Data Processing Addendum

1. Roles

The merchant is the controller of personal data relating to their customers. CreditDesk is the processor of that data and processes it only on the merchant's documented instructions.

The merchant's instructions consist of these terms, the configuration the merchant chooses in the app, and any further written instruction the merchant gives us. We will tell the merchant if, in our opinion, an instruction infringes applicable data protection law.

2. Subject matter and duration

• Subject matter: provision of credit control, accounts receivable and collections functionality to the merchant.
• Duration: for as long as the app is installed, plus the deletion period described in section 8.
• Nature and purpose: reading order, company and buyer records from the merchant's store; deriving a receivables ledger; enforcing merchant-configured credit limits; and sending payment reminders and statements on the merchant's behalf.
• Categories of data subject: the merchant's business customers and the individual contacts at those customers.
• Categories of personal data: name, email address, company affiliation, and order and payment amounts, dates and status. No special categories of personal data are processed. No payment card or bank account data is processed.

3. Confidentiality

We ensure that personnel authorised to process personal data are bound by appropriate obligations of confidentiality and receive guidance on their responsibilities.

4. Security

We implement appropriate technical and organisational measures designed to protect personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing. Those measures are described in the Annex below.

5. Sub-processors

The merchant provides general authorisation for us to engage the sub-processors listed in our Privacy Policy. We impose data protection obligations on each sub-processor no less protective than those in this Addendum, and we remain responsible for their performance.

We will give notice before adding or replacing a sub-processor. A merchant who reasonably objects on data protection grounds may terminate the affected service without penalty for the remainder of the paid period.

6. Assistance to the controller

• We will assist the merchant, by appropriate technical and organisational measures and insofar as possible, in responding to requests from data subjects exercising their rights, and we act on the redaction requests Shopify forwards to us.
• We will assist the merchant in ensuring compliance with their obligations relating to security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of processing and the information available to us.

7. Personal data breaches

CreditDesk will notify the merchant without undue delay after becoming aware of a personal data breach affecting personal data processed for that merchant, and will provide available information reasonably necessary for the merchant to evaluate and satisfy its applicable notification obligations.

8. Return and deletion

On termination, and at the merchant's choice, we will delete or return the personal data we process on their behalf. Data for an uninstalled store is deleted from active systems 30 days after uninstall, and on a shop redaction request. Residual copies may persist in encrypted backups until those backups age out on their ordinary retention cycle, after which they are overwritten. Merchants who require a copy of their data should export it before uninstalling.

9. Audits

We will make available to the merchant the information reasonably necessary to demonstrate compliance with this Addendum, and will allow for and contribute to audits conducted by the merchant or an auditor they mandate. Audits are on reasonable notice, no more than once in any twelve month period unless required by a supervisory authority, during business hours, subject to confidentiality, and conducted so as not to disrupt our operations or the security of other merchants' data.

10. International transfers

Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we do so under the European Commission's Standard Contractual Clauses (Module Two, controller to processor), together with the UK International Data Transfer Addendum where the UK GDPR applies. Those clauses are incorporated into this Addendum by reference and prevail over it in the event of conflict.

Annex — technical and organisational measures

The measures below are designed to achieve the outcomes described. They are not a guarantee that failure is impossible, and they may change as the service develops, provided the overall level of protection is not reduced.

• Encryption of personal data in transit and at rest, including database storage, cache, object storage and backups. Credentials granting access to a merchant's store are additionally encrypted at the application layer with a rotatable key.
• Logical separation of each merchant's data, enforced in application code and covered by automated tests.
• Signature verification of inbound webhooks before processing.
• Access control limiting production access to personnel who require it, with logging of actions that change data.
• Separation of test and production environments, with distinct databases, caches and credentials.
• Encrypted backups with point-in-time recovery over a defined retention window.
• Automated enforcement of retention limits, including deletion following uninstall and on redaction request.
• Monitoring and alerting on application errors and on the integrity of the receivables ledger, feeding an internal incident response process.

Contact

Questions about this Addendum, a data subject request, or a sub-processor change go to support@getcreditdesk.com. Anything touching the security of personal data goes to security@getcreditdesk.com, which reaches us directly.