Data processing agreement

Processing instructions and data

The service receives and answers customer support email, retrieves relevant order and shipment information, retrieves merchant knowledge, records support decisions, and performs order actions within merchant-configured permissions. Processing includes collection, storage, retrieval, transmission to the necessary subprocessors, correction, export and deletion. Data subjects are the merchant's customers and people who contact its support service.

Data can include names, email and delivery addresses, customer and order identifiers, message contents and attachments, purchases, shipment events, support decisions and associated technical records. The service does not require special-category data; merchants must avoid supplying it and request removal if it is received unnecessarily.

Aiders processes this data only on documented merchant instructions, including the service configuration and verified support requests, unless applicable law requires otherwise. Aiders informs the merchant of a legally required departure before processing unless prohibited, and promptly identifies instructions it considers contrary to applicable data-protection law. Aiders does not sell customer personal data or use it to train its own general-purpose models.

Merchant responsibilities and customer choices

The merchant establishes an appropriate legal basis, supplies required privacy information, sets access and action permissions, and provides lawful instructions. Acceptance of this agreement is not a substitute for customer consent where consent is required.

The merchant communicates applicable corrections, objections, consent withdrawals and processing restrictions to Aiders. Aiders assists with implementing them and must restrict affected automated processing while a request requiring restriction is resolved. The merchant remains responsible for human review of decisions that may have legal or similarly significant effects and for offering the applicable means to contest them.

Confidentiality and security

Aiders restricts personal-data access to authorized people who need it for the service and are bound by confidentiality. It maintains access controls, tenant isolation, credential protection, secure transport, backup and recovery procedures, incident response, and periodic verification appropriate to the processing risk.

The security schedule and any material limitations are described on the Aiders security page. This agreement does not represent a third-party certification. Aiders must not materially reduce the agreed protection during the service period and will provide relevant evidence on a reasonable request.

Subprocessors and international transfers

The merchant authorizes the subprocessors identified in the Aiders privacy policy for their stated functions. Aiders must impose applicable data-protection obligations on each subprocessor and remains responsible to the merchant for its subprocessor obligations under this agreement. The list distinguishes active services from optional model providers; optional processing requires the relevant configuration and authorization.

Aiders gives at least 30 days' notice of a material new or replacement subprocessor, except urgent security or continuity changes, for which it gives notice as soon as practicable. The merchant may object on reasonable data-protection grounds during that period. The parties will seek an alternative; if none is available, the merchant may terminate the affected service before the new processing starts.

Where personal data is transferred outside the EEA, Aiders must use an applicable adequacy decision or other lawful safeguard, including the relevant standard contractual clauses where required, and assess supplementary safeguards where necessary. Aiders provides information about the applicable mechanism on request. This agreement does not promise that all processing takes place in the EU.

Assistance and requests

Aiders promptly passes customer rights requests to the merchant and assists with access, correction, portability, erasure, restriction and objection requests. It does not respond substantively on the merchant's behalf without instruction unless legally required. Exports must be reviewed for other people's data and delivered securely to a verified recipient.

Taking account of the processing and information available, Aiders assists with security obligations, breach assessments and notifications, data-protection impact assessments, and supervisory-authority consultations. Signed Shopify privacy requests are recorded and fulfilled with the merchant; acknowledging a webhook alone is not proof of deletion.

Personal-data breaches

Aiders notifies the merchant without undue delay after becoming aware of a personal-data breach affecting the merchant's data. The notice provides known facts, affected data and people, likely consequences, containment or remediation, and a contact. Information may be supplied in stages without undue further delay. Aiders preserves necessary evidence, cooperates with the merchant, and documents the response. The merchant decides its own regulatory and customer notifications unless the law provides otherwise.

Return, retention and deletion

Aiders follows the documented retention schedule and applicable merchant instructions. At termination the merchant may request a secure return of its personal data or its deletion, followed by deletion of remaining operational copies unless applicable law requires retention. Aiders identifies the legal basis, restricted purpose and expiry of any exception; accounting obligations do not justify retaining all support content.

Deletion includes relevant service records and subprocessor copies, with verification and documented provider expiry where immediate erasure is unavailable. Aiders must disclose any provider limitation that affects a deadline and coordinate lawful handling with the merchant. A request is not marked complete merely because a deletion API accepted it.

Encrypted recovery backups expire under the backup schedule. Until expiry they are restricted to recovery; any restoration must reapply intervening erasures and processing restrictions before returning data to active service. Minimal restricted evidence of fulfilment may be retained without the deleted message contents.

Evidence and audits

Aiders provides information reasonably necessary to demonstrate compliance with these processor obligations and permits and contributes to audits by the merchant or its independent auditor. The parties coordinate scope, confidentiality and safe access to avoid exposing other merchants' data or disrupting the service. Reasonable notice normally applies, except where an incident or regulator requires prompt access; these arrangements do not remove the merchant's statutory audit rights.

Contact and governing terms

Contact support@aiders.app about this agreement or a privacy instruction. Dutch law governs this agreement, without limiting mandatory data-protection rights or supervisory-authority powers. This English version governs; the service terms and privacy policy remain available at aiders.app/terms and aiders.app/privacy. Material changes require a new version and notice; previous acceptance records remain tied to the text accepted.