Data processing agreement
1. Parties and scope
This Data Processing Agreement ("DPA") applies between the Merchant who installs Sigura: COD Confirmation (the "Controller") and Niche Kit (the "Processor") whenever the Processor processes personal data of the Controller's customers on the Controller's behalf. It forms part of the Terms of Service (/terms). Installing the app is the Controller's acceptance of this DPA.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Confirming Cash on Delivery orders over WhatsApp and recording the result on the Shopify order. |
| Duration | While the app is installed, plus the deletion periods in section 9. |
| Nature and purpose | Receiving order data from Shopify, sending messages through the Controller's WhatsApp Business account, collecting replies and delivery details, storing them and writing them back to the order. |
| Categories of data subjects | The Controller's customers who place COD orders, and people they nominate as an alternate contact. |
| Types of personal data | Phone number, first name (transient), order number and total, delivery country and city, products ordered, address details entered by the customer (building, floor, apartment, landmark or area), contact preference, alternate phone number, replies and timestamps, optional map location (off by default), and message delivery status. |
| Special categories | None intended. The Controller must not ask customers for special-category data through the app. |
3. Controller's instructions
The Processor processes personal data only on the Controller's documented instructions, which are these terms and the Controller's configuration of the app, unless the law requires otherwise, in which case the Processor will tell the Controller first if the law allows.
The Controller is responsible for the lawfulness of the processing, including having a legal basis and any consent or opt-in needed to message customers on WhatsApp, and for giving customers the required notices.
4. Confidentiality
Everyone who may access the personal data is bound by confidentiality and may access it only as needed to run and support the app.
5. Security measures
- Encryption of phone numbers, address details, locations and credentials at application level (AES-256-GCM), encryption in transit (TLS), and keys held in secret storage separate from the database.
- Separation of test and production data.
- Access limited to people who need it, with strong, unique credentials and multi-factor authentication where the provider supports it.
- Automatic deletion by retention period, and deletion on uninstall and on Shopify privacy requests.
- Verification of the signature on every webhook from Shopify and, where the Controller supplies the app secret, from Meta.
- A written incident response procedure.
6. Sub-processors
The Controller authorises the sub-processors listed in the Privacy Policy (/privacy, section 5): Shopify, Meta Platforms (WhatsApp Business Platform), and the hosting and database providers named there. The Processor remains responsible for them, imposes data protection obligations no weaker than these, and will update the Privacy Policy before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds by contacting the Processor, and if the issue cannot be solved the Controller may uninstall the app.
7. Helping the Controller
Taking into account the nature of the processing, the Processor helps the Controller respond to requests from customers exercising their rights (access, correction, erasure, restriction, portability, objection), and with security, breach notification and impact assessments, to the extent the Controller cannot do so itself. The Processor processes the three Shopify privacy requests (customer data request, customer erasure, shop erasure). If a customer contacts the Processor directly, the Processor will refer them to the Controller.
8. Personal data breaches
The Processor will notify the Controller without undue delay, and aims to do so within 72 hours, after becoming aware of a breach affecting the Controller's personal data, with the information it then has about the nature of the breach, the data and people affected, likely consequences and steps taken.
9. Deletion and return
The Processor deletes order, reply and message records after the retention period the Controller sets in the app (default 90 days). On uninstall it deletes credentials, scheduled jobs and sessions immediately, and all other data when Shopify sends the shop erasure request. On request the Processor gives the Controller a copy of the personal data it holds before deletion.
10. Audits
On reasonable written request, and no more than once a year unless there has been a breach, the Processor gives the Controller the information needed to show compliance with this DPA, and allows reasonable audits by written questionnaire. On-site audits require agreement on scope and timing and are at the Controller's cost.
11. International transfers
Personal data is hosted in Fly.io (Frankfurt, Germany). Where the Controller is subject to a law that restricts transfers (for example the GDPR, the UK GDPR, Egypt's Personal Data Protection Law, or Saudi or UAE data protection laws), the parties agree that the transfer mechanism recognised by that law applies. For GDPR and UK GDPR transfers the parties incorporate by reference the European Commission's Standard Contractual Clauses (and the UK Addendum), module two (controller to processor), with the details in this DPA as their annexes.
12. Liability, term and contact
Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow this. This DPA lasts as long as the Processor processes the Controller's personal data. If there is a conflict between this DPA and the Terms about personal data, this DPA prevails.
Niche Kit, Cairo, Egypt. Email: support@nichekit.app.