GENERAL TERMS OF USE OF PRESTASHOP CHECKOUT SERVICE

15. INDEPENDENCE OF THE PARTIES

The Parties will remain independent of one another. No stipulation contained in the present GTU was written with the purpose or the end result of forming a contract establishing a partnership, mandate, representation or hierarchical relationship between the Parties.

16. EFFECTIVE DATE

These General Terms of Use came into effect on 24 September 2019.

APPENDIX: AGREEMENT RELATING TO PERSONAL DATA PROCESSING

This agreement relating to the processing of personal data (hereinafter the "Agreement") applies to any User using PrestaShop Checkout Support services. This appendix, the above General Terms of Use of the Support services and PrestaShop’s Personal Data Protection Policy, constitute the entirety of the terms of use of the Support, as applicable to all Users.

Preamble:

As part of PrestaShop Checkout Support, the User may need to communicate personal data to PrestaShop. As defined by Article 4, points 7 and 8 of the GDPR, the User is the Controller (hereafter the “Controller”), and PrestaShop is the Processor of the personal data (hereafter the “Processor”).

Within the context of this Agreement, the Parties undertake to comply with the regulations in force applicable to the processing of personal data and, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 applicable since 25 May 2018 ("the GDPR").

Article 1. Object 

The purpose of this Agreement is to define the terms and conditions under which the Processor undertakes to perform the Personal Data Processing operations described below in the name and on behalf of the Controller, and ensure their protection and treatment in accordance with applicable regulations.

Article 2. Definitions

For the purposes of this Agreement, wherever the following terms begin with an uppercase letter, they will be understood as having the meanings defined below.

• Breach: a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
   
• Controller: as defined by Article 4(7) of the GDPR. For the purposes hereof, the User is the Controller.
   
• User: any person who has entered into a contract with the User via the Merchant Website.
   
• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
   
• Personal Data: any and all information relating to identified or identifiable natural persons,          
  An “identifiable natural person” is any individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  Personal Data are those entrusted by the User to PrestaShop for the purpose of their Processing on behalf of the former under this Agreement. These data are listed in Article 3 below.
   
• Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
   
• Processor: the natural person, legal entity, public authority, service or other organization processing the Personal Data on behalf of the User. For the purposes hereof, PrestaShop is the Processor.   
   

In the event of any conflict or ambiguity between the provisions of this Agreement and the T&Cs of the PrestaShop Checkout Services, the provisions of this Agreement shall prevail.

Article 3. Description of Processing

3.1 Services rendered

The Processor is authorized to process the Personal Data, in the name and on behalf of the Controller, needed to provide Support services to User.

The Processor is not allowed to process Personal Data for purposes others than these describe under this Agreement and/or without the Controller express authorisation.

3.2 Nature of the operations carried out and Data processed

The Controller determine, under his responsibility, the purposes of the data processing operations entrusted to the Processor and/or its subcontractor, which are as follows: the Support services. 

Support entails Processor teams and/or its subcontractor access to the User Website when he requires PrestaShop Checkout Support services. Access to the Merchant Website Back-Office necessarily provides access to the User Personal Data which are the following: Surname, Name, e-mail address, phone, name of the e-shop, URL.

Likewise, the Processor may have access to User’s Customer Personal data. Processor may have access to the following Personal Data: Customer identification data (full name, postal address, email address and telephone number), as well as to personal data about any purchases made on the User’s website.

For the purpose of performance of the services covered by this Agreement, the Controller will provide the Processor with the information required as per the latter’s Personal Data Protection Policy.

This Agreement will take effect upon the User’s subscription of the Support services and will come to an end upon termination of the said Support.

Article 4.  Processor’s obligations and liability

4.1. Processor’s obligations

The Processor undertakes to:

1. process the Personal Data solely for the purpose(s) of the subcontracting, as defined in Article 3 ;
    
2. process the Personal Data in accordance with the Controller’s documented instructions. If the Processor considers that an instruction violates the GDPR or any other provision of EU law or the laws of the EU Member States as concerns data protection, it will immediately notify the Controller. Further, if it is required to transfer data to a country outside the European Union, it must inform the Controller of that legal obligation prior to Processing, unless the law in question prohibits such notification on important grounds of public interest.     
   
   The Controller is hereby informed of the possibility of transmitting written instructions, so long as they are consistent with the Support services;
    
3. represents that it will keep a written register of all categories of processing activities performed on behalf of the Controller. The Processor will provide the necessary documentation to the Controller to demonstrate compliance with all its obligations and to enable the Controller to conduct audits.
    
4. guarantee the confidentiality of the Personal Data processed by virtue of this Agreement. If the Processor should be legally compelled to transmit the Personal Data to an authority, it will first notify the Controller of this, unless the law should prohibit such notification on grounds of public interest; 
    
5. ensure that the people authorized to process the Personal Data by virtue of this Agreement:

• undertake to respect the confidentiality of the Personal Data,
• receive the necessary personal data protection training;
• only process the Personal Data for the aforementioned Processing purposes;

1. incorporate the principles of data protection by design and data protection by default into its tools, products, applications and services.

