Data Processing Agreement

The processoris Socommerce LTD, a company registered in the United Kingdom under company number 17378950, with its registered office at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom (“socommerce”, “we”, “us”).

The controlleris the brand that accepts this DPA (“the Brand”, “you”). The Brand decides why its shoppers’ data is processed — to have the creators whose videos sold its products found and paid — and we process it for that purpose only.

Acceptance.A member of the Brand accepts this DPA on the Brand’s Integration tab in the Service, before its shop — on Shopify or on WooCommerce — can be connected. We record which version was accepted, by whom and when. The person accepting confirms they may bind the Brand.

This DPA covers the personal data of the Brand’s shoppers that reaches us once the Brand connects its shop — through our Shopify app, or through the key a WooCommerce shop grants us and the plugin of ours it may install (“Shopper Data”). It does not cover data we hold as a controller ourselves, such as the Brand’s own account, its members, or the creators on the Service, which our Privacy Policy describes.

What we do with Shopper Data, and only this

• Match each order to the creator whose link referred it, and record how it was matched or that it was not.
• Show the Brand its creators' sales, and each creator the number, product, value and date of the sales they earned — never anything about the shopper.
• Calculate commission, reverse it when an order is refunded, and charge the Brand and pay the creator for it.

We do not sell Shopper Data, use it to market to anyone, build profiles of shoppers, or use it to train any model.

Duration

For as long as the Brand’s shop is connected, and afterwards for as long as Section 9 allows us to keep what we already hold.

Data subjects

The people who buy from the Brand’s shop, on Shopify or on WooCommerce.

Categories of personal data — a Shopify shop

• Orders, as Shopify sends them: the products bought and their prices, discounts, taxes and shipping lines, the order’s currency, status and dates, the page the shopper landed on and the site that referred them, the attributes of their cart, the checkout’s identifier, and technical details such as the browser and language the order was placed from.
• Refunds against those orders, with the lines refunded.
• Checkout pixel reports: the shop’s Shopify address, the checkout’s identifier and the tracking code on the page the shopper came from, and when it arrived.

Categories of personal data — a WooCommerce shop

• Orders, as we read them from the shop: the order’s number, status, currency and dates, its totals, discounts, shipping total and tax, the products bought and their prices (each line less the meta data a line may carry), its coupon codes, a summary of each refund, how it was created, and five entries of its meta data only — the tracking code our plugin wrote, the landing page, referring site and source type WooCommerce’s own Order Attribution feature recorded, and our reference on a sample order.
• Refundsagainst those orders: when each was made, how much, and the lines refunded — not the reason typed by the shop’s staff.

What we do not take.Our Shopify app does not ask Shopify for a shopper’s name, email address, phone number or postal address. Where Shopify includes them in an order anyway, our service removes them, with the shopper’s IP address, before the order is stored.

A WooCommerce shop’s notifications carry the whole order, including the shopper’s name, email address, phone number, postal address, IP address and browser, and no setting of the shop’s omits them. Our service checks each notification’s signature, takes the order’s id from it and discards the rest unread. It then reads the order from the shop asking for the fields listed above and no others, so the shop does not send the shopper’s details, and removes them before storing if it does. With our plugin installed, the shop’s notification carries the order’s id only, so nothing about the shopper leaves the shop in it at all. No special category data is processed.

• We process Shopper Data only on the Brand's documented instructions, which are this DPA and the Brand's use of the Service, unless the law we are subject to requires otherwise; if so, we tell the Brand first unless that law forbids it.
• We tell the Brand promptly if, in our opinion, an instruction infringes data protection law.
• Everyone we authorise to process Shopper Data is bound by confidentiality.
• We help the Brand meet its obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to us.

We keep Shopper Data secure with technical and organisational measures appropriate to the risk, including:

• Encryption in transit: Shopify's and WooCommerce's notifications, our reads of a WooCommerce shop, the pixel's reports and every page of the Service travel over TLS; a WooCommerce shop is connected only over HTTPS.
• Encryption at rest: Shopper Data is stored in our database on Supabase, encrypted at rest (AES-256).
• Sealed credentials: the access token Shopify issues for the Brand's shop, and the REST API key a WooCommerce shop issues us, are encrypted (AES-256-GCM) before they are stored, with a key held only by our shop service and never in the database.
• Verified deliveries: every notification from Shopify or WooCommerce is checked against its signature before anything in it is believed.
• Access control: row-level security in the database limits every member of the Service to their own brands' data; the credentials that bypass it are held by our servers only, and access to production systems is limited to authorised personnel on the principle of least privilege.
• Minimal logs: our shop service records only which shop a delivery came from and whether it was accepted, not what it contained.

The Brand gives us general authorisation to use sub-processors. These are the ones that process Shopper Data today:

• Supabase(Frankfurt, Germany — AWS eu-central-1): our database, where Shopper Data is stored.
• Modal(United States): runs our shop service, which receives Shopify’s and WooCommerce’s notifications and the pixel’s reports, reads orders from WooCommerce shops, and writes them to the database. It does not store their contents.
• Vercel (Frankfurt, Germany): runs the Service, which reads stored orders to show the Brand and its creators their sales.

