Data Processing Addendum

This Data Processing Addendum ("Addendum") is between the person or business that owns the Shopify store where the NullGlitch Back in Stock app is installed ("you", the merchant) and NullGlitch - Bakhtiyar Duganov, a sole trader based in Hobsonville, Auckland, New Zealand ("we", "NullGlitch").

Roles. The people who ask for a back-in-stock alert on your store ("shoppers") are your shoppers. You decide that the form exists and what it says, so for their personal data you are the controller. We process it on your behalf, to run the app, so we are your processor. For your own information (your store details, contact emails, settings and billing) we decide how it is used to run the app; that is covered by the Privacy Policy, not by this Addendum.

How it applies. By installing the app you accept this Addendum, and by publishing it and running the app for you we accept it. It runs from installation until we have deleted your shoppers' data as described in section 7. It applies to every merchant, wherever you are: where the GDPR or the UK GDPR applies to you, it contains the terms that Article 28(3) of the GDPR requires; elsewhere, it is a set of commitments we make to you as a matter of contract.

If documents disagree. On how shoppers' data is handled, this Addendum prevails over the Privacy Policy. If the standard contractual clauses in section 9 apply to you and disagree with either, the clauses prevail.

• Subject matter: running the app for you: taking a shopper's request for a back-in-stock alert, checking stock, sending that shopper the one alert they asked for, recording what happened, and honouring unsubscribes.
• Nature of the processing: collecting, storing and checking the data; sending an email; recording delivery results; adding the shopper to your store's Customers by email address only, with the tag back-in-stock; letting you export it; deleting it.
• Purpose: only to send each shopper the alert they asked for, to show you who is waiting and why an alert was or was not sent, to keep the proof that the shopper asked, to protect stores and shoppers from abuse, and to honour opt-outs. Nothing else: no selling, renting, advertising, marketing lists or analytics.
• Types of personal data: the shopper's email address; a record of the request (the wording the shopper saw, the time, the language, the country the store's page reported, where the form was shown, the version of the form, and whether the optional marketing box was ticked); a record of each alert (which product, when, what happened) with a scrambled fingerprint of the address instead of the address; the scrambled fingerprint of any address that unsubscribed, bounced or complained; and, when someone opens an unsubscribe or confirmation link, a one-way code made from their IP address, used only to limit abuse and deleted within two days (our hosting provider's request log also shows the IP address). For a waiting list you import: the email address, the product, and optionally the date the person asked. No name, phone number, street address or device details. Two short-lived copies also exist, described in section 7: a restore journal and a queue of parked mail-event notices.
• Special categories of data: none. The form asks only for an email address and the app is not built to collect anything else.
• Whose data: shoppers who ask for an alert through the form on your store, and people whose addresses you import as a waiting list (you confirm in the app that these people asked to be told).
• Frequency: continuous, while the app is installed.
• How long we keep it: the periods in section 7.

We process shoppers' data only on your documented instructions, including on transfers to another country. Your instructions are this Addendum, the settings you choose in the app, and what you ask us in writing at info@nullglitch.co.nz. If the law we are subject to requires us to process the data in another way, we will tell you before we do, unless that law forbids it. If we think an instruction breaks data protection law, we will tell you straight away. If we cannot follow an instruction, we will tell you.

Only NullGlitch's owner has access to production systems. Anyone we ever give access to will be bound by confidentiality before they get it. The security measures we take are in Annex II. We keep them appropriate to the risk and update them if the app changes in a way that affects them.

You give us general written authorisation to use the sub-processors listed in Annex III (Vercel, MongoDB Atlas, and Amazon Web Services). We use each of them under written data processing terms that put the same data protection obligations on them as this Addendum puts on us, and we remain fully responsible to you for what they do with your shoppers' data.

Changes. If we want to add or replace a sub-processor, we will tell you at least 30 days before it starts handling your shoppers' data, by email to the contact address your store gave the app and by updating Annex III on this page. During those 30 days you can object on reasonable data protection grounds by writing to us. If we cannot resolve it, you can stop using the app: uninstalling it starts the deletion in section 7.

• Shoppers' requests. Shopify sends the mandatory privacy requests (customers/data_request, customers/redact, shop/redact) and we act on them after checking that they really come from Shopify. You can download a shopper's data for your store from the app's Settings page. If a shopper writes to us directly, we tell them to contact you, tell you about it, and act on your instruction.
• Personal data breaches. If we become aware of a breach that affects your shoppers' data, we will tell you without undue delay: what happened, which data, what we have done, and what we ask you to do, so that you can meet your own duties to regulators and shoppers.
• Security, impact assessments and regulators. We will give you the information we hold that you reasonably need for your duties under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments and prior consultation).
• Support. We answer messages to support@nullglitch.co.nz within one business day, New Zealand time.

