Merchant Data Processing Terms

1. Roles of the parties

For the personal data described in Annex A that tasc processes through the app (the "Merchant Personal Data"), you are the controller (or, if you act for another business, its processor) and tasc is your processor. You decide why and how the data is used; tasc processes it only to provide the app to you.

For the limited data about your staff who sign in to the app (see section 12), and for our own account administration, billing and security, tasc is an independent controller and uses that data under our Privacy Notice.

2. What the app does

The tasc Shopify app reads your store's product catalogue so it can appear in tasc's outfit recommendations, and, on paid plans, shows the tasc Widget on your product pages. Where you enable order attribution, it also matches orders to earlier Widget clicks and shows the results on your app dashboard. The app uses read-only access to the data you authorise at installation. It does not modify your store, create or edit orders, or change prices.

3. Data we process and what we do not

The categories of data, data subjects and purposes are in Annex A. In short:

• Product data (title, description, price, images, SKU, variants, inventory status) is business data and is not normally personal data. We process it to sync your catalogue and show it in recommendations.
• Order attribution data, if enabled, is limited to the order identifier, order total and currency, and for each line item the product, quantity and price.
• We do not store shopper identity. Even though Shopify's order notification contains more, tasc deliberately discards it and keeps no customer name, email address, telephone number or shipping or billing address. Orders are matched to Widget clicks by product and session, never by shopper identity.

4. Our obligations as processor

tasc will:

1. process the Merchant Personal Data only on your documented instructions, which are these terms, your use and configuration of the app, and your written requests, unless the law requires otherwise (in which case we will tell you first where we lawfully can);
2. tell you if we believe an instruction breaches data protection law;
3. ensure that people authorised to process it are bound by confidentiality;
4. implement the security measures in Annex B;
5. respect the conditions in section 6 for engaging sub-processors;
6. taking account of the nature of the processing, help you respond to requests from data subjects exercising their rights;
7. help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation, taking account of the information we hold;
8. delete or return Merchant Personal Data as set out in section 9; and
9. make available the information needed to show compliance with this DPA and allow for audits as set out in section 10.

5. Your obligations as controller

You are responsible for having a lawful basis and giving shoppers the notices the law requires for the processing you instruct, for the accuracy and lawfulness of the instructions you give, and for how the Widget is presented on your site, including cookie consent. You authorise tasc to process the Merchant Personal Data as described in this DPA.

6. Sub-processors

You give general authorisation for tasc to use the sub-processors listed in Annex C. tasc will bind each sub-processor to data protection obligations no less protective than this DPA and remains responsible for their performance. We will give you at least 30 days' notice of any new or replacement sub-processor (by email or notice in the app), during which you may object on reasonable data protection grounds. If we cannot resolve the objection, you may stop using the app and uninstall it, and we will treat that as the end of processing under section 9.

7. International transfers

tasc's infrastructure is hosted with Google Cloud in the United States. Where Merchant Personal Data is transferred from the UK (or, where applicable, the EEA) to a country without an adequacy decision, tasc relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or another lawful transfer mechanism, together with appropriate supplementary measures. Where the data is transferred from you to tasc, the parties agree that tasc, as processor, and you, as controller, enter into the relevant module of those clauses, which are incorporated into this DPA by reference.

8. Personal data breaches

tasc will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. The notice will describe, as far as known, the nature of the breach, the data and approximate numbers involved, the likely consequences and the measures taken or proposed, and we will update it as we learn more and help you meet your own notification duties.

9. Retention, uninstalling and deletion

• While the app is installed, product data is kept for as long as your catalogue sync is active. When you delete a product in your store, it is removed from active listings on tasc (soft-delisted) and then deleted in our regular clean-up.
• On uninstalling, the Widget is deactivated and further syncing stops immediately, and the access token we hold for your store is deleted.
• Deletion. Within 30 days of the earlier of (a) your written request to hello@tasc-fashion.ai quoting your shop domain, or (b) Shopify's shop-redaction notice, tasc will delete or irreversibly anonymise the Merchant Personal Data and the catalogue data we synced from your store. We may keep records we are legally required to keep, and aggregated or anonymised statistics that no longer identify you or any shopper.
• Order attribution records, if you enabled them, are keyed by shop and product, hold no shopper identity, and are deleted under the same rule rather than kept indefinitely.
• Backups are overwritten in the ordinary cycle after deletion.
• On your written request tasc will return a copy of the Merchant Personal Data it holds before deleting it.

10. Information and audits

On reasonable written request, tasc will provide the information needed to show compliance with this DPA, such as a summary of its security measures. If that is not enough to satisfy a legal requirement, you may audit tasc's relevant processing once in any 12 months, or sooner after a breach, on 30 days' notice, during business hours, subject to confidentiality, without access to other customers' data, and at your own cost.

11. Shopper requests and Shopify's privacy notices

If a shopper contacts tasc about Merchant Personal Data, we will tell them to contact you and will pass the request to you promptly, unless the law requires otherwise. tasc responds to Shopify's mandatory customer data request and redaction notices; because tasc does not store shopper identity, it expects normally to have no customer-specific data to return or erase, and will confirm that to Shopify.

12. Your staff who use the app

When a staff member signs in to the app, Shopify gives tasc basic account details of that user, such as name, email address, locale and whether they are the account owner. tasc uses them only to authenticate and identify that user in the app and to contact you about your account. It handles them as controller in line with our Privacy Notice, and deletes them with the other data when you uninstall.

13. Security

tasc maintains the technical and organisational measures in Annex B and will keep them appropriate to the risk. We do not sell Merchant Personal Data and do not use it for our own advertising. We do not share it with third parties other than the sub-processors in Annex C.

14. Liability, term and order of precedence

This DPA starts when you install the app and lasts as long as tasc processes Merchant Personal Data. Each party's liability under it is subject to the limits in the Partner Terms. If this DPA conflicts with the Partner Terms about the processing of personal data, this DPA prevails. We may update this DPA on 30 days' notice, including to reflect changes in law or to the app, and you may end processing by uninstalling the app before the change takes effect. It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex A. Details of the processing

Annex B. Security measures

• Encryption of data in transit between your store, the app and tasc's systems (TLS), and encryption at rest in the cloud infrastructure.
• Authentication of every request from Shopify (verified webhook signatures and session tokens) before any data is processed.
• Least-privilege access: only staff and systems that need data to run the service can reach it, controlled through cloud identity and access management.
• Store access tokens held only in tasc's own databases and removed on uninstall.
• Data minimisation by design: order notifications are reduced to the attribution fields in Annex A and the remainder discarded.
• Logging and monitoring of the application and administrative access, and separation of production and test environments.
• Notification of personal data breaches as set out in section 8.

Annex C. Sub-processors

tasc does not currently send Merchant Personal Data to any other sub-processor. We will update this list and notify you of changes as set out in section 6.

15. Contact us

Questions about how we process your store's data, or a deletion request: hello@tasc-fashion.ai. See also our Privacy Notice.