The short version
- This addendum is part of our Terms automatically. There’s nothing to sign.
- We only use your shoppers’ data to run CartUno for your store, on your instructions.
- We keep it secure, tell you about breaches and help with shopper requests.
- We delete it after you uninstall CartUno.
- The limits on liability in our Terms apply to this addendum too.
How this addendum works
Some privacy laws, such as the GDPR in the EU, the UK GDPR and India’s DPDP Act, require a written agreement when a business (you) uses a service (CartUno) to handle personal data for it. This addendum is that agreement.
- It forms part of the CartUno Terms of Service between you and Dcoded Innovations LLP (“Dcoded”), and applies for as long as CartUno is installed on your store and we hold data for you.
- For shopper data, you’re the controller and Dcoded is your processor. Words like “personal data”, “processing” and “data subject” mean what the GDPR says they mean.
- If this addendum and the Terms disagree about personal data, this addendum wins, except that the Terms’ limits on liability always apply.
What we process for you
| Purpose | Running CartUno on your store: showing your cart, applying your offers, running your A/B tests and showing your reports. |
|---|---|
| Duration | While CartUno is installed, then until deletion as described under “Deleting data”. |
| People involved | Shoppers who visit your store, and your staff or agency partners who use CartUno. |
| Types of data | A random visitor ID stored in the shopper’s browser; experiment events (visits, add to carts, checkouts, orders, cart features seen or unlocked); cart contents and choices such as free gift picks, delivery dates and gift notes; order details (order ID, date, totals, currency, items, discounts used and CartUno tags); staff names and email addresses. |
| Sensitive data | None. Please don’t use CartUno text fields, such as gift notes, to collect sensitive data like health information. |
Your instructions
We only process shopper data on your instructions. Your instructions are these terms and the settings you choose in CartUno. If we think an instruction breaks a privacy law, we’ll tell you, and we don’t have to follow it.
If the law requires us to process data in some other way, we’ll tell you first, unless the law forbids it.
Our team
Everyone at Dcoded who can access shopper data is bound to keep it confidential, and only accesses it when their work needs it.
Security
We use appropriate technical and organisational measures to protect shopper data, including:
- Encryption in transit (HTTPS).
- Asking Shopify only for the access CartUno needs.
- Access limited to team members who need it.
- Not keeping shoppers’ names, email addresses, phone numbers or postal addresses from orders.
Service providers we use
You allow us to use service providers (sub-processors) to help run CartUno. They’re listed in our Privacy Policy. Each one is bound by data protection terms at least as protective as this addendum, and we stay responsible for them.
We’ll update the list at least 15 days before a new provider starts handling shopper data. If you object for a genuine data protection reason, email us and we’ll try to resolve it. If we can’t, you can stop using CartUno by uninstalling it.
Helping you meet your duties
- Shopper requests. When a shopper asks you to see or delete their data, Shopify passes the request to CartUno and we act on it. If a shopper contacts us directly, we’ll pass the request to you.
- Assessments and authorities. We’ll give you reasonable information to help with data protection impact assessments or questions from a data protection authority.
Security breaches
If we become aware of a breach affecting shopper data we process for you, we’ll tell you without undue delay. We’ll share what we know about what happened, the data affected and what we’re doing about it, and keep you updated.
Telling you about a breach doesn’t mean we accept fault for it.
Deleting data
Shopify tells us 48 hours after you uninstall CartUno. We delete the shopper data we process for you within 30 days of that, unless the law requires us to keep it. Backups are overwritten within 30 days.
Showing that we comply
On request, once a year, we’ll answer a reasonable written questionnaire about how we protect shopper data. If the law requires more, such as an inspection, we’ll work with you on it. You’ll give at least 30 days’ notice and cover your own costs and ours, and the inspection must protect our other customers’ data and our confidential information.
Data leaving the EU, UK or Switzerland
Dcoded is based in India. When we process personal data from the EEA, UK or Switzerland, the transfer is covered by:
- EEA: the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), included in this addendum by reference. You’re the data exporter and Dcoded is the data importer. The optional clauses 7 and 11 don’t apply, and under clause 9 you give general permission for sub-processors as described above. For clauses 17 and 18, the clauses are governed by the laws of [Ireland] and disputes go to its courts.
- UK: the UK’s International Data Transfer Addendum to those clauses.
- Switzerland: the same clauses, read as referring to Swiss law and the Swiss data protection authority where needed.
The details of these transfers are the ones in “What we process for you”, “Security” and “Service providers we use” above.
Liability
Each party’s liability under this addendum, including the clauses above, is subject to the limits in our Terms of Service, as far as the law allows.
Contact
Dcoded Innovations LLP (LLPIN ABC-7569), Office No. B-728, 7th Floor, RK Iconic, 150 Feet Ring Road, near Ayodhya Chowk, Rajkot, Gujarat 360006, India. Email support@cartuno.app for anything about this addendum.