• Delete or return, at your choice. At the end of the service we delete your shoppers' data as set out below, or return it to you first. Returning means the CSV export of your waiting list, which you can run in the app at any time; do it before you uninstall, because the export is part of the app. If you need a copy after uninstalling, write to us at once and, if the data has not yet been deleted, we will send you one.
• On uninstall: we stop all sending at once and delete the login session Shopify issued for your store.
• 48 hours after an uninstall Shopify sends a shop/redact request. If your store has not reinstalled the app since, we then delete everything about your store: settings, waiting lists, alert records, unsubscribe records for your store, counters and logs, keeping only one dated line recording that the deletion happened. If your store reinstalled first, we keep its data so a returning merchant keeps their lists, and record that the deletion was skipped. You can also ask us at any time to close your account and delete everything.
• Retention while installed: a waiting request (address and request record) up to 180 days, then the address is removed and the rest deleted 30 days later; a finished request 180 days after its last event; a request waiting for the shopper to confirm, 7 days; records of alerts, 180 days after they finish; imported waiting-list rows, deleted as soon as they are processed (skipped rows up to 7 days so you can download them).
• Backups: the app backs up its database twice a day. Each backup is encrypted before it leaves the server and is deleted after 28 days, and never kept longer than 30 days, so data we have deleted is gone from every backup within 30 days.
• Restore journal: so that a restore from a backup does not undo a deletion or an opt-out made after the backup was taken, the app writes a small entry to the same private storage in Sydney that holds the backups whenever a shopper or a whole store is erased, an address unsubscribes, bounces or complains, or an unsubscribe is taken back. An entry holds a keyed one-way fingerprint of the address (never the address), the store's web address, the store's customer number for the shopper where Shopify sent one, the kind of request and the time. No email address and no other text. It is used only to apply those requests again after a restore. Each entry is deleted after 35 days.
• Parked mail-event notices: if Amazon SES reports a delivery, bounce or complaint and the app cannot accept the notice, Amazon Web Services keeps it in an encrypted queue in Sydney for up to 14 days instead of losing it. It can contain the recipient's email address. Only the app's owner reads the queue, to replay the notices into the app; each notice is deleted after 14 days.
• The one long-term record we keep after a deletion. The scrambled fingerprint of an address that unsubscribed, bounced or complained, with the reason, the date, and for an unsubscribe the store it was for. It is kept only so that address is not emailed again, it holds no readable address, it is never shown to another store, and it is never used for marketing. A store-level unsubscribe record is deleted with your store's data. The Privacy Policy explains this and how a shopper can ask for it to be removed. By accepting this Addendum you instruct us to keep it for that purpose.

On request we will give you the information you reasonably need to check that we are following this Addendum, including a description of our security measures and the current list of sub-processors, and we will answer your written questions. You, or an independent auditor you appoint who is bound by confidentiality, may audit our processes and systems that handle your shoppers' data: once a year, or after a breach or when there are signs we are not complying, with 30 days' written notice, in business hours, at your own cost unless the audit finds that we have materially broken this Addendum. For our sub-processors we will pass on what they make available to us.

NullGlitch is established in New Zealand. Shoppers' data is stored and processed in Sydney, Australia, by the sub-processors in Annex III. We do not send it anywhere else ourselves, apart from writing the customer record into your own Shopify store, which is your platform.

Europe (EEA). If the GDPR applies to you and sending shoppers' data to us is a restricted transfer under it, the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (transfer controller to processor), are part of this Addendum and apply between you as data exporter and us as data importer. We do not change them. We complete them as follows:

• Clause 7 (docking clause): not used.
• Clause 9(a) (sub-processors): Option 2, general written authorisation, with a notice period of 30 days (section 5).
• Clause 11(a): the optional independent dispute resolution wording is not used.
• Clause 13 and Annex I.C (supervisory authority): the supervisory authority that is competent for you under Clause 13, given where you are established.
• Clause 17 (governing law): Option 1, the law of Ireland. Clause 18(b) (courts): the courts of Ireland.
• Annex I is completed in Annex I below, Annex II in Annex II, and Annex III in Annex III.

United Kingdom. If the UK GDPR applies to you and sending shoppers' data to us is a restricted transfer under it, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, in force 21 March 2022, issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018, is part of this Addendum and applies to that transfer together with the clauses above. It is completed as follows: Table 1, the parties and contacts in Annex I.A; Table 2, the EU clauses above, Module Two only, with the choices listed above; Table 3, Annexes I to III of this Addendum; Table 4, neither party may end it when the Approved Addendum changes; Part 2, the Alternative Part 2 Mandatory Clauses (the template Addendum B.1.0, as revised under its Section 18).

Signing. The clauses ask the parties to sign Annex I.A. We agree that installing the app is your signature and our publication of this Addendum and running of the app is ours; the UK Addendum itself says entering into it has the same effect as signing the EU clauses.

Elsewhere. If neither the GDPR nor the UK GDPR applies to you, the rest of this Addendum still applies. If the law where you are requires other transfer terms, write to us.

As controller you are responsible for having a lawful basis for asking shoppers for their address, for telling them what happens to it (the form's wording is yours to set), and for importing only the addresses of people who asked to be told, which the app asks you to confirm before an import.

We will update this page, and its date, if the processing or the sub-processors change. If a change reduces the protection of shoppers' data, we will tell you by email at least 30 days before it takes effect. Contact: NullGlitch - Bakhtiyar Duganov (sole trader), Hobsonville, Auckland, New Zealand. info@nullglitch.co.nz.