Data Processing Agreement

This DPA forms part of the Terms of Service (the "Terms") between the merchant that installed the Carnet app (the "Controller", "Merchant") and TAKISOFT 2.0 (the "Processor", "Carnet"). It applies from the moment the Merchant installs the App and for as long as Carnet processes Personal Data on the Merchant's behalf. It reflects Art. 28(3) of Regulation (EU) 2016/679 ("GDPR"). Capitalised terms have their GDPR meaning.

1. Subject matter and parties

1.1 Subject matter. Carnet provides line sheets, buyer order links and conversion of order requests to Shopify draft orders (the "Service"). In doing so Carnet processes Personal Data of the Merchant's buyers on the Merchant's behalf.

1.2 Roles. The Merchant is the controller (or, where it acts for its own customers, a processor with Carnet as sub-processor; the Merchant confirms it has authority to give these instructions). Carnet is the processor. For the Merchant's own account data (staff, shop details, billing) Carnet acts as an independent controller as set out in the Privacy Policy and this DPA does not apply to it.

1.3 Details of processing (nature, purpose, duration, data categories, data subjects) are in Annex I. Duration: the term of the Terms, plus the deletion periods in section 6.

2. Instructions of the controller

2.1 Carnet processes Personal Data only on the Merchant's documented instructions: this DPA, the Terms, and the Merchant's use and configuration of the App (for example creating links, using "Delete buyer data"). Carnet will not process the data for its own purposes.

2.2 Carnet will inform the Merchant if, in its opinion, an instruction infringes data protection law.

2.3 Carnet ensures that persons authorised to process the data are bound by confidentiality.

2.4 Assistance. Taking into account the nature of processing, Carnet helps the Merchant respond to data subject requests and meet Arts. 32 to 36 GDPR, using: the export of buyer data on a Shopify customer data request; the Merchant's "Delete buyer data" function and Shopify's customer redaction request, which remove a buyer's contact details from the request and from related emails and imports while keeping the order reference, lines and totals the Merchant needs for its records; and the automatic retention periods in Annex I. Requests that buyers send to [email protected] are forwarded to the Merchant; Carnet does not respond to the buyer on the Merchant's behalf. Assistance beyond the above may be charged at reasonable cost.

2.5 Legal notice shown to buyers. The Merchant provides its legal name, contact and address in the App; Carnet displays them to buyers as the party responsible, and displays a notice that Carnet acts as its processor. The Merchant is responsible for the accuracy of this information.

3. Security measures

Carnet implements the technical and organisational measures in Annex II, appropriate to the risk (Art. 32 GDPR). Carnet may update them provided the overall level of protection is not reduced.

4. Sub-processors

4.1 The Merchant gives general authorisation for the sub-processors in Annex III. The Merchant also acknowledges that Shopify is the platform the Merchant itself uses and that Carnet calls Shopify's APIs on the Merchant's behalf.

4.2 Carnet will inform the Merchant of any intended addition or replacement of a sub-processor at least 30 days in advance by notice in the App or by email, giving the Merchant the opportunity to object on reasonable data protection grounds. If the parties cannot resolve the objection, the Merchant may terminate by uninstalling the App.

4.3 Carnet binds each sub-processor to data protection obligations no less protective than this DPA and remains liable for their performance as Art. 28(4) GDPR provides.

4.4 International transfers. Production data is hosted in the EU (France Central). Where a sub-processor transfers Personal Data outside the EEA (in particular Cloudflare and Shopify), it does so under the sub-processor's Standard Contractual Clauses and/or an adequacy decision such as the EU-US Data Privacy Framework.

5. Breach notification

5.1 Carnet will notify the Merchant without undue delay after becoming aware of a Personal Data Breach affecting the Merchant's data, by email to the contact address registered for the shop in Shopify.

5.2 The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and the measures taken or proposed. Carnet will update the Merchant as information becomes available and will help the Merchant meet its Art. 33 and 34 duties.

