This Data Processing Agreement ("DPA") is part of the Terms of Service between COEC (processor) and the Customer (controller).
1. Parties and precedence
COEC processes personal data on behalf of the Customer. On data protection, this DPA prevails over the Terms. Liability follows the Terms, subject to mandatory law.
2. Subject matter, duration, nature and purpose
COEC processes personal data to provide ShopAssist under the Terms, for the subscription term and the deletion period in clause 11.
3. Categories
Data subjects are shoppers and visitors of the Customer's stores and the Customer's staff using the dashboard. The categories of personal data are listed in Annex I. Special categories of data are not intended to be processed.
4. Controller duties
The Customer:
- has a lawful basis for the processing and informs shoppers, for example with the shopper privacy notice template;
- configures consent management so the widget follows shoppers' choices;
- does not collect special categories of data, payment card data or government identifiers through the chat;
- does not remove the AI disclosure;
- verifies a requester's identity before acting on a handoff marked as unverified.
5. Documented instructions
The Customer's instructions are the Terms, this DPA, the Customer's configuration in the dashboard (settings, integrations, AI keys, handoff targets, webhooks, retention) and API calls. COEC informs the Customer if it believes an instruction infringes data protection law. Integrations and AI keys configured by the Customer are instructions under clause 7, not sub-processing.
6. Confidentiality
COEC ensures that persons authorised to process personal data are bound by written confidentiality obligations and trained.
7. Own AI keys and integrations
When the Customer configures its own AI provider key, helpdesk, Slack webhook or webhook endpoint, COEC transmits data to that recipient on the Customer's instruction. The recipient is the Customer's own processor or recipient, and the Customer is responsible for its contract, data processing agreement and transfer mechanism with that party. COEC is not liable for the recipient's processing.
8. Sub-processors
8.1 The Customer gives general written authorisation for the sub-processors in Annex III.
8.2 COEC announces a new or changed sub-processor at least 30 days in advance by email to the organization's owners, admins and security contact, and on the sub-processors page and its RSS and JSON feeds.
8.3 The Customer may object within the notice period. The remedy is to terminate the affected service or, for managed-AI sub-processors, to switch to an own AI key.
8.4 Emergency replacements, for example when a sub-processor fails, are notified as soon as possible with the same right to object.
8.5 COEC imposes the obligations of this DPA on its sub-processors and remains liable for them.
9. Security
COEC implements the technical and organisational measures in Annex II. COEC may update them if the level of protection does not decrease.
10. Assistance
COEC assists the Customer with:
- data subject requests, through self-service tools in the dashboard and API, and otherwise within 7 days;
- personal data breaches, which COEC notifies without undue delay and within 48 hours of becoming aware, in phases where needed;
- data protection impact assessments, with a documentation pack, and prior consultations.
11. Return and deletion
During the term, the Customer can export data at any time. At the end of the term, the Customer has a 30-day retrieval window, after which the data is deleted within 30 days. Backups age out within 30 days after that. For stores installed from the Shopify App Store, data is deleted within 30 days after uninstall, and immediately on Shopify's shop redaction request.
12. Audits
COEC first provides documentation, such as its security measures, a penetration test summary and sub-processor certificates. The Customer may audit, on site or remotely, at most once a year, with 30 days' notice, at its own cost and under confidentiality.
13. Transfers
Personal data is processed in the EEA by default. Standard Contractual Clauses (Commission Decision 2021/914) are incorporated: Module 3 for non-EEA sub-processors and Module 4 where the Customer is outside the EEA without an adequacy decision and receives exports. The UK Addendum and Swiss adaptations apply where relevant.
14. AI-specific terms
Neither COEC nor its managed AI providers train or fine-tune models on the Customer's data. Provider retention is disclosed in Annex III.
15. Records, contact and law
COEC keeps records of processing under Article 30(2) GDPR. Privacy contact: privacy@coec.dk. This DPA is governed by Danish law.
Annex I: Processing details
- Shoppers: chat messages and uploaded photos (photos deleted after 24 hours), order data fetched live for signed-in or verified shoppers, email addresses and names they provide, consent records, newsletter and back-in-stock sign-ups, technical data such as language, page and a pseudonymous session id.
- Customer staff: names, email addresses, roles, sign-in and audit records.
Annex II: Technical and organisational measures
EU-only hosting; network segmentation; TLS 1.2 or newer; disk and backup encryption; application-level envelope encryption of credentials; hashed tokens and identifiers; tenant isolation with row-level security; role-based access with multi-factor authentication; least-privilege database roles; secrets management; egress control for customer-configured URLs; rate limiting and abuse protection; AI safety controls including confirmation of actions and prompt-injection scanning; data minimisation; retention and deletion policies; encrypted backups in two locations with restore drills; availability monitoring; separation of test and production; audit logging; log redaction; secure development and vulnerability management; incident response; staff confidentiality and training; vendor management; data-loss prevention.
Annex III: Sub-processors
The sub-processors listed on the sub-processors page, in the version current at signature.
Annex IV: Standard Contractual Clauses
Module 3 (processor to processor) for non-EEA sub-processors; Module 4 (processor to controller) for Customers outside the EEA without adequacy. Clause 7 (docking clause) applies; Clause 11 optional language does not apply; governing law and forum: Denmark.
Annex V: Own AI keys and integrations
Instruction and attestation text shown when the Customer connects its own AI key: "I confirm that my business has its own agreement with the provider, including a data processing agreement and, where needed, a valid transfer mechanism for any processing outside the EEA. I instruct ShopAssist to send shopper conversations and the store data needed to answer them to this provider. I understand that the provider is my processor, not ShopAssist's sub-processor."