MindFlash StudioA controller-to-processor addendum for limited Shopify store data handled to provide Gift Wrap & Messages.
1. Roles and scope
This Data Processing Addendum (DPA) forms part of the Gift Wrap & Messages Terms of Service. For personal data that Gift Wrap & Messages processes from a merchant’s Shopify store in order to provide the app, the merchant is the controller and MindFlash Studio is the processor.
For MindFlash Studio’s own website, merchant relationship, support, security, and service-administration activities, MindFlash Studio may act as an independent controller as described in the Privacy Policy.
2. Documented instructions
MindFlash Studio processes personal data only on the merchant’s documented instructions, including these Terms, this DPA, the merchant’s use of the app, and any lawful written instruction that is consistent with the service. MindFlash Studio will inform the merchant if an instruction appears to violate applicable data-protection law, unless prohibited by law.
3. Processing details
Subject matter and purpose: provide Shopify cart gift selection, material and card configuration, greeting preview, gift-order preparation and printing, usage accounting, gift-option analytics and Shopify privacy requests.
Duration: during use of the app and while limited retention is necessary to provide the service or meet legal obligations, as described in the Privacy Policy.
Data subjects: merchant administrators, customers and gift recipients.
Categories of data: shop and authorization identifiers, staff session data, product and variant information, gift selections, greetings, card and font settings, order identifiers and attributes, service metadata, usage and privacy-request records. Gift messages are stored with Shopify cart and order data and processed for display and printing. Payment-card data is not collected directly by the app.
4. Confidentiality and security
MindFlash Studio ensures that persons authorised to process data are subject to appropriate confidentiality obligations and implements reasonable technical and organisational measures appropriate to the nature of the processing. These measures include access-controlled cloud infrastructure, authenticated Shopify sessions, encrypted transport, and separation of the app database from the public marketing website.
5. Subprocessors
The merchant gives general authorisation for MindFlash Studio to use subprocessors that are necessary to provide the service. Current infrastructure includes Google Cloud and Firebase for hosting, runtime, and database services, and Shopify for platform integration. MindFlash Studio will impose data-protection obligations on subprocessors as required by applicable law and will make reasonable information about material subprocessors available on request.
6. Assistance and rights requests
Taking into account the nature of processing, MindFlash Studio will provide reasonable assistance to the merchant with data-subject requests, security obligations, impact assessments, and consultations. Shopify compliance webhooks are used to receive data-request and redaction instructions. The merchant remains responsible for responding to shoppers and determining the legal basis for its processing.
7. Personal-data breaches
MindFlash Studio will notify the merchant without undue delay after becoming aware of a personal-data breach affecting data processed under this DPA, and will provide reasonably available information to help the merchant meet applicable notification obligations.
8. Return and deletion
Authenticated Shopify uninstall and shop-redact events trigger store-wide app-database cleanup. Customer-redact events remove relevant app-side records for the supplied orders. Failed requests may be retried. Legally required retention remains limited to that purpose.
Shopify products, media, orders, downloaded reports, printed cards, email correspondence and infrastructure logs/backups are managed separately. The merchant should obtain necessary exports before uninstalling. Data return and deletion requests may be sent to support@mindflashstudio.com.
9. Audits and compliance information
On reasonable written request and no more than once per year, MindFlash Studio will provide information reasonably necessary to demonstrate compliance with this DPA. Any audit must be proportionate, protect the confidentiality and security of other customers, and be conducted during normal business hours with reasonable prior notice.
10. International transfers
Where a transfer outside the EEA is required, MindFlash Studio will use an appropriate transfer mechanism available under applicable law, such as an adequacy decision or contractual safeguards provided by the relevant service provider.