Data Processing Agreement

1. Definitions

"Personal data", "processing", "controller", "processor", "sub-processor", "data subject", "supervisory authority" and "personal data breach" have the meanings given to them in Article 4 GDPR.

"Merchant Personal Data" means personal data that the Processor processes on behalf of the Merchant in connection with HiveBee, as described in Annex I.

"Service" means the HiveBee application and the associated search, recommendation, analytics and reporting functions.

2. Subject matter and roles

The Merchant is the controller of Merchant Personal Data. Rankskipper GmbH acts as processor and processes Merchant Personal Data solely on the Merchant's behalf.

Where Rankskipper GmbH processes data relating to the Merchant's own account and business relationship, such as administrator contact details, billing information and service correspondence, it acts as controller in its own right. That processing is described in the Privacy Policy and is not governed by this DPA.

3. Nature, purpose and duration of processing

The nature, purpose, categories of personal data and categories of data subjects are set out in Annex I.

Processing begins when the Merchant installs the Service and continues for as long as the Merchant uses it. Upon uninstallation or termination of the Main Agreement, the provisions of section 13 apply.

4. Processing on documented instructions

The Processor processes Merchant Personal Data only on documented instructions from the Merchant, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor informs the Merchant of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

Documented instructions are given through:

• the Main Agreement and this DPA;
• the configuration and settings the Merchant selects within the Service;
• the permissions the Merchant grants through Shopify when installing the Service;
• written instructions sent to hello@hivebee.ai.

The Processor informs the Merchant without undue delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

5. Confidentiality

The Processor ensures that persons authorised to process Merchant Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. That obligation survives the end of their engagement.

Access to Merchant Personal Data is limited to personnel who require it in order to perform the Processor's obligations under the Main Agreement.

6. Security of processing

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as required by Article 32 GDPR.

The measures in place at the effective date of this DPA are described in Annex II. The Processor may update these measures provided that the level of security is not reduced.

7. Sub-processors

The Merchant grants the Processor general authorisation to engage sub-processors for the performance of the Service. The sub-processors engaged at the effective date of this DPA are listed in Annex III.

The Processor imposes on each sub-processor, by way of a written contract, data protection obligations that are no less protective than those set out in this DPA. The Processor remains fully liable to the Merchant for the performance of each sub-processor's obligations.

Changes and right to object

The Processor informs the Merchant of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the Merchant's registered contact address and by updating Annex III.

The Merchant may object to such a change on reasonable data protection grounds within 30 days of being informed. If the parties cannot reach a solution, the Merchant may terminate the Main Agreement with effect from the date the change takes effect, without penalty, and receive a pro-rata refund of any fees paid in advance for the unused period.

8. International transfers

Merchant Personal Data is stored within the European Union. Hosting takes place on Amazon Web Services infrastructure located in Germany.

To generate search results and product text, search queries and limited product information (such as title, description, tags and price) are processed through Google's Gemini API (see Annex III). This processing may take place outside the European Union.

Where Merchant Personal Data is transferred to a third country, including the transfer described above, the Processor only carries out that transfer on the basis of an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, supplemented by a transfer impact assessment and additional measures where required.

9. Assistance with data subject rights

Taking into account the nature of the processing, the Processor assists the Merchant by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Merchant's obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR, namely access, rectification, erasure, restriction of processing, data portability and objection.

If a data subject contacts the Processor directly in relation to Merchant Personal Data, the Processor does not respond to the substance of the request. It forwards the request to the Merchant without undue delay and informs the data subject that the Merchant is the controller.

The Processor supports the mandatory Shopify privacy webhooks for customer data requests, customer redaction and shop redaction.

10. Assistance with Articles 32 to 36 GDPR

Taking into account the nature of the processing and the information available to it, the Processor assists the Merchant in ensuring compliance with the obligations under Articles 32 to 36 GDPR, in particular with regard to the security of processing, the notification of personal data breaches, the communication of breaches to data subjects, data protection impact assessments and prior consultation with the supervisory authority.

11. Personal data breaches

The Processor notifies the Merchant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data.

The notification describes, to the extent known at the time and supplemented as further information becomes available:

• the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and to mitigate its possible adverse effects;
• the name and contact details of a point of contact for further information.

The Processor does not notify a supervisory authority or data subjects on the Merchant's behalf unless the Merchant instructs it to do so in writing.