We impose on each sub-processor data protection obligations no less protective than this DPA, and remain responsible to the Brand for their performance. We tell the Brand at least thirty (30) days before adding or replacing a sub-processor of Shopper Data. The Brand may object on reasonable data protection grounds; if we cannot resolve the objection, the Brand may disconnect its shop and end its use of the Service, and Section 9 applies.

Shopper Data is stored in the European Economic Area. Our shop service runs on Modal in the United States, so Shopper Data may be processed there on its way to our database. Vercel runs the Service in its Frankfurt region, but is itself a United States company. For any transfer outside the UK and EEA we rely on the European Commission’s Standard Contractual Clauses and, for data from the United Kingdom, the UK Addendum to them, or on an adequacy decision where one applies.

A shopper who asks to see, correct or delete their data should be answered by the Brand, which is the controller. We help:

On Shopify

• When the Brand, through Shopify, asks us to delete a shopper's data, we treat that shopper's orders as if their 180 days had passed (Section 9): we delete them, or cut them down where they earned commission.
• When the Brand, through Shopify, asks for a shopper's data, there is nothing to send: we hold no shopper's name, contact details or address, so we cannot find their orders from who they are.

On WooCommerce

WooCommerce sends us no notice of a shopper’s request. The Brand answers it in WordPress, and we help as follows:

• The Brand turns on WooCommerce’s setting Remove personal data from orders on request (WooCommerce → Settings → Accounts & Privacy). An erasure the Brand carries out then anonymises the shopper’s orders in the shop, and each reaches us as an order update — from which we never read the shopper in any case.
• To have those orders deleted or cut down here as well, the Brand tells us their order numbers at info@socommerce.io, and we treat them as if their 180 days had passed (Section 9).
• When a shopper asks for their data, there is nothing we can add: we hold no shopper's name, contact details or address, so we cannot find their orders from who they are.

Any other request, on either platform, goes to info@socommerce.io, and we respond within one month.

If a shopper contacts us directly, we refer them to the Brand.

We delete Shopper Data automatically, once a day, when its period has passed:

• Shopify's notifications themselves (which shop, which event, when) — 30 days after they arrive. A WooCommerce shop's notifications are not kept at all: we record only when the shop last reached us.
• The checkout pixel's reports (Shopify only) — 60 days after they arrive.
• Orders and their refunds are kept whole for 180 days after the order was placed. Then an order that earned no commission is deleted, with its refunds. An order that did earn commission is cut down to what that commission and our invoices need — the products, prices, discounts, taxes, totals and dates — and everything about the visit is deleted. On Shopify that is the landing page, referring site, the tracking codes read from them, cart attributes, checkout identifier, browser details, notes, shipping lines and a refund's payment details. On WooCommerce it is the order's meta data — the tracking code and what Order Attribution recorded — the reason typed on a refund, and whatever a line carries beyond its product, quantity and price.

At the end of the relationship, on Shopify.When the Brand removes our app from its shop, no new Shopper Data reaches us. Shopify asks us 48 hours later to erase the shop’s data, and we then delete all of it, and the shop’s access token, at once.

On WooCommercethere is no such notice. When the Brand leaves, it revokes the REST API key it issued us (WooCommerce → Settings → Advanced → REST API) and deletes our three webhooks (Settings → Advanced → Webhooks) — the Brand undertakes to do both — and tells us at info@socommerce.io. We then erase the shop’s data the same way, and the key we held with it. Our scheduled check of the shop notices a revoked key within six hours and stops reading in any case.

The Brand can ask us to erase its shop’s data at any time, on either platform, at info@socommerce.io.

The one exceptionis the cut-down orders that earned commission. They contain no shopper’s name, contact details, address or IP address, and they are the accounting records behind the Brand’s invoices and the creators’ statements, which UK law requires us to keep. We keep them as accounting records only.

We notify the Brand without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Shopper Data. We tell the Brand what we know of its nature, the categories and approximate number of shoppers and records concerned, its likely consequences, and what we have done and propose to do about it, and we send further information as we learn it. We notify the email address of the Brand’s account.

We make available to the Brand the information necessary to demonstrate compliance with this DPA and Article 28 GDPR. Where that information is not enough, we allow audits by the Brand or an auditor it mandates who is bound by confidentiality, on at least thirty (30) days’ written notice, no more than once a year unless a supervisory authority requires it or a breach has occurred, during business hours, and at the Brand’s cost.

This DPA lasts for as long as we process Shopper Data for the Brand.

If we change this DPA, we publish a new version here and ask the Brand to accept it on its Integration tab. The Brand cannot connect or reconnect its shop until it has accepted the current version.

Where this DPA and any other terms between us conflict on the processing of Shopper Data, this DPA prevails. This DPA and any dispute arising from it are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.