This agreement applies whenever Shopdresser (“processor”, “we”) handles personal data of your customers on behalf of your business (“controller”, “you”) through Shopdresser. It is part of the Terms of service and meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and of equivalent laws. It applies automatically: you do not need to sign anything. If you need a countersigned copy, write to zyagency20@gmail.com.
1. What is processed, and why
| Subject | Sending messages to your customers in your name (review requests, reminders, win-back messages), collecting their feedback, and showing you the results. |
|---|---|
| Duration | For as long as you have an account, and until the data is deleted as described in section 9. |
| Nature and purpose | Storing, organising, using for sending, and deleting — only to provide the service you subscribed to. |
| Types of data | Name, email address, phone number, language, date of last visit, whether the person agreed to receive news and offers, whether they unsubscribed, messages sent and whether the link in them was opened, feedback and rating given, redemption of a win-back code, enquiries sent through your page. |
| People concerned | Your customers and people who contact your business through your page. |
| Special categories | None. The Acceptable use policy forbids adding sensitive data. |
2. Your instructions
We process this data only on your documented instructions. Your instructions are: these terms, the settings you choose in your dashboard, and what you approve or send there. If we think an instruction breaks data protection law, we tell you. We do not use your customers' data for our own purposes, do not sell it, and do not combine it with the data of other businesses.
3. Your responsibilities
You decide which customers you add and what is sent to them. You are responsible for having a legal basis for each use — in particular consent where the law requires it for marketing — and for informing your customers about how you use their data.
4. Confidentiality
Everyone who works with this data for us is bound to confidentiality and may access it only as far as their work requires.
5. Security
We protect the data with the technical and organisational measures listed in the annex below and keep them up to date with the state of the art.
6. Other processors we use
You agree that we use the companies listed on the Subprocessors page. Each is bound by a contract that gives your customers' data at least the protection of this agreement, and we remain responsible to you for what they do. Before we add or replace one we update that page and tell account holders by email at least 30 days in advance. If you object for a justified reason and we cannot offer an alternative, you may cancel without cost.
7. Transfers outside the European Economic Area
Where a processor we use handles data outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by its standard contractual clauses, with additional safeguards where needed.
8. Helping you meet your obligations
- Requests from your customers. Your dashboard lets you see, update, export and delete your customers' data. If a customer writes to us instead, we pass the request to you without delay and do not answer it ourselves unless you ask us to. Unsubscribe requests are carried out immediately.
- Breaches. If we become aware of a personal data breach affecting your customers' data, we tell you without undue delay and at the latest within 48 hours, with what we know: what happened, which data and roughly how many people are concerned, the likely consequences, and what we have done about it.
- Impact assessments and authorities. We give you the information you reasonably need for a data protection impact assessment or for a consultation with your supervisory authority.
9. Deletion and return
You can export your customers' data from your dashboard at any time. When you delete a customer, a list or your account, the data is deleted from the live system at once. Copies in backups are overwritten in the normal backup cycle. Where a law obliges us to keep something longer, we keep only that, and only for that purpose.
10. Showing that we comply
We give you the information needed to show that this agreement is kept. Once a year, or after a breach, you may audit our compliance yourself or through an independent auditor bound to confidentiality, on 30 days' written notice, during business hours and without disrupting the service. We may first answer with written information; an on-site audit follows only where that is not enough.
11. Liability and precedence
The liability rules of the Terms of service apply to this agreement. Where this agreement and the terms contradict each other on the protection of personal data, this agreement prevails. Where it contradicts standard contractual clauses that apply between us, those clauses prevail.
Annex: technical and organisational measures
- Encryption in transit. All pages and all connections to the dashboard use HTTPS.
- Access control. Every business sees only its own data; every action in a dashboard checks that the record it touches belongs to that business. Passwords are stored only as salted hashes. Staff access is limited to the people who need it for support.
- Separation. Data of different businesses is logically separated and never combined.
- Protection against abuse. Rate limits on login, sign-up and public forms; signed payment notifications; public forms protected against automated submission.
- Minimisation. Page statistics are counted without identifiers. Payment card data is handled by the payment provider and never reaches our servers.
- Location. Servers in France (European Union).
- Resilience. Regular backups by the hosting provider; software kept up to date.
- Testing. The rules above are checked by automated tests before every release.