6. Deletion at uninstall

6.1 When the Merchant uninstalls the App, buyer links are paused and staff sessions are deleted immediately.

6.2 Shopify sends Carnet a store-deletion (shop/redact) request about 48 hours after uninstall. On receipt Carnet deletes all the store's data from its live database (every table keyed to the store, plus related jobs and sessions), removes the store's Cloudflare hostnames and routing entries, and destroys the store's encryption key so that any remaining encrypted fields become unreadable. This normally happens within an hour of the request. If a reinstall has occurred in the meantime, the request deletes nothing. If no request arrives, Carnet deletes the data 60 days after uninstall. In short: the data is deleted about 2 days after uninstall, and 60 days at the latest.

6.3 Backups. Copies in database backups are deleted automatically when the backups expire, at most 35 days later. If a backup is ever restored, Carnet re-applies every recorded deletion before resuming normal processing. For this purpose Carnet keeps deletion records (store identifier, request identifiers and keyed hashes, without readable contact data) for 42 days.

6.4 During the term, Carnet deletes buyer data per the retention periods in Annex I and on the Merchant's instruction.

6.5 At the Merchant's written request before deletion, Carnet will provide a copy of the Personal Data in a common format.

6.6 Carnet may keep data where the law requires, in which case it will isolate and protect it.

7. Audit

7.1 Carnet will make available the information needed to show compliance with Art. 28 and allow for and contribute to audits, including inspections, by the Merchant or an auditor it mandates.

7.2 Carnet may first respond with written documentation (Annexes II and III, security page, hosting providers' published certifications). On-site audits require 30 days' notice, a confidentiality undertaking, a reasonable scope and frequency (not more than once in 12 months absent a breach or regulator request), and are at the Merchant's cost. Because production is hosted on a cloud provider, audits of the provider are limited to its published reports.

8. Liability, governing law, order of precedence

Liability under this DPA is subject to the limits in the Terms. This does not limit liability towards data subjects under Art. 82 GDPR. Governing law and jurisdiction: French law, with the courts of the registered office of TAKISOFT 2.0. If this DPA conflicts with the Terms on the processing of Personal Data, this DPA prevails.

9. Contact

[email protected].

Annex I: Details of processing

Annex II: Technical and organisational measures

Encryption.

• Buyer details, buyer link tokens, email recipients and bodies, and data-export files are encrypted at field level with AES-256-GCM, with a random 12-byte nonce per value and authenticated additional data tying each value to its row.
• Keys are derived per store from a root key (held as a secret in Azure Key Vault and read through the app's configuration) and a random per-store secret held in the database. Root keys can be rotated while the app runs.
• Email and VAT number are indexed only by keyed hash (HMAC-SHA-256 with a per-store secret), never in clear.
• Encrypted buyer names and emails are not searchable.
• TLS in transit; the blob container for deletion records requires TLS 1.2 and has no public access.

Crypto-shredding. On store deletion the per-store secret is destroyed, which makes the store's encrypted fields unreadable, including in backups, in addition to deleting the rows.

Access control and isolation.

• All database access for store data goes through a store-scoped data layer and per-transaction store context. This is application-level isolation, not database row-level security.
• Merchant staff authenticate via Shopify. Production secrets are Key Vault references; the production email service uses a managed identity, with no long-lived connection string. The App Service accepts only Cloudflare IP ranges.
• Buyer links use long random tokens; only a lookup hash and an encrypted copy are stored. Optional access codes protect links; codes are stored as HMACs; failed attempts are rate-limited and locked out.

Application security of the buyer pages. Strict Content Security Policy with nonces, no framing, no referrer, noindex, exact-origin check on submissions, honeypot and minimum-fill-time check, rate limits per IP hash, per link and per store, and a daily cap per link, session cookie with Secure, HttpOnly, SameSite flags.

Logging. Request logs record paths without query strings; link tokens in paths are masked; error messages, stacks and context values are scrubbed of email addresses and tokens before logging.

Minimisation and retention. Automatic redaction and deletion as in Annex I; hourly retention job; buyer contact data cleared from requests, emails and imports on erase; aggregates in the order book are not personal data and are kept.

Deletion and recovery. Shopify's customers/redact, customers/data_request and shop/redact webhooks are verified and processed automatically with retries; deletion records are exported hourly to private blob storage and re-applied after any backup restore. Database backups are retained up to 35 days.

Availability. Managed PostgreSQL with automated backups; health checks; background jobs with leases and idempotent retries.

Organisational. Access to production limited to the operator.

Annex III: Sub-processors

Planned changes will be notified under section 4.2.