Data Processing Addendum

This Data Processing Addendum (the “Addendum”) is part of the Terms of Service between you and Altius Web Solutions LLC (“Merkora”, “we”, “us”). Words defined in the Terms mean the same thing here: the “Services” are the Merkora platform, a “Store” is a store you run on it, “Shoppers” are the people who visit or buy from your Store, and “Shopper Data” is personal information about Shoppers that is handled through your Store.

The Addendum applies to Shopper Data that we process for you through the Services. You accept it when you accept the Terms, and it applies for as long as we process Shopper Data for you.

It does not apply to information about you and your staff as account holders, such as account and billing information. We decide how that information is used, and our Privacy Policy describes it. It also does not apply to statistics that are aggregated or de-identified as the Terms allow.

If this Addendum and the rest of the Terms disagree about how Shopper Data is handled, this Addendum controls. Otherwise the Terms control.

You decide what Shopper Data your Store collects and why. Under privacy laws you are the “controller” or “business” for it. We process Shopper Data on your behalf and are your “processor” or “service provider”.

In this Addendum, “Privacy Laws” means the US federal and state privacy laws that apply to the Shopper Data we process for you. They include the California Consumer Privacy Act as amended (the “CCPA”) and its regulations, and the comprehensive consumer privacy laws of other US states.

Each of us will follow the Privacy Laws that apply to our own role.

• Subject matter — hosting and operating your Store and its admin.
• Duration — for as long as you use the Services, and afterwards until the Shopper Data is deleted as described in Deletion and return.
• Nature of the processing — collecting, storing, organizing, displaying, transmitting and deleting Shopper Data, by automated means.
• Purpose — to provide the Services to you: showing your Store, keeping carts, taking and recording orders, running Shopper accounts, sending your Store's emails, applying your fraud rules, recording and applying Shoppers' privacy choices, counting your Store's traffic, and sending events to the Third-Party Services you connect.
• Types of Shopper Data — names and contact details; shipping addresses; order contents, amounts and status; limited payment details (card brand, last four digits, expiry date and a one-way keyed card fingerprint); Shopper account details, including hashed passwords and session records; email marketing preferences and the record of consent; saved carts; reviews; form entries; campaign and advertising click identifiers; cookie and opt-out choices; IP address, browser type and approximate location; and the notes and tags your team adds.
• Categories of people — visitors to your Store, your customers, Shopper account holders, people who write reviews and people who fill in your forms.
• Sensitive information — the Services are not designed to hold government identity numbers, health records or similar highly sensitive information, and the Terms ask you not to put them there. A purchase can itself be sensitive; see Health-related products.

You are responsible for the following. They add to your responsibilities under Shopper data and Tracking and consent in the Terms.

• Notices and legal grounds — publishing an accurate privacy policy for your Store, giving Shoppers the notices the law requires, and having a lawful reason, and consent where it is needed, for the Shopper Data you collect and for each use you make of it.
• Your instructions — making sure the instructions you give us, including the settings you choose, are lawful.
• Your tracking setup — which advertising and analytics tools you connect, how you configure the cookie banner, including whether it asks every visitor or only visitors in the EU, EEA, UK and Switzerland, and any scripts you add to your theme. The banner holds back a script you add only if you mark it to wait for consent.
• Shoppers' requests — answering requests from Shoppers to see, correct or delete their information or to opt out.
• Data you bring — having the right to give us any Shopper Data you add or import, and not putting into the Services information they were not built to hold, as the Terms describe.
• Your team — giving staff access only to the Shopper Data they need, and keeping your accounts secure.
• What leaves the Services — what you do with Shopper Data after you export it or send it to a Third-Party Service.

A “subprocessor” is a company we use to process Shopper Data for you. You give us general permission to use subprocessors on the conditions in this section.

We maintain technical and organizational measures designed to protect Shopper Data against unauthorized access, loss and misuse, taking into account the nature of the data and the Services. They include:

• encrypted (HTTPS) connections between browsers and the Services;
• database access rules that keep each Store's data separate, so one Store's team cannot read another's;
• roles and per-area permissions inside your Store, with bulk exports of customer and order details limited to owners and admins;
• Shopper passwords stored only as salted hashes, and Shopper session tokens and emailed sign-in codes stored only in hashed form;
• limits on repeated sign-in, checkout and form attempts, and a temporary lock on a Shopper account after repeated wrong passwords;
• keys and secrets kept on our servers, with the credentials you save for a Third-Party Service kept in a separate secrets store and never shown again in full;
• checkout, order status and Shopper account pages that do not run scripts from your theme.

