Data Processing Agreement

enless processes personal data from your store only so that people who follow your brand in enless, and have chosen to add their purchases, get the pieces they bought from you in their enless wardrobe. This runs for as long as the enless app is installed in your store.

Your customers' email address on an order, the order number and date, and the products and prices on it. The email is only compared with enless accounts and not stored; the order number is kept on the wardrobe piece it created.

We process this data only as described here and on your documented instructions, which these Terms and your settings in Shopify are. If we think an instruction breaks data protection law, we tell you.

Only people who need it for this work have access, and they are bound to confidentiality. We protect the data with measures that fit the risk: encryption in transit and of access tokens at rest, separate production and test data, two-step sign-in for staff, an access log, backups, and an incident response plan.

We host enless on servers in the EU. Before adding or changing a sub-processor that handles this data, we tell you, and you can object. A current list is available from [email protected].

We help you answer requests from your customers (access, deletion and others) and meet your duties on security, breach notification and impact assessments. Shopify's customer data requests reach us automatically, and we act on them.

We tell you without undue delay, and within 48 hours, once we become aware of a personal data breach affecting this data.

When you remove the enless app, we delete the data from your store within 30 days, unless the law requires us to keep it.

We give you the information you need to show this agreement is kept, and allow audits by you or an auditor you choose, with reasonable notice.