Help Center (“the App”) helps to build attractive FAQ’s page, Knowledge Base, and Help Desk for ticketing service (emails, live chat and social chat) (“the Service") for online stores to merchants who use Shopify and/or Magento / Adobe Commerce to power their stores.
This Privacy Policy describes how Personal Information is collected, used, and shared when you install or use the App in connection with your supported store. And how we treat gathered Personal Information of you when you (“Staff Users(s)") are accessing our website and services as well as the data (“user data”) gathered about your end users (“Customer User(s)") relevant to the services we provide. Some of Help Center app features and services require Personal Information of Staff User and Customer User to be gathered.
INFORMATION WE COLLECT
Information we collect may contain Staff User’s and Customer User’s personal data.
1. Store & Installation Information
1.1. Magento / On-Premise Store Details: actual_domain, domain, name, email, customer_email, phone, country_code, currency, is_active, primary_locale, is_magento_extension_enabled, is_magento, return_url.
1.2. Shopify Store Details: Shop ID, Shop name, myshopify_domain / domain, Shop email, Customer contact email, Phone, Country code, Shopify plan name, Primary locale / language, OAuth access tokens, refresh tokens, and scopes.
1.3. FAQ Page Content: Section titles, section content, category names, layout settings, and storefront tabs.
1.4. Knowledge Base Content: URL handle, Category titles, category descriptions, Section titles, section content, article titles and content, layout settings.
2. Device & Technical Log Information
Additionally, for Service delivery purpose upon your visit to our website or storefront widgets, we automatically collect information about your device, including your IP address (browser_ip) and potentially other unique device identifiers (for example, if you are using a phone with iOS or Android installed), Internet browser type and language, information about any website that referred you, the date/time of your visit, and any search keywords. We refer to this information collectively as “Device Information.” When we refer to “Personal Information” in this Privacy Policy, we’re including both Device Information and Account Information that means information relating to the Help Center app's account.
In order to ensure network and information security, and to identify and resolve product defects we log IP and device information in logs which are kept secure and limited to no more than 60 days and securely deleted thereafter. This log information is subject to restricted access and not used with any other identifying information to identify or otherwise track Staff User’s and Customer User’s behavior and is not shared with any third parties and is not used otherwise for the purposes of general analytics or marketing.
3. Help Desk & Order Synchronization Data
3.1. Staff Users Data:
For Help Desk ticketing account creation, as well as Knowledge Base admin access, we collect your full name, email address, IP address, and company information. We also collect similar data for other Staff Users added by you to manage tickets and articles. We track login information and usage data for Staff Users for analytics and reporting features within the Help Center app account.
3.2. Customer Profile Data (Magento & Shopify):
customer_id, customer_email, email, customer_firstname, customer_lastname, telephone / phone, First name, last name, Tags, Notes, Orders count, total spent, and Marketing flags (accepts_marketing, buyer_accepts_marketing, marketing_opt_in_level).
3.3. Customer & Shipping Address Data:
Address ID, firstname, lastname, company, street / Address1, Address2, city, region / Province / province code, country_id / Country / country code, postcode / zip, telephone / phone, and Latitude / longitude.
3.4. Order & Financial Information:
3.4.1. Magento Orders: entity_id, customer_firstname, customer_lastname, customer_email, status, order_currency_code, base_currency_code, total_due, total_qty_ordered, parent_item_id, qty_ordered, qty_shipped, grand_total, subtotal, created_at, updated_at, discount_amount, tax_amount, shipping_amount, shipping_description, coupon_code, discount_description.
3.4.2. Shopify Orders: Order ID, name/number, Email, Status, financial status, fulfillment status, Currency, Total, subtotal, discounts, tax, outstanding, Taxes included, Order status URL, Created / updated / cancelled / closed dates, Cancel reason, Note, tags, Browser IP, Cart / checkout token & ID, Landing site / referring site, Payment gateway names, Device / location / user IDs, Source fields, Discount codes, Billing address, and Buyer marketing acceptance.
3.5. Order Line Items & Product Data:
3.5.1. Magento Order Items: item_id, name, qty_ordered, price, discount_amount, qty_shipped, sku, is_virtual, tax_percent, product_id, parent_item_id.
3.5.2. Shopify Order Line Items: Line item ID, Product ID, variant ID, Title / name, SKU, Quantity, price, currency, Total discount, Fulfillment status, Requires shipping, taxable, Tax lines (price, rate).
3.5.3. Products & Collections: Product ID, title, status, vendor, type, tags, Images, Inventory / variant count, Variant (ID, title, price, compare-at, SKU, barcode, inventory qty/policy, options, taxable, requires shipping), Collections (ID, title, handle).
