Data processing agreement

When a merchant connects their store to LIORA, they entrust us with personal data for which they are the controller: that of their own customers — names, delivery addresses, orders. We process it only in order to provide the service to them, on their instructions.

Article 28 of the GDPR requires this relationship to be governed by a written contract. This document serves as that contract. The customer accepts it, together with the Terms of use and the Terms of sale, by ticking the box provided for that purpose when registering on this site, and again before payment; an account can be opened from the application only with the same acceptance. The date and the version accepted are kept. It forms an integral part of the subscription contract.

It does NOT cover the merchant’s own account data — their name, their email address, their subscription. For that data we are the controller, and it is our Privacy policy that applies.

• Subject-matter — the provision of the LIORA service: synchronisation of the catalogue, stock levels, prices, orders and customers of the customer’s Shopify store; operation of the management tools they use (purchasing, production, costs); issuing their invoices and, where they so request, sending them by email to their own customers; handling the requests relating to personal data that Shopify forwards to us.
• Duration — that of the subscription, plus the retrieval period of at least thirty days provided for by the Terms of sale.
• Nature — reading the store’s data through the Shopify API, consultation, structuring, storage, making available within the application, writing back to the store when the customer so requests, issuing invoices and sending them by email, and erasure.
• Purpose — to enable the customer to manage their business. No other.
• Data subjects — the customers of the merchant’s store, and the people the merchant authorises to use the application.
• Categories of data — identity and contact details, delivery and billing addresses, content and history of orders and invoices; and, where they exist, date of birth, notes, tags, consents to marketing communications and attached documents — all information entered by the customer, in Shopify or in LIORA.
• Sensitive data — we request none within the meaning of Article 9 of the GDPR, and the customer refrains from entering any in free-text fields and attached documents.

Shopify forwards three kinds of request to us, which we handle on the customer’s behalf:

• Access request from an end customer — we gather the data concerning them and make it available to the customer, whose responsibility it is to reply.
• Erasure request from an end customer — we erase their data from the copy of the store that we hold.
• Erasure of the store — forty-eight hours after LIORA is uninstalled, Shopify asks us to erase the store’s data: we then erase the copy of it that we held. What the customer has created themselves in LIORA — purchases, recipes, invoices — follows the rules for the end of the contract, set out below.

• Acting on instructions — we process this data solely in order to provide the service, never on our own behalf, and never to train models.
• Instructions contrary to the law — if an instruction from the customer appears to us to infringe the GDPR or another data protection rule, we inform the customer immediately.
• Confidentiality — the people with access to the data are bound by a duty of confidentiality and access it only for operational or support reasons.
• Security — encryption in transit and at rest, separation of data by business, logging of actions, hashed passwords. The detail is set out on our Security and incident response page, in the ‘Technical and organisational measures’ section.
• Sub-processors — we engage them only on the conditions described below, imposing on each of them, by contract, data protection obligations equivalent to those in this agreement, in particular sufficient guarantees as to technical and organisational measures. We remain fully liable to the customer for the performance of their obligations.
• Assistance — we help the customer respond to the requests to exercise data subject rights that they receive, and carry out their data protection impact assessments where these concern our processing.
• Alerting — we inform the customer without undue delay of any data breach affecting them, with what we know of it, so that they can meet their own seventy-two-hour deadline.
• Documentation — we make available to the customer whatever is needed to demonstrate compliance with these undertakings, and we submit to the audits they commission, on reasonable terms and without compromising the security of other customers.

The customer authorises the use of the following providers, which act on our behalf in performing the service:

• Scaleway SAS — hosting of the application and its database, in France.
• Vercel Inc. — hosting of the site and execution of the processing, in the European Union (Paris).
• Databricks, Inc. (Neon service) — hosting of the site’s database, in the European Union (Frankfurt).
• Stripe Payments Europe Ltd — collection of subscription payments. Has no access to store data; processes only account and payment data.
• Resend Inc. — delivery of the site’s emails. Receives only the recipient’s address and the content of the message.
• Google (Google Workspace) — our team’s email. Receives support requests and correspondence with the customer, which may mention data about the customer’s own customers.

The application also lets the customer send an invoice by email to one of their own customers. That message is delivered by an email provider that has not yet been named in this list; it will be added, like any new sub-processor, after the notice described below. Until then, a customer who does not want to entrust these emails to a provider not yet named sends their invoices by their own means rather than through this feature. Any change to this list is announced at least thirty days in advance by email. A customer who objects to it on data protection grounds may terminate at no cost, and the unused part of their subscription is refunded to them.

The application and its data are hosted in France, and the site in the European Union. Vercel, Databricks (Neon service), Stripe, Resend and Google nonetheless belong to groups whose parent company is established in the United States: access from that country, for operational or support purposes, cannot be ruled out, and messages received in our Google mailbox may be stored outside the European Union. These transfers are governed by the European Commission’s standard contractual clauses, supplemented by the technical measures described above.

We would rather flag this reservation than claim a watertightness we could not demonstrate.

At the end of the contract, the customer chooses whether the data is returned or erased, on the conditions set out in the ‘Switching providers’ section of the Terms of sale. Failing an express choice, it remains retrievable for at least thirty days, and is then erased from our active systems, including at our sub-processors.

Encrypted backups may keep a copy beyond that period, for the time it takes them to rotate. They are never consulted and are overwritten automatically.

For any question about this agreement, write to direction@liora-eu.com.