Data processing agreement

Scope and definitions

• Data protection law means the laws that apply to the processing, including Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK), the EU General Data Protection Regulation 2016/679 (GDPR) and, where they apply, the UK GDPR and the Swiss Federal Act on Data Protection.
• Personal data, processing, controller, processor, data subject and personal data breach have the meaning given in data protection law. Under KVKK, the controller is the veri sorumlusu and the processor the veri işleyen.
• Merchant personal data means personal data that Tryino processes on the merchant’s behalf through the app.
• This DPA does not cover Tryino’s own business data about merchants, such as contact details and support correspondence, for which Tryino is the controller under its general privacy policy. It does not cover the Ino Loyalty Engine, which has its own agreement.

Roles

The merchant is the controller of merchant personal data and decides why and how it is processed. Tryino is the processor and processes it only on the merchant’s behalf. Each party complies with the data protection law that applies to it.

Details of the processing

Subject matter and duration

Providing the Ino Loyalty app to the merchant under the terms of service, for as long as the app is installed and afterwards until the data is deleted under the “Deletion and return” section.

Nature and purpose

Receiving, storing, calculating, displaying, reporting and deleting loyalty data in order to run the merchant’s loyalty program: earning and spending points, tiers, campaigns, referrals, missions and games; showing the merchant its members and reports; writing each member’s points balance and tier to the Shopify customer record as app fields and tags; answering Shopify privacy requests; and keeping the service secure and working.

Data subjects

• The merchant’s customers who join the loyalty program.
• The merchant’s customers whose orders the app receives before or without joining. For them, only order identifiers and the Shopify customer ID are kept, briefly; orders of non-members are kept only as a count, without products.
• The merchant’s staff who use the app, identified by their Shopify staff user ID.

Categories of personal data and retention

Read but not stored: the customer’s name is read live from Shopify to show it to the merchant’s staff in the app’s admin pages, and is never written to our database, logs or reports. Search text that staff type in the member search is passed to Shopify’s customer search and is not stored.

Not processed: e-mail addresses, phone numbers, postal addresses and payment data are not stored. No special categories of personal data are processed.

Processing on instructions

Tryino processes merchant personal data only on the merchant’s documented instructions. These terms, this DPA and the settings the merchant chooses in the app are those instructions. Tryino will tell the merchant if it believes an instruction breaks data protection law, and may then decline to follow it. If the law requires Tryino to process data otherwise, Tryino will tell the merchant first, unless the law forbids it. Tryino does not sell merchant personal data, does not use it for its own purposes or for advertising, and does not combine it with other stores’ data.

Confidentiality of personnel

Tryino gives access to merchant personal data only to personnel who need it to operate, support or secure the app, and makes sure they are bound by confidentiality obligations that continue after their work ends.

Security measures

Tryino takes appropriate technical and organisational measures to protect merchant personal data, taking into account the state of the art, the cost, and the nature and risks of the processing. The measures in place today are:

• Encryption in transit: HTTPS only, with HSTS, on all app endpoints. The database is reached over a private network with TLS.
• Encryption at rest: database storage and backups are encrypted by Azure. Shopify access tokens are additionally sealed with AES-GCM, with the key held in Azure Key Vault.
• Network: the PostgreSQL database is on a private network and is not reachable from the internet. Administrative endpoints are switched off in production.
• Secrets: kept only in Azure Key Vault and read by managed identities; each service reads only its own secrets.
• Separation of stores: PostgreSQL row-level security keeps each store’s data apart. The service refuses to start under a database role that could bypass it, and automated tests check cross-store access.
• Data minimisation: order notifications are reduced before storage, so names, e-mail, phone and addresses are never written. Customer names are read live from Shopify for the merchant’s admin screens and never stored. Logs contain no shopper data.
• Merchant-side access: the app’s admin pages check Shopify session tokens and are limited to the store owner and staff with permission to manage discounts. Staff point adjustments have daily limits and are logged with the staff user ID.
• Webhooks: Shopify webhooks are verified by signature, and a request that names a different store is rejected.
• Tryino access: production access is limited by Azure role-based access control to the people who operate the app.
• Logging: access to secrets in Azure Key Vault (audit events) and connections to the database are logged to Azure Log Analytics and kept for 90 days. Application logs contain no shopper data.
• Test and production: production runs in its own environment, with its own network, database, key vault and Shopify app. Production data is not copied to test.
• Resilience: point-in-time backups for 14 days in the same region, with restore tests at least once a year.
• Incidents: a written security incident response policy.

Tryino may change the measures, but not in a way that lowers the overall level of protection.

