Data Processing Terms

1. Scope and roles

"Referlane" means the operator named in the Merchant Terms. These terms apply when Referlane processes personal data of the merchant's shoppers, creators, customer referrers and staff to provide the service. The merchant is the controller and Referlane is the processor ("service provider" under US state privacy laws) for that data. Referlane is the controller only of merchant account data, its own security logs, and website and beta-application data.

2. Processing details

3. Referlane's commitments

• Instructions. Process only on the merchant's documented instructions, which are the agreement and the merchant's use of the app, unless the law requires otherwise.
• Confidentiality. People with access are bound by confidentiality.
• Security. Referlane applies the measures in Annex A.
• Sub-processors. Referlane uses the sub-processors listed in Annex B, under written terms that impose equivalent data-protection obligations. It gives at least 30 days' notice by email before adding or replacing one. The merchant may object on reasonable data-protection grounds; if the parties can't resolve the objection, the merchant may stop using the service.
• Data-subject requests. Referlane helps the merchant answer them, including through Shopify's privacy webhooks (customer data request, customer redaction, shop redaction).
• Breaches. Referlane notifies the merchant without undue delay after becoming aware of a personal-data breach affecting the merchant's data. It gives the information the merchant reasonably needs as it becomes available, and reasonable assistance with the merchant's own notification duties.
• Deletion. Referlane deletes or pseudonymises the data at the end of the service and on Shopify redaction requests. It keeps only what the law, or the merchant's own financial records, require.
• Audits. Referlane makes available the information reasonably needed to demonstrate compliance with these terms, through documentation and a security questionnaire, at most once a year unless there has been a breach. An inspection is available where applicable law or a regulator requires it, on 30 days' notice, during business hours, under confidentiality, without access to other customers' data, and at the merchant's cost.

4. International transfers

Referlane hosts the service in the United States. Where the merchant's use of the service involves a transfer of personal data from the EEA or the UK to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2, controller to processor) and, for UK data, the UK International Data Transfer Addendum are incorporated into these terms for that transfer. They apply only where such a transfer occurs, and prevail over these terms to the extent of any conflict.

4a. Liability and precedence

• The limitations of liability in the Merchant Terms (section 14) apply to these terms, to the extent applicable data-protection law permits. Where the Standard Contractual Clauses or UK Addendum apply to a transfer, they apply as written to that transfer.
• On data-protection matters, these terms prevail over the Merchant Terms.
• The measures in Annex A describe controls Referlane maintains; Referlane may update them provided the overall level of protection is not reduced.

5. Annex A — technical and organisational measures (implemented)

• Tenant isolation: PostgreSQL row-level security enforced on every tenant table; the runtime database role cannot bypass it.
• Encryption: TLS in transit; Shopify access and refresh tokens encrypted at rest with application envelope encryption; sign-in, invitation and session secrets stored only as hashes. The hosting provider encrypts the database, its backups and point-in-time recovery archives at rest with AES-256, and the file storage provider encrypts stored files at rest with AES-256.
• Access control:
  • merchant staff by role (Owner, Manager, Operator) through Shopify sessions or single-use emailed links;
  • sensitive actions need a fresh Manager step-up;
  • internal operator access is break-glass: emailed link, reason required, time-limited, with an alert and an audit record.
• Logging: a security and protected-data access log is kept for 12 months, and an append-only product audit trail records every consequential command.
• Data minimisation: shopper email only; referral click evidence is minimised; no payment or bank data.
• Retention:
  • raw webhooks for 30 days;
  • failed or quarantined webhooks for up to 180 days;
  • logs for 30 days;
  • security logs for 12 months;
  • database backups for about 4 weeks (point-in-time recovery archive);
  • exports for 7 days.
• Separation: test and production use separate infrastructure and Shopify apps, and staging uses synthetic data only.
• Resilience:
  • continuous point-in-time recovery for the database, with a tested restore drill;
  • a redaction journal re-applied after any restore;
  • safety controls that pause processing without losing events.

6. Annex B — sub-processors