Feedpack data processing addendum

This data processing addendum (“addendum”) is part of the Feedpack terms of service between you, the merchant who installs Feedpack, and Vestrivo (“we”, “us”). Vestrivo is responsible for the personal information described in this policy. It applies whenever Feedpack processes personal information about your customers for you.

For that information you are the controller (you decide why it is collected and how it is used) and we are your processor. If anything in the terms conflicts with this addendum on the processing of your customers’ personal information, this addendum wins.

• Subject matter and purpose. Collecting, moderating and showing product and store reviews; sending review requests and at most one reminder when you turn sending on; confirming verified purchases; publishing the Google reviews file you choose to submit; and the support and security work that keeps the service running.
• People concerned. Your customers and the people who review your products, including reviews you import from another app.
• Personal information. Names, email addresses, language, order numbers and ordered items, review content (rating, title, text, photos and videos), and for imported reviews a location if the other app had one. A shopper’s IP address is used briefly to prevent abuse and isn’t stored.
• Duration. For as long as you use Feedpack, followed by the deletion described below. The retention periods for each kind of record are listed in the privacy policy.

We process your customers’ personal information only on your documented instructions: these terms, this addendum and the settings you choose in Feedpack (for example turning review requests on, choosing how names appear, or submitting the Google feed). If we believe an instruction breaks data protection law, we’ll tell you. We won’t use the information for our own purposes, sell it or use it for advertising.

• Confidentiality. Only people who need access to run Feedpack can reach your customers’ information, and they are bound to keep it confidential.
• Security. We maintain the measures listed in the next section and keep them up to date.
• Your customers’ requests. Shopify forwards data and erasure requests to us automatically. For a data request you can download a file of everything Feedpack holds about that customer from Feedpack’s settings; an erasure request is carried out automatically. We’ll also help with requests that reach you another way.
• Help with your obligations. We’ll give you reasonable help with data protection impact assessments and with questions from regulators about Feedpack’s processing.
• Information and audits. We’ll answer reasonable written questions about how we meet this addendum and provide the information you need to show compliance, including our providers’ security certifications where they publish them.

• All traffic to Feedpack and to our providers is encrypted with HTTPS/TLS, and data is encrypted at rest by our hosting provider.
• The database is reachable only over our host’s private network. Photos and videos are kept in private storage and served through short-lived signed links.
• Each store can only reach its own data. Webhooks from Shopify and our email provider are signature-checked.
• We read only the customer fields Feedpack needs, and keep unsubscribes, bounces and complaints as one-way hashes of the email address.
• Every download of customer data from Feedpack is recorded in an access log that you can see in Feedpack’s settings.
• Retention periods are enforced automatically.

You authorise us to use these subprocessors:

• Shopify — the platform Feedpack runs on and the source of order information.
• Railway — hosting for the Feedpack application and its database.
• Railway object storage (Amsterdam, Netherlands) — copies of review photos and videos.
• Resend — delivery of review-request emails.

Each is bound by written terms that protect personal information at least as well as this addendum. We’ll update this page and tell you in the app or by email at least 14 days before adding or replacing a subprocessor. If you object, you can stop using Feedpack before the change takes effect.

If we become aware of a breach affecting your customers’ personal information, we’ll notify Shopify within 24 hours, as Shopify requires, and tell you without undue delay — normally within 48 hours — with what happened, the information involved, what we’re doing about it and what you may need to tell your customers. We’ll keep you updated as we learn more.

Our subprocessors may process information outside your country. Where the law requires it, transfers rely on appropriate safeguards such as the European Commission’s standard contractual clauses or an adequacy decision.

When you uninstall Feedpack, Shopify sends us a deletion request 48 hours later and we then delete your store’s data, including your customers’ personal information, photos and videos. If that request never arrives, we delete the same data 30 days after the uninstall, unless you have installed Feedpack again. You can download every review as a CSV file before you uninstall.

Questions about this addendum: email support@ampersand.co.il or visit our support page.