12. Audits and demonstration of compliance

The Processor makes available to the Merchant all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.

The Processor allows for and contributes to audits, including inspections, conducted by the Merchant or an auditor mandated by the Merchant, subject to the following:

• audits take place during normal business hours, upon at least 30 days' written notice, and no more than once per calendar year, unless a personal data breach has occurred or a supervisory authority requires otherwise;
• the auditor must not be a competitor of the Processor and must be bound by confidentiality;
• audits must not compromise the security of the Service or the confidentiality of other merchants' data;
• the Merchant bears its own costs; the Processor may charge its reasonable costs for audits exceeding one per calendar year.

13. Deletion and return of data

Upon uninstallation of the Service, termination of the Main Agreement, or at the Merchant's written request, the Processor deletes or anonymises all Merchant Personal Data within seven days, unless Union or Member State law requires continued storage.

At the Merchant's request made before the end of that period, the Processor returns Merchant Personal Data in a structured, commonly used and machine-readable format.

Backup copies are deleted within the ordinary backup rotation cycle, and in any event within 30 days. Until deletion, data held in backups remains subject to this DPA.

The Processor confirms deletion in writing upon request.

14. Merchant obligations

The Merchant is responsible for:

• establishing and maintaining a valid legal basis for the processing of personal data through the Service;
• providing data subjects with the information required under Articles 13 and 14 GDPR, including the use of HiveBee as a processor, and maintaining an accurate privacy policy for its store;
• ensuring that the permissions granted through Shopify are lawful and limited to what is necessary;
• ensuring that its instructions to the Processor comply with applicable data protection law;
• responding to data subject requests as controller.

15. No sale of data, no AI training

The Processor does not sell Merchant Personal Data and does not share it for advertising, profiling or any purpose unrelated to the provision of the Service.

The Processor does not use Merchant Personal Data, catalogue data, order data or search data to train artificial intelligence or machine learning models, and does not permit its sub-processors to do so.

Data from one merchant's store is not used to generate, improve or inform results for any other merchant's store. Each merchant's catalogue and query data is indexed and served in isolation.

16. Liability

Liability under this DPA is governed by the liability provisions of the Main Agreement, except where Article 82 GDPR provides otherwise. Nothing in this DPA limits or excludes either party's liability towards data subjects or supervisory authorities under the GDPR.

17. Changes to this agreement

The Processor may amend this DPA where necessary to reflect changes in applicable law, guidance from supervisory authorities, or changes to the Service. The Processor informs the Merchant of material changes at least 30 days before they take effect, by email and by publishing the updated version on this page.

If the Merchant does not accept a material change, it may terminate the Main Agreement without penalty before the change takes effect. Continued use of the Service after that date constitutes acceptance.

Each version of this DPA is identified by its version number and effective date, shown at the top of this page.

18. Governing law and jurisdiction

This DPA is governed by Austrian law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The place of jurisdiction is Vienna, Austria, insofar as this is legally permissible.

Mandatory consumer protection provisions and the rights of data subjects under the GDPR remain unaffected.

19. Contact

For privacy enquiries, deletion requests, a signed counterpart of this DPA, or any other matter arising under it:

Annex I: Details of the processing

Subject matter

Provision of AI-powered product search, product recommendations, catalogue indexing, order attribution, analytics and reporting within the Merchant's Shopify store.

Duration

For the term of the Main Agreement, followed by deletion or anonymisation in accordance with section 13.

Categories of data subjects

• Customers of the Merchant's store
• Visitors to the Merchant's storefront
• Administrative contacts of the Merchant

Categories of personal data and purposes

Data not accessed

The Processor does not access or store shipping addresses, billing addresses, telephone numbers, payment or bank details, government identification numbers, or dates of birth.

Special categories of data

No personal data within the meaning of Article 9 GDPR is knowingly processed. The Merchant must not instruct the Processor to process such data through the Service.

Non-personal data

Product and collection data (names, descriptions, identifiers, variants, prices, images, categories and collections) is processed for indexing, search and recommendations. The Processor does not modify product data.

Annex II: Technical and organisational measures

Measures implemented pursuant to Article 32 GDPR.

Annex III: Approved sub-processors

As at the effective date of this DPA.

Changes to this list are governed by section 7.