This Data Processing Agreement ('DPA') forms part of, and is subject to, the Terms & Conditions between you (the 'Customer') and Mipler (the 'Service'). It applies where, and to the extent that, Mipler processes Personal Data on the Customer's behalf in connection with the Service and that Personal Data is subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679, 'GDPR'), the UK GDPR, or another applicable data protection law ('Applicable Data Protection Law'). If there is any conflict between this DPA and the Terms & Conditions on the subject of data protection, this DPA prevails.
In this DPA, 'Mipler', 'we' and 'us' refer to the provider of the Mipler Service. For data-protection matters you can reach us at the contact address at the end of this DPA.
1. Definitions
'Controller', 'Processor', 'Data Subject', 'Personal Data', 'Personal Data Breach', 'Processing' and 'Supervisory Authority' have the meanings given in the Applicable Data Protection Law. 'Sub-processor' means any processor engaged by Mipler to process Personal Data on the Customer's behalf. 'Customer Personal Data' means Personal Data that Mipler processes on behalf of the Customer under the Service (for example, the Customer's Shopify store order and customer records).
2. Roles of the parties
With respect to Customer Personal Data, the Customer acts as the Controller (or as a processor acting on behalf of a third-party controller) and Mipler acts as the Processor. Mipler processes Customer Personal Data only to provide and support the Service and otherwise in accordance with this DPA.
3. Subject matter and details of the processing
The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are described in Annex 1 (Details of Processing).
4. Obligations of Mipler as Processor
Mipler shall:
- (a) process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers, unless required to do otherwise by law (in which case Mipler will inform the Customer of that legal requirement before processing, unless the law prohibits it). The Terms & Conditions, this DPA and the Customer's use and configuration of the Service constitute the Customer's documented instructions;
- (b) ensure that persons authorised to process Customer Personal Data are bound by an appropriate duty of confidentiality;
- (c) implement and maintain the technical and organisational measures set out in Annex 2 (Security Measures), appropriate to the risk, in accordance with Art. 32 GDPR;
- (d) engage Sub-processors only in accordance with Section 5 below;
- (e) taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from Data Subjects exercising their rights under the Applicable Data Protection Law;
- (f) assist the Customer in ensuring compliance with its obligations relating to security of processing, notification of Personal Data Breaches, data protection impact assessments and prior consultation (Art. 32–36 GDPR), taking into account the nature of processing and the information available to Mipler;
- (g) notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide the Customer with the information reasonably available to Mipler to help the Customer meet its own breach-notification obligations;
- (h) at the Customer's choice, delete or return all Customer Personal Data after the end of the provision of the Service, and delete existing copies unless retention is required by law; and
- (i) make available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable confidentiality and security conditions.
5. Sub-processors
The Customer provides a general authorisation for Mipler to engage the Sub-processors listed in Annex 3 (Sub-processors). Mipler will impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each Sub-processor's obligations. Mipler will inform the Customer of any intended addition or replacement of a Sub-processor, giving the Customer the opportunity to object on reasonable data-protection grounds.
6. International transfers and location of processing
The Customer's Shopify store order and customer records are hosted and processed within the European Union, on infrastructure provided by OVH, and Mipler's personnel who access them to operate and support the Service are located within the European Union. Certain sub-processors that support ancillary functions (such as product-usage analytics and content delivery) may be located outside the European Economic Area and process only limited technical or pseudonymous data, not customer records. Where any transfer of personal data outside the European Economic Area occurs, Mipler relies on an appropriate transfer mechanism under the Applicable Data Protection Law, such as the European Commission's Standard Contractual Clauses.
7. Liability and general
Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms & Conditions. This DPA takes effect on the date the Customer first accepts the Terms & Conditions or begins using the Service, whichever is earlier, and remains in force for as long as Mipler processes Customer Personal Data.
Annex 1 — Details of Processing
- Subject matter: provision of the Mipler reporting and analytics Service to the Customer.
- Duration: for the term of the Terms & Conditions and until deletion or return of Customer Personal Data in accordance with this DPA.
- Nature and purpose: collecting, storing, organising and displaying the Customer's Shopify store data so the Customer can view reports, dashboards and analytics within the Service.
- Types of Personal Data: data contained in the Customer's Shopify store records, which may include customer name, email address, billing and shipping address, phone number, order details and value, order notes, customer identifiers and the order's IP address. Mipler does not store full payment-card numbers or bank-account details.
- Categories of Data Subjects: the Customer's own customers and other individuals whose Personal Data appears in the Customer's Shopify store records.
- Special categories of Personal Data (Art. 9 GDPR): none are intended to be processed.
Annex 2 — Security Measures (technical and organisational measures)
- Encryption of Customer Personal Data in transit (TLS) and of sensitive credentials at rest.
- Access to Customer Personal Data is limited to authorised personnel who need it to operate and support the Service, through individual accounts protected by multi-factor authentication.
- Tenant isolation so that each store's data is served only to that store's authenticated session.
- Network security controls, segregation of environments and restriction of administrative and debugging interfaces to trusted networks.
- Logging and monitoring, including alerting on anomalous or suspicious access patterns.
- Secure software development practices, dependency and secret scanning, and automated checks that endpoints require authentication.
- Regular, access-controlled backups and a documented incident-response process.
- Confidentiality obligations and security awareness for personnel with access to Customer Personal Data.
Annex 3 — Sub-processors
- OVH (OVHcloud) — cloud hosting and infrastructure within the European Union; stores and processes the Customer's store order and customer records.
- Amazon Web Services (Amazon SES), European Union region — delivery of transactional and scheduled-report emails, which may include report content.
- Mixpanel, Inc. (United States) — product-usage analytics; receives only pseudonymous usage events keyed to a store identifier, not customer records.
- Cloudflare, Inc. (United States, with EU edge) — DNS and content-delivery / edge services.
- Google LLC (United States) — only where the Customer connects a Google Analytics or Google Ads account; limited to the data described in the Privacy Policy.
Shopify is the source platform from which the Customer's authorised store data originates and is synced to the Service.
Contattaci
For questions about this DPA or to exercise rights under it, please contact us by e-mail at [email protected].
