Parties
These terms govern the processing of personal data under Art. 28 GDPR between the operator of an e-shop on the Shoptet platform who installs the Vacation mode addon (the “controller” or “you”) and Apptiary s.r.o., with its registered office at Tylova 1043/15, 831 04 Bratislava, Slovakia, company ID (IČO) 57 466 408, tax ID (DIČ) 2122765986 (the “processor” or “we”).
The terms form part of the Add-on terms of service and apply from the installation of the addon. The data we process as a controller (the e-shop contact email and the installation data we need to provide the addon, send summaries and give support) is described on the Privacy policy page.
Subject matter, nature and purpose of the processing
The subject matter of the processing is the data the addon needs in order to temporarily change delivery times and availabilities in your e-shop on your instruction, display a notice in the e-shop and a warning in the cart, restore the original values when the vacation ends, and send you summaries and reminders.
The processing includes storing, reading and writing data through the Shoptet API, retaining it for the duration of the installation, and deleting it. The processing has no other purpose. We do not use the data for our own purposes, we do not sell it and we do not share it with other addons.
Duration of the processing
We process data only while the addon is installed in your e-shop. The processing ends when the addon is uninstalled, and we then delete the data as described in the section Deletion and return of data.
Type of personal data and categories of data subjects
The addon stores the e-shop identifier and address, its time zone and language, the e-shop contact email, your settings (the delivery time shift, the strategy, the text of the banner and the cart warning, the availabilities left unchanged and the scheduled vacation dates), a record of the original delivery times and availabilities, and logs of the addon activity. These may be personal data where the e-shop is operated by an individual, where the contact email belongs to a specific person, or where you enter personal details, such as a name or phone number, in the text of the banner or the cart warning. We process the e-shop contact email as a controller under the Privacy policy page, so these terms do not apply to it.
The data subjects are therefore the e-shop operator, if an individual, its employees and contact persons, and the persons whose data you enter in the addon texts.
The addon does not read data about the e-shop customers or orders and has no access to it. We store nothing about e-shop visitors, and the addon sets no cookies in the e-shop. The addon does not process special categories of personal data.
Controller instructions
We process personal data only on your documented instructions. The instructions are these terms, the settings you make in the addon administration, and any instructions you send us by email to [email protected]. This also applies to transfers of data to third countries; the section Further subprocessors lists which subprocessors process data outside the EU.
If, in our opinion, we receive an instruction that infringes the GDPR or another data protection regulation, we will inform you without undue delay.
Confidentiality
Only persons authorised by the processor who need access to operate and support the addon have access to personal data. Each of them is bound by a duty of confidentiality that continues after their cooperation with us ends.
Security of processing (Art. 32 GDPR)
The data is stored in the EU (Hetzner Online GmbH, Helsinki data centre, Finland). All communication takes place exclusively in encrypted form over HTTPS (TLS), and we verify notifications from Shoptet by their signature.
The access token for the Shoptet API is encrypted in the database with the AES-256-GCM algorithm. Only authorised persons with their own credentials have access to the servers and the database, and each addon has its own database that other addons cannot access.
We back up the database every day to encrypted Cloudflare R2 storage in the EU. Daily backups are kept for 30 days and weekly backups for up to 6 months, after which they are deleted automatically. We keep operational logs without personal data: they contain no names, email addresses, access tokens or notification content.
Further subprocessors
You give us a general authorisation to engage further subprocessors. At present these are: Hetzner Online GmbH (hosting, EU), Resend, Inc. (sending summaries and reminders to the e-shop contact email; a company based in the USA, emails are sent through its EU region in Ireland, and any transfer to the USA is based on the standard contractual clauses of the European Commission), Cloudflare, Inc. (delivery of the banner settings to the e-shop, protection against attacks and R2 storage in the EU for encrypted database backups), Functional Software, Inc. (Sentry, error tracking, EU region, without personal data).
We bind each further subprocessor by contract to the same data protection obligations that apply to us under these terms, and we remain responsible to you for its performance.
We will inform you by email at the e-shop contact address at least 30 days in advance of any intention to add or replace a subprocessor. You may object to the change within that period at [email protected]. If we cannot accommodate the objection, you may uninstall the addon at any time without any penalty.
Assistance with data subject rights and controller obligations
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures in fulfilling your obligation to respond to requests from data subjects exercising their rights. If a data subject contacts us directly, we will forward the request to you without undue delay.
On request, we will also assist you in meeting your obligations under Art. 32 to 36 GDPR, that is, with the security of processing, the notification of personal data breaches, the data protection impact assessment and prior consultation with the supervisory authority.
Personal data breach
We will inform you of a personal data breach affecting your data without undue delay, and no later than 48 hours after becoming aware of it, by email at the e-shop contact address. We will state the nature of the breach, the categories of data and data subjects concerned, the likely consequences, and the measures we have taken or propose to take. We will supplement any information we do not yet have as soon as we learn it.
Deletion and return of data
After the addon is uninstalled, we delete all data of the e-shop, including the encrypted access token, the settings, the record of the original values and the history. After uninstalling, the addon no longer has access to the e-shop and cannot change anything in it. If a vacation was active, the addon sends you an email with all the original values before deletion so that you can set them manually. In all cases the data is deleted no later than 24 hours after the uninstallation. It remains in database backups until they are deleted automatically, for up to 6 months. We use a backup only to restore the whole database after an outage, and we delete the data of uninstalled e-shops again immediately after such a restore.
If you want to receive your data before uninstalling, write to [email protected] and we will send it to you. We keep data longer only where a legal regulation requires it.
Information and audits
On request, we will provide you with all the information necessary to demonstrate that we comply with our obligations under Art. 28 GDPR and these terms. We allow audits and inspections carried out by you or by an auditor you appoint, at a time agreed in advance. Send requests to [email protected].
Final provisions
These terms are governed by the law of the Slovak Republic. We announce changes to the terms in the same way as changes to the Add-on terms of service, that is, by email at least 30 days before they take effect.
Contact: Apptiary s.r.o., Tylova 1043/15, 831 04 Bratislava, Slovakia, company ID (IČO) 57 466 408, tax ID (DIČ) 2122765986, [email protected].