Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the merchant who installs Hypesoul (the "Merchant") and Kirill Novak s.r.o. ("we"). It applies where we process personal data on behalf of the Merchant while providing the app.

For the personal data of the Merchant's partners (affiliates) and of customers whose orders are recorded, the Merchant is the controller and we are the processor. For the Merchant's own account and billing data and for our own security and service operation, we act as an independent controller, as described in the Privacy Policy.

2. Details of the processing

• Subject matter and purpose: running the Merchant's affiliate program: partner accounts, tracking links and codes, recording clicks and orders, calculating commissions and payouts, reporting.
• Duration: while the app is installed, then until deletion under section 8.
• Data subjects: the Merchant's partners and visitors who click partner links. Order records contain no customer names or contact details.
• Types of data: partner name, email, country, password hash, optional payout details (encrypted), IP address and user agent of link clicks, order numbers and amounts, discount and commission amounts, payout records.
• Special categories of data are not intended to be processed.

3. Our obligations as processor

• We process the data only on the Merchant's documented instructions, which are these Terms, this DPA and the Merchant's use of the app's features, unless the law requires otherwise; we tell the Merchant if we think an instruction breaks data protection law.
• People who can access the data are bound by confidentiality.
• We apply the security measures described in the Security page (access control, encryption in transit, encryption of payout details at rest, hashed passwords, limited access to the database).
• We help the Merchant answer requests from data subjects (access, correction, deletion, export), taking into account the nature of the processing.
• We help the Merchant with security, breach notification, impact assessments and consultation with authorities, as far as it relates to our processing.

4. Personal data breaches

We notify the Merchant without undue delay after becoming aware of a personal data breach affecting the Merchant's data, with the information we have: what happened, the data and the number of people concerned, likely consequences and the steps taken. We keep the Merchant informed as the facts become clear.

5. Sub-processors

The Merchant gives a general authorisation for the sub-processors listed on the Sub-processors page. We bind each of them to data protection obligations no less protective than this DPA and stay responsible for them.

We announce a new or replaced sub-processor on that page at least 14 days before it processes the Merchant's data. The Merchant may object on reasonable data protection grounds within that time by writing to us; if we cannot resolve it, the Merchant may stop using the app and uninstall it.

6. International transfers

Where personal data is transferred outside the European Economic Area, it is done on a lawful basis such as an adequacy decision, the EU–US Data Privacy Framework or the Standard Contractual Clauses, together with appropriate additional safeguards. The Sub-processors page shows where each provider processes data.

7. Audits and information

On written request, and not more than once a year unless a breach requires otherwise, we provide the information needed to show compliance with this DPA. Audits are done remotely by questionnaire and documents; an on-site audit needs our agreement, reasonable notice and an agreed scope, and is at the Merchant's cost.

8. Return and deletion

When the Merchant uninstalls the app, Shopify sends us a shop erasure request and we delete the shop's partners, clicks, orders, payouts, materials and payout details, normally within 48 hours of the request. The Merchant can export its data as CSV before uninstalling. Backups are overwritten within the period stated on the Security page.

We may keep data that the law requires us to keep, only for that purpose and period.

9. Liability, order of precedence, law

Liability under this DPA follows the limits in the Terms of Service, as far as the law allows. If this DPA and the Terms conflict on data protection, this DPA applies. It is governed by the same law as the Terms.

Questions about this DPA: Bochichenko@gmail.com. Kirill Novak s.r.o., Nad Dalejským údolím 2690/7, 155 00 Praha, Czech Republic, Company ID 28432797.