1. WHAT DO WE DO WITH YOUR INFORMATION?
When you purchase something from our store, as part of the buying and selling process, we collect the personal information you give us such as your name, address and email address.
When you browse our store, we also automatically receive your computer’s internet protocol (IP) address in order to provide us with information that helps us learn about your browser and operating system.
Email marketing (if applicable): With your permission, we may send you emails about our store, new products and other updates.
How do you get my consent?
When you provide us with personal information to complete a transaction, verify your credit card, place an order, arrange for a delivery or return a purchase, we imply that you consent to our collecting it and using it for that specific reason only.
If we ask for your personal information for a secondary reason, like marketing, we will either ask you directly for your expressed consent, or provide you with an opportunity to say no.
How do I withdraw my consent?
If after you opt-in, you change your mind, you may withdraw your consent for us to contact you, for the continued collection, use or disclosure of your information, at anytime, by contacting us at firstname.lastname@example.org.
We may disclose your personal information if we are required by law to do so or if you violate our Terms of Service.
Our store is hosted on Shopify Inc. They provide us with the online e-commerce platform that allows us to sell our products and services to you.
Your data is stored through Shopify’s data storage, databases and the general Shopify application. They store your data on a secure server behind a firewall.
If you choose a direct payment gateway to complete your purchase, then Shopify stores your credit card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction. After that is complete, your purchase transaction information is deleted.
All direct payment gateways adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover.
PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.
For more insight, you may also want to read Shopify’s Terms of Service here or Privacy Statement here.
5. THIRD-PARTY SERVICES
In general, the third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.
However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions.
For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by these providers.
In particular, remember that certain providers may be located in or have facilities that are located in a different jurisdiction than either you or us. So if you elect to proceed with a transaction that involves the services of a third-party service provider, then your information may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.
As an example, if you are located in Canada and your transaction is processed by a payment gateway located in the United States, then your personal information used in completing that transaction may be subject to disclosure under United States legislation, including the Patriot Act.
When you click on links on our store, they may direct you away from our site. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.
To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed.
If you provide us with your credit card information, the information is encrypted using secure socket layer technology (SSL) and stored with a AES-256 encryption. Although no method of transmission over the Internet or electronic storage is 100% secure, we follow all PCI-DSS requirements and implement additional generally accepted industry standards.
Here is a list of cookies that we use. We’ve listed them here so you can choose if you want to opt-out of cookies or not.
_session_id, unique token, sessional, Allows Shopify to store information about your session (referrer, landing page, etc).
_shopify_visit, no data held, Persistent for 30 minutes from the last visit, Used by our website provider’s internal stats tracker to record the number of visits
_shopify_uniq, no data held, expires midnight (relative to the visitor) of the next day, Counts the number of visits to a store by a single customer.
cart, unique token, persistent for 2 weeks, Stores information about the contents of your cart.
_secure_session_id, unique token, sessional
storefront_digest, unique token, indefinite If the shop has a password, this is used to determine if the current visitor has access.
7. AGE OF CONSENT
By using this site, you represent that you are at least the age of majority in your state or province of residence, or that you are the age of majority in your state or province of residence and you have given us your consent to allow any of your minor dependents to use this site.
If our store is acquired or merged with another company, your information may be transferred to the new owners so that we may continue to sell products to you.
QUESTIONS AND CONTACT INFORMATION
If you would like to: access, correct, amend or delete any personal information we have about you, register a complaint, or simply want more information contact our Privacy Compliance Officer at email@example.com.
EU DATA PROCESSING AMENDMENT
This Data Processing Amendment (this “DPA”), effective as of the DPA Effective Date (defined below), is entered into by and between Alter Babe (“Alter Babe”, “we”, or “us”) and the customer that electronically accepts or otherwise agrees or opts-in to this DPA (“Customer”, or “you”).
You have entered into one or more agreements with us (each, as amended from time to time, an “Agreement”) governing the provision of our applications or software services (the “Service”).