3.6. Fulfillment & Tracking Information:
3.6.1. Magento Fulfillment: entity_id, increment_id, track_number, tracks[], items[], qty.
3.6.2. Shopify Fulfillment: Fulfillment ID, name, status, shipment status, Tracking number(s), Tracking URL(s), Fulfillment line item ID + quantity, Shipping line (ID, code, title, price, tax, total shipping price).
3.7. Discounts, Refunds & Payment Details:
3.7.1. Discounts: Code, type, title, value, value type, Description, target type/selection, allocation method, Total discounts.
3.7.2. Refunds: Refund ID, Adjustments (kind, amount, tax, reason), Refund line items (qty, subtotal, tax), Suggested refund / transaction gateway & amounts.
3.7.3. Payments: Financial status, amounts, Gateway names.
3.8. Themes, Scripts & Content Data:
3.8.1 Themes (ID, name, role, dates, assets including settings_data.json), ScriptTags (ID, src, display scope), Pages (ID, title, handle).
WE COLLECT DEVICE INFORMATION USING THE FOLLOWING TECHNOLOGIES:
When Staff User or Customer User uses the Service (when deployed when the HelpCenter plugin is used on a site), to ensure the quality of the provided Services and functionalities, cookies are being used. “Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. They are designed to hold a modest amount of data specific to a particular Staff User or Customer User. We use cookies to recognize your device and provide you with a personalized experience on our websites or apps, or to improve the Services.
Purposes and legal basis for the use of cookies:
- The purpose of mandatory (technical) cookies - to help ensure the proper functioning of the Service. These cookies are essential to run the Service successfully and functionally. The legal basis for the use of mandatory (technical) cookies is our legitimate interest to ensure the functioning of the Service, ensuring the quality and security of the Service, and the provision of the Service (Article 6 (1) (f) of the GDPR).
- The purpose of analytical cookies - to gain information and data on use of the Service. The legal basis for the use of these cookies is the consent (Article 6 (1) (a) of GDPR).
- The purpose of functional cookies - to help use the Service efficiently, effectively and conveniently. These cookies are not necessary, but significantly improve the quality of use of the Service. The legal basis for the use of these cookies is the consent (Article 6 (1) (a) of GDPR).
- The purpose of commercial cookies – advertising by us or third parties. The legal basis for the use of these cookies is the consent (Article 6 (1) (a) of GDPR).
Management of cookies:
- Most web browsers are set to accept cookies automatically. Staff User or Customer User may, at their discretion, block or delete cookies and similar unique identifiers if their browser or device settings allow it. However, please note that if Staff User or Customer User refuses certain cookies, then we cannot ensure that the Service will be duly delivered. Staff User or Customer User can access, edit and change or cancel selections on cookies at any time. This can be done via internet browser settings panel. Most browsers have an option for turning off the cookie feature, which will prevent your browser from accepting new cookies, also allows you to decide on acceptance of each new cookie in different ways.
- For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
- “Log files” track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
- “Web beacons,” “tags,” and “pixels” are electronic files used to record information about how you browse the Site.
HOW DO WE USE YOUR PERSONAL INFORMATION?
We use the Personal Information we collect from you and your customers in order to provide the Service and to operate the App.
Additionally, we use this Personal Information to:
- To communicate with you,
- To optimize or improve the App,
- To provide merchants with information or advertising related to our products or services,
- To provide reporting and analytics,
- To help merchants find and integrate with apps through our app store,
- To provide troubleshooting, support services or to answer questions,
- To prevent risk and fraud on our platform,
- To test out features or additional services,
- To ask for ratings and/or reviews of services,
- To improve our services applications and website.
Help Center app will never provide or sell your information (and your customer end-user Information) to any third party not related with Help Center, except as permitted by law and except as written within this Policy below.
We will only send personal information about you and your customers to other companies or people if we need to share your information to provide the products or services you have requested.
Help center app will send personal information about you and your customers to other companies or people if:
- We have your permission (consent) to share the information;
- We need to share your information based on our contractual commitment to provide the services you have requested, such as in the case of a third party integration, to our contractors who are bound by written obligations of confidentiality;
- We need to send the information based on our legitimate interest to ensure due Service delivery, to companies who work with Help Center app to provide FAQ and Help Desk ticketing services to you, such as hosting companies or service providers which provide infrastructure for Help Center app services.
