Data processing addendum

Introduction and incorporation

This data processing addendum (the "addendum") forms part of the terms of service available at /terms (the "agreement") between you (the merchant) and Zobi OÜ, a private limited company (osaühing) incorporated in Estonia with registered office at Maakri 23a, Tallinn, Estonia, operating the Zobi service ("Zobi", "we", "us"). The addendum applies wherever Zobi processes personal data on the merchant's behalf in the course of providing the service, including when the service messages the merchant's customers and prospects over iMessage, with SMS and RCS fallback, to recover checkouts and drive repeat purchases.

For the purposes of applicable data protection law, the merchant is the controller and Zobi is the processor with respect to the personal data described in Annex 1. The merchant alone determines the purposes and means of the processing; Zobi acts only as a processor on the merchant's documented instructions. Where there is a conflict between the addendum and the rest of the agreement on the subject of data protection, the addendum prevails to the extent of that conflict.

The addendum takes effect when the merchant accepts the terms of service or first uses the service, whichever is earlier, and remains in force for as long as Zobi processes personal data on the merchant's behalf.

Definitions

Terms used in this addendum have the meanings given to them in applicable data protection law. For convenience:

• Controller means the party that determines the purposes and means of the processing of personal data; here, the merchant.
• Processor means the party that processes personal data on behalf of the controller; here, Zobi OÜ, operating Zobi.
• Personal data means any information relating to an identified or identifiable natural person that Zobi processes on the merchant's behalf under the agreement.
• Processing means any operation performed on personal data, such as collection, storage, use, disclosure, or erasure.
• Data subject means the identified or identifiable natural person to whom the personal data relates.
• Sub-processor means any third party engaged by Zobi to process personal data on the merchant's behalf.
• Applicable data protection law means all data protection and privacy laws that apply to the processing under the agreement, including the EU General Data Protection Regulation (GDPR) and the UK GDPR where relevant.

This addendum is intended to be read consistently with GDPR Article 28.

Scope and roles

Zobi processes personal data only on the merchant's documented instructions, including with regard to international transfers of personal data, unless Zobi is required to process by law to which it is subject. Where Zobi is required to process by law, it will inform the merchant of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The merchant's instructions are set out in the agreement, in this addendum, and in the configuration and use of the service. The merchant is responsible for ensuring it has a lawful basis to collect the personal data and to instruct Zobi to process it, and for the accuracy and legality of the personal data and instructions it provides.

Zobi may use aggregated statistics derived from the personal data to improve the service only once they are anonymised, so that they no longer relate to an identified or identifiable person, and only as far as Shopify's API terms allow for data that came from Shopify (section 10.4 of the terms of service).

No Edge Checkout data is collected on the checkout pages Zobi hosts for the merchant unless Edge Checkout is switched on for its store at the merchant's request (section 11.1 of the terms of service). This addendum does not apply to Edge Checkout data. "Edge Checkout data" means the details a shopper saves under the Edge Checkout Terms for one-reply checkout. For that data, the Edge Checkout provider (Zobi OÜ) acts as an independent controller under the Edge Checkout Terms and Privacy Notice and section 11.7 of the terms of service. Your own permission to charge a shopper's saved card (section 11.4 of the terms of service: your own orders and subscriptions the shopper signed up for at your store), and the order, address and payment details collected on a checkout page we host for you, are your data and stay under this addendum, whether or not the shopper also saved them with Edge Checkout.

Processing on instructions

Zobi processes personal data only on the merchant's documented instructions, including those given through the configuration and ordinary use of the service. The merchant is responsible for issuing instructions that comply with applicable data protection law.

If Zobi considers that an instruction infringes applicable data protection law, it may inform the merchant, though Zobi is not obliged to provide legal advice on the merchant's compliance and is not obliged to follow any instruction it reasonably considers to be unlawful. Zobi may suspend the affected processing, in whole or in part, until the instruction is withdrawn, amended, or confirmed in writing, without liability for any resulting interruption to the service.

Any processing that the merchant requests beyond the documented instructions, or that departs from the standard configuration of the service, is carried out at the merchant's sole risk and cost, and only where Zobi agrees in writing to perform it. Zobi may charge for such additional processing on a time-and-materials basis at its then-current rates.

Controller warranties and who covers what

The merchant warrants and undertakes, on a continuing basis, that:

• it has, and will maintain throughout the term, a valid lawful basis under applicable data protection law for the collection of the personal data and for instructing Zobi to process it for the purposes of the service, including any consent or other lawful basis required for sending marketing or transactional messages over iMessage, SMS, and RCS;
• it has provided all notices, obtained all consents, and met all transparency and opt-out/unsubscribe requirements required of it as controller in relation to the data subjects and the processing, including under applicable electronic-communications and telemarketing laws;
• its instructions, and Zobi's processing of personal data in accordance with those instructions and the standard operation of the service, will not cause Zobi to breach applicable data protection law; and
• the personal data it provides or makes available is accurate and lawfully obtained, and the merchant is entitled to disclose it to Zobi and its sub-processors for the purposes of the service.

