Data processing agreement

1. Roles and scope

You (the merchant) are the controller and Cartnio is your processor for the personal data of your customers that you send to or collect through Cartnio (“Customer Data”). This agreement is designed to meet Article 28 of the UK GDPR and EU GDPR and applies alongside our terms of service. If they conflict on data protection, this agreement wins.

Cartnio is the controller of merchant account and billing data; that is covered by our privacy policy, not this agreement.

2. Details of the processing

• Subject matter and purpose: providing the Service: sending review requests, reminders and loyalty emails; collecting, moderating and displaying reviews, photos, videos and questions; running your loyalty programme; and sending events to destinations you connect.
• Data subjects: your customers, reviewers, people who ask questions and loyalty members.
• Categories of data: name, email address, order details (order number, products, totals, dates, status, coupons and referral codes), review and question content, photos and videos, loyalty balances and history, birthday if provided, email delivery and unsubscribe records.
• Special category data: none is required. Do not ask customers for it; review text is free-form, so moderate anything sensitive.
• Duration: for as long as you use the Service, then deleted as set out below.

3. Our obligations

Cartnio will:

• process Customer Data only on your documented instructions, which are these terms, your settings in Cartnio and your actions in the dashboard and plugin, unless the law requires otherwise (in which case we will tell you unless the law forbids it);
• tell you if we believe an instruction breaks data protection law;
• ensure everyone with access to Customer Data is bound by confidentiality;
• not sell Customer Data or use it for our own purposes, other than producing aggregated, anonymous statistics that cannot identify you or any individual;
• help you respond to requests from data subjects, and with security, breach notification, data protection impact assessments and consultations with regulators, taking into account the nature of the processing; and
• make available the information reasonably needed to show compliance with this agreement.

4. Your obligations

• Have a lawful basis to share Customer Data with Cartnio and to send the emails you configure (for example, review requests to recent customers).
• Tell your customers about Cartnio in your privacy notice. The Cartnio WooCommerce plugin adds suggested text to WordPress’s privacy policy guide.
• Only send us the Customer Data needed for the Service.

5. Security measures

• Encryption in transit (TLS) for all traffic and at rest for the database and file storage.
• Row-level access controls so each store’s data is readable only by its owner; privileged database functions are limited to server-side jobs.
• Plugin API keys stored only as SHA-256 hashes; loyalty identity signed with HMAC so customers can only see their own balance.
• Review photos and videos stored privately and served only through short-lived signed links once approved.
• Webhooks signed so you can verify they came from Cartnio; outbound destinations restricted to public HTTPS addresses.
• Access to production systems limited to authorised personnel.
• Automated tests that check stores cannot read each other’s data.

6. Sub-processors

You authorise Cartnio to use the sub-processors below. Each is bound by written terms that protect Customer Data at least as well as this agreement. We remain responsible for their performance.

We will update this list and email account owners at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within that period; if we cannot address the objection, you may close your account and we will refund any prepaid fees for the unused period.

Destinations you connect yourself, such as Klaviyo or your own webhook endpoints, are your recipients, not our sub-processors.

7. International transfers

Customer Data is stored in Sydney, Australia and some sub-processors operate in the United States. Where Customer Data from the UK, EEA or Switzerland is transferred to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (Module 2, controller to processor, or Module 3 for onward transfers) and the UK International Data Transfer Addendum are incorporated into this agreement by reference, with Cartnio as data importer. We will also rely on adequacy frameworks, such as the EU-US Data Privacy Framework and the UK extension, where a provider is certified.

8. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your Customer Data. We will describe what happened, the data and people likely affected, the likely consequences and what we are doing about it, and keep you updated as we learn more.

9. Return and deletion

You can export reviews and loyalty members from the dashboard at any time. When your account is closed, we delete Customer Data within 30 days, and backups roll off within a further 30 days, unless the law requires us to keep it. On request, we will confirm deletion in writing.

10. Audits

We will answer reasonable written questions about our security and compliance once a year, or after a breach. If that is not enough to show compliance, you may audit us on 30 days’ notice, during business hours, at your cost and under confidentiality, in a way that does not compromise other customers’ data.

11. Contact and liability

Each party’s liability under this agreement is subject to the limits in our terms of service, except where the law does not allow that. Data protection questions: hello@cartnio.com.