Data Processing Agreement

This Data Processing Agreement (the “DPA”) is between the Merchant, as controller, and JRM E-COMMERCE, trading as Tallrung, as processor. It is part of the Terms of Service, and it applies to the personal data that Tallrung processes for the Merchant when it provides the Services (“Buyer Data”). Words with capitals mean what the Terms or the GDPR define.

It applies from the day the Merchant accepts the Terms. If it conflicts with the Terms on personal data, it prevails. It doesn’t cover the Merchant’s own account data, which Tallrung controls under its Privacy Policy.

• Subject matter. Hosting the Merchant’s Funnels and Landers, running their checkout, upsells, and thank-you pages, recording orders, and sending orders and purchase events to the Merchant’s Connected Accounts.
• Duration. The term of the Terms, and the period until deletion under section 12.
• Nature. Collection, recording, storage, organization, consultation, use, transmission to the Merchant’s Connected Accounts, restriction, erasure, and destruction.
• Purpose. To serve the Merchant’s pages, take and record Buyers’ orders, measure the visits and split tests, fulfill the order through Shopify, report purchases to the Merchant’s ad accounts, and answer the Merchant’s and Buyers’ requests.
• Data subjects. Visitors to the Merchant’s pages, Buyers, and people who start a checkout.

Categories of Buyer Data

• Contact: email address, first and last name.
• Address: shipping address, and the address text typed into the address search.
• Phone: phone number, in international format.
• Order: the steps bought or declined, the items and amounts, the currency, the payment provider’s charge and refund ids, and the Shopify order id. Card numbers are held by Stripe only.
• Device and visit: IP address, browser (user agent), device class, country, the page the visit landed on, the referrer, and the UTM parameters.
• Cookies and identifiers: the visitor and session ids ( fnl_vid, fnl_sid), the split-test variant assigned, and the page views.
• Pixel identifiers: the ad click ids (fbclid, gclid, ttclid), and the values of the Meta, Google, and TikTok cookies (_fbp, _fbc, _ga, _ttp) when the Merchant’s tags set them.

The Services aren’t designed for special categories of data. The Merchant must not use them to collect such data, or data about children.

• Tallrung processes Buyer Data only on the Merchant’s documented instructions. The Terms, this DPA, and the Merchant’s settings and actions in the Services (for example, connecting an ad account, publishing a page, or erasing a Buyer) are those instructions.
• Tallrung may also process Buyer Data where EU or member-state law requires it. It tells the Merchant first, unless that law forbids it.
• Tallrung tells the Merchant at once if it believes an instruction breaks the GDPR.
• Tallrung doesn’t sell Buyer Data, use it for its own purposes, or combine it with another Merchant’s data.

• The Merchant has a lawful basis for the processing, and informs its Buyers, including in its own privacy notice and checkout policies.
• The Merchant decides which ad tags, pixels, and custom code its pages load, and gets the consent the ePrivacy rules require for them before they run. The Cookie Policy describes what the pages set.
• Data that the Merchant’s Connected Accounts receive (Stripe, PayPal, Shopify, Meta, Google, and TikTok) is governed by the Merchant’s own agreements with those providers. They aren’t Tallrung’s sub-processors.

Tallrung gives access to Buyer Data only to staff and contractors who need it for the Services, and who are bound by a duty of confidentiality. For support the Merchant asks for, for security, to stop abuse, or where the law requires it, Tallrung personnel may open the Merchant’s Workspace and act in it as one of its users, and so see the Buyer Data that user could see. They do so under the same duty of confidentiality, and each access is recorded in Tallrung’s internal audit log.

Tallrung takes the technical and organizational measures in Annex 1, which are appropriate to the risk under GDPR article 32. It may change them, provided that the protection they give doesn’t fall.

The Merchant gives Tallrung general authorization to engage sub-processors. The current ones are listed in Annex 2 and on the Sub-processors page.

• Tallrung tells the Merchant of an intended new or replaced sub-processor by email at least 30 days before it processes Buyer Data, except in an emergency that affects the Services’ security or continuity, when it tells the Merchant as soon as it can.
• The Merchant may object on reasonable data-protection grounds within that period, by writing to privacy@tallrung.com. The parties then look for a solution in good faith. If they find none, the Merchant may end the Terms before the change, and get a refund of the unused part of a month it paid for.
• Tallrung binds each sub-processor by a written contract to data-protection duties that are at least as protective as this DPA, and remains responsible to the Merchant for it.

Buyer Data is hosted in the United States (Annex 2). Each transfer outside the European Economic Area relies on an adequacy decision, such as the EU-US Data Privacy Framework for a certified recipient, or on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with additional measures where needed.

Tallrung and the Merchant are both established in the European Economic Area in the usual case, and no transfer tool is needed between them. Tallrung puts the Standard Contractual Clauses, Module 3 (processor to processor), in place with each sub-processor outside the European Economic Area that no adequacy decision covers, or relies on the sub-processor’s own clauses.