Each party covers claims (in the sense of section 18.1 of the terms of service) to the extent they come from its own part. The merchant covers claims that come from: (a) the merchant's breach of the warranties above or of its obligations as controller; (b) the absence of a lawful basis, consent, or required notice for the personal data or the instructions; (c) any instruction given by the merchant that is unlawful or that causes Zobi to act in breach of applicable data protection law; or (d) the inaccuracy or unlawful provision of personal data by the merchant. Zobi covers claims that come from its processing of personal data outside or contrary to the merchant's lawful documented instructions, or from its breach of the obligations that applicable data protection law places on processors (GDPR Article 82(2)). Where both parties played a part in a claim, each pays in proportion to its share (section 18.4 of the terms of service).

These obligations count toward the caps in section 17 of the terms of service: the merchant's within section 17.3, and Zobi's within section 17.2, in each case with the exceptions in section 17.4.

Shared safeguard lists

To keep unwanted messages from reaching anyone through any Zobi store, Zobi keeps a small set of lists that are shared across all merchants (section 10.3 of the terms of service). For these lists Zobi acts as an independent controller, on the basis of its legitimate interest in preventing unwanted and unlawful messages (GDPR Article 6(1)(f)). The lists hold:

• the phone number or email address of a person who asked any Zobi store to stop, with when they asked, the store they asked and how;
• US phone numbers checked against a litigator suppression list from a specialist provider, with the result and when it was checked;
• phone numbers and email addresses that Zobi has been asked never to contact.

Zobi uses these lists only to stop or hold back messages, never to start a conversation, to choose whom to message, or for any other purpose. A stop request and a never-contact entry are kept for as long as Zobi provides the service, because deleting one would let messages start again. A litigator check result is refreshed from time to time and deleted when that person's data is erased.

Details of processing (Annex 1)

This Annex 1 describes the processing carried out by Zobi on the merchant's behalf.

Subject matter

Provision of the service, namely automated and assisted messaging to the merchant's customers and prospects to recover abandoned checkouts and encourage repeat purchases.

Duration

For the term of the agreement, plus any additional period during which Zobi is required or permitted to retain personal data under this addendum or applicable law.

Nature and purpose

Receiving and storing order, checkout, and cart data; generating message content (including with the assistance of a third-party AI model provider); sending and receiving messages over iMessage, SMS, and RCS; and the related hosting, logging, support, and analytics necessary to provide and improve the service for the merchant; and hosting checkout pages on the merchant's behalf, including collecting order, address and payment details for the merchant's own order.

Types of personal data

• Names
• Phone numbers
• Email addresses
• Message content exchanged with data subjects over iMessage, SMS, and RCS
• Order, checkout, and cart data relating to the merchant's customers and prospects
• Billing and shipping addresses; payment card data entered on a hosted checkout page (stored by the card vault provider or the merchant's own payment processor; Zobi holds the card brand, last four digits, expiry, cardholder name and the vault's card fingerprint, never the full card number)

Categories of data subjects

• The merchant's customers
• The merchant's prospects and leads (including those who abandon a checkout or sign up)

Confidentiality

Zobi ensures that the personnel authorized to process the personal data are bound by an appropriate duty of confidentiality, whether by contract or by statutory obligation, and that access to personal data is limited to personnel who need it to provide the service.

Security measures (Annex 2)

Zobi implements and maintains technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as required by GDPR Article 32. These measures are commercially reasonable and appropriate rather than absolute, may evolve over time, and do not amount to a guarantee that personal data will be completely secure; no method of transmission or storage is completely secure. Current measures include:

• Encryption of personal data in transit;
• Access controls and least-privilege principles restricting access to personal data;
• Hosting within the EU on DigitalOcean (Amsterdam) and DigitalOcean Spaces;
• Regular backups of the systems that store personal data;
• Logging and monitoring of relevant system activity;
• Vendor management and review of sub-processors that handle personal data.

Zobi may update these measures from time to time provided the updates do not materially reduce the overall level of protection for the personal data. The merchant is responsible for the security of its own systems, store, accounts, and credentials, for controlling access to the service on its side, and for assessing whether the measures described here are appropriate for the personal data it chooses to process through the service. Where the merchant requires specific additional security measures, the parties may agree them in writing, at the merchant's cost.

Sub-processors

The merchant gives Zobi general written authorization to engage sub-processors to process personal data in connection with the service. The current list of sub-processors is published at /subprocessors.

Where Zobi intends to add or replace a sub-processor, it will give the merchant notice by email and update the list at /subprocessors. The merchant may object to a new sub-processor on reasonable data-protection grounds by written notice within ten (10) days of that notice. The parties will work in good faith to resolve the objection; if it cannot be resolved within a reasonable period, the merchant's sole and exclusive remedy is to terminate the part of the service that requires the use of that sub-processor. Absent a timely written objection, the merchant is deemed to have authorized the new or replacement sub-processor.

