Data Processing Agreement

1. Applicability

This DPA applies when we process personal data on your behalf as a data processor. It supplements our Terms of Service and Privacy Policy. In the event of conflict, this DPA takes precedence regarding data processing matters.

• This DPA is effective from the date you accept our Terms of Service
• It applies to all personal data processed through the OmniOps service
• The Controller determines the purposes and means of processing; the Processor acts only on documented instructions

2. Processing Scope

Nature and Purpose

We process personal data to provide the OmniOps service, including AI-powered customer support, business operations management, and connected integrations. The public Shopify App Store app uses product catalogue data and the shop's published policies, and does not request access to Shopify order or customer data. Separately connected direct or custom Shopify integrations may process additional customer, fulfilment, return, or refund data only for scopes and workflows enabled by the merchant.

Duration

Processing continues for the duration of the service agreement plus any retention period required by law or as specified in our Privacy Policy.

Types of Personal Data

• Customer chat messages and conversation history
• Business contact information (names, emails, phone numbers)
• Website visitor session data and analytics
• Integration data, including read-only Shopify product and store-policy data for the public app and additional Shopify order, customer, fulfilment, return, or refund data only for separately enabled direct or custom integrations
• Account credentials and authentication data

Categories of Data Subjects

• Your employees and team members (account users)
• Your customers and website visitors (chat participants)
• Business contacts within connected integrations

3. Processor Obligations

In accordance with GDPR Article 28, we undertake to:

• Process personal data only on your documented instructions, unless required by law
• Ensure that persons authorised to process personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational measures to ensure data security
• Assist you in fulfilling your obligation to respond to data subject requests
• Assist you in ensuring compliance with data security, breach notification, and impact assessment obligations
• Delete or return all personal data at the end of the service, at your choice
• Make available all information necessary to demonstrate compliance and allow for audits
• Immediately inform you if an instruction infringes GDPR or other data protection law

4. Sub-Processors

You provide general authorisation for us to engage the sub-processors listed below. We will notify you of any intended changes to sub-processors at least 30 days in advance, giving you the opportunity to object.

5. Security Measures

In accordance with GDPR Article 32, we implement the following technical and organisational measures:

• Encryption at Rest: Managed storage providers apply their documented at-rest protections. Omniops separately encrypts integration credentials and selected sensitive payloads using AES-256-GCM before storage
• Encryption in Transit: Public application traffic and service connections use HTTPS or TLS with the versions negotiated by the connected endpoint
• Access Controls: Role-based access control (RBAC) with principle of least privilege
• Tenant Isolation: Multi-tenant data logically separated and queried within its organisation and, where applicable, exact store scope
• Credential Encryption: All integration credentials encrypted before storage
• Audit Logging: Security-relevant application, authentication, integration, and privacy operations are logged where those controls apply
• Regular Security Reviews: Periodic vulnerability assessments and security audits

6. Data Subject Assistance

We assist you in fulfilling your obligations to respond to data subject requests under GDPR Articles 15-22:

• We provide self-service data export and deletion tools in the dashboard
• We respond to Controller requests for assistance within 10 business days
• We will not respond directly to data subjects unless instructed by you
• We maintain technical capabilities for data access, rectification, erasure, and portability

7. Breach Notification

In the event of a personal data breach, we will:

• Notify you within 48 hours of becoming aware of a breach affecting your personal data
• Provide details including: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach
• Cooperate fully with your investigation and any notification obligations to supervisory authorities or data subjects
• Document all breaches including facts, effects, and remedial actions taken

8. Audit Rights

You have the right to audit our compliance with this DPA:

• You may request an audit with reasonable advance notice (minimum 30 days)
• Audits will be conducted during normal business hours and will not unreasonably disrupt our operations
• We will provide relevant compliance documentation and reasonable cooperation while protecting other customers, confidential information, and production-system security
• Audit costs are borne by the Controller unless the audit reveals material non-compliance
• We may satisfy audit requests by providing relevant third-party certifications or audit reports

9. International Transfers

Where personal data is transferred outside the European Economic Area (EEA) or United Kingdom, we rely on the following transfer mechanisms:

• EU Standard Contractual Clauses (SCCs): used where required for a transfer and made available through the relevant provider agreement
• UK International Data Transfer Agreement (IDTA): used where required for data originating from the United Kingdom
• Adequacy Decisions: Transfers to countries recognised as providing adequate protection by the EU Commission or UK Secretary of State
• Supplementary Measures: Additional technical safeguards including encryption in transit and at rest, access controls, and contractual protections

You may request copies of the relevant transfer mechanisms by contacting us.

10. Data Deletion and Return

Upon termination of the service agreement:

• Data Export: You may export supported data in JSON format through the dashboard while your account is active. After termination and before deletion completes, you may request assistance from us
• Deletion Timeline: We will delete all personal data within 30 days of termination, unless retention is required by law
• Retention Exceptions: Data may be retained where required by applicable law, regulation, or to resolve disputes. We will inform you of any such retention and its legal basis
• Certification: Upon request, we will provide written confirmation that personal data has been deleted

11. General Provisions

• Governing Law: This DPA is governed by the laws of the United Kingdom. EU data subjects retain the right to bring claims in their local courts
• Severability: If any provision of this DPA is found unenforceable, the remaining provisions continue in full effect
• Amendments: We may update this DPA to reflect changes in law or our processing activities. Material changes will be communicated with 30 days notice
• Precedence: In the event of conflict between this DPA and the Terms of Service, this DPA prevails regarding data processing matters

Contact

For questions about this DPA or our data processing practices, contact us at [email protected].