Data Processing Addendum

This Addendum applies automatically to every Merchant that uses the Service. No signature or countersignature is required: by installing the Merchanite app or continuing to use the Service, the Merchant accepts this Addendum on behalf of itself and of any affiliate whose store is connected to the same Merchanite account.

A Merchant that requires a separately executed copy, or that needs the standard contractual clauses signed as a standalone document, can request one using the contact details at the end of this page.

"Controller", "processor", "data subject", "personal data", "processing", and "personal data breach" have the meanings given to them in the GDPR. "Business", "service provider", and "sell" have the meanings given to them in the CCPA.

"Merchant Personal Data" means the personal data that Merchanite processes on the Merchant's behalf in providing the Service. It is a subset of the information described in the Privacy Policy: it does not include the personal data of the Merchant's own staff who hold Merchanite accounts, for which Merchanite is an independent controller.

"Sub-processor" means a third party engaged by Merchanite to process Merchant Personal Data on Merchanite's behalf.

"Applicable Data Protection Law" means every privacy and data protection law that applies to a party's processing of Merchant Personal Data, including the GDPR, the UK GDPR, Swiss data protection law, and United States state privacy laws.

For Merchant Personal Data, the Merchant is the controller (or, under the CCPA, the business) and Merchanite is the processor (or service provider). The Merchant decides which shoppers are offered shipping protection and which orders flow to Merchanite; Merchanite processes the resulting data only to deliver the Service.

Merchanite does not sell or share Merchant Personal Data, does not use it for cross-context behavioral advertising, does not retain, use, or disclose it for any purpose other than performing the Service, and does not combine it with personal data received from another source except as the CCPA permits a service provider to do. Merchanite does not use Merchant Personal Data to create, develop, train, fine tune, or improve any machine learning or artificial intelligence system.

Each party is separately responsible for its own compliance with Applicable Data Protection Law. The Merchant is responsible for the lawfulness of the personal data it makes available to Merchanite, including giving its shoppers the notices and, where required, collecting the consents that its own privacy obligations demand.

Subject matter. Merchanite's provision of the shipping protection service described in the Terms of Service.

Duration. For as long as the Merchant's account is open, and afterwards for the retention periods set out in the "Data retention" section of the Privacy Policy.

Nature and purpose. Receiving order information from Shopify; recording whether an order carries shipping protection; accepting, reviewing, and resolving claims; generating and settling merchant invoices; providing support; and securing, monitoring, and troubleshooting the Service.

Categories of data subject. The Merchant's shoppers who purchase shipping protection or file a claim, and the individuals a Merchant designates as account, billing, or support contacts.

Types of personal data. Name and email address; a phone number where the Merchant supplies one; order identifiers, order values, and protection status; ship-to and billing addresses, including street lines and, where present, geographic coordinates; the payment method shown on an order, limited to the card brand and its last four digits; claim type, claim narratives, claim messages, and uploaded evidence files; and technical identifiers and diagnostics such as session identifiers, error and performance diagnostics, browser and device details, and the network (IP) address a request or error report is sent from. Merchanite never receives or stores a full card number, expiry date, or security code.

Special category data. Merchanite does not request special category personal data. A shopper may nonetheless include it in a free-text claim narrative or an evidence file. Those free-text fields and files are encrypted at rest and are treated as claim content under this Addendum.

Merchanite processes Merchant Personal Data only on the Merchant's documented instructions. The Terms of Service, this Addendum, the Privacy Policy, and the Merchant's ordinary use of the Service through its configuration settings together constitute those instructions.

Merchanite will tell the Merchant if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend that part of the processing until the instruction is withdrawn or amended. Merchanite may also process Merchant Personal Data where a law it is subject to requires it; in that case Merchanite will inform the Merchant of the legal requirement before processing, unless that law prohibits the notice.

Merchanite limits access to Merchant Personal Data to the personnel who need it to deliver, support, and secure the Service. Those personnel are bound by confidentiality obligations that survive the end of their engagement, authenticate with individual accounts, and act under role-based permissions that scope every request to the records the role may reach.

Reads that open an individual claim, order, or customer record in the Merchanite staff tools are recorded in an access log that identifies who read which record and the purpose of the read.

Merchanite maintains the technical and organizational measures described below. They may be updated as the Service evolves, provided the level of protection is not reduced.

The Merchant gives Merchanite general authorization to engage the sub-processors listed below, each of which is bound by written terms that impose data protection obligations no less protective than this Addendum.

Google Analytics runs on the Merchanite marketing website only, and Calendly is used only to book onboarding calls with merchant users. Neither receives Merchant Personal Data, so neither is a sub-processor under this Addendum.

Merchanite will give the Merchant at least thirty days' notice before adding or replacing a sub-processor, by updating this page and notifying the Merchant's account contact. A Merchant that objects to a new sub-processor on reasonable data protection grounds may raise the objection within that notice period; if the parties cannot agree on a resolution, the Merchant may terminate the Service for the affected processing without penalty.

Merchanite remains liable to the Merchant for the performance of each sub-processor's obligations.

