Data processing addendum

Scope

This addendum is part of the OrderSmith Terms of service between BoredApp Inc. (“BoredApp”) and the merchant that uses OrderSmith (“you”). It applies when BoredApp processes personal data for you while providing OrderSmith, mainly the data of your shoppers. It meets the requirements of Article 28 of the GDPR and the UK GDPR, the Swiss FADP, the CCPA and similar US state laws, and PIPEDA. You accept it by accepting the Terms of service. No separate signature is needed.

Definitions

“Personal data”, “controller”, “processor”, “processing”, “data subject” and “supervisory authority” have the meanings given in the GDPR. “Data protection laws” means all privacy and data protection laws that apply to the processing. “Customer personal data” means the personal data described in Annex 1 that BoredApp processes for you.

Processing on your instructions

You are the controller of customer personal data, and BoredApp is your processor. BoredApp processes it only on your documented instructions. These are the Terms of service, this addendum, and the way you set up and use OrderSmith. The only exception is where the law requires otherwise; in that case we tell you first, unless the law forbids that. If we believe an instruction breaks data protection laws, we will tell you.

You are responsible for having a lawful basis for the processing, for your privacy notice to shoppers, and for not configuring OrderSmith to collect special categories of data.

Our obligations

• Confidentiality. Only personnel who need access have it, and they are bound by confidentiality.
• Security. We keep in place the technical and organisational measures in Annex 2.
• Data subject requests. OrderSmith handles Shopify’s customer data request and erasure requests automatically (see Annex 1). For anything else, we help you answer requests to exercise rights. If a shopper writes to us directly, we pass the request to you.
• Personal data breaches. We notify you without undue delay after becoming aware of a breach that affects customer personal data. We give you the information we have, so you can meet your own obligations to notify.
• Assistance. We give you reasonable help with data protection impact assessments and consultations with supervisory authorities about OrderSmith.
• Audits. We make available the information needed to show we comply with this addendum. You may audit once a year, at your cost, with 30 days’ notice, during business hours, and under confidentiality. We may meet the audit by giving you written answers and documentation first.

Sub-processors

You authorise BoredApp to use the sub-processors listed in Annex 3. Each is bound by written terms that protect customer personal data at least as well as this addendum, and we are responsible for their work. Before adding or replacing a sub-processor, we update Annex 3 and tell you at least 30 days in advance. If you object on reasonable data protection grounds, we will try to find a solution. If we can’t, you may stop using OrderSmith by uninstalling it.

International transfers

BoredApp Inc. is in Canada. The European Commission, the United Kingdom and Switzerland recognise Canada as giving adequate protection for organisations covered by PIPEDA. Customer personal data is stored with Google in the United States. Google LLC takes part in the EU–US Data Privacy Framework and its UK and Swiss extensions, and its data processing terms include the Standard Contractual Clauses.

If a transfer from you to BoredApp is not covered by an adequacy decision, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply and are incorporated by reference. They apply as Module Two (controller to processor), with these choices:

• Clause 7 does not apply.
• Clause 9: Option 2, with 30 days’ notice.
• The optional wording in Clause 11 does not apply.
• Clauses 17 and 18: the law and courts of Ireland.
• Annexes I to III are completed by Annexes 1 to 3 below.

For the UK, the ICO’s International Data Transfer Addendum applies on top of them. For Switzerland, references to the GDPR mean the FADP, and the competent authority is the FDPIC.

US state privacy laws

For the CCPA and similar laws, BoredApp is your service provider or contractor. We will not:

• sell or share customer personal data;
• keep, use or disclose it outside our direct business relationship with you, or for any purpose other than providing OrderSmith;
• combine it with personal data from other sources, except as those laws allow.

We comply with those laws and give the same level of protection they require. We will tell you if we can no longer meet them, and you may take reasonable steps to stop and remedy any unauthorised use.

Deletion at the end

When you uninstall OrderSmith, Shopify sends a shop erasure request 48 hours later. BoredApp then deletes all customer personal data and your other OrderSmith data, and backups expire within 30 days after that. If you want a copy, ask us before you uninstall. Data in your own Shopify store, such as orders and Shopify Files, stays there.

Liability and order of precedence

Each party’s liability under this addendum is subject to the limits in the Terms of service, to the extent data protection laws allow. If this addendum conflicts with the Terms of service, this addendum wins. If the Standard Contractual Clauses apply and conflict with it, the Clauses win.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit (TLS/HTTPS) for all traffic, and encryption at rest by Google Cloud.
• The database and file storage deny all direct client access. Only OrderSmith’s server service account reaches them, with least-privilege roles.
• Shopify access tokens and app secrets are kept server-side only, with secrets in Google Secret Manager.
• Webhooks and storefront (app proxy) requests are verified with Shopify’s HMAC signatures. Admin requests use Shopify session tokens.
• Uploaded files are stored under random, unguessable paths and links. Only file types allowed by the order form field are accepted, up to 15 MB.
• Each store’s data is kept separate, and requests are checked against the store they come from.
• Production is separate from testing. Access to it is limited to authorised BoredApp Inc. personnel.
• Point-in-time recovery and daily backups, which expire within 30 days. The service is monitored for uptime.
• Application logs record counts and errors, not shopper data.

Annex 3: Sub-processors

Shopify is not our sub-processor. It runs the platform you contracted with directly, and your store data there is under your agreement with Shopify.

Contact

BoredApp Inc.
3060 Davidson Court Unit C2, Suite 1004
Burlington, ON L7M 4X7
Canada
info@boredapp.io