This DPA will amend the terms of the Agreement to reflect the parties’ rights and responsibilities with respect to the processing and security of Customer’s data under the Agreement. If you are accepting this DPA in your capacity as an employee, consultant or agent of Customer, you represent that you are an employee, consultant or agent of Customer, and that you have the authority to bind Customer to this DPA.1. DEFINITIONS The following definitions apply to this DPA:
2. DATA PROCESSING2.1 Roles and Regulatory Compliance; Authorization. a. Processor and Controller Responsibilities. If European Data Protection Legislation applies to the processing of Customer’s Personal Data, the parties acknowledge and agree as follows: (i) that the subject matter and details of the processing are described in Appendix 1 hereto; (ii) that Alter Babe is a processor of Customer’s Personal Data under European Data Protection Legislation; (iii) that you are a controller or processor, as applicable, of the Personal Data under European Data Protection Legislation; and (iv) that each of us will comply with our obligations under applicable European Data Protection Legislation with respect to the processing of the Personal Data. b. Consent obtained from End User. If European Data Protection Legislation applies to the processing of Customer’s Personal Data and you are a controller of the Personal Data, you acknowledge and agree as follows: (i) You must use commercially reasonable efforts to disclose clearly, and obtain consent to, any data collection, sharing and usage that takes place on any site, app, email or other property as a consequence of your use of Alter Babe and (ii) you must use commercially reasonable efforts to ensure that an end user is provided with clear and comprehensive information about, and consents to, the storing and accessing of cookies or other information on the end user’s device where such activity occurs in connection with a product to which this policy applies; and (iii) you must make clear that as a consequence of your use of Alter Babe products, End User data will be processed outside of the EU and that the End User retains their rights under applicable data processing laws. c. Authorization by Third Party Controller. If European Data Protection Legislation applies to the processing of Personal Data and you are a processor of the Personal Data, you warrant to us that your instructions and actions with respect to that Personal Data, including your appointment of Alter Babe as another processor, have been authorized by the relevant controller. d. Responsibilities Under Non-European Legislation. If Non-European Data Protection Legislation applies to either party’s processing of Personal Data, the parties acknowledge and agree that each of us will comply with any applicable obligations under that legislation with respect to the processing of Personal Data. 2.2 Scope of Processing. a. Customer Authorization. By entering into this DPA, you hereby authorize and instruct us to process the Personal Data: (i) to provide the Service, and related technical support; (ii) as otherwise permitted or required by your use of the Service and/or your requests for technical support; (iii) as otherwise permitted or required by the Agreement, including this DPA; and (iv) as further documented in any other written instructions that you give us, provided we acknowledge those instructions in writing as constituting processing instructions for the purposes of this DPA. We will not process the Personal Data for any other purpose, unless required to do so by applicable law or regulation. b. Prohibition on Sensitive Data. You will not submit, store, or send any sensitive data or special categories of Personal Data (collectively, “Sensitive Data”) to us for processing, and you will not permit nor authorize any of your employees, agents, contractors, or data subjects to submit, store, or send any Sensitive Data to us for processing. You acknowledge that we do not request or require Sensitive Data as part of providing the Service to you, that we do not wish to receive or store Sensitive Data, and that our obligations in this DPA will not apply with respect to Sensitive Data.
3. DELETION3.1 Deletion During Term. We will enable you to delete Personal Data during the Term in a manner that is consistent with the functionality of the Service. If you use the Service to delete any Personal Data in a manner that would prevent you from recovering the Personal Data at a future time, you agree that this will constitute an instruction to us to delete the Personal Data from our systems in accordance with our standard processes and applicable law. We will comply with this instruction as soon as reasonably practicable, but in all events in accordance with applicable law. 3.2 Deletion When Term Expires. When the Term expires, we will either destroy or return to you any Customer Data in our possession or control. This requirement will not apply to the extent that we are required by applicable law to retain some or all of the Customer Data, in which event we will isolate and protect the Customer Data from further processing except to the extent required by law. You acknowledge that you will be responsible for exporting, before the Term expires, any Customer Data you want to retain after the Term expires.
