Data Processing Agreement

This agreement covers the personal data of your shoppers that Uncart processes for your shop. It is the agreement Article 28 of the GDPR asks for (and the UK GDPR, where it applies), and it is part of Uncart's Terms. It applies from the moment your shop installs Uncart.

1. Parties and roles

• Your shop, the business that installed Uncart: the controller.
• Woomega LLC, trading as Uncart, 2810 N Church St STE 90071, Wilmington, DE 19802, United States, hi@uncart.ai: the processor.

Where your shop sends from Uncart's own WhatsApp number, Uncart is the controller of the data it needs for those messages: the shopper's number, their consent and STOP, their messages on Uncart's number, and the basket or product they wrote about. That part is not covered by this agreement; the Privacy Policy covers it. Your shop stays the controller of its own shop data.

Data about your shop and your team (accounts, sign-ins, billing) is Uncart's own, as the Privacy Policy explains, and is not covered here either.

2. Subject and duration

Uncart processes your shoppers' data to provide the service the Terms describe. This agreement lasts as long as your shop uses Uncart, and after that until the data is erased (section 13).

3. Nature and purpose

Uncart collects, stores, uses and deletes shopper data, by automated means, only for these purposes:

• confirming a shopper's opt-in, and recording their consent and their STOP;
• sending the basket reminders, order and delivery updates and back-in-stock messages a shopper asked for;
• answering shoppers' messages, through the AI assistant and your team;
• counting the orders placed after a tap on an Uncart link, so your shop can be billed;
• checking that Uncart works, with a test group of shoppers who don't get the later reminder;
• answering requests from shoppers and from your shop.

Uncart does not use your shoppers' data for its own purposes, does not sell it, does not profile shoppers, and makes no automated decisions about them.

4. Whose data

The shoppers of your shop who opt in to messages from it, who write to it on WhatsApp through Uncart, who ask for their basket or a back-in-stock message, or who leave a basket while signed in to your shop.

5. What data

• Phone numbers: stored encrypted, and as a keyed fingerprint (a hash), so a shopper and their STOP are recognised without the number.
• Consent records: the channel, what the consent is for, how the shopper opted in, the wording version and the time, and each STOP.
• Messages and conversations with your shop and the assistant, stored encrypted.
• Baskets: products, quantities, value, and your shop's basket and checkout tokens.
• Order references: order number, value and refunds of the orders placed after an Uncart message or link, and for the order updates a shopper asked for, when the order shipped and was delivered and the carrier's tracking link (encrypted).
• Back-in-stock requests: the product, the size or colour, how the shopper asked, and whether the message was sent.
• Other: the shopper's customer id at your shop if they were signed in, the product they asked about, and whether they are in the test group.

Uncart does not process shoppers' email addresses, postal addresses, payment details, IP addresses or browser details, and it does not ask for special categories of data.

6. Your instructions

Your instructions are this agreement, the Terms, and the choices you make in your dashboard: where the opt-in shows, whether the assistant answers, whether back-in-stock messages are on, how long conversations are kept (up to 90 days, or less), pausing all sending, and deleting shoppers. You can give further instructions by email to hi@uncart.ai.

Uncart follows only your instructions, unless the law requires otherwise; it then tells you, unless the law forbids that. If Uncart thinks an instruction breaks data protection law, it tells you.

7. Confidentiality

Only the people at Uncart who need to reach shopper data to run the service can reach it, and each of them is bound to keep it confidential. Uncart's logs never contain phone numbers or message text.

8. Security measures

Uncart protects shopper data with these technical and organisational measures (Article 32 GDPR):

• Where: stored in Frankfurt, Germany, in AWS eu-central-1.
• Encryption: data is encrypted at rest, and phone numbers, messages and access tokens are also encrypted with AWS KMS keys held in Frankfurt; each value is bound to its shop, so one shop's data cannot be opened as another's. Data is encrypted in transit, connections to the database included.
• Separation: row-level security in the database walls each shop's data off; no shop can read another's.
• Access: Uncart's team signs in with two factors, sessions end after a short idle time, and the most sensitive admin actions need an owner and a fresh second factor.
• Records: every change to settings and every admin action is written to an audit log that cannot be edited.
• Less data: text reaches the AI model only after names, numbers and addresses are removed.
• Checks: messages from Shopify, Shopware and WhatsApp are checked for a valid signature, and 14 privacy checks run on every change Uncart makes.
• Deletion: retention jobs delete data every day, and backups are kept for 7 days.

Uncart may change these measures, as long as the protection stays at least as strong.

9. Sub-processors

You allow Uncart to use these providers. Uncart binds each to data protection terms at least as protective as this agreement and stays responsible to you for them.

Uncart gives you 30 days' notice, by email or in your dashboard, before it adds or replaces a provider. If you object and we find no solution, you can end the contract at any time (Terms, section 10).

10. International transfers

Uncart stores your shoppers' data in Frankfurt. Where data goes outside the EU, to the United States or another country, transfers rely on the EU–US Data Privacy Framework where it applies, and otherwise on the European Commission's Standard Contractual Clauses.

11. Helping you answer requests

• Shoppers can write STOP at any time, and can have their data deleted on WhatsApp, by email or through your shop, as the Data Deletion Instructions explain.
• Requests made through Shopify reach Uncart by themselves. Your dashboard's consent page lists each request with its 30-day deadline: for a copy, a download of everything Uncart holds about that shopper; for a deletion, a way to delete them once you checked who is asking.
• You can download your consent records at any time, for the whole shop or one phone number.
• A request Uncart receives directly is passed to you, or answered where Uncart can.
• Uncart also helps you, with the information it has, with security, breach notifications, impact assessments and questions from a supervisory authority (Articles 32 to 36 GDPR).

12. Personal data breaches

Uncart tells you without undue delay after it becomes aware of a personal data breach that affects your shoppers' data. It tells you what it knows (what happened, the data and shoppers concerned, the likely consequences, and what it is doing about it) and adds more as it learns it.

13. At the end: deletion or return

• Before you uninstall, you can download your consent records and each shopper's data from the dashboard.
• When you uninstall, Uncart stops sending for your shop at once. 48 hours after an uninstall, Shopify asks Uncart to erase your shop's data, and Uncart erases what it holds for your shop within 30 days; copies in backups are gone within 7 days after that.
• Uncart keeps only what the Privacy Policy lists as kept after a deletion: the record that a shopper wrote STOP (24 months, so they are never messaged again) and proof of consent and of each deletion, without the number (3 years).
• While you use Uncart, data is kept for the periods in the Privacy Policy's "How long we keep data".

14. Audits

Uncart gives you the information you need to show that this agreement is kept, and allows and contributes to audits, inspections included, by you or an auditor you choose who is bound to confidentiality. Ask by email with reasonable notice. Audits take place once a year at most, unless a breach or a supervisory authority makes another one necessary. Each of us bears its own costs.

15. Liability and precedence

Liability follows the Terms (section 9), unless data protection law says otherwise. Where this agreement and the Terms differ on personal data, this agreement applies.

16. Contact

Questions about this agreement or your shoppers' data: hi@uncart.ai.