Thridify for Shopify: Data Processing Addendum

Thridify is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business’s billing address.

• India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
• European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
• Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document “Thridify”, “we” and “us” mean whichever of them you deal with.

This Data Processing Addendum (“DPA”) is between Thridify (“Processor”) and the merchant that installs the Thridify 3D-AR-Configurator app on a Shopify store (“Controller”). It applies to personal data about the Controller’s store visitors and customers that the app processes for the Controller. It forms part of the agreement under which the Controller uses Thridify, and takes effect when the app is installed.

For merchants in the European Union or the United Kingdom, the Processor is Aapastech OÜ and this DPA is the contract required by Article 28 of the GDPR and of the UK GDPR.

• Purpose: showing 3D and AR product experiences on the Controller’s storefront, and reporting which views, carts, orders, refunds and returns followed a 3D or AR view.
• Data subjects: visitors to and customers of the Controller’s store.
• Data: pseudonymous session IDs; page, product and 3D interaction events; order IDs, amounts, currency and the 3D link. The app does not process names, email addresses, phone numbers or postal addresses.
• Duration: while the app is installed, plus the retention periods in our Shopify app privacy policy.

The Processor processes this data only to provide the app, as configured by the Controller in the app and in Shopify. If the Processor believes an instruction breaks data protection law, it will tell the Controller.

People with access to the data are bound by confidentiality. The Processor keeps the security measures in Annex 2 in place and may improve them over time, but will not make them weaker.

The Controller authorises the sub-processors in Annex 3. The Processor will give at least 30 days’ notice of a new sub-processor, by email or in the app. The Controller may object on reasonable data protection grounds, and may uninstall the app if the objection cannot be resolved. The Processor holds each sub-processor to data protection terms at least as protective as this DPA and remains responsible for its sub-processors.

The Processor answers Shopify’s privacy requests (customer data request, customer deletion, store deletion) automatically, and helps the Controller with any other data subject request, data protection impact assessment or regulator enquiry about the app. Write to our Privacy Officer, Shikha Gupta, at contact@aapastech.com.

The Processor will notify the Controller of a personal data breach affecting the Controller’s data without undue delay, and no later than 48 hours after becoming aware of it. The notice will describe what happened, the data and people affected as far as known, and the steps taken.

• Deletion: when the app is uninstalled, the Processor deletes the store’s data on Shopify’s store deletion request (48 hours after uninstall), except where law requires it to be kept. A one-way hash of the store domain is kept only to offer the free trial once per store.
• Return: before uninstalling, the Controller can ask us at contact@aapastech.com for a copy of its store’s data in a common format, and we will provide it within 30 days.
• Transfers: data may be processed outside the Controller’s country, by the sub-processors in Annex 3. For Controllers in the European Union or the United Kingdom, transfers to 14818032 Canada Inc. rely on the adequacy decisions for Canada, and transfers to Aapastech Private Limited in India and to sub-processors in other countries without an adequacy decision rely on the European Commission’s Standard Contractual Clauses (Module 3) with the UK International Data Transfer Addendum.
• Audits: on request, the Processor provides the information needed to show it meets this DPA. Where that is not enough, the Controller may audit once a year on 30 days’ notice, at its own cost, under confidentiality.

This section applies to both parties equally and only to the extent permitted by law.

• Cap. Each party’s total liability arising out of or in connection with this DPA is limited to the fees the merchant paid to Thridify in the 12 months before the event that gave rise to the claim, or US$100, whichever is greater (so merchants on the free plan are covered too).
• Excluded losses. Neither party is liable for indirect, incidental, special or consequential damages, including lost profits, revenue, goodwill or data, even if it was told such damages were possible.
• What this does not limit. Nothing in this DPA limits liability that cannot be limited under applicable law, including the rights of individuals to compensation under data protection law (such as Article 82 GDPR) and fines imposed by a regulator on the party that incurred them.

If this DPA and any other agreement between the parties conflict on data protection, this DPA applies.

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, and the courts of Ontario have jurisdiction, except where data protection law requires another law or forum (for example, the EU Standard Contractual Clauses, which follow the law and courts they specify).

For merchants in India, this DPA is instead governed by the laws of India, and the courts at Delhi have jurisdiction. For merchants in the European Union or the United Kingdom, it is instead governed by Estonian law, and the Harju County Court in Tallinn has jurisdiction.

See section 2.

• Encryption in transit (TLS) and at rest.
• Shopify access tokens encrypted again in the database.
• Every Shopify notification verified against its HMAC signature.
• Access limited to people who need it to run the service.
• Automatic expiry of order links (400 days; 45 days if unpaid) and of analytics events (6 months).
• Analytics stores no IP addresses: a daily-salted one-way visitor hash and approximate location only.

• Google Cloud: hosting and storage (Taiwan, Mumbai, Delhi).
• MongoDB Atlas: database.
• Cloudflare: content delivery and analytics edge (global).
• Aapastech Private Limited (India) and 14818032 Canada Inc. (Canada): when either is not the Processor, for engineering, hosting and support, under a written intra-group agreement. Aapastech Private Limited also runs YOM analytics.