תנאי עיבוד מידע

These Data Processing Terms are entered into between you (the Merchant, referred to as “you”) and B.F Entreprises, trading as Jeweliful, of [REGISTERED ADDRESS] (“Jeweliful”, “we”, “us”).

They form part of, and are incorporated by reference into, the agreement under which we supply the Jeweliful service to you. You enter into them when you install the Jeweliful app on your store, or when you create or use a Jeweliful account, whichever happens first. Where they conflict with any other part of that agreement, these terms prevail on anything concerning the personal data of your customers.

They are in writing in electronic form, which is the form data protection law requires and allows. You can print this page or save it, and we will send you a copy on request.

1. (a)Customer Personal Data means personal data about your customers or the recipients of your orders that we process on your behalf under the agreement. Annex A describes it.
2. (b)Data Protection Law means every law about personal data that applies to processing under these terms, including the EU General Data Protection Regulation, the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended.
3. (c)Controller, processor, personal data, data subject, processing and personal data breach have the meanings the GDPR gives them. Business, service provider, contractor, sell, share and business purpose have the meanings the California Consumer Privacy Act gives them.
4. (d)Subprocessor means anyone we engage to process Customer Personal Data on our behalf. Annex B lists them.
5. (e)Standard Contractual Clauses means the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

For Customer Personal Data you are the controller and we are your processor. Where you are yourself a processor for someone else, you are the processor and we are your subprocessor, and these terms apply as if references to you were references to that controller.

You are responsible for having a lawful basis for the processing you ask us to perform, for giving your customers the privacy information the law requires them to have, and for the accuracy of what you send us. We do not have a route to your customers: we hold no buyer email addresses at all, by design, so the notice a data subject is owed can only come from you.

For the personal data we hold about you and your business, we are the controller. That is described in our Privacy Policy and is outside these terms.

We process Customer Personal Data only on your documented instructions, including in relation to transfers to another country, unless a law we are subject to requires otherwise. If that ever happens, we will tell you before we process, unless that law forbids us to tell you.

Your instructions are:

1. (a)the agreement between us, including these terms;
2. (b)the actions you take in the Jeweliful dashboard and the app, including sending us an order, changing an order, and asking us to erase data;
3. (c)any other instruction you give us in writing, including by email, which we agree to follow.

The purposes those instructions cover are the ones in Annex A and no others: importing the orders you send us, making the pieces on them, packing them with your branding, shipping them to the recipient you named, writing tracking back to your store, and supporting you about those orders.

If we think an instruction you give us breaks Data Protection Law, we will tell you immediately and may pause that processing until it is resolved.

Everyone we allow to process Customer Personal Data, whether an employee, a contractor or an agency worker, is bound to keep it confidential, either by a written undertaking to us or by a professional duty of confidence. That obligation survives the end of their engagement.

We grant access on a need-to-know basis only, and we keep a log of every occasion on which one of our people reads or exports Customer Personal Data, recording who, what, why and when.

We implement and maintain technical and organisational measures appropriate to the risk, taking account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Those measures are set out in Annex C. In summary they cover the encryption of personal data; the ongoing confidentiality, integrity, availability and resilience of our systems; our ability to restore access to data after an incident; and the regular testing and review of the measures themselves.

We may update the measures as the service changes, provided the level of protection is not reduced.

You give us general written authorisation to engage the subprocessors listed in Annex B, and to engage others in accordance with this section.

Before a new subprocessor begins processing Customer Personal Data, we will update Annex B and tell you, at least 10days beforehand or as promptly as our own provider’s notice to us allows if that is shorter. We give you that number rather than the customary thirty because it is one we can actually keep: some of our own providers give us as little as five days’ notice of their changes, and a promise of thirty would be a promise broken the first time one of them moved.

If you object to a new subprocessor on reasonable data protection grounds, tell us within ten days of our notice. We will discuss it with you in good faith and look for an alternative. If we cannot find one, you may stop using the affected part of the service and end the agreement for it, without penalty and with a refund of anything you paid in advance for a period you will not now receive.

We impose on every subprocessor, by written contract, data protection obligations that offer an equivalent level of protection to the ones in these terms. Where a subprocessor fails to meet them, we remain fully liable to you for its performance.

Where you are yourself a processor and we are your subprocessor, the authorisation and the right to object in this section belong to your own controller, and you must pass our notice on to them and pass their objection back to us. That is what the Standard Contractual Clauses require in that arrangement, and it is why we send the notice to you rather than deciding for ourselves who further down the chain should receive it.

If one of your customers exercises a right against you, we will help you answer, by appropriate technical and organisational measures and as far as it is possible for us to do so. If a request reaches us directly, we will not answer it ourselves. We will pass it to you without undue delay and tell the person that you are the one who decides.

For stores connected over Shopify, three of those routes are automatic. They run at POST /api/channels/shopify/webhook, which verifies the request’s signature and refuses anything unsigned:

For orders you placed by hand, or for anything the three routes do not cover, write to us and we will act on your instruction.

Taking into account the nature of the processing and the information available to us, we will help you meet your own obligations to keep personal data secure, to notify a regulator and your customers of a breach, to carry out a data protection impact assessment, and to consult a regulator where one is needed. In practice that means giving you the information we hold about how the processing works, what measures protect it, where data is held and who has access to it.

