Data processing agreement

This agreement is between you, the merchant (controller), and Money Trees AS, organisation number 938 785 813, Solveien 18, 1394 Nesbru, Norway (processor). It forms part of our terms of service and applies whenever we process personal data for you.

Subject and purpose: providing adbjørn. That means importing, storing, organising, analysing, displaying, backing up and deleting your advertising and store data, and related support and security.

Data subjects and data:

• your store’s customers (shoppers): Shopify customer and order IDs (pseudonymous identifiers), orders, refunds, products, amounts, shipping postcodes and countries, and the privacy requests Shopify forwards about them (we keep the request’s ID, type, store and dates, never an email address);
• people who appear in, or are named in, your imported ad data and creatives.

We do not intend to process special categories of personal data.

Duration: for as long as you use the service, plus the retention periods below. Our own account, billing and security processing is covered by our privacy policy.

We process personal data only on your documented instructions, including for transfers outside the EEA, which we make only as described in the annex. Your instructions are these terms, the settings you choose and your use of the service. If the law requires us to process data otherwise, we will tell you first, unless the law forbids that. We will tell you if we believe an instruction breaks the law.

Only people who need access to run the service can access your data, and they are bound by confidentiality. We never sell your data or use it for our own marketing.

You are responsible for having a legal basis for the processing and for your store’s privacy notice, cookie banner and consent.

We use the technical and organisational measures described in the security annex.

You give general authorisation for the subprocessors listed in the annex. Each is bound by a written contract with data protection obligations at least as protective as this agreement, and we remain responsible for them. We will notify you directly at least 14 days before a new subprocessor starts processing your data. If you object and we cannot resolve the objection, you may end the affected processing, or cancel, and the new subprocessor will not receive your data before that processing ends.

We help you respond to data subjects’ requests to access, correct, delete, restrict, move or object to processing of their data. If someone contacts us directly about your store’s data, we refer them to you.

When Shopify sends us a shopper’s erasure request, we anonymise that shopper’s orders within 30 days: we replace their customer and order IDs with random values and delete the shipping postcode, and keep the order amounts, so your reports do not change (the redacted orders drop out of the postcode map). We keep only a one-way coded form of the original IDs, to stop those orders being imported again.

We notify you without undue delay after becoming aware of a personal data breach affecting your data. We tell you what we know about its nature, the data and people affected, its likely consequences and what we are doing about it, and we send more details as we learn them.

We also give reasonable help with security, impact assessments and consultations with data protection authorities, taking into account the information available to us.

Contact: [email protected].

When the service ends, we keep your imported data for 90 days after the end of the period you have paid for, so you can come back or ask for a copy, and then delete it, as set out in our retention table. You can ask us to return or delete your data earlier at any time. If you disconnect a platform, or uninstall the Shopify app, we delete the data we imported from it within 30 days.

Database backups expire after no more than 28 days, and a restore does not return deleted or anonymised data to active use. We keep data after this only where the law requires it.

We make available the information reasonably needed to show that we meet this agreement. We allow and contribute to audits, including inspections, by you or an auditor you choose who is bound by confidentiality.

We will first try to answer your questions with documents. An inspection needs at least 30 days’ notice, and takes place no more than once a year unless a breach or a data protection authority requires it. You bear its cost, unless it shows we materially breached this agreement.

If this agreement conflicts with the terms of service on data protection, this agreement prevails. The liability terms in the terms of service apply to this agreement, except where the law does not allow it.

• Access control: team roles decide who can connect, disconnect and view data. Access controls restrict each customer to its authorised data. Our own production access is limited to the people who run the service.
• Authentication: every account signs in before it can reach data. Passwords are stored using one-way hashing. Optional passkeys or authenticator codes are available.
• Encryption: stored connection credentials are encrypted. Traffic between your browser and adbjørn uses HTTPS. Our hosting provider states that it encrypts stored data.
• Logging: application logs redact tokens and secrets.
• Backups and deletion: database backups expire after no more than 28 days. A restore does not return deleted or anonymised data to active use.

Subprocessors

These providers process your store and ad data for us under this agreement.

Railway Corporation (United States). Purpose: hosts the application and database, including your imported data. Location: EU region (Netherlands); Railway may access it from the United States to run and support the service. Transfer safeguard: standard contractual clauses in Railway’s data processing addendum.

Providers we use as controller

These providers process data for our own business, not your store data.

Plus Five Five, Inc. (Resend) (United States). Purpose: sends our account, security and team-invitation emails. Location: United States. Transfer safeguard: standard contractual clauses in Resend’s data processing addendum.

Add Rabbit LLC (Purelymail) (United States). Purpose: hosts our business and support email. Location: United States.

Stripe processes billing data for card payments under its own terms, partly as an independent controller.

Meta, TikTok, Snap and Shopify are the platforms you connect, not subprocessors. We exchange data with them on your instruction, and they handle it under their own terms.