We may change these measures as the Services develop, provided the change does not materially lower the protection of Shopper Data. You are responsible for the security of your own accounts, devices and the code you add to your Store.

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss or alteration of Shopper Data we process for you, or to unauthorized access to it or disclosure of it, we will notify you without undue delay, by email to the address on your account.

The notice will give the information we have at the time so that you can meet your own duties: what happened, the kinds of Shopper Data and roughly how many people are affected, what we are doing about it, and who to contact. We will add to it as we learn more.

We will take reasonable steps to contain and investigate the breach and to limit its effects. You are responsible for any notice the law requires you to give to Shoppers or regulators, and we will give you reasonable help with it. Telling you about a breach is not an admission of fault or liability.

Taking into account the nature of the processing, we help you respond to Shoppers who use their rights under the Privacy Laws.

• Tools in the Services — the admin shows each customer's profile and order history and lets owners and admins download the customer list, orders, reviews and form entries. Shoppers with an account can see their orders and change their own details, addresses and email marketing preference. The Services record unsubscribes, cookie choices, Global Privacy Control signals and “Do not sell or share” requests automatically, and owners and admins can see the Store's consent record.
• Help on request — where the admin has no tool for what a Shopper asks, such as deleting or correcting one person's records, write to us with the details and we will carry out your instruction, or tell you why we cannot, within a reasonable time that lets you meet your deadline.
• Requests sent to us — if a Shopper sends a request about your Store to us, we will pass it to you and will not answer it ourselves, other than to tell the Shopper that we have passed it on to the Merchant responsible.

On reasonable written request, we will give you the information you need to show that we meet our obligations under this Addendum and the Privacy Laws, and reasonable help with a data protection or risk assessment that the Privacy Laws require of you and that concerns our processing.

We will also allow and cooperate with a reasonable assessment of our processing of your Shopper Data by you or an assessor you appoint. An assessment may take place no more than once in any 12 months unless a regulator requires it or there has been a breach affecting your Shopper Data. It needs at least 30 days' written notice and an agreed scope, must not put other customers' information or the security of the Services at risk, and is carried out at your cost and under a duty of confidentiality.

While you use the Services, you can download the data the Services make available, as Export your data first in the Terms describes. If you need a copy of Shopper Data that has no download, ask us before you delete your Store and we will give you reasonable help to obtain it.

When you delete a Store, its database records, including its Shopper Data, are deleted at once, and its uploaded files are removed. This cannot be undone.

When your plan ends or your account is terminated, we may delete the Store and its Shopper Data after the notice described in After a plan ends or an account is terminated in the Terms. You may ask us to delete it sooner.

Copies can remain for a limited time in backups and logs until they are overwritten in the ordinary course, and this Addendum continues to protect them until then. We may keep Shopper Data where a law requires us to, and only for as long as it does. Shopper Data you sent to a Third-Party Service stays with that service until you delete it there.

The periods for which the Services keep particular records while your Store is open, such as sign-in codes, saved carts and consent records, are listed in How long we keep information in the Privacy Policy.

The database that holds Shopper Data is hosted in the United States, and our hosting provider delivers pages through servers in many countries. You agree that Shopper Data may be processed in the United States and wherever our subprocessors operate.

This Addendum is written for US Privacy Laws. It does not include the standard contractual clauses or other transfer terms that the laws of the European Economic Area, the United Kingdom, Switzerland or other places may require. If those laws apply to you, contact us at info@altiusapps.com before you use the Services to collect personal information from people there.

Each side's liability under this Addendum is subject to the limits and exclusions in Limitation of liability in the Terms. Nothing in this Addendum limits a Shopper's rights under the Privacy Laws or any liability that the law does not allow to be limited.

We may update this Addendum, for example when the Privacy Laws, the Services or our subprocessors change. Changes follow the process in Changes to these Terms and to the Services in the Terms, including at least 30 days' notice of a material change. Changes to the list of subprocessors follow New subprocessors above.

Questions about this Addendum, privacy requests and notices under it: info@altiusapps.com

By mail: Altius Web Solutions LLC, [Mailing address]