- We reserve the right to disclose any information app collects in connection with the Service, without further notice to you (1) to any successor to Help Center business as a result of any merger, acquisition or similar transaction and (2) to any law enforcement or regulatory authority to the extent required by law or if disclosure is necessary to investigate fraud or any threat to the safety of any individual, to protect our company legal rights or to protect the rights of third parties.
FACEBOOK PLATFORM TERMS
1. Introduction
a. Our Platform is the set of APIs, SDKs, tools, plugins, code, technology, content, and services that enables others, including app developers and website operators, to develop functionality, retrieve data from Facebook and any other Facebook Products, or provide data to us.
b. To use Platform (including to Process any Platform Data), you agree to these Platform Terms (“Terms”), as well as all other applicable terms and policies. This may include the Facebook Terms of Service, the Instagram Terms of Use, the Facebook Commercial Terms, the Business Tools Terms, and any Facebook Product terms that are applicable.
c. You must also comply with the applicable requirements in our Developer Policies and those made available on our Developer Site, including in our Documentation (collectively, the “Developer Docs”).
d. These Terms will start on the earlier of the date you accept them or otherwise start accessing or using Platform, and will continue until you stop accessing and using Platform, unless ended earlier as described below. If you are accepting these Terms or accessing or using Platform on behalf of an entity, you represent and warrant that you have the authority to bind such entity to these Terms and you agree on behalf of such entity to be bound by these Terms (and for clarity, all other references to “you” in these Terms refer to such entity). For clarity, these Terms updated and replaced the Facebook Platform Policy and the Instagram Platform Policy and any references in existing terms, policies, or agreements to the “Facebook Platform Policy,” “Instagram Platform Policy,” or “Platform Policy” shall now mean these Terms.
e. If you fail to comply with these Terms or any other applicable terms or policies, we may suspend or terminate your App or account, as described below.
f. Capitalized terms not otherwise defined herein have the meaning given in our other terms and policies, including our Terms of Service and our Facebook Commercial Terms. The term “including” means “including without limitation.”
2. Intellectual Property Rights
a. Our License to You. Subject to your compliance with these Terms and all other applicable terms and policies, we grant you a limited, non-exclusive, non-sublicensable (except to Service Providers as described below), non-transferable, non-assignable license to use, access, and integrate with Platform, but only to the extent permitted in these Terms and all other applicable terms and policies. You will not sell, transfer, or sublicense Platform to anyone. Except as expressly licensed herein, you will not use, access, integrate with, modify, translate, create derivative works of, reverse engineer, or otherwise exploit Platform or any aspect thereof. The Facebook Companies reserve all rights, title, and interest (including the right to enforce any such rights) not expressly granted in these Terms.
b. Your License to Us:
i. Your Content:
- You grant us a non-exclusive, transferable, sublicensable, royalty-free, worldwide license to: host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of any information, data, and other content made available by you or on your behalf (including by your Service Providers or through your App) in connection with Platform (collectively, “Your Content”) for any business purpose in connection with operating, providing, or improving Platform or any other Facebook Product. This license remains in effect even if you stop using Platform. Without limitation, your license to us includes: the right to incorporate Your Content into other parts of Facebook Products, the right to attribute the source of Your Content using your name, trademarks, or logos; the right to use Your Content for promotional purposes, and the right to analyze Your Content (including to make sure you’re complying with these Terms and all other applicable terms and policies).
- If you use the Facebook Business Tools to send us Business Tool Data, our use of that data is governed by the Business Tools Terms rather than the foregoing license for Your Content.
- If you owned Your Content before providing it to us, you will continue owning it after providing it to us, subject to any rights granted in these Terms or any other applicable terms or policies and any access you provide to others by sharing it via Platform.ii. Your App:
- You grant us a non-exclusive, transferable, sublicensable, royalty-free, worldwide license to: host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of your App for any business purpose in connection with operating, providing, or improving Platform. This license remains in effect even if you stop using Platform. Without limitation, the foregoing license includes the right to frame or link to your App, to place content (including ads) around your App, and to analyze your App (including to assess your compliance with these Terms and all other applicable terms and policies).
- As between the parties, in connection with Platform, we won’t be subject to any terms or policies associated with your App or Your Content (even if we click or tap agreement). Those terms and policies are considered null and void and are rejected and excluded from these Terms.
