Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the terms of service between you, the merchant, and Caelena Software Labs (“we”, “us”), the developer of MergeGuard for Shopify. It applies whenever MergeGuard processes personal data about your customers. It takes effect when you install MergeGuard and lasts as long as we process that data.

Questions about this DPA: dpa@mergeguard.store.

1. Roles

For your customers’ personal data, you are the controller and we are the processor. You decide why and how that data is processed. We process it only to run MergeGuard for you.

2. What we process

Whose data: your store’s customers, and the team members you add as digest recipients.

What data: customer names, email addresses, phone numbers and addresses; email and SMS marketing subscription status; order counts, dates and spend; discount use; subscription status; tags and notes; whether a profile has something that stops Shopify merging it; and, if you connect Klaviyo, Klaviyo profiles. The privacy policy explains why the app needs each item.

What we do with it: find duplicate profiles, show why they match, merge profiles when you confirm or through automatic merging you switched on for strong matches or groups that need your judgment, suggest and apply contact fixes, build audience lists, sync lists to Klaviyo when you choose, ask Klaviyo to merge the Klaviyo profiles of merged customers if you turn on Klaviyo merging, export lists you ask for, and record every change in History.

How long: while MergeGuard is installed on your store, and until the data is deleted as sections 7 and 11 describe.

3. Your instructions

We process your customers’ data only on your instructions. Your instructions are these terms and the choices you make in the app: the merges you confirm, the automatic merging settings you switch on, your merge rule, the fixes you apply, the lists you sync or export, and whether you turn on Klaviyo merging.

If we believe an instruction breaks data protection law, we tell you.

4. Confidentiality

Everyone at Caelena Software Labs who can access your customers’ data is bound to keep it confidential.

5. Security

We protect your customers’ data against loss, misuse and unauthorized access.

• Data travels between Shopify, MergeGuard and our sub-processors over encrypted connections (TLS).
• Our providers encrypt the data they store.
• Only the founders can access your customers’ data, and their accounts use multi-factor sign-in.
• Our providers keep backups of the data.

6. Sub-processors

You allow us to use the sub-processors on our sub-processor list. Each one is bound by written terms that protect your data at least as well as this DPA. We stay responsible to you for their work.

When we add or replace a sub-processor, we email your store’s contact address 30 days before the new one starts, and we update the list. To object, reply to that email. You can also uninstall MergeGuard at any time.

7. Deletion through Shopify’s privacy requests

Shopify passes privacy requests to apps, and MergeGuard acts on each:

• Customer data request. When one of your customers asks you for their data, we give you that customer’s current profile data: email, name, phone, tags, note and addresses.
• Customer redaction. When you or Shopify ask to erase one of your customers, we act at once. We delete the customer record, blank that customer’s merge snapshots, redact their contact-fix and activity records, anonymise their orders and delete any Klaviyo profile snapshots. History rows for their merges stay, with the personal details removed. If a merge involving that customer is still in progress, we ask Shopify to send the request again.
• Shop redaction. When Shopify asks us to erase your store’s data after you uninstall MergeGuard, we record the request. Your store’s data is deleted 30 days after the uninstall, as section 11 describes.

Merges and contact fixes are made in your Shopify store. Deleting our copies doesn’t change your store’s data, and merges stay permanent.

8. Helping you with requests and duties

We help you answer your customers’ requests to access, correct or delete their data, mainly through the Shopify privacy requests in section 7. Write to dpa@mergeguard.store for anything those don’t cover. We also give you the information you reasonably need for a data protection impact assessment or a regulator’s question about MergeGuard.

9. Security incidents

If we become aware of an actual or suspected compromise of your store’s data, we act at once to contain it.

Shopify’s API terms require app developers to give notice immediately, and no later than 24 hours after becoming aware of an actual or suspected compromise of merchant data. We follow that requirement.

We tell you what happened, which data was affected, and what we are doing about it, as soon as we know. Where another law requires notice, we give it to the people and within the time that law requires.

10. Transfers

Where your customers’ data leaves the EU or UK, we rely on our providers’ standard contractual clauses. The sub-processor list names each provider.

11. End of processing

When you uninstall MergeGuard, we stop processing your customers’ data, except to delete it. 30 days after the uninstall, we delete all of your store’s data: merge history, snapshots, customers, orders and sessions. We keep billing records.

12. Order of precedence

If this DPA and the terms of service disagree about personal data, this DPA applies.