4. DATA SECURITY4.1 Security Measures. a. Security Measures. We will implement and maintain appropriate technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (collectively, the “Security Measures”). The Security Measures will have regard to the state of the art, the costs of implementation, and nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The Security Measures will include, as appropriate: (i) the ability to ensure the ongoing security, confidentiality, integrity, availability, and resilience of data processing systems and services; (ii) the ability to restore the availability and access to Personal Data in a timely manner, in the event of a Data Incident; and (iii) a process for regularly testing, accessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of data processing. We may update or modify the Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Service. b. Security Compliance by our Staff. We will take appropriate steps to ensure that our employees, contractors, and Subprocessors comply with the Security Measures to the extent applicable to their scope of performance, including ensuring that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligations of confidentiality. 4.2 Data Incidents. If we become aware of a Data Incident, we will notify you promptly and without undue delay, and will take reasonable steps to minimize harm and secure Customer Data. Any notifications that we send you pursuant to this Section 4.2 will be sent to your Notification Email Address and will describe, to the extent possible, the details of the Data Incident, the steps we have taken to mitigate the potential risks, and any suggestions we have for you to minimize the impact of the Data Incident. We will not assess the contents of any Customer Data in order to identify information that may be subject to specific legal requirements. You are solely responsible for complying with any incident notification laws that may apply to you, and to fulfilling any third party notification obligations related to any Data Incident(s). Our notification of or response to a Data Incident under this Section will not constitute an acknowledgement of fault or liability with respect to the Data Incident. 4.3 Your Security Responsibilities. You agree that, without prejudice to our obligations under Sections 4.1 or 4.2: (i) you are solely responsible for your use of the Service, including making appropriate use of the Service to ensure a level of security appropriate to the risk in relation to Customer Data, securing any account authentication credentials, systems, and devices you use to use the Service, and backing up your Customer Data. You understand and agree that we have no obligation to protect Customer Data that you elect to store or transfer outside of our or our Subprocessors’ systems (e.g., offline or on-premise storage). You are solely responsible for evaluating whether the Service and our commitments under this Section 4 meet your needs, including with respect to your compliance with any of your security obligations under European Data Protection Legislation and/or Non-European Data Protection Legislation, as applicable. You acknowledge and agree that – taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing of Personal Data, as well as the risks to individuals – the Security Measures that we implement in this DPA provide a level of security appropriate to the risk in respect to the Customer Data. 4.4 Audit Rights. If European Data Protection Legislation applies to the processing of Personal Data, we will allow an internationally-recognized independent auditor that you select to conduct audits to verify our compliance with our obligations in this DPA. You must send any requests for audits under this Section to support@WellPick.com. Following our receipt of your request, the parties will discuss and agree in advance on the reasonable start date, scope, duration, and security and confidentiality controls applicable to the audit. You will be responsible for any costs associated with the audit. You agree not to exercise your audit rights more than once in any twelve (12) calendar month period, except (i) if and when required by a competent data protection authority; or (ii) an audit is necessary due to a Data Incident.
5. DATA SUBJECT RIGHTS; DATA EXPORT5.1 Access; Rectification; Restricted Processing; Portability. During the Term, we will, in a manner consistent with the functionality of the Service, enable you to: (i) access the Customer Data; (ii) rectify inaccurate Customer Data; (iii) restrict the processing of Customer Data; (iv) delete Customer Data; and (v) export Customer Data. 5.2 Cooperation; Data Subjects’ Rights. We will provide you, at your expense, with all reasonable and timely assistance to enable you to respond to: (i) requests from data subjects who wish to exercise any of their rights under European Data Protection Legislation; and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Customer Data. In the event that any such request, correspondence, enquiry or complaint is made directly to us, we will promptly inform you of it, and provide you with as much detail as reasonably possible.