Sub-processors

The merchant gives Tryino general authorisation to use sub-processors. The current sub-processors are:

• Shopify is the merchant’s own platform and is not Tryino’s sub-processor. Cloudflare provides DNS only and receives no personal data.
• Tryino will tell the merchant about a new or replaced sub-processor at least 30 days in advance, in the app or by e-mail, and update this list. The merchant may object on reasonable data protection grounds. If we cannot resolve the objection, the merchant may end the terms by uninstalling the app.
• Tryino imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible to the merchant for them.

International transfers

Merchant personal data is stored by Microsoft Azure in France Central (Paris, EU). Tryino is based in Türkiye, and its personnel may access the systems remotely from Türkiye to operate and support the app.

• Where the GDPR applies to that access, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two: controller to processor) are incorporated into this DPA by reference, with the merchant as data exporter and Tryino as data importer. The details of the processing are those in this DPA.
• Where KVKK applies to a transfer abroad, Tryino will sign the standard contract published by the Personal Data Protection Board on the merchant’s request and help the merchant make any notification the Board requires.
• Tryino will not transfer merchant personal data to any other country without a safeguard that data protection law accepts.

Data subject requests

Tryino helps the merchant answer requests from data subjects to exercise their rights, by appropriate technical and organisational measures:

• Access (customers/data_request): when Shopify forwards a request, Tryino prepares a report of the loyalty data held about the customer, which the merchant downloads in the app.
• Erasure (customers/redact): Tryino deletes the member and the loyalty data linked to them, and unlinks and clears their order summaries, usually within minutes.
• Correction and other requests: the merchant can make changes in the app, or write to [email protected] and we will help.

If a data subject contacts Tryino directly about merchant personal data, Tryino will pass the request to the merchant and will not answer it itself, except to tell the person to contact the store. We help the merchant answer within the legal deadline, for example 30 days under KVKK.

Personal data breaches

• Tryino notifies the merchant without undue delay after becoming aware of a personal data breach affecting merchant personal data. Our target is to send the first notice within 48 hours, and we send updates as facts become clear.
• The notice describes, as far as known: what happened and when; the categories of data and the approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; what the merchant should do; and a contact person.
• Tryino gives the merchant the information it needs to meet its own obligations, such as notifying the supervisory authority within 72 hours under the GDPR, or the Personal Data Protection Board within 72 hours and the affected people as soon as possible under KVKK. Tryino provides draft wording on request.
• Tryino takes reasonable steps to contain the breach and reduce its effects, as set out in our security incident response policy. Notifying a breach is not an admission of fault.

Other assistance

Taking into account the nature of the processing and the information available to it, Tryino gives the merchant reasonable help with data protection impact assessments and prior consultations with supervisory authorities that concern the app.

Deletion and return

• Uninstalling: Shopify sends a deletion request (shop/redact) 48 hours after the merchant uninstalls the app. Tryino then deletes all of the store’s data. Deleted data leaves the backups within 14 days. Server logs, which contain no shopper data, are deleted after 90 days.
• Return: before uninstalling, the merchant can ask [email protected] for a copy of its program data, and Tryino will provide it in a common machine-readable format.
• Moving to the merchant’s own Ino Loyalty Engine: if the merchant signs an Ino Loyalty Engine agreement, Tryino moves the store’s program data to that engine on the merchant’s instruction. The transfer package contains no names, e-mail addresses or phone numbers and is deleted once the move finishes, at the latest after 30 days. The merchant’s engine then reads the customer’s name, e-mail and phone from Shopify itself; that processing is governed by the engine agreement. The copy in the app is kept for 30 days after the move, so that the merchant can receive its history file, and then deleted; it is deleted at once if Shopify sends shop/redact.
• Tryino may keep data longer only where the law requires it, and then keeps it confidential and processes it only for that purpose.

Audits and information

Tryino makes available the information needed to show compliance with this DPA, for example by answering the merchant’s written security questions. If that is not enough, or a supervisory authority requires it, the merchant may audit Tryino’s compliance once a year, with at least 30 days’ notice, at its own cost, during business hours and without disrupting operations. The audit may be done by an independent auditor bound by confidentiality, and is limited to the systems that process the merchant’s data. Tryino does not claim any third-party security certification.

Liability

Each party’s liability under this DPA is subject to the limitations in the terms of service, except where data protection law does not allow liability to be limited.

Term and precedence

• This DPA applies for as long as Tryino processes merchant personal data.
• If this DPA conflicts with the terms of service, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.
• Apart from the Standard Contractual Clauses, this DPA is governed by the same law and courts as the terms of service.
• We may update this DPA as the terms of service describe; the date at the top shows the latest version. See also the app privacy policy.

Contact

Privacy and data protection: [email protected] · Tryino, İstanbul, Türkiye