This agreement applies when a business (the "merchant") uses OumsAI to process the personal data of its store's customers. It forms part of the Terms of service and meets Article 28 of the UK GDPR and the EU GDPR.
Roles
The merchant is the controller of its customers' personal data. BRODV LTD, a company registered in England and Wales under number 17069547, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("OumsAI") is its processor.
Subject matter and duration
Running the merchant's store on OumsAI, for as long as the merchant uses the service, and until the data is deleted or returned as set out below.
Nature and purpose
Hosting, storage, display, transmission and analysis needed to take and fulfil orders, handle payments, returns and messages, send order and marketing email, keep consent records, run the AI features the merchant uses, and, if the merchant turns them on, send basket reminders to shoppers who did not complete a checkout.
Data subjects and data
Buyers, newsletter subscribers and people who contact the store. Identity and contact details, delivery addresses, order and payment history (card data stays with Stripe), messages, consent records, and technical data (IP address, browser).
If basket reminders are on: shoppers who give their email at checkout and tick the reminder box, with their email address, basket contents, store language, and the record of their consent.
Basket reminders
Basket reminders are off until the merchant turns them on. By turning them on, the merchant instructs OumsAI to process the data below for this purpose only.
OumsAI saves a shopper's email and basket only when the shopper submits the checkout step and has ticked the unticked reminder box shown next to the email field. OumsAI keeps the record of that consent (date and time, language and the version of the wording) for the merchant.
OumsAI sends at most 3 reminders within 7 days of the checkout being left, in the merchant's name. Each reminder has a one-click link to stop them. OumsAI stops the reminders at once if the shopper completes the order, uses that link, has unsubscribed from the store's marketing, or if the email bounces.
OumsAI deletes the email address and the basket 30 days after the checkout was left. It keeps reminder results (emails sent, orders recovered, amounts) for 13 months in pseudonymised form, without the email address or the basket, so that the merchant can see how the feature performs. OumsAI does not add tracking pixels to reminders.
The merchant chooses whether to use the feature, is responsible for the content of any offer it adds, and must not use the saved emails for any other purpose. OumsAI does not use them for its own purposes.
OumsAI's obligations
Process the data only on the merchant's documented instructions (the service as configured, and the merchant's actions in it).
Ensure that the people who process it are bound by confidentiality.
Apply technical and organisational security measures suited to the risk, including encryption, access controls and regular encrypted backups. The detailed measures are described in a security annex, available to the merchant in its account or on request.
Help the merchant answer data subjects' requests (export, correction, erasure are in the service) and with security, breach notification and impact assessments.
Tell the merchant without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data.
Subprocessors
The merchant authorises OumsAI to use subprocessors for hosting, email delivery, payments and AI features. The current list, with each subprocessor's name, role and location, is available to the merchant in its account (Settings → Legal) and on request.
OumsAI will give 30 days' notice of a new subprocessor, during which the merchant may object; if no solution is found, the merchant may end the service.
International transfers
Data sent to the AI features is processed by our AI service providers, including in China. Neither the European Union nor the United Kingdom has recognised China as protecting personal data to their standard, so the data may be less protected there. The legal basis for this transfer is under legal review. The merchant can switch the AI assistant off for its workspace in Settings → AI.
End of processing
When the merchant closes its workspace, OumsAI deletes the customers' data within 30 days, after the merchant has had the chance to export it, except what the law requires OumsAI to keep.
Audits
OumsAI makes available the information needed to show compliance with this agreement, and allows reasonable audits, on reasonable notice, at most once a year unless a breach calls for more.
Contact
Questions about this page? hello@oumsai.com