Where a transfer between the Merchant and Tallrung is itself a restricted transfer (for example, where the Merchant is a processor for another controller, or its data reaches Tallrung from outside the European Economic Area under the GDPR), the Standard Contractual Clauses are incorporated by reference: Module 2 (controller to processor) where the Merchant is a controller, and Module 3 (processor to processor) where the Merchant is itself a processor. For those clauses: clause 7 (the docking clause) applies; under clause 9, option 2 (general authorization) applies, with the notice in section 7 of this DPA; the optional wording in clause 11 doesn’t apply; under clauses 17 and 18, the law and courts are those of France; and the annexes are filled by section 2 and Annexes 1 and 2 of this DPA.

United Kingdom. For a transfer subject to UK data-protection law, the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner, version B1.0, is incorporated, and its tables are filled from this DPA.

Switzerland. For a transfer subject to the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply with the Federal Data Protection and Information Commissioner as the competent authority, Swiss law as the law of the clauses where required, and “member state” read to include Switzerland, so that data subjects there can enforce their rights.

The Services give the Merchant tools to answer Buyers’ requests itself:

• Settings → Privacy finds a Buyer by email, phone, or Shopify ids, exports what the Workspace holds on them (kept for the Merchant’s owners for 30 days), and erases them. Erasure clears the fields that name or reach the person and keeps the order amounts, because accounting and tax law require the Merchant to keep sales records.
• Shopify’s customer data requests and erasure requests for the connected store are answered in the same way, automatically.
• Orders and Customers show and export each Buyer’s orders.

If a Buyer writes to Tallrung directly, Tallrung sends the request to the Merchant without undue delay and doesn’t answer it itself, unless the Merchant instructs it to. Tallrung helps further, at the Merchant’s reasonable cost, where the tools don’t cover a request.

Tallrung tells the Merchant of a personal data breach affecting Buyer Data without undue delay, and at the latest within 48 hours after it becomes aware of it, by email to the Workspace’s owners.

The notice describes, as far as Tallrung then knows, the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, the measures taken or proposed, and a contact. Tallrung sends what it learns later as it learns it, and helps the Merchant meet its own duties to notify the authority and Buyers. A notice isn’t an admission of fault.

Tallrung gives the Merchant the information it reasonably needs, about the Services and this processing, for a data protection impact assessment and a prior consultation with an authority (GDPR articles 35 and 36).

• While the account is open, the Merchant can export its orders and customers, and erase Buyers, at any time.
• When the Terms end, the Merchant may ask for a copy of the Buyer Data within 30 days. After that, Tallrung deletes the Buyer Data within a month (by hand, until this is automated), and the copies in the database’s restore history expire within 6 hours.
• Tallrung keeps Buyer Data longer only where EU or member-state law requires it, and then only for that purpose.

• Tallrung makes available to the Merchant the information needed to show that it meets article 28: this DPA, its annexes, and written answers to reasonable security questions.
• If that isn’t enough, or an authority requires it, the Merchant may audit Tallrung, once a year, with at least 30 days’ written notice, during business hours, by itself or by an independent auditor bound by confidentiality, in a way that doesn’t put other Merchants’ data or the Services’ security at risk. Each party bears its own costs, unless the audit shows a material breach by Tallrung.
• Tallrung holds no security certification today, and this DPA claims none.

Each party’s liability under this DPA is subject to the limits in the Terms, except where the GDPR or another law forbids a limit, and without limiting a data subject’s rights under GDPR article 82.

• Encryption in transit. The app, the sites, the webhooks, and every call to a provider use TLS (HTTPS).
• Sealed secrets. Integration secrets (PayPal secrets, ad accounts’ tokens, Shopify credentials) are encrypted with AES-256-GCM under versioned keys held outside the database, so they can be rotated.
• Card data. Card numbers are entered in Stripe’s own fields, and are held by Stripe only. No card number or security code reaches Tallrung’s servers or database.
• Separation of Workspaces. Every record carries its Workspace, the database refuses a record that names another Workspace’s parent, and a public request gets its Workspace only from the site’s host.
• Access by role. Each Member has a role (owner, admin, editor, or analyst), and every page and request checks the Member’s right to act. Orders and Customers are limited to owners and admins, and privacy requests to owners. Platform staff are a short allowlist.
• Activity log. Sensitive actions (publishing, refunds, exports, privacy requests, integration changes) are logged before they run, with their outcome after. The log records that a search ran, never its text.
• Sessions. A Buyer’s order can be acted on only by the browser session that opened it. Session cookies are HTTP-only and, in production, secure.
• Abuse limits. Sign-in, sign-up, password reset, checkout, and address search are rate-limited per session or address and per IP address, by limits the database enforces.
• Pages. Pages written by the AI are cleaned of scripts and unsafe markup before they are saved and served, and they run on separate domains from the app, so a page can’t reach the app’s sign-in cookies.
• Minimization. Data sent to ad platforms from the server is hashed (email, phone, name, and address fields) where the platform accepts hashes. Erasure keeps no name or address of the person.
• Hosting. The database and the hosting are run by Neon and Vercel, whose own measures cover the physical security and availability of their infrastructure, and the database’s backups.

These sub-processors receive Buyer Data. The full list, with what each provider does for the Merchant’s own account data, is on the Sub-processors page.

Contact for this DPA: privacy@tallrung.com. The European Commission’s Standard Contractual Clauses are incorporated as published. A signed copy of this DPA is available on request to legal@tallrung.com.