MindFlash StudioParties, application and instructions
This addendum applies when a merchant accepts the EU Product Safety Manager service agreement and MindFlash Studio processes personal data on that merchant’s behalf. Controller: the merchant identified in the applicable store/service agreement. Processor: Vladimir Pogozhev, trading as MindFlash Studio, Calle Puerto Franco 41, 38410 Los Realejos, Santa Cruz de Tenerife, Spain; contact support@mindflashstudio.com. Version effective 17 October 2026. Store configuration and authorised service requests are documented instructions. We process only on lawful instructions, including on transfers, unless law requires otherwise, informing the controller where permitted. We inform the controller if an instruction appears unlawful. Publication of this document alone does not execute a merchant agreement.
Processing schedule
Subject and purpose: authentication and requested management/display of safety information in a Shopify store. Nature: collection, organisation, storage, linking, validation, import/export, logging, public display as instructed and deletion. Duration: the service relationship and the period reasonably required for instructed return/deletion, subject to lawful retention. Data subjects: store administrators, manufacturer/responsible-person contacts and persons identified in relevant support records. Data: shop/product identifiers, contact names/addresses, warnings/languages/review choices, authentication/session information, operation journals and webhook metadata. No special-category personal data is required. The controller establishes lawful bases, accuracy, notices and the authority to disclose contacts publicly.
Confidentiality and security
Access is limited to persons authorised for the relevant task and bound by confidentiality. Measures include official Shopify authentication, store-boundary checks, encrypted session payloads and verification of signed webhook requests; public output uses escaped Liquid text. Operational import/change journals are not field-encrypted and should contain only necessary information. We assess security according to the risk and document material changes. These terms do not claim an external security certification or complete protection from every incident.
Providers and processing locations
Current provider register: Google / Firebase — delivery and protection of the public static website, processing technical request data; Hostinger — routing/handling of support email sent to the studio domain, including sender, message and attachments where supplied. The applicable provider entity and its affiliates are specified in the linked service/DPA terms. These services use international systems, not an app-specific EU-only cloud database. Shopify — store platform, product/safety records, authentication and billing under the merchant’s own agreement; Shopify is not recharacterised here as our hosted app database. App operational/session records are operator-managed local records. Controller-led correspondence is distinguished from merchant data handled as processor.
Subprocessor changes and transfers
The controller gives general authorisation for necessary subprocessors described in the register, subject to this clause. Before engaging a new processor of merchant personal data or materially changing its role, we give at least 30 days’ notice through the service or registered contact. The controller may object on reasonable data-protection grounds within that period. We seek a reasonable alternative; if none resolves the objection, affected processing must not start and the controller may terminate the affected service. We impose equivalent data-protection obligations and remain responsible as required by law. Restricted transfers require an applicable adequacy decision or appropriate safeguards, including applicable standard contractual clauses. Details/copies of relevant safeguards are available through support@mindflashstudio.com. Any required transfer agreement must be in place before the restricted processing begins.
Incidents and assistance
We notify the controller of a personal-data breach without undue delay after awareness, provide available information on nature, affected data, likely consequences and mitigating action, and supplement it as information becomes available. We assist with data-subject requests, security obligations, breach notifications, impact assessments and regulator enquiries, taking account of the processing and information available. We do not respond on the controller’s behalf unless instructed or legally required. No fixed detection or recovery time is promised.
Return, deletion and copies
At the controller’s choice on ending the service, we return or delete processor-held personal data and existing copies unless Union or Member State law requires retention, and confirm completion or the lawful exception. The controller may export during authorised access or request assistance. We agree a proportionate timetable for the actual request; no guaranteed automatic cloud/backup deadline is represented. Current journals are eligible for expiry after seven days through operation cleanup; verified uninstall removes sessions and shop/redact removes local sessions, journal rows/jobs and receipts. Shopify-held records, merchant exports and provider-managed copies have distinct controllers and lifecycles and are not falsely certified as deleted by a local handler.
Accountability, audits and precedence
We provide information necessary to demonstrate these obligations and allow proportionate audits/inspections by the controller or its independent auditor, subject to reasonable confidentiality, scheduling and protection of other merchants’ data. Urgent incidents or regulatory duties are not delayed by ordinary scheduling. Report evidence may be used where sufficient; it does not remove the controller’s legal audit rights. These data-protection obligations prevail over conflicting service terms. Mandatory statutory liability and data-subject rights are not excluded. Changes requiring new providers, purposes or transfers must be assessed before processing begins.