, running checkout and Fraud Shield, delivering products and licenses, sending emails and messages, support, analytics, search, and the AI features you use.
• Purpose: to provide, secure and support the Service for you, as the Terms describe and as you configure it.
• Data subjects: your buyers and people who start a checkout; visitors to your store; people with an account at your store; your newsletter and marketing contacts; people who contact your store's support; your affiliates and resellers; and anyone else whose data you put into the Service.
• Types of personal data: contact details (name, email address, and phone number and address where you ask for them); account details; orders, payments and refunds (never full card numbers); delivery data, such as license keys, download records, hashed device IDs and license activations; online identifiers, such as IP addresses, browser details, cookie and device IDs and approximate location; Fraud Shield signals and risk scores; messages and support requests; marketing preferences; reviews; Discord and Telegram IDs and usernames; answers to your checkout fields; and any other data you add.
• Special categories of data: none are intended. You must not use the Service to collect special categories of personal data or data about criminal convictions unless you have assessed that you may and have told us in writing.
• Frequency: continuous, while you use the Service.

Instructions

• ShopFast processes store data only on your documented instructions, which are the Terms, this DPA, the way you configure and use the Service, and any further written instructions we agree, including about transfers to other countries. ShopFast may process store data otherwise only where EU or Member State law (or, for UK data, UK law) to which ShopFast is subject requires it, and then tells you first unless that law forbids it.
• ShopFast tells you at once if it believes an instruction breaks data protection law.
• You are responsible for your instructions and for having a lawful basis, the notices and any consents needed for the processing they ask for.

What ShopFast does as a controller

ShopFast acts as a separate controller, and not as your processor, when it uses some data from stores for its own purposes, as its Privacy Policy describes:

• to keep the Service secure and prevent fraud and abuse across stores, including through ShopFast's shared blocklist;
• to handle reports of illegal content and abuse, and to comply with the law and with lawful requests;
• to manage your account and bill you;
• to improve ShopFast's AI features with AI conversations, unless the store owner has turned this off (for this use ShopFast is an independent controller and relies on its legitimate interests); and
• to produce statistics about the Service that identify no person and no store.

Confidentiality

ShopFast gives access to store data only to staff and contractors who need it to provide, support or secure the Service, and only to the extent they need it. Each of them is bound by a duty of confidentiality. Every change staff make is recorded in an audit log, and looking inside a store for support is read-only, limited in time and logged.

Security

ShopFast keeps appropriate technical and organisational measures in place under Article 32 GDPR, including:

• encryption in transit (TLS) for every connection;
• payment credentials, two-factor secrets and license keys encrypted at rest, license keys with a separate key for each store;
• passwords stored only as Argon2id hashes, and two-factor sign-in available to sellers and required for ShopFast staff;
• each store's data kept apart in the database by row-level security;
• roles and permissions for your team, and an activity log of changes to your store;
• signed webhooks and rate limits;
• daily database backups kept for 14 days;
• access to production servers limited to named staff, with key-only sign-in and a separate, restricted deploy account; and an incident response process for security events.

ShopFast may update these measures as long as the level of protection does not go down. You are responsible for your own use of the Service, including your team's access, your passwords and keys, and the data you choose to collect.

Sub-processors

You give ShopFast general authorisation to engage sub-processors. These are its current sub-processors for store data:

Each sub-processor is bound by data processing terms with ShopFast, and transfers outside the EEA and the UK rely on the safeguards described under International transfers.

• ShopFast tells you at least 30 days before a new sub-processor starts processing store data, by updating this list and by email to store owners .
• You can object on reasonable grounds about data protection by writing to [email protected] before the change takes effect. We will discuss your concerns in good faith. If we cannot resolve them, you may stop using the affected feature or close your account, and we refund any fees you paid in advance for the time after closure.
• ShopFast imposes on each sub-processor data protection duties that are no less protective than those in this DPA, and remains responsible to you for how its sub-processors perform them.
• Services you choose to connect, such as your payment providers, Discord, Telegram, the analytics, advertising and chat tools you add to your storefront, apps, plugins, webhooks and the API clients you authorise, are not ShopFast's sub-processors. You instruct us to send them data, and their own terms govern what they do with it.