Merchanite is operated from the United States, and the sub-processors above process Merchant Personal Data in the United States and, in Shopify's case, also in Canada.

Where a transfer of Merchant Personal Data out of the European Economic Area, the United Kingdom, or Switzerland requires a transfer mechanism, the parties adopt the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this Addendum by reference. The Merchant is the data exporter and Merchanite is the data importer. The optional docking clause applies, the optional independent audit language in Clause 8.9 applies, the governing law is the law of Ireland, and the forum for disputes is the courts of Ireland. Annexes I, II, and III of those clauses are populated by the "Scope and duration of processing", "Security measures", and "Sub-processors" sections above.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies, with the United Kingdom as the relevant country and UK law and courts governing. For transfers from Switzerland, references in the clauses to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

Merchanite will tell the Merchant if it receives a legally binding request from a public authority for Merchant Personal Data, unless the law prohibits the notice, and will challenge a request that appears unlawful.

Merchanite provides the Merchant with the tools and information it needs to answer a data subject request. Order, claim, and shopper records for a Merchant's own store are visible to that Merchant in the Merchanite portal.

If a data subject contacts Merchanite directly about personal data belonging to a Merchant's store, Merchanite will not answer the substance of the request itself. It will tell the data subject to contact the Merchant, and will notify the Merchant without undue delay.

Where the Merchant asks, Merchanite will act on an access or erasure request for a named shopper of that Merchant's store. Merchanite receives the three Shopify compliance webhooks and records every one of them in the audit trail as compliance evidence. A customers/data_request opens an access request that our team fulfils by hand and returns to the Merchant, because we do not run a self-service export portal. A customers/redact erases the matched shopper's identifying details, address, claim content, and uploaded evidence files automatically. A shop/redact is recorded, the store's Shopify credentials and sign-in sessions are already deleted at uninstall, and the records that remain for that store are held for the periods stated in the Privacy Policy rather than being erased on receipt.

Taking account of the nature of the processing and the information available to it, Merchanite also assists the Merchant with data protection impact assessments, prior consultations with a supervisory authority, and the security obligations in Articles 32 to 36 of the GDPR.

Merchanite notifies the Merchant of a personal data breach affecting Merchant Personal Data without undue delay, and in any event within twenty four hours of becoming aware of it. Merchanite does not wait for a complete picture before sending that first notice.

The notice describes the nature of the breach, the categories and approximate number of data subjects and records involved so far as they are known, the likely consequences, the measures taken or proposed to address it, and a contact point for further information. Merchanite follows up as the investigation develops.

Merchanite also notifies Shopify of an actual or suspected breach or compromise of merchant data within twenty four hours, as the Shopify API Terms require. Notifying Shopify does not replace the notice to the Merchant.

Notification is not an acknowledgement of fault or liability. The Merchant remains responsible for any notification it owes to a supervisory authority or to its own shoppers.

On written request, and no more than once in any twelve month period unless Applicable Data Protection Law or a supervisory authority requires otherwise, Merchanite will make available the information reasonably necessary to demonstrate compliance with this Addendum. That normally takes the form of written responses to a security questionnaire and copies of the current security documentation.

Where written information is not enough to satisfy an audit obligation under Applicable Data Protection Law, the parties will agree in advance on the scope, timing, and duration of an on-site or remote audit. An audit must not disrupt the Service or expose another merchant's data, must be conducted under confidentiality, and is carried out at the Merchant's cost unless it uncovers a material breach of this Addendum.

At the end of the Service, Merchanite deletes the Merchant's stored access credentials and ends the sign-in sessions for that store straight away.

At the end of the Service, on the Merchant's written request, Merchanite's team prepares a copy of the Merchant Personal Data it holds, returns it to the Merchant, and then deletes or anonymizes that data, except to the extent it is required to keep a record by law. This is carried out by hand rather than through a self-service tool. The financial records described in the Privacy Policy are retained for the statutory period stated there.

Where deletion is not immediate because a statutory retention period applies, Merchanite continues to protect the retained records under this Addendum and stops processing them for any purpose other than the legal obligation that requires their retention.

Each party's liability under this Addendum is subject to the limitations and exclusions of liability in the Terms of Service.

If there is a conflict between documents, the order of precedence is: the Standard Contractual Clauses, then this Addendum, then the Privacy Policy, then the Terms of Service.

If any provision of this Addendum is found unenforceable, the rest stays in effect and the parties will replace that provision with one that reflects its intent as closely as the law permits.

Merchanite may update this Addendum to reflect a change in the Service, in the sub-processor list, or in Applicable Data Protection Law. Material changes are announced by updating the version and date shown with this Addendum and, where appropriate, by notifying the Merchant's account contact. A change that reduces the protection given to Merchant Personal Data will not be made without the Merchant's agreement.

Questions about this Addendum, requests for a separately executed copy, sub-processor objections, and privacy notices should be sent by email to the address shown below. Security incidents should be reported to the security contact published at merchanite.com/.well-known/security.txt.