If you ask for help that goes beyond what Data Protection Law and these terms require of us, we may agree a reasonable fee for it first. We will never make routine assistance conditional on payment.

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any event within 48 hours. We do not assess first whether the breach is likely to be risky to your customers, because that judgement is yours to make and your own 72-hour clock starts when we tell you.

Our notification will describe, as far as we know it at the time:

1. (a)what happened, including the categories and approximate number of data subjects and records concerned;
2. (b)the likely consequences;
3. (c)the measures we have taken or propose to take, including anything to mitigate the effects;
4. (d)a contact point for more information.

Where we cannot give all of it at once, we will give what we have and follow with the rest without undue further delay. Notifying you, or responding to an incident, is not an admission of fault or liability by us.

Notifying a supervisory authority and your customers is yours to do, as controller. We will not do it in your name, and we will not do it without telling you.

You can ask us to delete Customer Personal Data at any time, and the routes in section 8 do it on request. At the end of the agreement, at your choice, we will return it to you or delete it.

1. (a)For 30 days after the agreement ends you can export your data from the dashboard or ask us for a copy of it.
2. (b)After that window we delete it from our live systems.
3. (c)Copies in our backups are deleted on the ordinary backup rotation. Until they are, they are put beyond use: nothing reads them except a restore, and they remain covered by these terms.

We will make available to you all the information necessary to demonstrate that we comply with this document, and allow for and contribute to audits.

By entering into the agreement you are treated as having signed the Standard Contractual Clauses and the Addendum, including their annexes. No handwritten signature is needed. Where they conflict with anything else in these terms, they prevail.

Where the California Consumer Privacy Act applies to you, you are the business and we are your service provider. We receive Customer Personal Data from you, or on your behalf, only for the business purposes set out in Annex A, and you disclose it to us only for those purposes. They are stated there specifically, and not by a general reference to this agreement, because the regulations require exactly that.

We are prohibited from, and we will not:

1. (a)sell or share the personal information;
2. (b)retain, use or disclose it for any purpose other than the business purposes specified in Annex A, including for any commercial purpose of our own;
3. (c)retain, use or disclose it outside the direct business relationship between us;
4. (d)combine it with personal information we receive from or on behalf of anyone else, or that we collect from our own interaction with a consumer, except where the regulations expressly permit it for a business purpose.

We also undertake that:

1. (a)we will comply with the applicable requirements of the CCPA and provide the same level of privacy protection it requires of you;
2. (b)you may take reasonable and appropriate steps to satisfy yourself that we use the personal information consistently with your obligations, which section 12 puts into practice;
3. (c)you may, on notice, take reasonable and appropriate steps to stop and remediate any unauthorised use of personal information by us;
4. (d)we will notify you if we determine that we can no longer meet our obligations under the CCPA;
5. (e)we will enable you to comply with consumer requests, and you will tell us of any request we need to act on and give us what we need in order to act on it;
6. (f)where we engage a subcontractor to help us process personal information for you, we will notify you and put in place a written contract binding it to all of the requirements in this section.

These terms apply for as long as we process Customer Personal Data for you, and the sections that by their nature should survive, including confidentiality, deletion and audit, survive the end of the agreement until we no longer hold any of it.

Liability under these terms is subject to the limitations and exclusions in the agreement they form part of. There is deliberately no separate cap, indemnity or governing-law clause for the agreement as a whole in this document. Those belong to the commercial agreement, and a second quieter set of them here would only create a conflict.

If any part of these terms is held unenforceable, the rest continues to apply.

The three marked as receiving customer data are the only ones that can reach the personal data of your customers. The others are named for completeness: they process data about you and your account, which the Privacy Policy covers.

These are the measures in place today. They answer both Article 32 of the GDPR and the protected customer data requirements the store platforms impose on us.

• Encryption in transit. Every connection to the service, and every connection from it to a provider, runs over TLS.
• Encryption at rest. The database and the file storage encrypt their contents with AES-256.
• A second layer over the keys to a merchant's store. The access tokens that let us read a connected store are encrypted field by field with a rotating key, on top of the storage encryption.
• Personal data is stripped from logs before they are written, and error reporting is configured to send none.
• An access log over end-customer data. Every read or export by our staff, and every send to our shipping provider, is recorded with who, what, why and when.
• Least privilege. Every route in the application is permission-guarded by construction, staff accounts exist only by invitation, and the ability to move money is narrower than the ability to fulfil an order.
• Separation of test and production. Development and preview environments run on their own databases and never receive production data.
• Retention limits that run on a schedule, with a hold switch that suspends every one of them while an incident is open.
• A written security incident response policy with severity levels, containment runbooks and notification duties.

We keep a written security incident response policy setting out severity levels, who decides what, containment steps for each kind of compromise, how evidence is preserved, and the notification duties in section 10. Our retention schedules are suspended in full while an incident or a legal hold is open, so nothing can be swept away while it is still needed.

Write to privacy@jeweliful.com, or to B.F Entreprises at [REGISTERED ADDRESS]. Mark anything urgent, including a suspected breach, as urgent in the subject line.