- Nothing in these Terms will be interpreted as a representation or agreement that we will not develop or have not developed apps, products, features, or services that are similar to your App or compete with your App.iii. Your Name, Trademarks, and Logos: You grant us a non-exclusive, transferable, sublicensable, royalty-free, worldwide license to use your name, trademarks, and logos for distribution, marketing, and promotional purposes, in connection with your use of Facebook Products, in all formats and media. This license remains in effect for existing materials and instances even if you stop using Platform.c. Protecting the Rights of Others:i. You will not provide or promote content in your App that infringes upon or otherwise violates the rights of any person or third party.ii. You will obtain (and represent and warrant that you own or have secured) all rights necessary from all applicable rights holders to (1) grant the licenses, rights, and permissions in these Terms; (2) display, distribute, and deliver all information, data, and other content in your App; and (3) otherwise operate your App. This includes satisfying all licensing, reporting, and payout obligations to third parties.iii. If your App contains content submitted or provided by your Users or other third parties, you must have an appropriate notice and takedown process and otherwise comply with all applicable laws and regulations to respond to notices of claimed infringement. Without limiting that compliance, in the United States, you must comply with all requirements of the Digital Millennium Copyright Act.
3. Data Use
a. Prohibited Practices. You will not perform, or facilitate or support others in performing, any of the following prohibited practices:
i. Processing Platform Data to discriminate or encourage discrimination against people based on personal attributes including race, ethnicity, color, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, medical or genetic condition, or any other categories prohibited by applicable law, regulation, or Facebook policy.
ii. Processing Platform Data to make eligibility determinations about people, including for housing, employment, insurance, education opportunities, credit, government benefits, or immigration status.
iii. Processing Platform Data to perform, facilitate, or provide tools for surveillance.
iv. Selling, licensing, or purchasing Platform Data.
v. Placing Platform Data on, or otherwise making Platform Data available to, a search engine or directory without our prior express written consent.
vi. Attempting to decode, circumvent, re-identify, de-anonymize, unscramble, unencrypt, or reverse hash, or reverse-engineer Platform Data that is provided to you.
vii. Changing your App’s core functionality or data Processing so that Users would view it as an unfamiliar or different App, or materially changing the scope of Processing of previously collected Platform Data, unless in each case you first re-submit your App and receive our approval through App Review.
viii. Processing friend lists from Facebook to establish social connections in your App unless each person in that connection has granted you access to that information for that purpose.
b. Additional Terms for Restricted Platform Data:
i. You will not request Restricted Platform Data unless it is necessary to meaningfully improve the quality of the applicable User's experience in the specific product or service for which the User shared the data.
ii. It must be clear to the User why you are requesting their Restricted Platform Data in order to improve the quality of their experience.
iii. For clarity, your Processing of Restricted Platform Data must comply with the applicable Developer Docs and other provisions of these Terms.
c. Sharing Platform Data. You may only share Platform Data in compliance with these Terms, applicable law and regulations, and all other applicable terms and policies, and only in the following circumstances:
i. With respect to Platform Data collected as a Tech Provider, solely as described below in Section 5.b (“Tech Providers”);
ii. With respect to Platform Data not collected as a Tech Provider:
- when required under applicable law or regulation;
- with your Service Provider;
- when a User expressly directs you to share the data with a third party; or
- solely with respect to Platform Data that is not Restricted Platform Data, with other third parties, so long as you contractually prohibit them from violating these Terms and ensure their compliance.d. Retention, Deletion, and Accessibility of Platform Data:i. Unless required to keep Platform Data under applicable law or regulation, you must:
- Make reasonable efforts to keep Platform Data up to date, including Platform Data that has been modified or deleted. You must update Platform Data promptly after receiving a request from us or the User to do so.
- Delete all Platform Data as soon as reasonably possible when retaining it is no longer necessary for a legitimate business purpose, when you stop operating the service, when requested by us or the User, or when required by law.ii. If you are required to keep Platform Data under applicable law or regulation, you must retain proof of the applicable requirement and provide it if we ask for it.iii. If you have received Platform Data in error, you must immediately report this to us, delete that Platform Data, and provide proof of deletion.e. Exceptions to Restrictions. The above provisions of this section do not apply to certain Platform Data as described here.
4. Privacy Policy
a. If you use Platform to Process Platform Data, you will provide and comply with a publicly available and easily accessible privacy policy.
b. This policy must comply with applicable law and regulations and must accurately and clearly explain what data you are Processing, how you are Processing it, the purposes for which you are Processing it, and how Users may request deletion of that data.
c. You may only Process Platform Data as clearly described in your privacy policy and in accordance with all applicable law and regulations, these Terms, and all other applicable terms and policies.
d. Your privacy policy will not supersede, modify, or be inconsistent with these Terms or any other applicable terms or policies.
e. You must retain all of your privacy policies in effect while using Platform and provide them to us if we ask for them.
f. You will maintain publicly available links to your privacy policies in the privacy policy field in the settings of your App Dashboard, as well as in any App Store that allows you to do so, if applicable, and ensure the links remain current and up to date.
5. Service Providers and Tech Providers
a. Service Providers:
i. You will not use a Service Provider in connection with your use of Platform or Processing of Platform Data unless such Service Provider first agrees in writing to Process Platform Data solely for you and at your direction.
ii. You must ensure that any Service Provider complies with these Terms, and you are responsible for their acts and omissions.
iii. When you cease using a Service Provider, you must ensure they immediately cease using Platform and promptly delete all Platform Data.
iv. Upon our request, you must provide a list of your Service Providers and proof of written agreements.
v. We may prohibit your use of any Service Provider if we believe they have violated these Terms or are negatively impacting Platform.
b. Tech Providers:
i. If you are a Tech Provider, you must comply with the provisions in this section with respect to your use of Platform as a Tech Provider.
ii. You will only use Platform and Process Platform Data on behalf of and at the direction of your Client to help such Client use Platform in accordance with these Terms, and not for your own purposes.
iii. You will ensure that Platform Data maintained on behalf of one Client is maintained separately from that of other Clients.
iv. You will maintain an up-to-date list of your Clients and provide it to us if requested.
6. Data Security
a. Data Security Requirements:
i. You must always maintain administrative, physical, and technical safeguards that meet or exceed industry standards, comply with applicable data protection laws, and prevent unauthorized processing or access.
ii. You must have a publicly available way for people to report security vulnerabilities in your App.
iii. You must not solicit, collect, store, cache, proxy, or use Facebook or Instagram login credentials of other Users.
iv. You must not transfer or share user IDs or your access token and secret key, except with a Service Provider helping you build or operate your App.
b. Incident Reporting:
i. You must promptly, and no later than 24 hours after becoming aware, notify us of any unauthorized Processing or security incident affecting Platform Data or IT Systems.
ii. You must immediately begin remediation and reasonably cooperate with us.
7. Compliance Review Rights and Suspension and Termination of these Terms
a. App Review. We may require that you submit your App for our review or approval (“App Review”). You will cooperate with our reviews and provide requested information.
b. Regular Monitoring. We or Third-Party Auditors may conduct regular monitoring of your App using technical and operational measures.
c. Auditing Rights. We or Third-Party Auditors may conduct an Audit, no more than once a calendar year (unless a Necessary Condition exists), to ensure compliance. You will cooperate with Audits.
d. Certifications. From time to time, we may request information, certifications, and attestations relating to your use of Platform or Processing of Platform Data.
e. Suspension and Termination. We may take enforcement action (including suspending or removing your App, or terminating access) if we believe you have violated these Terms, to comply with laws, or to protect Facebook Companies.
8. Notice
After you agree to these Terms, any written notice, request, or communications from us to you may be provided via email, mail, or in-product notifications. You will keep your contact information current.
9. Indemnification
You will indemnify and hold the Facebook Companies harmless from and against all damages, losses, and expenses (including reasonable legal fees) related to any claim, cause of action, or dispute brought by a third party related to your use of Platform, your Processing of Platform Data, Your Content, or your App.
10. International Transfers
This section applies to the extent that your Processing of Platform Data includes personal data controlled by Facebook Ireland Limited (“Facebook Ireland Data”) transferred outside the EEA. In such cases, you will comply with applicable transfer mechanisms, including Standard Contractual Clauses (SCCs) where Facebook Ireland Limited is the "data exporter" and you are the "data importer."
11. General
a. You will not transfer any of your rights or obligations under these Terms to anyone else without our prior written consent.
b. You must comply with all applicable laws and regulations (including COPPA and VPPA).
c. If there is any conflict between these Terms and any other applicable online terms, the terms that are more restrictive on you or more protective of us apply.
CONTACT US
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail [email protected] or [email protected], or using the contacts provided below:
Shark Byte Inc.
8271 NW 125th Ln, Parkland
FL 33076
Helpcenterapp.com
This Privacy Policy was last modified on: June 27th, 2022.
Exhibit A to HELP CENTER APP PRIVACY POLICY
DATA PROCESSING AGREEMENT
By starting to use Help Center app you (hereinafter referred to as “Controller”) conclude this Data Processing Agreement (hereinafter: “Agreement”), including its annexes, with Shark Byte Inc. (“Shark Byte”, “we”, “our”, “us”). Controller and us together are called the “Parties”,
Whereas:
- a) The Parties have agreed to be bound by Help Center App terms of service (hereinafter referred as “Terms and Conditions”),
- b) It is possible that in the course of using Help Center App as defined in the Terms and Conditions it may be necessary for us to process personal data received from or on behalf of the Controller, as defined under the Applicable Data Protection Law,
- c) According to the Article 28 (3) of the EU General Data Protection Regulation (hereinafter: “GDPR”) processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller,
the Parties have entered into this Agreement and agree as follows:
Definitions
1.1. For the purposes of this Agreement, the following definitions apply:
- (a) “GDPR” shall mean Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
- (b) “Applicable Data Protection Laws” means all applicable laws, regulations, legislative and regulatory requirements, and codes of practice applicable to the processing of personal data, including all the provisions of the GDPR, and any other relevant laws, regulations or instruments, as amended or superseded from time to time and together with any regulations or instruments made thereunder, that are applicable to a controller or processor.
- (c) “Personal Data” means any information relating to an identified or identifiable natural person (hereinafter “Data Subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of such a natural person.
- (d) “Controller(s)” is you, the natural or legal person whichever the case using Help Center App, that makes decisions individually or together with other parties regarding the purposes and means for processing Personal Data.
- (e) “Processor” is Aheadworks Inc. that processes Personal Data on behalf of the Controller.
- (f) “Third Party” means a natural or legal person, public authority, agency, or body other than the Data Subject.
- (g) The terms used in this Agreement such as “processing” (and “process”), “transfer of data”, “categories of data”, “personal data breach” and “technical and organizational measures” shall have the meaning ascribed to them in the Applicable Data Protection Laws.
- (h) The term “Services” shall have the meaning ascribed to it in the Terms and Conditions.
Subject matter of this Agreement
2.1. This Agreement specifies the obligations of the Parties in relation to the Controller’s and Processor processing of Personal Data on behalf of Controller(s) within the scope of and related to the Services.
Details of the personal data processing
3.1. If and to the extent that the Processor will be processing Personal Data in the course of the performance of the Services, an overview of the categories of Personal Data, categories of Data Subjects, and other details regarding processing is provided in Annex 1, insofar this is not already described in separate written binding communication between the Parties.
Obligations of the Processor / sub-processor
4.1. Processor shall process the Personal Data exclusively in the context of the Services and only to the extent and in the appropriate way necessary in order to provide Services.
4.2. Processor shall process Personal Data in accordance with this Agreement and Applicable Data Protection Laws and only upon the instructions of Controller, documented herein, including the transfer of Personal Data to a non-EU country, unless Processor is required to process the Personal Data under mandatory law.
4.3. In the event that a mandatory law prevents Processor from complying with such instructions or requires Processor to process and/or disclose the Personal Data to a Third Party, Processor shall inform Controller in writing of such legal requirement before carrying out the relevant processing activities and/or disclosing the Personal Data to a Third Party, unless Processor is prohibited under that law from informing Controller of such processing.
4.4. All Personal Data that Processor receives in the course of providing Services is confidential and Processor shall not provide or make the Personal Data in any other way available to any Third Party without Controller’s prior written consent.
4.5. Processor shall ensure that only those of its employees and other persons operating on behalf of Processor who have a need to know and are under confidentiality obligations with respect to the Personal Data, have access to the Personal Data.
Technical and Organizational Measures
5.1. Processor warrants that it maintains and shall continue to maintain appropriate and sufficient technical and organizational measures to protect Personal Data against accidental loss, destruction, damage, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
5.2. Taking into account the state of the art, the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor warrants that appropriate technical and organizational measures have been implemented in order to ensure a level of security appropriate to the risk, including inter alia as appropriate:
- 5.2.1. the pseudonymization and encryption of Personal Data;
- 5.2.2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
- 5.2.3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident.
5.3. Processor commits that it has implemented the procedure to control and identify unauthorized or illegal access or use of Personal Data. This includes regular testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing on an ongoing basis. Processor shall continuously enhance and improve such data protection measures.
5.4. At Controller’s request, Processor shall provide Controller with full details of the technical and organizational measures employed by it and/or any of its permitted sub-contractors. If, in Controller's opinion, the measures employed by the Processor and/or its permitted sub-processors are not sufficient to ensure compliance with their obligations under this Agreement, the Processor shall take all reasonable measures required by Controller to ensure that such compliance is achieved.
Responding to Data Subject and Third-Party requests
6.1. In the event that Processor receives a complaint, request, enquiry or communication from either a Data Subject, supervisory authority or Third Party which relates to the processing of Personal Data or to either Party's compliance with Applicable Data Protection Laws or this Agreement, Processor shall immediately, inform Controller according to internal procedures.
6.2. Processor shall respond to such requests, complaints, enquiries or communications according to internal procedures or shall provide Controller with full co-operation, information and assistance in relation to it, including but not limited to the correction, deletion and blocking of Personal Data.
Assistance with Controller compliance
7.1. Taking into account the nature of the processing, Processor shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights.
7.2. Taking into account the nature of processing and the information available to the Processor, Processor shall provide Controller any further assistance required to ensure compliance with Controller’s obligations under Applicable Data Protection Laws, including assisting Controller with the performance of any relevant data protection impact assessments and prior consultations with data protection supervisory authorities regarding high risk processing.
Information and audit
8.1. Processor agrees to provide Controller all information necessary to demonstrate compliance with the obligations laid down in this Agreement and to allow for and contribute to audits, including on-site inspections, conducted by Controller, Controller’s clients or another independent auditor commissioned by Controller and/ or Controllers and/or another independent auditor commissioned by Controller or Controller.
8.2. Such audits shall be announced within a reasonable period and shall take due care during their performance not to disturb regular business operations.
Personal Data breach notification
9.1. In respect of any Personal Data breach, Processor shall notify Controller of such a breach immediately, but in no event later than 48 (forty-eight) hours after becoming aware of the Personal Data breach and provide reasonable details pertaining the subject Personal Data breach.
9.2. Personal Data breach notification shall include, at the time of notification or as soon as possible after notification:
- 9.2.1. the description of the nature of the Personal Data breach including where possible, the categories and approximate number of data subjects concerned as well as the categories and an estimated number of Personal Data records concerned;
- 9.2.2. the name and contact details of the data protection officer or other contact point for further relevant inquiries;
- 9.2.3. the description of the likely consequences of the Personal Data breach;
- 9.2.4. the description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.
9.3. Processor shall provide all necessary resources and assistance at its own expense to Controller in relation to any action to be taken in response to such Personal Data breaches under Applicable Data Protection Laws.
9.4. Unless required by mandatory law, Processor shall not disclose nor publish any statement, communication, notice, press release or report regarding a Personal Data breach, nor notify Data Subject or data protection authorities, without Controller’s prior written consent.
Sub-contracting
10.1. Controller gives general authorization to the Processor to engage another sub-contractor for carrying out specific processing activities under this Agreement, provided that Processor shall impose the same data protection obligations as set out in this Agreement on that other sub-contractor by written contract.
10.2. Where Processor sub-contracts its obligations under this Agreement it shall do so only by way of a binding contract with the sub-contractor which imposes similar obligations as those set in this Agreement.
International data transfers
11.1. Controller acknowledges and agrees that Processor’s primary data hosting, server infrastructure, and databases are located in the United States of America (Chicago, IL) outside the European Economic Area (EEA). By using the App, Controller explicitly instructs and authorizes Processor to transfer and store Personal Data on servers located in the United States (Chicago, IL).
11.2. Where the performance of the Services involves the transfer of Personal Data originating from the EEA, United Kingdom, or Switzerland to servers or sub-processors outside these regions, Processor shall ensure an adequate level of data protection in compliance with Applicable Data Protection Laws.
11.3. Controller authorizes Processor to enter into any agreements or execute standard transfer mechanisms to ensure adequate data safeguards for international transfers. In particular, transfers of Personal Data from the EEA to the United States are governed by the EU Standard Contractual Clauses (SCCs) set out in Annex 2, with mandatory compliance required for all processing operations in third countries.
11.4. In the event of any conflict or inconsistency between the terms of this Agreement and the EU Standard Contractual Clauses, the provisions of the EU Standard Contractual Clauses shall control.
Indemnification
12.1. The Processor's liability toward the Controller with regard to culpable breaches of this Agreement shall be based on the statutory provisions. Any limitations of liability agreed elsewhere shall not apply to this Agreement.
12.2. To the fullest extent permissible by law, Shark Byte’s total liability for all damages arising out of or related to the Agreement shall not exceed the total amount of fees paid by Controller to us under the Terms and Conditions with respect to the then-current subscription term.
12.3. Shark Byte shall not be liable for any lost profits, loss of business opportunity, loss of data, or any direct, indirect, incidental, special, incidental, consequential, exemplary or punitive damages, resulting from the infringement of this Agreement. Aheadworks shall not be liable or responsible, nor be considered to have defaulted or breached this Agreement, for any failure or delay in fulfilling or performing any provision of this Agreement to the extent such failure or delay is caused by or results from any act, circumstance or other cause beyond the reasonable control, including flood, fire, earthquake, explosion, governmental actions, war, invasion or hostilities (whether war is declared or not), terrorist threats or acts, riot, or other civil unrest, national emergency, revolution, insurrection, epidemic, lockouts, strikes or other labor disputes, or restraints or delays affecting carriers or inability or delay in obtaining supplies of adequate or suitable technology or components, telecommunication breakdown, or power outage (force majeure).