Requests from data subjects

• The Service gives you tools to answer requests from your buyers and visitors: you can find and export customer and order data, erase marketing contacts with their email history, and add a privacy request page to your store. For a correction or deletion these tools do not cover, ask us at [email protected] and we make it for you.
• If a data subject sends ShopFast a request about store data, ShopFast passes it to you without undue delay and does not answer it itself, except to say that it has passed it on.
• Where your tools are not enough, ShopFast helps you answer requests, as far as it reasonably can given the nature of the processing. This help is free, unless a request is manifestly unfounded or excessive.

Other assistance

Taking into account the nature of the processing and the information it has, ShopFast helps you meet your duties under Articles 32 to 36 GDPR: security, notifying breaches, data protection impact assessments, and consulting a supervisory authority.

Personal data breaches

• ShopFast notifies you without undue delay after becoming aware of a personal data breach involving store data, and in any case within 48 hours. It notifies the email address of the store owner.
• The notice describes, as far as ShopFast knows at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to deal with it and to limit its effects, and a contact for more information. Where it cannot give everything at once, it gives the rest as soon as it can.
• ShopFast takes reasonable steps to contain the breach and limit its effects, and keeps you informed.
• A notice of a breach is not an admission of fault or liability by ShopFast.

Deletion and return

• While you use the Service, you can export store data from the dashboard and erase marketing contacts there. To delete other store data, ask us at [email protected].
• When your account closes, you can ask for an export for 30 days. After that, ShopFast deletes the store data within 90 days, unless the law requires it to keep some of it, in which case it protects that data and uses it only for that purpose.
• Deleted data leaves ShopFast's backups when they expire, within 14 days.

Information and audits

• ShopFast makes available the information needed to show that it meets this DPA and Article 28 GDPR, such as this DPA, a description of its security measures and the security certifications and audit reports of its main sub-processors (for example Cloudflare's ISO 27001 certificate and SOC 2 report).
• If that information is not enough, you or an independent auditor bound by confidentiality may audit ShopFast once a year, on at least 30 days written notice, during business hours, in a way that does not disrupt the Service or reveal other customers' data, at your cost. You may audit more often after a personal data breach involving your store data or when a supervisory authority requires it.

International transfers

• ShopFast processes store data in the United States (Boston) and, through its providers, in the other places listed under Sub-processors. ShopFast itself is registered in Colorado, United States.
• Where store data covered by the GDPR is transferred to ShopFast in a country without an adequacy decision, the Standard Contractual Clauses apply and are incorporated into this DPA by reference: Module Two where you are a controller, and Module Three where you are a processor. For the clauses: the optional docking clause (Clause 7) applies; under Clause 9 option 2 applies, with the notice period in Sub-processors; the optional wording in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the Data Protection Commission of Ireland; under Clauses 17 and 18 the law and courts are those of Ireland; and Annexes I to III are filled in by Details of the processing, Security and Sub-processors. Module Two applies where you are a controller and Module Three where you are a processor; under Clause 9(a) Option 2 (general written authorisation) applies, with the notice period above.
• For store data covered by the UK GDPR, the UK Addendum applies, completed with the information in this DPA. For store data covered by Swiss law, the Standard Contractual Clauses apply with the changes Swiss law requires.
• ShopFast transfers store data to sub-processors outside the EEA, Switzerland and the UK only with appropriate safeguards, such as the Standard Contractual Clauses or an adequacy decision, including the EU-U.S. Data Privacy Framework for certified providers.

United States privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, ShopFast is your service provider (or processor) for store data. It does not sell or share store data, does not keep, use or disclose it for any purpose other than providing the Service to you or as the law allows, and does not combine it with other personal data except as the law allows.

Liability and order of precedence

• Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in the Terms of Service, except where data protection law or the Standard Contractual Clauses do not allow it.
• If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If it conflicts with the Standard Contractual Clauses, the clauses prevail.
• ShopFast may change this DPA as the Terms describe, as long as the change does not reduce the protection of store data, unless the law requires it.
• Questions about this DPA go to [email protected].