Data processing agreement

This agreement covers the data StoreAsk reads from your WooCommerce store. For that data, you (the team that connects the store) are the controller, and J Melker Bengtsson AB, Odengatan 31C, 113 51 Stockholm, Sweden ("we") is your processor. It is part of the terms of service; where they conflict on the processing of your store's data, this agreement applies.

• Purpose: to import your store's data, calculate reports from it, answer your questions, and send the alerts and weekly emails you set up.
• Data: store settings; products, variations, categories, tags and coupons; orders and refunds (numbers, dates, statuses, items, totals, discounts, tax and shipping, billing country and region, and order attribution); customers' WooCommerce customer numbers; and, for guest orders when guest matching is on, a keyed hash of the guest's email address.
• Data subjects: your store's customers.
• Not stored: customers' names, email addresses, phone numbers, street addresses, postcodes, IP addresses and browser details.
• Duration: while the store is connected, then until deletion as described below.

We process the data only on your documented instructions: these terms, this agreement, and the choices you make in StoreAsk's settings. We'll tell you if we believe an instruction breaks data protection law. Other instructions apply only if we agree to them in writing, and we may charge for them.

You are responsible for having a lawful basis for the processing, for informing your customers, and for the lawfulness of your instructions. If you connect an AI assistant, or turn on "Show customer names in AI chats", what that assistant receives is processed under your own agreement with its provider.

Everyone we authorise to access the data is bound by confidentiality.

We take appropriate technical and organisational measures to protect the data, including: access to your store limited to what you approve; access keys stored encrypted; each team seeing only its own stores; and hosting in the EU. We may change these measures over time, as long as they remain appropriate to the risk.

You authorise us to use the subprocessors listed on the subprocessors page. Before adding or replacing one, we update that page at least 14 days before the change takes effect, and email anyone who has asked to be notified (by emailing [email protected]). In urgent cases, such as a provider shutting down or a security issue, the notice may be shorter. You may object before the change takes effect, on reasonable data protection grounds. If we can't resolve the objection, your only remedy is to cancel your plan before the change takes effect. We impose data protection obligations on our subprocessors equivalent to those in this agreement.

Some subprocessors are based in the US or the UK. Transfers rely on an adequacy decision (including the EU–US Data Privacy Framework, where the provider is certified) or on the EU Standard Contractual Clauses.

Taking into account the nature of the processing and the information available to us, we give reasonable help with requests from your customers and with your obligations on security, breach notification and impact assessments. Help beyond what StoreAsk's own features provide is at your cost.

We notify you without undue delay after becoming aware of a personal data breach affecting your store's data, with the information available at the time. A notification is not an admission of fault.

On request, we provide the information needed to show that we meet this agreement. If that isn't enough, you may audit us yourself or through an independent auditor bound by confidentiality, at most once every 12 months, with 30 days' notice, during business hours, without disrupting the service, and at your cost. This limit doesn't apply to audits required by a supervisory authority.

When you disconnect a store, delete the team or delete your account, the store's data is deleted as described in the privacy policy. The data comes from your store and stays there, so we don't return a copy. We may keep data where the law requires it.

Liability under this agreement is subject to the limitation of liability in the terms of service, to the extent the law allows. This doesn't limit either party's liability towards data subjects under the GDPR.

As in the terms of service: Swedish law, Stockholm District Court.