Data Processing Agreement

This Data Processing Agreement (the “DPA”) under Art. 28 of Regulation (EU) 2016/679 (the “GDPR”) is concluded between the merchant who installs the Feedyio app for Shopify (the “Controller”) and Jan Thér, a sole trader registered in the Czech Republic trading as Feedyio, IČO: 01465694, DIČ: CZ9010073479, [email protected] (“Feedyio” or the “Processor”).

This DPA forms part of the Feedyio Terms & Conditions (https://feedyio.com/terms-and-conditions) (the “Terms”) and applies automatically when the Controller installs the App. No separate signature is required. On request, Feedyio provides a signed copy. If this DPA and the Terms conflict on the protection of personal data, this DPA prevails.

1. Subject, duration and instructions

1.1 Feedyio provides the Controller with the Feedyio app for Shopify (the “App”). When providing the features listed in Annex 1, Feedyio processes personal data on behalf of the Controller. The subject, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

1.2 Product feeds built from the Controller’s catalogue do not involve personal data of the Controller’s customers. Personal data is processed only when the Controller enables a feature that requires it (Annex 1).

1.3 This DPA applies for as long as the App is installed in the Controller’s store and Feedyio processes personal data on the Controller’s behalf.

1.4 Feedyio processes personal data only on documented instructions from the Controller, unless required to do so by Union or Member State law; in that case Feedyio informs the Controller before processing, unless the law prohibits this. The Controller’s instructions are this DPA, the Terms and the settings the Controller makes in the App, including which integrations and marketplaces it connects. Feedyio informs the Controller without undue delay if it believes an instruction infringes the GDPR.

1.5 The Controller is responsible for the lawfulness of the processing, including the legal basis for sending customer data to the review services and marketplaces it connects, and for how customer consent is collected at checkout.

2. Obligations of the Processor

2.1 Confidentiality. Feedyio ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2.2 Security. Feedyio implements the technical and organisational measures in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR). Feedyio may update these measures as long as the overall level of security is not reduced.

2.3 Data subject requests. Taking into account the nature of the processing, Feedyio assists the Controller by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. If a data subject contacts Feedyio directly, Feedyio forwards the request to the Controller without undue delay and does not respond itself unless instructed.

2.4 Further assistance. Feedyio assists the Controller in meeting its obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to Feedyio.

2.5 Personal data breaches. Feedyio notifies the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data. The notification includes, as far as available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided as soon as it is.

2.6 Records. Feedyio keeps a record of processing activities carried out on behalf of the Controller (Art. 30(2) GDPR).

3. Sub-processors and transfers

3.1 The Controller gives Feedyio general authorisation to engage the sub-processors listed in Annex 3. Feedyio informs the Controller by email at least 30 days before adding or replacing a sub-processor and updates Annex 3 on this page. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the use of the App.

3.2 Feedyio imposes on each sub-processor, by contract, data protection obligations that provide at least the same level of protection as this DPA. Feedyio remains liable to the Controller for the performance of its sub-processors’ obligations.

3.3 The review services, marketplaces and other channels that the Controller connects in the App receive data on the Controller’s instruction and are not sub-processors of Feedyio. Shopify is the Controller’s own platform provider and is not a sub-processor of Feedyio.

3.4 Where personal data is transferred to a country outside the European Economic Area without an adequacy decision, Feedyio ensures appropriate safeguards under Chapter V GDPR, in particular the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) or certification under the EU-U.S. Data Privacy Framework.

4. Deletion, audits, liability and final provisions

4.1 Deletion. After the App is uninstalled, Feedyio deletes the personal data processed on behalf of the Controller within 30 days, unless Union or Member State law requires its storage. Before uninstalling, the Controller can export its data from the App or from Shopify, where imported orders remain in the Controller’s store. On the Controller’s request, or on a customer data deletion request sent by Shopify, Feedyio deletes the personal data of the customer concerned within 30 days.

4.2 Information and audits. Feedyio makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR, primarily by written answers and documentation. Where this is not sufficient, the Controller may carry out an audit, itself or through an independent auditor bound by confidentiality, at most once per calendar year, with at least 30 days’ written notice, during normal business hours and without disrupting the service. Each party bears its own audit costs. Additional audits are possible after a personal data breach or at the request of a supervisory authority.

4.3 Liability. Liability is governed by Art. 82 GDPR and, to the extent permitted by law, by the limitation of liability in the Terms.

4.4 Term. This DPA ends automatically when Feedyio no longer processes personal data on behalf of the Controller. Section 4.1 continues to apply until the data is deleted.

4.5 Governing law. This DPA is governed by the laws of the Czech Republic, without prejudice to the GDPR. The courts of the Czech Republic have jurisdiction, unless mandatory law provides otherwise.

4.6 Changes. Feedyio may update this DPA, for example when sub-processors change (section 3.1). Feedyio informs the Controller by email about material changes at least 30 days in advance. The date at the top of this page shows the current version. If a provision is invalid, the remaining provisions stay in force.

Annex 1: Description of the processing

Data subjects: customers of the Controller’s Shopify store and buyers who order from the Controller on connected marketplaces.

Special categories of data: not intended. Product names in orders may, depending on the Controller’s assortment, allow conclusions about a customer’s health. The Controller decides whether to enable features that send order items to third parties.

Frequency: continuous while a feature is enabled.

Retention: as long as the App is installed, then deleted under section 4.1.

Annex 2: Technical and organisational measures

Annex 3: Sub-processors

Product data sent to the AI provider for category suggestions contains no personal data, so that provider is not listed.

Write to us and we’ll send you this DPA signed.