Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between GemBoss (“we”) and the merchant using GemBoss (“you”), including our Terms of Service. It applies when we process personal data of your shoppers on your behalf. Where this DPA and the Terms differ on data protection, this DPA wins.

1. Roles

You are the controller of your shoppers' personal data: you decide why it is collected. We are your processor: we process it only to provide GemBoss to you. Our Privacy Policy covers the data we hold as a controller, such as your account details.

2. What we process

• Whose data: shoppers and visitors of the storefronts, funnels and pages GemBoss serves for you.
• What data: random session and visitor ids; page views, clicks, scrolls, searches and purchase events; order ids, totals and line items, and Shopify's numeric customer id; and what shoppers enter in popups, quizzes and forms you build with GemBoss, such as email, phone number, first name, answers and the consent they gave.
• Why: to host your storefront and funnels, measure and attribute sales, run your tests and personalization, and collect the signups you ask for.
• For how long: while you use GemBoss, for the periods in our Privacy Policy, and until it is erased as described in section 8.

3. Your instructions

We process personal data only on your documented instructions. How you set up and use GemBoss, including the integrations you connect, is your instruction. If we believe an instruction breaks data protection law, we will tell you.

4. Confidentiality

Everyone at GemBoss who can access personal data is bound to keep it confidential, and access is limited to the people who need it to run or support the service.

5. Security

We keep the measures listed in the annex below and review them as the service changes.

6. Sub-processors

You authorize us to use the sub-processors listed in our Privacy Policy. We bind each to data protection terms no less protective than this DPA, and we remain responsible for them. We will update that list at least 30 days before a new sub-processor starts processing your shoppers' data; if you object on reasonable data protection grounds, you may stop using the affected feature or end the agreement.

7. Helping you

• Shopper requests. Shopify forwards your shoppers' access and erasure requests to us. For an access request we gather what we hold about that shopper into a file your store owner can download from the GemBoss inbox for 30 days. For an erasure request we delete the details the shopper gave; analytics events tied to their Shopify customer id, which hold no name or contact details, are deleted when they expire, within 90 days. For anything else, email us and we will help within 30 days.
• Assessments. We give you the information you reasonably need for a data protection impact assessment or a regulator's question about GemBoss.
• Personal data breaches. We tell you without undue delay, and no later than 72 hours after we become aware of a breach affecting your shoppers' data, with what we know and what we are doing about it.

8. Deletion

When you uninstall GemBoss, Shopify asks us 48 hours later to erase your store's data, and we do. Before that, you can ask us to export it. Copies in database backups are deleted when those backups expire, within 14 days. We keep only what law requires, such as billing records, and the record that the erasure happened.

9. Transfers

We store data in the United States and Singapore. Where data protection law requires a transfer safeguard, such as the European Commission's Standard Contractual Clauses, the relevant safeguard applies to the transfer and forms part of this DPA.

10. Audits

On request, we give you the information you need to check that we meet this DPA. If that is not enough, you may audit our compliance once a year, with 30 days' notice, at your own cost, in a way that protects other merchants' data and our security.

11. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service.

Annex: security measures

• Encryption in transit: HTTPS for every connection, and an encrypted private network between our services.
• Encryption of secrets: Shopify access tokens, keys for connected services and sign-in secrets are encrypted with AES-256-GCM.
• Separation: every store's data is scoped to that store, and team roles control who can see and change what.
• Access: staff access to production is limited to the people who run the service; admin accounts can use two-factor sign-in.
• Consent: storefront analytics waits for the shopper's analytics choice, and marketing integrations for their marketing or ads choice.
• Minimization: no payment details, no shoppers' postal addresses, no IP addresses stored; nothing personal is sent to Meta or Google.
• Retention: raw analytics events 90 days, session recordings 30 days, database backups 14 days.
• Records: every erasure is logged.

Contact

Email support@gemboss.ai with any question about this DPA.