Data processing terms

When we build, migrate, connect or support your store, we may see or handle personal data that belongs to your business, such as your customers' names, contact details, addresses and order history. For that data, you are the controller and Shyft Stack is your processor (a "service provider" or "processor" under US state privacy laws). This page summarizes the terms we follow, which reflect Article 28 of the EU and UK GDPR.

If your business needs a signed data processing agreement (DPA), email info@shyftstack.com. We will send ours, with the standard contractual clauses for international transfers, or review yours.

What we handle, and why

• Data: whatever personal data is in your store or in the systems you ask us to work on or connect, such as your previous platform, ERP or email platform. Usually customer names, email addresses, phone numbers, postal addresses and order history.
• Purpose: only to deliver the work in your scope or support plan, such as a build, migration, integration or fix.
• Duration: for the length of the project or support plan.

What we commit to

• We handle your data only on your instructions, as set out in your scope, proposal and written requests, and we tell you if we believe an instruction breaks data protection law.
• Everyone on our team who handles your data is bound to keep it confidential.
• We protect it with encrypted connections, collaborator access to your store rather than shared passwords, and two-factor authentication on our accounts. We build on a development copy of your store, and work with customer data only when the task needs it.
• We do not sell your customers' data or use it for our own purposes, and we combine it with data from other sources only when your project requires it.
• We do not hand your data to other companies, except the tools your project needs, which we agree with you beforehand. We tell you in advance about any new one, so you can object, and we remain responsible for them.
• We help you respond to requests from your customers who use their privacy rights, and with security and impact assessments where you need our input.
• If we become aware of a breach affecting your data, we tell you without undue delay, with the information you need to meet your own obligations.
• When the project or plan ends, we remove our access and delete or return your data, unless the law requires us to keep it.
• We give you the information you need to show that these terms are met, and we cooperate with reasonable audits agreed in advance.

International transfers

Our team works from Pakistan. For data from the UK, EU or Switzerland, our DPA includes the European Commission's standard contractual clauses for controller-to-processor transfers, with the UK addendum, so your data keeps the protection the law requires.

Your own obligations

As the controller, you decide what data your store collects and tell your customers how it is used, usually in your store's privacy policy. Shopify, your apps and other platforms you use handle data under your own agreements with them.

Questions? Email info@shyftstack.com. Our privacy policy covers the information we collect about you as our client.