Data processing agreement

1. Who is the database owner and who is the processor

This agreement is part of the terms of service, and governs the processing of data about the customers of the stores. The business is the database owner, and it is the business that decides what data is collected and why. [Company name Ltd., company no. 5XXXXXXXX] ("Kreaza") is the holder and processes the data for the business only, as those terms are defined in the Privacy Protection Law, 5741-1981, and in the Privacy Protection (Data Security) Regulations, 5777-2017.

The data processed: order details, customers' name, phone, email and address, marketing consent, customer accounts, reviews, enquiries, and the content of the chat with the store assistant. It is processed for as long as the store is active and for the purpose of running it.

2. Processing only on your instructions

Kreaza processes the data only to provide the service: to display the store, take orders, send the messages the business has set up, back up and secure. The settings the business chooses in the admin are its instructions.

Kreaza does not use the customers' data for its own purposes, does not sell it, and does not use it to train models or for advertising.

Everyone who works at Kreaza and is exposed to the data is bound by confidentiality, and access is given only to those who need it for the service or for support.

3. Sub-processors

The providers that process customer data for Kreaza are listed in the privacy policy, in the section "Who holds the data". The servers are hosted by OVHcloud in Frankfurt, in the European Union.

Before we add a sub-processor that receives customer data, we will update the list and give at least 30 days' notice, by email and in the admin. You can object for a reasonable cause and, if no solution is found, cancel the plan.

Services that the business connects itself, such as a payment processor or a shipping company, are not sub-processors of Kreaza: it is the business that chooses them and transfers data to them.

4. Security

Kreaza applies security measures that match the security level the regulations set: encrypted communication, passwords stored as a hash, encrypted secrets, role-based permissions, two-step verification, an activity log, separation between stores, and continuous backup.

5. Security incident

If a severe security incident occurs that concerns the store's data, we will notify the business without delay, with what is known: what happened, which data, and what was done. We will help the business meet its obligations, including notifying the Privacy Protection Authority where the law requires.

6. Customers' rights

A customer who wants to inspect the data about them, or to correct or delete it, contacts the store. The admin has tools for this, such as exporting and deleting a customer. If a customer contacts Kreaza directly, we will pass the request to the store.

7. At the end of the engagement

The business can export all the data at any time. After the store is closed and the period for changing your mind has passed, the data is deleted, and its backups are deleted with the backup cycle, except for what the law requires to be kept.

For questions about data processing: [legal@kreaza.com].