Data processing agreement
This data processing agreement is part of the IntentBundle terms of service and applies automatically when you install the app. It meets Article 28 of the General Data Protection Regulation (GDPR).
This is a translation. If the Dutch and English versions differ, the Dutch version prevails.
- Controller: the merchant who installs IntentBundle ("you").
- Processor: Digiten Ai, Admiraliteitslaan 982, 5224 EX 's-Hertogenbosch, the Netherlands, Chamber of Commerce 42074801 ("we").
1. Subject and duration
1.1 We process personal data of visitors to your store solely to make the app work for you: showing a bundle, applying discounts, measuring results, managing saved bundles and leads and, if you enable it, sending data to your Klaviyo account.
1.2 This agreement runs as long as we process personal data for you.
2. Which data, about whom
| Data subjects | Data |
|---|---|
| Visitors to your store | Viewed products and viewing time (on the device), a random visitor code, language, A/B group |
| Visitors who save a bundle | Email address, products in the bundle, amounts and discount, whether and when they consented to email |
| Buyers | Order number, products and amounts of orders with a bundle (no name, address or payment details) |
We do not process special categories of personal data. Please do not send them to us, for example in a support ticket.
3. Your instructions
3.1 We process the data only on your instructions. Your settings in the app count as your instructions. Other instructions you give in writing.
3.2 We do not use the data for ourselves, do not sell it and do not combine it with data of other merchants, except anonymised and aggregated to improve the app.
3.3 If we believe an instruction breaches the law, we tell you immediately.
3.4 If the law requires us to disclose data, we tell you in advance unless that is prohibited.
4. Confidentiality
Everyone at our side with access to the data is bound by confidentiality.
5. Security
We take appropriate technical and organisational measures, including:
- encrypted connections (HTTPS/TLS) between store, app and database;
- encryption of API keys in the database;
- strict separation of each store's data in the app; every database query is limited to one store;
- admin access only with a password and a second factor, and only for those who need it;
- rate limiting to prevent abuse;
- data minimisation: viewing history stays on the visitor's device;
- fixed retention periods that are applied automatically (see article 10).
6. Sub-processors
6.1 You authorise the following sub-processors:
| Party | Purpose | Location |
|---|---|---|
| Railway Corporation | Hosting of the app and the database | United States / EU, with safeguards as below |
6.2 Shopify and Klaviyo are not our sub-processors: Shopify is the platform you use, and Klaviyo is your own service to which we send data on your instruction.
6.3 We announce a new sub-processor at least 30 days in advance. If you have a reasonable objection, we look for a solution together; if that fails, you can cancel.
6.4 We impose at least the same obligations on sub-processors as in this agreement.
7. Outside the EEA
Data is only transferred to a country outside the European Economic Area if an adequate level of protection applies, such as an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
8. Assistance with requests and obligations
8.1 If we receive a request from a data subject, we forward it to you. We help you with access and deletion; Shopify's requests to view or delete data (customers/data_request, customers/redact) are handled automatically.
8.2 We reasonably assist you with a data protection impact assessment (DPIA) or consultation with the supervisory authority, insofar as it concerns the app.
9. Data breaches
If we discover a security breach affecting your data, we notify you without undue delay, and no later than 48 hours after discovery, at your store's email address. We provide the information you need to report it to the supervisory authority and data subjects where required, and we take measures to limit the consequences.
10. Retention and deletion
- Saved bundles and leads: 24 months after the last change.
- A/B test assignment: 13 months.
- A visitor's deletion request (through Shopify): immediately.
- After you uninstall: all data of your store within 48 hours after Shopify sends the deletion request; backups at our hosting provider are overwritten within 90 days.
If you want your data first, export your leads in the app (CSV) before uninstalling.
11. Audits
You may ask us to demonstrate that we comply with this agreement. We then provide the information needed. An audit by an independent expert can take place at most once a year, with 30 days' notice, during office hours, under confidentiality and at your expense.
12. Liability
Article 10 of the terms of service applies to liability. You warrant that you have the data processed lawfully, that you inform your visitors and, where required, ask for their consent.
13. Other
This agreement is governed by Dutch law. Where it conflicts with the terms of service on personal data, this agreement prevails.