Data processing agreement
This agreement applies between the merchant who installs Kukis (the controller) and Kukis (the processor). It is accepted in the app during onboarding, and the acceptance is recorded with a timestamp.
1. Subject and duration
Kukis processes personal data of the merchant's shoppers only to provide the app: capturing an email address with consent, storing the consent record, sending the requested email, and the reporting the merchant sees in the admin. It lasts as long as the app is installed, plus the deletion period in section 7.
2. The merchant's instructions
Kukis processes shopper data only on the merchant's documented instructions. Installing the app, configuring it, and the choices made in its settings are those instructions. Kukis does not sell shopper data, does not use it to train models, and does not use it for its own marketing.
3. Categories of data and data subjects
- Data subjects: shoppers and visitors of the merchant's store.
- Data: email address and its hash; consent records with the exact wording, version, language, timestamp, page and cookie choice; saved cart, product or wishlist contents; shortened IP address and user agent; email delivery events; and, where the merchant enables Shopify customer sync, the Shopify customer ID and marketing status.
- No special categories of data are processed.
4. Confidentiality
Everyone with access is bound by confidentiality, has their own account with two-factor login, and gets access only where needed.
5. Security
Encryption in transit and at rest; tokens stored only as hashes; logs scrubbed of personal data; access limited and recorded; backups at the database provider; and a written incident response procedure that is tested.
6. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Shopify | Store platform the app runs in | Global |
| Fly.io, Inc. | Application hosting | Frankfurt, Germany (US company) |
| Neon | Database hosting | Frankfurt, Germany |
| Resend | Email delivery | United States |
| Sentry | Error reporting, scrubbed, optional | EU region |
The merchant gives general authorisation for these sub-processors. Kukis gives notice before adding or replacing one, and the merchant may object. Transfers to the United States rely on the EU Standard Contractual Clauses.
7. Deletion and return
Retention windows are set by the merchant in the app. On uninstall, Kukis follows Shopify's redaction requests and erases the shop's data. A merchant can export their consent log and contacts at any time from the app.
8. Assistance
Kukis helps the merchant answer data subject requests, including Shopify's automated customer data requests, and helps with security, breach notification and data protection impact assessments, in proportion to the processing.
9. Breach notification
Kukis notifies the merchant without undue delay after becoming aware of a personal data breach, and in any case within 24 hours of confirming that personal data is affected, with the facts known at that time.
10. Audits
Kukis makes available the information needed to show compliance with this agreement, and supports audits by the merchant or an auditor they appoint, on reasonable notice and at most once a year unless required by a supervisory authority.
11. Liability and law
This agreement follows the law of the merchant's main establishment unless otherwise agreed. Liability is as set out in the terms and conditions between the parties.
Contact
Kukis — main@kukis.nl
Registered with the Dutch Chamber of Commerce (KvK) under number 42138940
See also the privacy policy.