Data processing agreement

This agreement applies between the merchant who installs SPJ Direct Sellers (the "Controller") and SPJ Création, publisher of the app (the "Processor"), for the personal data processed through the app. It is accepted when the app is installed.

1. Subject and duration

The Processor processes personal data of the Controller's sellers, candidates and customers solely to provide the app's features (applications, seller files, commissions, payouts, emails), for as long as the app is installed.

2. Instructions

The Processor only acts on the documented instructions of the Controller, expressed through the app's settings and actions. It never uses the data for its own purposes.

3. Confidentiality and security

• Access to production data is limited to the Processor's maintainer, for support and incident handling only.
• Data is encrypted in transit (HTTPS). Documents are stored in the database and only served to authenticated store administrators.
• Each store's data is strictly isolated (multi-tenant scoping on every query).
• See our security page for details.

4. Sub-processors

Shopify, Railway (hosting, database) and Resend (emails). The Controller will be informed of any change.

5. Data subject rights

The app lets the Controller view, correct and delete seller and candidate data at any time. Shopify privacy webhooks (customers/data_request, customers/redact, shop/redact) are handled automatically.

6. Breach notification

The Processor notifies the Controller without undue delay, and within 72 hours at most, of any personal data breach.

7. End of processing

After uninstall, all of the Controller's data is deleted upon receipt of the shop/redact webhook.

Contact

nordship76@gmail.com