Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the merchant using Popify (“Controller”) and Importify Ltd, Hagana 40/34, Givatayim, Israel 5348813, provider of the Popify service (“Processor”). It forms part of the terms under which the Controller uses Popify (the “Service”) and applies for as long as the Processor processes personal data for the Controller.

1. Scope and roles

1. Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meanings given in Regulation (EU) 2016/679 (“GDPR”).
2. “Customer Personal Data” means the personal data of the Controller’s store visitors and customers that the Processor processes to provide the Service, as described in Annex 1.
3. The Controller is the controller of Customer Personal Data and the Processor is its processor.
4. Account, billing and contact data of the Controller itself is not covered by this DPA. The Processor handles it as a controller under the Popify privacy policy.

2. Processor obligations

The Processor shall:

1. process Customer Personal Data only on the Controller’s documented instructions, including for transfers outside the EEA, unless the law requires otherwise, in which case it will inform the Controller first where the law allows. Installing and configuring the Service is the Controller’s instruction;
2. tell the Controller if it believes an instruction infringes data protection law;
3. ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
4. apply the security measures in Annex 2;
5. help the Controller, as far as reasonably possible, to respond to requests from individuals exercising their rights, and forward to the Controller any such request it receives directly;
6. help the Controller meet its obligations on security, breach notification and data protection impact assessments, taking into account the information available to the Processor;
7. not sell Customer Personal Data or use it for its own purposes.

3. Controller obligations

1. The Controller is responsible for having a lawful basis for the processing and for informing its own visitors and customers, including about the cookies and browser storage the Service uses, that details of recent orders and reviews are shown in popups on its store, and that the Service loads fonts and script libraries from third-party networks in the visitor’s browser.
2. The Controller decides what its popups display and which forms and push notifications it uses. It is responsible for that content and for any consent needed to collect contact details or to send messages.
3. The Service is not designed for special categories of personal data (GDPR Article 9), and the Controller will not use it to process them.

4. Subprocessors

1. The Controller authorises the Processor to use the subprocessors listed in Annex 3.
2. The Processor will inform the Controller by email before adding or replacing a subprocessor. The Controller may object within 14 days. If the objection cannot be resolved, the Controller may stop using the Service.
3. The Processor binds each subprocessor to data protection obligations equivalent to this DPA and remains responsible for its performance.

5. International transfers

1. The Processor is established in Israel, which the European Commission recognises as providing adequate protection (Decision 2011/61/EU).
2. Customer Personal Data is hosted in the United States by the subprocessors in Annex 3. These transfers rely on the subprocessor’s certification under the EU-US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

6. Personal data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will share the information the Controller needs to meet its own obligations.

7. Information and audits

The Processor will make available the information needed to show compliance with this DPA. The Controller, or an independent auditor bound by confidentiality, may audit that compliance once a year on 30 days’ written notice, at the Controller’s cost and without unreasonably disrupting the Processor’s business.

8. Return and deletion

After the Controller stops using the Service, the Processor will delete or return Customer Personal Data, at the Controller’s choice, within 30 days of the Controller’s written request to support@popify.app, unless the law requires it to be kept.

9. General

1. If this DPA conflicts with the terms that govern the Service, this DPA prevails on data protection matters.
2. Liability under this DPA is subject to the limits in the terms that govern the Service, except where the law does not allow liability to be limited.

This DPA applies to every merchant using Popify without the need for a signature. A copy signed by Importify Ltd is available on request from support@popify.app.

Annex 1: Details of the processing

Annex 2: Security measures

• All connections to the Service use HTTPS.
• Access to the server and the database is limited to two named administrators, over encrypted connections (SSH).
• The server and database are backed up regularly by the hosting provider.
• Payment card data is handled by the billing providers and never reaches Popify.

Annex 3: Subprocessors

Shopify, Wix and WooCommerce are the Controller’s own store platforms and are not subprocessors of Popify. The same applies to the email marketing platforms, reviews apps and image hosting accounts the Controller connects to Popify. Web push notifications are delivered through the push service of the visitor’s own browser.