This Data Processing Addendum ("DPA") forms part of the Terms of Service between Plumbline Labs ("Plumbline," "Processor") and the customer ("you," "Controller") and applies where Plumbline processes personal data on your behalf, in particular, customer personal data contained in orders from a connected e-commerce store.
For personal data that Plumbline processes on your behalf, you are the controller (or processor for your own merchants) and Plumbline is the processor (or sub-processor). Each party will comply with the data protection laws that apply to it.
Plumbline will: (a) process personal data only on your documented instructions, including as set out in the Terms of Service and this DPA; (b) ensure persons authorized to process personal data are bound by confidentiality; (c) implement appropriate technical and organizational security measures (§04); (d) not sell personal data or use it for advertising to individuals or any purpose other than providing the services; and (e) assist you, taking into account the nature of processing, in meeting your own compliance obligations.
Plumbline maintains appropriate security measures, including encryption of data in transit and at rest, storage of access tokens in a key-management-backed vault, tenant isolation and access controls, and regular review of its practices. Plumbline limits access to personal data to personnel who need it to provide the services.
You authorize Plumbline to engage sub-processors (such as cloud infrastructure and hosting providers) to support the services. Plumbline imposes data protection obligations on its sub-processors that are no less protective than those in this DPA and remains responsible for their performance. We will make our list of sub-processors available on request and give notice of material changes.
Taking into account the nature of the processing, Plumbline will assist you in responding to requests from data subjects to exercise their rights. Because Plumbline stores order data in aggregated form and does not retain customer-identifying fields, we honor erasure requests by deleting the associated data, including via platform mechanisms such as Shopify's customer-redaction and shop-redaction webhooks.
Plumbline will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide information reasonably available to help you meet any notification obligations.
On termination of the services, or upon your request, Plumbline will delete or de-identify the personal data it processes on your behalf, except where retention is required by law. Uninstalling the app from a connected store triggers revocation of access and deletion of that store's data.
Where personal data is transferred across borders, the parties will rely on an appropriate transfer mechanism recognized under applicable data protection law.
Plumbline will make available information reasonably necessary to demonstrate compliance with this DPA and will contribute to audits as required by applicable data protection law, subject to reasonable confidentiality and security safeguards.
For questions about this DPA or our data processing, contact: