Quizproof Data Processing Addendum

Effective: since this version was published

This Data Processing Addendum ("DPA") forms part of the Quizproof Terms of Service between the merchant that installs the Quizproof Shopify app ("Merchant", "you") and Quizproof Labs ("Quizproof", "we"). It applies to personal data that Quizproof processes on your behalf when you use the app, and it takes precedence over the Terms where they conflict on data protection. Installing or continuing to use Quizproof is acceptance of this DPA.

1. Definitions

"GDPR" means Regulation (EU) 2016/679, and "UK GDPR" its United Kingdom version. "Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA), and any other privacy law that applies to the processing. "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the GDPR. "Shopper Data" means the Personal Data described in section 3.

2. Roles

You are the Controller of Shopper Data, and Quizproof is your Processor. For data about you and your staff that we need to run our business (your account, support, billing state), Quizproof is a Controller, as described in our Privacy Policy. Under the CCPA, Quizproof is your service provider: we do not sell or share Shopper Data, and we do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the app.

3. Details of the processing

4. Your instructions

We process Shopper Data only on your documented instructions, which are these Terms, this DPA, and your configuration and use of the app (for example connecting Klaviyo, turning on "save to customer" for a question, or setting the retention period). We will tell you if we believe an instruction infringes Data Protection Law. We may process Shopper Data otherwise only where law requires it, and then we will tell you first unless the law forbids it.

5. Your responsibilities

You are responsible for having a lawful basis for the processing; for the content of your quizzes and opt-in wording; for your store's privacy policy and cookie banner telling shoppers about the quiz, the opt-in and analytics; for the shopper consent you rely on; and for answering your Data Subjects, using the tools in section 9.

6. Our obligations (GDPR Article 28(3))

Quizproof will:

1. process Shopper Data only on your documented instructions (section 4);
2. ensure that anyone authorised to process Shopper Data is bound by confidentiality. Today that is only Quizproof Labs' operator;
3. take the security measures in section 8;
4. engage sub-processors only under section 7;
5. assist you, as far as the nature of the processing allows, in responding to Data Subject requests (section 9);
6. assist you with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us;
7. delete Shopper Data at the end of the service (section 10);
8. make available the information needed to demonstrate compliance with this section and allow audits (section 12).

7. Sub-processors

You authorise the sub-processors below. Each is bound by written terms that protect Shopper Data at least as well as this DPA.

The infrastructure that holds the database is rented from Hetzner in Germany and operated by us; Hetzner provides the infrastructure only (listed above). Our own backup site in the European Union, also operated by us, keeps encrypted backups and can also run the service; it is not a sub-processor.

Not sub-processors. Shopify is the platform you contract with directly; data we send to or receive from your store is under your agreement with Shopify. Klaviyo receives Shopper Data only from your own Klaviyo account connection, on your instruction, under your agreement with Klaviyo.

Changes. We will give you at least 30 days' notice of a new or replacement sub-processor by email to the store owner's address and by updating this page. If you object on reasonable data protection grounds within that period, we will work with you in good faith on a solution; if there is none, you may stop using the app and uninstall it, which ends the processing under section 10.

8. Security measures

• Encryption in transit: HTTPS only (TLS) for every request to Quizproof and every call we make to Shopify, Klaviyo and our sub-processors.
• Encryption at rest: the database, export files and backups on the server live on a LUKS2-encrypted partition; Shopify and Klaviyo access tokens and export files are additionally encrypted by the app (AES-256-GCM).
• Backups: hourly, encrypted with age on the server before they are written anywhere else, kept up to 30 days in the European Union, and restore-tested.
• Access control in the app: a store setting lets only the store owner view and export respondent data; other staff are refused, with an explanation.
• Access logging: every view, export and download of respondent data and every data request export, allowed or refused, is logged with the staff member, shown to you under Settings › Privacy, and kept for one year.
• Exports: created only on request, stored encrypted on our server (never with a third party), and deleted after 24 hours; the download link expires with them.
• Least privilege: the app requests only the Shopify scopes it needs; customer write access is an optional scope requested only when you turn on email opt-in. Administrative access to our servers is limited to the operator.
• Minimisation: no names, postal addresses or payment data; IP addresses are stored only as a salted hash for one hour; email addresses are matched by salted hash; logs and error reports are scrubbed of email addresses, phone numbers and credentials; the web server's access log drops query strings and is kept 7 days.
• Separation: each store's data is scoped to that store; test and production run on separate virtual machines with separate databases and secrets.
• Incident response: a written procedure with severities, containment, evidence preservation and notification (section 11).

