Naar de inhoud
 
Inloggen

Data processing agreement

This agreement is part of the terms of use. It applies as soon as you have personal data of others processed through StoreBOS, such as the customers of your webshop. You are then the controller and we are the processor (art. 28 GDPR).

The agreement itself

We use the standard clauses of the European Commission, UNCHANGED: Implementing Decision (EU) 2021/915, annex. The text is available in English on EUR-Lex. Those clauses satisfy art. 28(3) and (4) GDPR. What follows below are only the appendices that the standard clauses ask to be filled in.

For this agreement we choose, within the standard clauses: option 2 in clause 7.7 (general written authorisation for sub-processors, with prior notice of at least 30 days), and the notification of a breach under clause 9.

Appendix I - Parties

ControllerProcessor
Whoyou: the name under which you made your requestStoreBon
Address, email, Chamber of Commerce no.as recorded with your requestsee below
Privacy contactthe email address of your requestthe email address below

The details of StoreBon (the processor), taken straight from the page Company details:

Deze gegevens volgen.

Appendix II - What we process for you

ItemDetails
Subject matterhosting and serving your website and webshop
Durationas long as you have a site with us; afterwards 30 days to export
Nature and purposestoring, displaying, forwarding and keeping, to make your site and shop work
Data subjectsyour customers and visitors, and anyone who contacts you through your site
Types of dataname, address, email address, phone number, order data and messages; and, once the customer chat is available, the messages someone types in that chat and the email address they leave there
Special categories of datanone; do not put them on your site either
Instructionsyour use of the admin screens; we process nothing for our own purposes
Endwe delete the data after the export period, unless the law requires us to keep it; backups that still contain your data then expire by themselves, at the latest 52 days later
Chat messages and email address left behindwe keep them with the ticket the conversation belongs to and delete them together with that ticket, at the latest at the end of the export period

Appendix III - How we secure the data

  • Each site sees only its own data, even though sites run on the same servers.
  • Confidential fields are stored encrypted on disk.
  • Whoever logs in gets only the rights of their role; every change is recorded.
  • Traffic to and from the site is encrypted.
  • There is a backup every hour, in the Netherlands, and every change to the software first goes through an automated test run.
  • We report a data breach to you without undue delay, and at the latest within 48 hours of discovering it.
  • Once the customer chat is available, we mask a message on our own servers in the Netherlands before it goes to a language model: email addresses, phone numbers, IBANs, postcode with house number and the names we know of you are replaced with placeholders, which are only restored on our side. Names of others that appear in a message and that we do not know, we cannot recognise this way; that residual risk remains.
  • The provider of the language model may not use your data to train a model and may not keep it beyond what is needed to give the answer, as stated in its data processing agreement with us.

Appendix IV - Sub-processors

You give your authorisation for these sub-processors:

Sub-processorFor whatWhere
Google Cloudhosting of the servers and receiving emailthe Netherlands (region europe-west4)
Google Workspace (Google Ireland Limited)sending email on behalf of your siteIreland; Google may also process outside the EEA, under the EU standard contractual clauses
Google Vertex AI (Google Cloud), with Claude by Anthropic as language modelthe customer chat: an answer to a visitor's question, on messages we have masked firstEurope (processing in the European multi-region of Vertex AI), so within the EEA; there is no transfer outside the EEA

If a sub-processor is added or removed, we notify you at least 30 days in advance. If you do not agree, you may stop.