Zobi imposes data-protection terms on each sub-processor that are no less protective than those in this addendum to the extent applicable to the sub-processor's services. Zobi remains responsible to the merchant for a sub-processor's performance of its data-protection obligations only to the extent required by GDPR Article 28(4), and not further.

International transfers

Where Zobi transfers personal data outside the European Economic Area, it relies on an appropriate transfer mechanism under applicable data protection law, namely the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with the UK addendum or international data transfer agreement where the transfer is subject to the UK GDPR, or another appropriate safeguard. Details of where personal data is processed are reflected in the sub-processor list at /subprocessors.

Data subject requests

Taking into account the nature of the processing and the information available to Zobi, Zobi assists the merchant by appropriate technical and organizational measures, insofar as this is possible, in responding to requests from data subjects exercising their rights under applicable data protection law (such as access, rectification, erasure, restriction, portability, and objection). The merchant, as controller, is responsible for assessing and responding to those requests. Zobi may recover its reasonable costs of providing assistance that goes beyond minimal effort.

If Zobi receives a request directly from a data subject relating to personal data processed on the merchant's behalf, it will, where lawful to do so, forward the request to the merchant and will not respond to the request itself except on the merchant's instructions or as required by law.

Personal data breach

Zobi notifies the merchant without undue delay after becoming aware of a personal data breach affecting personal data processed on the merchant's behalf. The notification will include the information then available to and in the possession of Zobi that is reasonably necessary to help the merchant meet its own breach obligations, and Zobi will provide further information as it becomes available. The merchant, as controller, is solely responsible for assessing the breach and for any notification to supervisory authorities and affected data subjects. Zobi provides reasonable assistance to the merchant in connection with the merchant's obligations to investigate and remediate the breach, and may recover its reasonable costs of assistance that goes beyond minimal effort. Zobi's notification is not, and will not be construed as, an acknowledgement of fault or liability.

Assistance

Taking into account the nature of the processing and the information available to Zobi, Zobi provides reasonable assistance to the merchant with data protection impact assessments and prior consultations with supervisory authorities where the merchant is required to carry these out under applicable data protection law. Zobi may recover its reasonable costs of providing such assistance where it goes beyond minimal effort.

Return and deletion

For thirty (30) days after termination or expiry of the agreement, the merchant can ask for a copy of its conversations, opt-out list and consent records (sections 10.1 and 20.3 of the terms of service), and can ask Zobi to return the personal data processed on its behalf. Zobi then deletes that personal data, and existing copies, within sixty (60) days, unless Zobi is required to retain the personal data by law. Entries on the shared safeguard lists are Zobi's own records and are kept as that section describes. Backups that contain personal data are deleted in the ordinary course of Zobi's backup cycle and are not separately retrieved for individual deletion before then.

Audits and information

Zobi makes available to the merchant information reasonably necessary to demonstrate compliance with its obligations under this addendum and allows for and contributes to audits, including inspections, conducted by the merchant or an independent auditor mandated by the merchant. Zobi may satisfy an audit request in the first instance by providing existing third-party certifications, audit reports, or responses to a reasonable security questionnaire, and an on-site or hands-on audit may be requested only where those materials are reasonably insufficient. Such audits are subject to reasonable safeguards, including that they:

• are requested on reasonable prior written notice;
• are subject to appropriate confidentiality obligations;
• are conducted during normal business hours;
• take place no more than once in any twelve-month period, except where required by a competent supervisory authority or following a personal data breach affecting the merchant's personal data;
• are carried out at the merchant's cost;
• are conducted in a manner that does not disrupt Zobi's operations or compromise the security or confidentiality of other customers' data.

CCPA / CPRA terms

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), applies to personal information processed under the agreement, Zobi acts as a service provider. Zobi does not sell or share (as those terms are defined under the CCPA) personal information, and does not retain, use, or disclose personal information except as necessary to provide the service to the merchant, as otherwise permitted under the agreement, or as permitted by applicable law. Zobi will comply with applicable CCPA obligations that apply to it as a service provider.

Liability

Each party's liability arising out of or related to this addendum, whether in contract, tort, or otherwise, is subject to the exclusions and limitations of liability set out in the terms of service at /terms. The addendum and the agreement share the same liability caps: liability under this addendum is subject to, and counts toward, the same caps set out in sections 17.1 to 17.4 of the terms of service; for Zobi's breaches of data protection, Zobi's cap is twice the amount in section 17.1 (section 17.2). This addendum does not create any separate or additional cap and does not increase the caps in the agreement.

Nothing in this addendum or the agreement excludes or limits either party's liability to the extent that liability cannot be excluded or limited under the GDPR or under Estonian mandatory law.

General and contact

This addendum is governed by the laws of Estonia, consistent with the governing law of the agreement. The competent supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). If any provision of this addendum is held to be invalid or unenforceable, the remaining provisions continue in full force.

For data protection questions or to exercise rights described here, contact Zobi OÜ at [email protected]. You can also review our privacy policy, our sub-processor list, and our messaging terms.