Data processing agreement

This is an English translation for convenience. If it differs from the Ukrainian version, the Ukrainian version prevails.

This agreement is an integral part of the Storeforma Public Offer and is concluded together with it.

1. Parties and roles

1.1. The Customer is the controller of the personal data of its Store's Buyers: it determines the purpose and scope of the data.

1.2. Andrii Rodiuk (the "Provider") is the processor: it processes this data only on the Customer's instructions and to provide access to the Platform.

2. What data and why

2.1. Categories of data subjects: Buyers, Store visitors, recipients of the Customer's mailings, and the Customer's employees with access to the control panel.

2.2. Data: first and last name, phone, email, delivery address, order history, order comments and any other data the Customer decides to collect.

2.3. Purpose of processing: storing and displaying data in the Store, placing and delivering orders, and passing data to services the Customer connects (delivery services, payment systems, CRM).

3. The Customer's obligations

3.1. To have a lawful basis for processing Buyers' data, in particular to publish its own privacy policy in the Store and to obtain consent where it is required.

3.2. Not to upload to the Platform data whose processing poses a special risk (health, biometrics, criminal records, etc.) without separate agreement with the Provider.

3.3. To answer Buyers' requests about their data on its own. The Provider helps technically by providing export and deletion.

4. The Provider's obligations

4.1. To process data only on the Customer's documented instructions, which are the Store settings and requests to support, and not to use it for its own purposes, including advertising.

4.2. To ensure confidentiality: only employees and contractors who need access and have committed to confidentiality have access to the data.

4.3. To apply organisational and technical safeguards: encryption in transit, access control, backups and logging.

4.4. To notify the Customer of a breach or unauthorised access to the data within 72 hours of discovering it, and to provide the known information about its scope.

4.5. To provide, at the Customer's request, the information needed to demonstrate compliance with this agreement.

5. Sub-processors

5.1. The Customer agrees that the Provider engages sub-processors for hosting, backups and sending notifications. The current list is published in section 6 of the Privacy policy.

5.2. The Provider gives at least 7 days' notice of a replaced or added sub-processor. A Customer who objects may terminate the agreement with a refund of the unused balance of its payment.

5.3. Services the Customer connects to the Store on its own (delivery services, payment systems, marketplaces, analytics) are not the Provider's sub-processors: the Customer passes data to them in its own name.

6. Term and deletion of data

6.1. This agreement remains in force as long as the offer between the parties does.

6.2. After the offer ends, the Provider deletes Buyers' data within the period set in section 7 of the offer. Until then, the Customer may export it.

6.3. Backups are deleted in their normal rotation, but no later than 90 days.

7. Liability

7.1. The Provider's liability under this agreement is limited as set out in section 14 of the offer: any compensation is solely a refund of the unused part of the payment for the current Paid period.

7.2. The Provider is not liable for the consequences of processing carried out on the Customer's instructions or settings, for data the Customer passed to third-party services it connected, or for the Customer's lack of a lawful basis to process Buyers' data.

7.3. The Customer compensates the Provider for all losses, fines and costs arising from the Customer's breach of personal data protection law.