6. DATA TRANSFERS6.1 Data Storage and Processing Facilities. You agree that we may, subject to Section 6.2, store and process Customer Data in the United States and any other country in which we or our Subprocessors maintain facilities. 6.2 Transfers of Data out of the EEA; Your Responsibilities. If the storage and/or processing of Personal Data as described in Section 6.1 involves transfers of Personal Data out of the EEA and European Data Protection Legislation applies to the transfers of such data (collectively, “Transferred Personal Data”), we will, at our sole discretion, either (i) ensure that we (as the data importer) have entered into MCCs with you (as the data exporter), and that the transfers are made in accordance with the MCCs; or (ii) ensure that the transfers are made in accordance with an Alternative Transfer Solution. With respect to Transferred Personal Data, you agree that if we reasonably require you to enter into MCCs with respect to such transfers as required by European Data Protection Legislation, you will promptly do so; similarly, if we reasonably require you to use an Alternative Transfer Solution and we request that you take any action (including, without limitation, execution of documents) required to give full effect to that solution, you will promptly do so.
7. SUBPROCESSORS7.1 Consent to Engagement. You specifically authorize us to engage third parties as Subprocessors. Whenever we engage a Subprocessor, we will enter into a contract with that Subprocessor to help ensure that the Subprocessor only accesses and uses Customer Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement and this DPA. 7.2 List of Subprocessors. A list of our current Subprocessors can be made available upon request to support@WellPick.com. 7.3 Objections; Sole Remedy. You have the right to object to the engagement of a Subprocessor by providing documentary evidence that reasonably shows that the Subprocessor does not or cannot comply with the requirements set forth in this DPA (each, an “Objection”). If we do not remedy or provide a reasonable workaround for your Objection within a reasonable time, you may, as your sole remedy and our sole liability for your Objection, terminate the Agreement for your convenience, and without further liability to either party. We will not owe you a refund of any fees you have paid in the event you decide to terminate the Agreement pursuant to this Section.
8. ADDITIONAL INFORMATIONYou acknowledge that we are required under European Data Protection Legislation (i) to collect and maintain records of certain information, including, among other things, the name and contact detail of each processor and/or controller on whose behalf we are acting and, where applicable, of such processor’s or controller’s local representative and data protection officer; and (ii) to make such information available to the supervisory authorities. Accordingly, if European Data Protection Legislation applies to the processing of Personal Data, you will, when requested, provide this additional information to us, and ensure that the information is kept accurate and up-to-date.
9. DATA PROTECTION IMPACT ASSESSMENT
If we believe or become aware that our processing of Customer Data is likely to result in a high risk to the data protection rights and freedoms of data subjects, we will promptly inform you of that risk, and provide you with reasonable and timely assistance as you may require in order to conduct a data protection impact assessment and, if necessary, consult with the relevant data protection authority.
10. MISCELLANEOUSThere are no third party beneficiaries to this DPA. Except as expressly provided herein, nothing in this DPA will be deemed to waive or modify any of the provisions of the Agreement, which otherwise remains in full force and effect. Specifically, nothing in this DPA will affect any of the terms of the Agreement relating to Alter Babe’s limitations of liability, which will remain in full force and effect. If you have entered into more than one Agreement with us, this DPA will amend each of the Agreements separately. In the event of a conflict or inconsistency between the terms of this DPA and the terms of the Agreement, the terms of this DPA will control.
APPENDIX 1 TO DATA PROCESSING AMENDMENTSubject Matter: Alter Babe’s provision of the Service to the Customer, and related technical support. Processing Duration: Throughout the Term of the Agreement. Nature and Purpose of the Processing: Alter Babe will process Personal Data submitted to, stored on, or sent via the Service for the purpose of providing the Service and related technical support in accordance with this DPA. Categories of Data: Personal data submitted to, stored on, or sent via the Service may include, without limitation, the following categories of data: IP addresses, browser agents, email addresses, usernames, full names, browser and operating system identifiers, and any other personal data that Customer chooses to send us related during the course of our provision of the Service and technical support. Data Subjects: Personal data submitted, stored, sent or received via the Service may concern the following categories of data subjects, without limitation: Customer’s employees, contractors, and agents; the personnel of Customer’s customers, suppliers and subcontractors; and any other person who transmits data via the Service.