Data Processing Agreement
1. Parties
This Data Processing Agreement ("DPA") is between the merchant who installs Orkestr Recovery (the "Controller") and Ludovic Lolli, acting in an individual capacity, operator of Orkestr Recovery (the "Processor"). It forms part of the Terms of Service and applies from installation of the app. If there is a conflict between this DPA and the Terms on data protection, this DPA prevails.
2. Subject and duration
The Processor processes personal data on behalf of the Controller only to provide the app's features, for as long as the app is installed, and afterwards only until deletion as set out in section 11.
3. Nature and purpose of processing
- analyzing order frequency and purchase history;
- identifying and prioritizing inactive customers;
- drafting recovery messages, including with AI;
- creating single-use discount codes reserved for one customer;
- attributing later orders that use those codes;
- calculating recovery results for the Controller.
Priority scores only support the Controller's commercial decisions. The Processor makes no decisions with legal or similarly significant effects on data subjects and does not send communications to them.
4. Data subjects and personal data
Data subjects: customers of the Controller's Shopify store.
Personal data: Shopify customer ID, name, email address, email marketing consent status, order count and total spent, order IDs, dates, totals and discount codes, and campaign data (message text, discount code, status and dates). The app does not require special categories of personal data under Article 9 GDPR.
5. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's actions in the app, unless required otherwise by law. The Processor will inform the Controller if it believes an instruction infringes data protection law.
6. Confidentiality
Only the Processor has access to personal data, and only as needed to operate, secure and support the service. Any person later authorized to process the data will be bound by confidentiality.
7. Security measures
- encryption in transit (HTTPS) and at rest by the hosting provider;
- verification of requests and webhooks received from Shopify;
- multi-factor authentication on administrative accounts with access to infrastructure or data;
- minimization: only the customer's first name and aggregated metrics are sent to the AI provider;
- access log of operations on customer data, without customer names or emails, retained for up to 12 months and reviewed monthly;
- no personal data intentionally written to application logs;
- separate development environment using test data only;
- random discount codes that do not contain customer names;
- a documented security incident response policy.
8. Sub-processors
The Controller authorizes the following sub-processors:
- Render: application hosting and database, located in Frankfurt, Germany (EU);
- OpenAI: generation of message drafts through its API.
The Processor binds each sub-processor by a written agreement with data protection obligations equivalent to this DPA. The Processor will inform the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance, by email or in the app; the Controller may object and, if no solution is found, stop using the app.
9. International transfers
Where a sub-processor processes personal data outside the European Economic Area, the transfer relies on appropriate safeguards under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses included in that sub-processor's data processing agreement.
10. Assistance
- Data subject requests: the app supports Shopify's customer data request (customers/data_request) and deletion (customers/redact) processes. On a data request, the Processor provides the Controller with the relevant data it holds; on a deletion request, the customer's campaign data is irreversibly anonymized.
- Personal data breaches: the Processor notifies the Controller without undue delay after becoming aware of a breach affecting the Controller's data, with the information available to help the Controller meet its obligations.
- The Processor reasonably assists the Controller with data protection impact assessments and consultations with authorities, where relevant to the processing.
11. Retention, deletion and return
- Campaign personal data is kept for up to 12 months from the campaign's creation, then irreversibly anonymized. Only non-identifying data (status, dates, incentive and recovered amount) may remain, for aggregate statistics.
- When the app is uninstalled, Shopify sends a shop deletion request (shop/redact), normally 48 hours later. The Processor then deletes all data relating to the store, including campaigns, sessions, usage counters and access logs.
- Before uninstalling, the Controller can request a copy of its campaign data at orkestr.recovery@gmail.com.
12. Information and audits
The Processor makes available the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, and contributes to reasonable audits by the Controller, on reasonable notice and without access to other merchants' data.
13. Controller obligations
The Controller is responsible for the lawfulness of the original collection of the data, for having a valid legal basis for its marketing and retention activities, for respecting customers' consent and preferences, and for the content and sending of any communication.
14. Contact
Ludovic Lolli, operator of Orkestr Recovery: orkestr.recovery@gmail.com