Term and termination, deletion and return of personal data
13.1. This Agreement shall come into effect upon Controller starting using Help Center App and shall be valid for the duration of the actual provision of Services by the Processor. The Agreement automatically terminates upon termination of the Terms and Conditions.
13.2. Following the expiry or termination of this Agreement for any reason Processor shall, at the instruction of Controller:
- 13.2.1. comply with any other agreement made between the Parties concerning the return or deletion of Personal Data, if any; or
- 13.2.2. securely delete all Personal Data passed to Processor by Controller for processing, unless prohibited from doing so by mandatory law, in which case Processor shall inform Controller of any such requirement unless prohibited by that applicable law. Processor shall not retain any copies of the Personal Data in any form what so ever, with the only exception being as expressly required as per mandatory laws, and even then, solely for the duration and the purposes required by the same.
Miscellaneous
14.1. Where individual provisions of this Agreement are invalid or unenforceable, the validity and enforceability of the other provisions of this Agreement shall not be affected.
Annexes
15.1. The following Annexes are integral parts of this DP Agreement:
- 15.1.1. Annex 1: Details about Personal Data processing
- 15.1.2. Annex 2: STANDARD CONTRACTUAL CLAUSES (PROCESSORS)
ANNEX 1 TO DATA PROCESSING AGREEMENT – DETAILS OF THE PERSONAL DATA PROCESSING
ANNEX 2 TO DATA PROCESSING AGREEMENT – STANDARD CONTRACTUAL CLAUSES (PROCESSORS)
For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection
Name of the data exporting organization: Any of Shark Byte Inc. or its Affiliates, which may be parties to the Services Agreement.
Address: The address shall be the address that is listed in the Privacy Policy.
(the data exporter)
And
Name of the data importing organisation: Shark Byte Inc. subprocessor
Address: 12495 S Parkland Bay Trail, Parkland, FL, 33076, USA
(the data importer)
each a “party”; together “the parties”, HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.
Clause 1: Definitions
For the purposes of the Clauses:
- (a) 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
- (b) 'the data exporter' means the controller who transfers the personal data;
- (c) 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
- (d) 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
- (e) 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
- (f) 'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
Clause 2: Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.
Clause 3: Third-party beneficiary clause
- The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
- The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
- The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
- The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.
Clause 4: Obligations of the data exporter
The data exporter agrees and warrants:
- (a) that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
- (b) that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;
- (c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
- (d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
- (e) that it will ensure compliance with the security measures;
- (f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
- (g) to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
- (h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
- (i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
- (j) that it will ensure compliance with Clause 4(a) to (i).
Clause 5: Obligations of the data importer
The data importer agrees and warrants:
- (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
- (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
- (c) that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
- (d) that it will promptly notify the data exporter about:
- (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;
- (ii) any accidental or unauthorised access, and
- (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
- (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
- (f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members;
- (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing;
- (h) that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
- (i) that the processing services by the subprocessor will be carried out in accordance with Clause 11;
- (j) to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.
Clause 6: Liability
- The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
- If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter.
Appendix 1 to the Standard Contractual Clauses
This Appendix forms part of the Clauses and must be completed and signed by the parties.
- Data exporter: The data exporter is the merchant using the Help Center App in connection with their Shopify or Magento / Adobe Commerce store.
- Data importer: The data importer is Aheadworks Inc. subprocessor, a provider of customer support, FAQ builder, and Help Desk ticketing software.
- Data subjects: The personal data transferred concerns Controller’s end customers (site visitors, buyers) and authorized Staff Users (support agents).
- Categories of data: As specified in Annex 1 of this Data Processing Agreement (including store details, customer contact profiles, physical shipping addresses, order histories, line items, tracking numbers, and technical log data).
- Processing operations: Personal data will be processed to deliver customer service management, helpdesk ticketing, live chat, FAQ knowledge base, product tabs, and order tracking functionalities.
Appendix 2 to the Standard Contractual Clauses
This Appendix forms part of the Clauses and must be completed and signed by the parties.
Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):
Please refer to DPAgreement, section 5.
SIGNATURE BLOCK TO STANDARD CONTRACTUAL CLAUSES
DATA EXPORTER
Name: [Merchant / Customer Name]
Authorised Signature: ...........................................................................................
DATA IMPORTER
- Name: Shark Byte Inc. subprocessor
Authorised Signature: ...........................................................................................