Parties
These terms govern the processing of personal data under Art. 28 GDPR between the operator of an e-shop on the Upgates platform who activates the Notify add-on (the "controller" or "you") and Apptiary s.r.o., with its registered office at Tylova 1043/15, 831 04 Bratislava, Slovakia, company ID (IČO) 57 466 408, tax ID (DIČ) 2122765986 (the "processor" or "we").
The terms form part of the Add-on terms and apply from the activation of the add-on. The data we process as a controller (the e-shop contact email, the channel settings, and the data about the installation and the subscription) is described on the Privacy page.
Subject matter, nature and purpose of the processing
The subject matter of the processing is the data from the order notifications that Upgates sends us and that the add-on needs in order to send, on your instruction, a message about an order to the channel you chose, include the order in the daily summaries and calculate the statistics in the add-on administration.
The processing includes receiving the notification, verifying its signature, selecting the necessary data, storing it briefly, sending the message to your channel, and deleting it. The processing has no other purpose. We do not use the data for our own purposes, we do not sell it and we do not share it with other add-ons.
Duration of the processing
We process data only while the add-on is activated in your e-shop. The processing ends when the add-on is deactivated, and we then delete the data as described in the section Deletion and return of data.
Type of personal data and categories of data subjects
From an order notification we process the order number, the total amount and currency, the number of items, the payment and shipping method, the status, the paid flag and the time of creation. On their own these are not personal data about the buyer, but they may become personal data if you link them to a specific person. We process the name of the buyer only if you switch on showing it in a message for the given channel. In that case we take it from the notification, insert it into the message and do not store it. We do not store the address, email, phone number or the list of items from the notification at all.
The data subjects are therefore the buyers in your e-shop. The add-on does not process special categories of personal data.
The channel settings (webhook addresses, chat identifiers, recipient email addresses, the API key of your email service) and the e-shop contact email may be personal data of your employees or contact persons. We process them as a controller under the Privacy page, so these terms do not apply to them.
Controller instructions
We process personal data only on your documented instructions. The instructions are these terms, the settings you make in the add-on administration, and any instructions you send us by email to [email protected]. This also applies to transfers of data to third countries; the section Further subprocessors lists which subprocessors process data outside the EU.
We send messages only to the services you choose and manage yourself. You are responsible for their terms and for who has access to them.
If, in our opinion, we receive an instruction that infringes the GDPR or another data protection regulation, we will inform you without undue delay.
Confidentiality
Only persons authorised by the processor who need access to operate and support the add-on have access to personal data. Each of them is bound by a duty of confidentiality that continues after their cooperation with us ends.
Security of processing (Art. 32 GDPR)
The data is stored in the EU (Hetzner Online GmbH, Helsinki data centre, Finland). All communication takes place exclusively in encrypted form over HTTPS (TLS), and we verify notifications from Upgates by their signature.
The access data for the Upgates API and the channel settings are encrypted in the database with the AES-256-GCM algorithm. Only authorised persons with their own credentials have access to the servers and the database, and each add-on has its own database that other add-ons cannot access.
We back up the database every day to encrypted Cloudflare R2 storage in the EU. Daily backups are kept for 30 days and weekly backups for up to 6 months, after which they are deleted automatically. We keep operational logs without personal data: they contain no names, email addresses, access data or the content of notifications and messages.
Further subprocessors
You give us a general authorisation to engage further subprocessors. At present the following may process data about buyers: Hetzner Online GmbH (hosting, EU) and Cloudflare, Inc. (R2 storage in the EU for encrypted database backups). Functional Software, Inc. (Sentry, error tracking, EU region) receives only technical errors without personal data. Service emails to the e-shop contact email are sent by Resend, Inc. (USA, emails are sent through its EU region in Ireland, and any transfer to the USA is based on the standard contractual clauses of the European Commission), and payments for paid plans are processed by Stripe Payments Europe, Limited (Ireland). Those two do not receive data about the buyers of your e-shop.
We bind each further subprocessor by contract to the same data protection obligations that apply to us under these terms, and we remain responsible to you for its performance.
We will inform you by email at the e-shop contact address at least 30 days in advance of any intention to add or replace a subprocessor that would process data about buyers. You may object to the change within that period at [email protected]. If we cannot accommodate the objection, you may deactivate the add-on at any time without any penalty.
Assistance with data subject rights and controller obligations
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures in fulfilling your obligation to respond to requests from data subjects exercising their rights. Because we do not store data about buyers for longer than is necessary to send a message, you can handle most requests directly in your e-shop. If a data subject contacts us directly, we will forward the request to you without undue delay.
On request, we will also assist you in meeting your obligations under Art. 32 to 36 GDPR, that is, with the security of processing, the notification of personal data breaches, the data protection impact assessment and prior consultation with the supervisory authority.
Personal data breach
We will inform you of a personal data breach affecting your data without undue delay, and no later than 48 hours after becoming aware of it, by email at the e-shop contact address. We will state the nature of the breach, the categories of data and data subjects concerned, the likely consequences, and the measures we have taken or propose to take. We will supplement any information we do not yet have as soon as we learn it. If the breach concerns the Upgates platform or its customers, we will also notify Upgates within 24 hours.
Deletion and return of data
The order data that the add-on processes is short-lived: we keep the technical envelope of a notification for 7 days, the delivery records for 30 days and the order data for statistics for 400 days, as described on the Privacy page. We then delete it automatically.
After the add-on is deactivated, we stop notifications immediately and delete all data of the e-shop, including the encrypted access data and the channel settings, within 30 days. If you activate the add-on again within that period, the settings are restored. The data remains in database backups until they are deleted automatically, for up to 6 months. We use a backup only to restore the whole database after an outage, and we delete the data of deactivated e-shops again immediately after such a restore. On request, we will confirm that the deletion has been carried out.
If you want to receive your data before deactivation, write to [email protected] and we will send it to you. We keep data longer only where a legal regulation requires it.
Information and audits
On request, we will provide you with all the information necessary to demonstrate that we comply with our obligations under Art. 28 GDPR and these terms. We allow audits and inspections carried out by you or by an auditor you appoint, at a time agreed in advance. Send requests to [email protected].
Final provisions
These terms are governed by the law of the Slovak Republic. We announce changes to the terms in the same way as changes to the Add-on terms, that is, by email at least 30 days before they take effect.
Contact: Apptiary s.r.o., Tylova 1043/15, 831 04 Bratislava, Slovakia, company ID (IČO) 57 466 408, tax ID (DIČ) 2122765986, [email protected].