Data processing agreement

For end-customer data collected through a store built on ShopyX (order, confirmation, delivery): • the merchant who runs the store is the controller: they decide the purposes (sale, delivery, after-sales) and inform their customers; • ShopyX processes that data on the merchant’s behalf, as a processor, only to provide the platform, according to the instructions and settings of their workspace. ShopyX does not sell the merchant’s products and is not a party to the sale between the merchant and the buyer.

End-customer data processed on the merchant’s behalf includes name, phone, delivery address, order contents and amount, confirmation notes and delivery status. ShopyX also processes, for its own account, merchant account data (identity, access, billing, technical logs). That processing is described in the privacy policy.

ShopyX applies measures proportionate to the service: dashboard access by account and permissions, passwords stored as a hash, HTTPS for traffic with the platform, infrastructure hosting, and internal access limited to operating and supporting the service. The merchant remains responsible for the access they grant their team and for the tools they choose to connect.

To provide the service, ShopyX may use technical subprocessors: hosting, account-related email, file storage, and, when the merchant turns the feature on, a payment or messaging provider. When the merchant themselves connects a carrier, an ad pixel or a spreadsheet, the transfer of data to that tool is their responsibility and is governed by that provider’s terms.

When the workspace is closed, the merchant may ask ShopyX to return or delete the customer data they entrusted to the platform, by writing to the address at the bottom of this page. Some data may be kept for as long as legal, tax, evidence or anti-fraud duties require, as described in the privacy policy. After those periods, the data is deleted or anonymised.