4.2. Liability of the Processor

The Processor is responsible for its personnel, employees and subcontractors, and for their compliance with its obligations under this Agreement. To this end, the Processor’s personnel may not access, use or modify Personal Data, except where strictly necessary for the purpose of providing Support services.

The Processor implements organisational and technical measures to ensure that its personnel comply with its obligations, in particular in terms of monitoring who is authorised to access Personal Data, securing access and traceability.

Article 5. Controller’s obligations

The Controller undertakes to:

1. collect under its responsibility, in a lawful, fair and transparent manner, the Personal Data provided to the Processor for the performance of its services, and in particular, ensure the legal basis for such collection and the information given to the persons concerned.
2. provide the Processor with the Personal Data necessary for the Processing, excluding irrelevant, disproportionate or unnecessary Personal Data and excluding any "specific" Data within the meaning of the GDPR, unless the processing and purposes justify it, it is the responsibility of the Controller to establish these justifications and to take all measures, in particular prior information, collection of consent and security, appropriate for such specific data.
3. document all of its instructions in writing concerning Personal Data Processing by the Processor, if specific instructions should be necessary.        
4. ensure the Processor’s compliance with the obligations laid down in the GDPR, before and throughout the Processing period, supervise the Processing, including the performance of audits and inspections of the Processor’s services.
5. report any Personal Data Breach which entails a legal obligation to notify the competent supervisory authority.     
    

Article 6. Collaboration

As far as possible, the Processor will help the Controller to fulfil its obligation of handling requests from its Customers to exercise their rights – of access to, rectification or erasure of their Personal Data, to object to or restrict the Processing thereof, to data portability and to not be the subject of an automated decision (including profiling).

The services are set up so that the Controller can respond to its Customers’ requests.

The Processor undertakes to help the Controller, to the extent possible, so that the latter may fulfil its obligations in respect of the aforementioned Processing, as concerns the conduct of any impact assessments, for the purpose of notification of a data Breach and for the exercise of Customer rights.

Article 7. Subsequent Processing

The Processor may call on another data processor (hereinafter the “subsequent processor”) to carry out specific Processing tasks.

The Controller is hereby informed that the Processor already uses the processors listed below for its Support services.

For the management and provision of Support to Users, PrestaShop uses software from Freshdesk Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403. That company is an active participant in the Privacy Shield, which guarantee that the level of personal data protection that it offers has been deemed sufficient and adequate.

As part of the PrestaShop Checkout solution, PrestaShop uses the company « Active Contact – 2, rue de Guinée, 1002 Tunis – Tunisie » to provide first-line support for Users. A subcontracting agreement and standard contractual clauses have been signed with them. 

PrestaShop also uses “Jira”, software published by Atlassian, 341 George Street, Sydney, NSW 2000, Australia, to provide the ticketing system used to transmit User requests to the Support teams. That software is hosted internally on PrestaShop’s Google server.

In the event of subsequent Processing, the Processor will inform the Controller of any changes involving the addition or replacement of other processors, at least one month prior to the change, so as to give the Controller the chance to share any objections to the said changes.

Whenever the Processor recruits a new processor, PrestaShop undertakes to ensure that the same Personal Data Processing obligations are imposed upon that subsequent processor as those defined herein, such that this sub-processor will also satisfy the requirements of the GDPR.

Article 8. Notification of Personal Data Breaches

The Processor will notify the Controller by email of any Personal Data Breach within seventy-two (72) hours of having become aware of it. This notification will be accompanied by all useful information to enable the Controller to notify the competent data protection authority of the Breach, if necessary.

The Processor will provide the following information, where such is available:

• the nature of the incident;
• the date and time of detection of the incident;
• the affected Personal Data;
• any measures taken directly to limit any additional damage;
• the date and time when the incident came to an end;
• any structural prevention measures going forward.

Article 9. Security measures

The Processor undertakes to implement technical and organizational measures intended to protect the security and confidentiality of the Personal Data against any unauthorized access, alteration, use, modification or disclosure during the performance of the Support services.

To that end, the Processor’s Support staff are subject to an obligation of confidentiality. 

Given the state of the art, the cost of implementation and the nature, scope, context and purposes of the Processing, the Parties undertake to implement all appropriate technical and organizational measures to provide a level of security which is commensurate with the risk.

The Controler is responsible for the Website’s security at all times. 

Article 10. Fate of Personal Data

At the end of the Support services relating to Personal Data Processing, the Processor undertakes to return all Personal Data to the Controller or to the subcontractor designed by the latter.

That return will include all existing copies in the Processor’s information system and written proof of their destruction, unless the applicable legislation prohibits the destruction of the Personal Data for a certain period of time. In that instance, the Processor undertakes to protect the confidentiality of the Personal Data and to archive them, namely to retain them as proof.

Article 11. Responsibilities

The Parties acknowledge that they share responsibilities to the Customers, pursuant to Article 82 of the GDPR.

The Controller acknowledges that the Processor shall only be held liable for any damage caused by the Processing if the latter has failed to satisfy the obligations specific to processors