9. Data Subject requests

Shopify forwards your customers' requests to us. For a data request (customers/data_request) we prepare a JSON export of the shopper's quiz sessions, answers and consents, available to the store owner under Settings › Privacy (link valid 24 hours), for you to send to the shopper. For a deletion request (customers/redact) we act as described in section 10. You can also view a respondent's data and change the answer retention period in the app. If a shopper contacts us directly, we will refer them to you and will not respond on your behalf unless you instruct us.

10. Deletion and return

• Customer deletion (customers/redact). We start at once and complete within 30 days of Shopify's request: the shopper's quiz sessions are anonymised (answers, email hash and customer ID removed; counts remain), their consent records deleted, their email, phone and hashes cleared from queued and past deliveries, pending deliveries cancelled, and exports that contain them deleted. If your Klaviyo account is connected, we ask Klaviyo to delete each profile we created or updated for that shopper and check until Klaviyo confirms, for up to 30 days. Profiles in a Klaviyo account that is no longer connected cannot be reached by us; we record that, and you remain responsible for that account.
• Store deletion (shop/redact, sent by Shopify 48 hours after you uninstall). We delete all Shopper Data and your store's other data: sessions, answers, consents, opt-in deliveries, order attributions, exports and their files, the access log, and Klaviyo connection data. We keep only data without Personal Data: a minimal record that the store existed (domain, Shopify shop ID, install count), the current and previous month's completion counts, and a record of the deletion. Data already in your Shopify store or your Klaviyo account is yours and is not deleted by us. If you reinstall before Shopify's request, nothing is deleted.
• Uninstall. Our Shopify and Klaviyo access tokens for your store are deleted at once, so no further data flows.
• Backups. Deleted data remains only in encrypted backups until they expire, within 30 days. Backups are used only to recover from data loss. We keep a record of every deletion outside the backups, and if we ever restore a backup we re-apply every deletion made after that backup was taken before the service resumes.
• Return. Before you uninstall, you can export respondent data from the app. On request we will provide a copy of Shopper Data we still hold.

11. Personal Data Breach

We will notify you without undue delay, and in any case within 72 hours of becoming aware of a Personal Data Breach affecting your Shopper Data, by email to the store owner's address. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of Data Subjects and records, the likely consequences, the measures taken or proposed, and a contact. We will provide further information as it becomes available and cooperate with your notifications to authorities and Data Subjects. We also notify Shopify as Shopify requires.

12. Audits

On written request, no more than once a year (or after a Personal Data Breach), we will answer reasonable security questionnaires and provide the information needed to demonstrate compliance with this DPA. If that is insufficient for a requirement of Data Protection Law, you may audit our compliance yourself or through an independent auditor bound by confidentiality, on 30 days' notice, at your cost, in a way that does not compromise other merchants' data or our security.

13. International transfers

Shopper Data is stored on our servers in the European Union. Where a sub-processor processes it outside the EU, EEA, UK or Switzerland, or is based in a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (Module 3, processor to processor) and, for UK data, the UK International Data Transfer Addendum, or by the EU-US Data Privacy Framework where the recipient is certified.

14. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow it. This DPA lasts as long as we process Shopper Data for you.

15. Contact

Quizproof Labs — support@quizproof.app