Data processing agreement
Last updated
This Data Processing Agreement (the "DPA") forms part of the Firepush Terms of use (the "Terms") between Firepush Ltd, 93 Fernside Road, Poole, United Kingdom, BH15 2JQ ("Firepush") and the merchant that installs and uses the Firepush app (the "Merchant").
The DPA applies when Firepush processes personal data for the Merchant and that processing is covered by Data Protection Law. By accepting the Terms, the Merchant also accepts this DPA. No signature is needed. If the Merchant needs a signed copy, it can ask using the contact details in our Privacy Policy.
1. Definitions
"Data Protection Law" means the EU General Data Protection Regulation (EU GDPR), the UK GDPR and the UK Data Protection Act 2018, where each applies. "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in that law. "Merchant Personal Data" means the personal data described in Schedule 1. "Sub-processor" means a third party that Firepush engages to process Merchant Personal Data.
2. Roles
2.1. The Merchant is the controller of Merchant Personal Data and Firepush is its processor.
2.2. The Merchant is responsible for having a lawful basis for the processing, including any consent needed to send marketing messages, and for giving data subjects the information the law requires.
2.3. Firepush is a separate controller of the data it holds about the Merchant's own account, as described in our Privacy Policy. This DPA does not apply to that data.
3. Instructions
3.1. Firepush processes Merchant Personal Data only on the Merchant's documented instructions, unless the law requires otherwise. If the law requires otherwise, Firepush will tell the Merchant first, unless the law forbids this.
3.2. The Terms, this DPA and the Merchant's settings and actions in the Firepush app are the Merchant's instructions.
3.3. Firepush will tell the Merchant if it believes an instruction breaks Data Protection Law.
4. Confidentiality
Firepush makes sure that everyone it authorises to process Merchant Personal Data is bound by a duty of confidentiality.
5. Security
Firepush keeps technical and organisational measures in place to protect Merchant Personal Data, as set out in Schedule 2. Firepush may change these measures if the level of protection does not go down.
6. Sub-processors
6.1. The Merchant gives Firepush general authorisation to use Sub-processors. The current Sub-processors are listed in Schedule 3.
6.2. Firepush will update Schedule 3 at least 30 days before it adds or replaces a Sub-processor. The Merchant may object on reasonable data protection grounds during that time. If the parties cannot resolve the objection, the Merchant may stop using the Services by uninstalling the app.
6.3. Firepush binds each Sub-processor to data protection obligations that are no less protective than this DPA, and remains responsible for each Sub-processor's work.
7. International transfers
7.1. Firepush is established in the United Kingdom. Transfers of Merchant Personal Data from the EEA to Firepush rely on the European Commission's adequacy decision for the United Kingdom while it remains in force.
7.2. Where Merchant Personal Data goes to a Sub-processor in a country without an adequacy decision, Firepush relies on a safeguard recognised by Data Protection Law, such as the EU Standard Contractual Clauses, the UK Addendum to those clauses or the UK International Data Transfer Agreement.
8. Data subject requests
8.1. If a data subject contacts Firepush directly, Firepush will pass the request to the Merchant and will not answer it unless the Merchant asks it to.
8.2. The Merchant can view, unsubscribe and delete subscribers and customers in the Firepush app. Where this is not enough, Firepush will give reasonable help.
9. Personal data breaches
Firepush will tell the Merchant without undue delay after it becomes aware of a personal data breach affecting Merchant Personal Data. Firepush will share the information the Merchant reasonably needs to meet its own duties, as that information becomes available.
10. Assistance
Firepush will give reasonable help with data protection impact assessments and consultations with supervisory authorities, taking into account the nature of the processing and the information available to Firepush.
11. Retention and deletion
11.1. While the Merchant uses the app, Firepush keeps Merchant Personal Data until the Merchant deletes it. There are two cases for push subscribers who unsubscribe. If a subscriber turns off notifications in their browser, the next message to them fails, and Firepush permanently deletes the record within 14 days of that failure. If the Merchant unsubscribes a subscriber in the app, the record stays, marked as unsubscribed, until the Merchant deletes it or uninstalls the app.
11.2. When a record is deleted, or after the Merchant uninstalls the app, Firepush permanently deletes subscriber and customer records from its live systems within 30 days. Database backups are kept for 7 days and are then deleted.
11.3. Firepush keeps SMS opt-out records for as long as the Merchant uses the app, so that it can keep honouring them. Firepush may keep other data for longer only where the law requires it.
12. Audits
On reasonable written request, Firepush will give the Merchant the information needed to show that it complies with this DPA. If that information is not enough, or a supervisory authority requires it, the Merchant may audit Firepush once a year at its own cost, with at least 30 days' notice, during business hours and under a duty of confidentiality.
13. General
13.1. This DPA lasts for as long as Firepush holds Merchant Personal Data.
13.2. If this DPA and the Terms conflict on the protection of personal data, this DPA applies.
13.3. The limits of liability in the Terms apply to this DPA, as far as the law allows.
13.4. Firepush may update this DPA by posting a new version on this page. An update will not reduce the protection of Merchant Personal Data.
Schedule 1: Details of the processing
Subject matter: providing the Firepush web push and SMS marketing services to the Merchant's Shopify store.
Duration: for as long as the Merchant uses the Services, and until deletion under section 11.
Nature and purpose: collecting subscribers, storing their records, sending the messages and automations the Merchant sets up, and reporting on the results.
Data subjects: visitors to the Merchant's store who subscribe to messages, and the Merchant's customers.
Categories of personal data:
- Push subscribers: browser subscription token, Firepush token, IP address, time zone, platform, browser, device type, operating system and model, tags, last activity, and the Shopify customer ID where known.
- Customers: name, email address, phone number, country, city, time zone, Shopify customer ID, tags, marketing consent status and order summary data.
- Message activity: which messages were sent to a subscriber or customer, and their deliveries, clicks and related orders.
Special categories of data: none intended. The Merchant must not use the Services to process them.
Schedule 2: Security measures
- Data sent between browsers, stores and Firepush is encrypted in transit with HTTPS.
- Firepush runs on cloud infrastructure in access-controlled data centres operated by its hosting provider.
- Access to production systems is limited to staff who need it for their work.
- Each Merchant's data is kept separate from other Merchants' data in the application.
- Databases are backed up daily and backups are kept for 7 days.
- Application errors are monitored.
Schedule 3: Sub-processors
| Sub-processor | Purpose | Applies to |
|---|---|---|
| Amazon Web Services | Hosting, storage, queues and databases | All Merchants |
| Cloudflare, Inc. | Content delivery and edge security | All Merchants |
| Google LLC (Firebase Cloud Messaging) | Delivering web push notifications | All Merchants |
| OpenAI | Automated spam checks on message content | All Merchants |
| Functional Software, Inc. (Sentry) | Application error monitoring | All Merchants |
| Vonage (Nexmo) | Sending SMS messages | Merchants using SMS |
| Vertex | Sending SMS messages in certain regions | Merchants using SMS |
Shopify is the platform the Merchant uses and is not a Sub-processor of Firepush.