Data processing agreement

This agreement applies when a business (the "merchant") uses OumsAI to process the personal data of its store's customers. It forms part of the Terms of service and meets Article 28 of the UK GDPR and the EU GDPR.

Roles

The merchant is the controller of its customers' personal data. BRODV LTD, a company registered in England and Wales under number 17069547, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("OumsAI") is its processor.

The merchant is responsible for the lawfulness of the processing it instructs, for informing its customers (its store's privacy notice) and for any consent it needs.

Subject matter and duration

Running the merchant's store on OumsAI, for as long as the merchant uses the service, and until the data is deleted or returned as set out below.

Nature and purpose

Hosting, storage, display, transmission and analysis needed to take and fulfil orders, handle payments, returns and messages, send order and marketing email, keep consent records, run the AI features the merchant uses, fix problems with the store, and, if the merchant turns them on, send basket reminders to shoppers who did not complete a checkout.

Data subjects and data

Buyers, newsletter subscribers and people who contact the store. Identity and contact details, delivery addresses, order and payment history (card data stays with Stripe), messages, consent records, and technical data (IP address, browser).

If basket reminders are on: shoppers who give their email at checkout and tick the reminder box, with their email address, basket contents, store language, and the record of their consent.

Basket reminders

Basket reminders are off until the merchant turns them on. By turning them on, the merchant instructs OumsAI to process the data below for this purpose only.

OumsAI saves a shopper's email and basket only when the shopper submits the checkout step and has ticked the unticked reminder box shown next to the email field. OumsAI keeps the record of that consent (date and time, language and the version of the wording) for the merchant.

OumsAI sends at most 3 reminders within 7 days of the checkout being left, in the merchant's name. Each reminder has a one-click link to stop them. OumsAI stops the reminders at once if the shopper completes the order, uses that link, has unsubscribed from the store's marketing, or if the email bounces.

OumsAI deletes the email address and the basket 30 days after the checkout was left. It keeps reminder results (emails sent, orders recovered, amounts) for 13 months in pseudonymised form, without the email address or the basket, so that the merchant can see how the feature performs. OumsAI does not add tracking pixels to reminders.

The merchant chooses whether to use the feature, is responsible for the content of any offer it adds, and must not use the saved emails for any other purpose. OumsAI does not use them for its own purposes.

OumsAI's obligations

Process the data only on the merchant's documented instructions (this agreement, the service as configured, and the merchant's actions in it), including for transfers outside the United Kingdom and the European Economic Area; tell the merchant at once if, in OumsAI's opinion, an instruction breaks data protection law; and if the law requires OumsAI to process the data otherwise, tell the merchant first, unless that law forbids it.

Not use the data for its own purposes, not sell it, and not use it to train AI models.

Ensure that the people who process it are bound by confidentiality.

Apply technical and organisational security measures suited to the risk, including encryption, access controls and regular encrypted backups. The detailed measures are described in a security annex, available to the merchant in its account or on request.

Help the merchant answer data subjects' requests (export, correction, erasure are in the service) and with security, breach notification, impact assessments and prior consultation of the supervisory authority.

Tell the merchant without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data, with the information the merchant needs to notify it.

Keep a record of the processing it carries out for the merchant.

Support copies

To fix a problem with the merchant's store that cannot be reproduced otherwise, OumsAI may make a copy of the store's data on equipment it controls in the United Kingdom or the European Economic Area. In the copy, every personal field is replaced with made-up details (masked), and the merchant's payment account details are left out.

The copy is encrypted, can be opened only by the people at OumsAI who handle the problem, and expires after 7 days at most. It is used with the AI features off and only to find and fix that problem, then deleted once the problem is fixed, and in any case when it expires. Nothing from the copy goes back to the live store. Each copy is recorded, with its reason, in the merchant's activity history.

Masked data can still be personal data, for example in free text, so OumsAI treats the copy as personal data under this agreement.

OumsAI makes a copy that is not masked only with the merchant's written consent, given for that problem and kept with the record of the copy.

Subprocessors

The merchant authorises OumsAI to use subprocessors for hosting, email delivery, payments and AI features. The current list, with each subprocessor's name, role and location, is available to the merchant in its account (Settings → Legal) and on request.

OumsAI will give 30 days' notice of a new subprocessor, during which the merchant may object; if no solution is found, the merchant may end the service.

OumsAI imposes on each subprocessor, by contract, data protection obligations equivalent to those in this agreement, except as stated under "International transfers", and remains responsible to the merchant for its subprocessors.

International transfers

The data is stored in the European Union. OumsAI is established in the United Kingdom, which the European Union recognises as protecting personal data to its standard. OumsAI transfers personal data outside the United Kingdom and the European Economic Area only as this section describes.

Data sent to the AI features is processed by our AI service providers, including in China. Neither the European Union nor the United Kingdom has recognised China as protecting personal data to their standard, so the data may be less protected there. During the beta, this AI service provider does not commit to the obligations of this agreement: it may keep the data and use it to improve its models. Until OumsAI tells the merchant that its AI features run on a provider bound by this agreement, the merchant must not send its real customers' personal data to them. The legal basis for this transfer is under legal review. The merchant can switch the AI assistant off for its workspace in Settings → AI.

Our payment provider may process data in the United States, under the EU–US Data Privacy Framework and its UK extension.

End of processing

When the agreement ends, the merchant can retrieve its customers' data for 30 days, as the Terms of service say. OumsAI then deletes it, except what the law requires OumsAI to keep. Copies in encrypted backups are replaced in rotation within a further 60 days and are used meanwhile only to restore the service.

Audits

OumsAI makes available the information needed to show compliance with this agreement, and allows reasonable audits, on reasonable notice, at most once a year unless a breach calls for more.

Contact

hello@oumsai.com