Data Processing Addendum

Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meaning given in the data protection law that applies. Full definitions will be added in legal review.

For personal data in shopper conversations and store data that Handychat processes to provide the service, the merchant is the controller and Handychat is the processor. For merchant account data and website data, Handychat is the controller and the Privacy Policy applies.

Handychat processes personal data only on the merchant's documented instructions, which are these terms, the merchant's settings in the app, and its use of the service. Handychat will tell the merchant if it believes an instruction breaks the law.

People who process personal data for Handychat are bound by confidentiality obligations.

Handychat applies the technical and organizational measures described on the Security page and in Annex B.

The merchant gives general authorization for the subprocessors listed on the Subprocessors page. Handychat will update that page before adding or replacing a subprocessor, and will offer a way to subscribe to updates and to object. The notice period will be set in legal review.

Where personal data is transferred across borders, Handychat will use a valid transfer mechanism where the law requires one. The mechanisms will be specified in legal review.

Handychat will help the merchant respond to requests from data subjects, including Shopify's customer data request and customer redact webhooks, taking into account the nature of the processing.

Handychat will notify the merchant without undue delay after becoming aware of a personal data breach affecting the merchant's data, with the information available at that time. The exact timeframe will be set in legal review.

Handychat will make available the information reasonably needed to show compliance with this addendum and will cooperate with reasonable audit requests. The audit process will be set in legal review.

When the merchant uninstalls the app or Shopify sends a shop redact request, Handychat deletes or returns the merchant's personal data, unless the law requires it to keep some. The timing will be set in legal review.

Liability under this addendum follows the limits in the Terms of Service.

The annexes summarize the details of processing.

• Annex A, details of processing: the subject matter is providing the Handychat service. The data subjects are the merchant's shoppers and staff. The personal data includes conversation content, contact details and order references. The duration is the term of the service. Special categories of data are not intended to be processed.
• Annex B, technical and organizational measures: see the Security page.
• Annex C, subprocessor list: see the Subprocessors page.