Data Processing Agreement

1. Parties and scope

"You" are the business that uses LatchPay for one or more online stores. "We" and "LatchPay" are the provider named under "Who we are" at the end of this page. This agreement applies whenever we process personal data on your behalf while providing LatchPay. Where it and the terms differ about personal data, this agreement applies.

Words such as personal data, processing, controller, processor, sub-processor and personal data breach mean what they mean in the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Annex 1 describes the processing, Annex 2 our security measures and Annex 3 our sub-processors.

2. Who decides what

You decide why and how your buyers' data is processed: you are the controller and we are your processor. For our own records about you, and for the security of LatchPay itself, we are an independent controller and the privacy notice applies.

We do not combine the buyer data of different merchants and do not use it for purposes of our own: no advertising, no profiles, no fraud list shared between merchants. If we ever wanted to use buyer data across merchants, for example for a shared fraud list, we would be a controller for that use. We would then tell you at least 30 days in advance, update this agreement and the published assessment, and start only with a lawful basis.

3. Your instructions

We process your buyers' data only on your documented instructions. Your instructions are:

• the terms of service and this agreement;
• the settings you choose in the dashboard for each store;
• every feature or connection you turn on: turning it on instructs us to process the data it needs, as the privacy notice describes it;
• other instructions you send in writing through the contact form and that we confirm.

Recording the payment-security data of every checkout is part of the service on every store, as described in the privacy notice and in our payment-security assessment. By using LatchPay you instruct us to record it.

If we believe an instruction breaks the GDPR or other data protection law, we tell you without delay, and we may pause the processing concerned until you confirm or change the instruction. If a law requires us to process your buyers' data in another way, we tell you before we do, unless that law forbids it.

4. Confidentiality

Only people who need access to provide the service can access your buyers' data. They are bound to confidentiality by contract or by law. Today these are LatchPay's administrators. In our admin console each of them has a personal account with two-factor authentication, and every time one of them opens a merchant's dashboard to help, it is logged.

5. Security

We protect personal data with the technical and organisational measures in Annex 2, appropriate to the risk of the processing (article 32 GDPR). We keep them at least at that level and may improve them. We review them when the service changes and at least once a year.

6. Sub-processors

You give us general written authorisation to engage sub-processors. The current list is on the sub-processors page (Annex 3).

Before a new or replacement sub-processor processes your buyers' data, we tell you at least 30 days in advance: we update that page and e-mail the address of your LatchPay account or show a notice in the dashboard. Within that period you can object through the contact form, on reasonable grounds related to data protection. We then look for a solution with you, such as not using that sub-processor for your stores. If we cannot find one, you can end the service before the change takes effect, and we refund the part of a membership period you paid in advance that falls after the end.

If a sub-processor has to be replaced at once to keep the service secure or available, we may do so sooner. We then tell you as soon as we can, and your right to object starts from that notice.

Each sub-processor is bound by a written contract to data protection obligations that protect your data at least as well as this agreement. We remain responsible to you for the work of our sub-processors.

7. Transfers outside the European Economic Area

Our database is in the EU (Ireland). Some sub-processors are based in the United States or can access data from there. We transfer personal data outside the European Economic Area only with a transfer mechanism of chapter V GDPR: an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or the EU standard contractual clauses. The sub-processors page shows where each one is.

Data that goes to a service you connect (your payment provider, Shopify, Klaviyo, your ad platforms) goes there on your instruction and under your own agreement with that service.

8. Helping you

Buyers' requests. Buyers exercise their rights with you. If a buyer contacts us, we pass the request on to you without undue delay and do not answer it ourselves unless you ask us to. When you ask through the contact form, we help you answer a request in time for the one-month deadline of the GDPR, normally within 10 working days: we look up what we hold for a buyer's e-mail address and send it to you, correct it, or delete it. On deletion we remove the payment-security data, the prepared dispute evidence and the card codes we hold for you; you decide whether a blocklist entry stays to prevent fraud. The privacy notice says what stays and why.

Assessments. We published a legitimate-interest and data-protection impact assessment of the payment-security data. We give you the information you reasonably need for your own assessments and for a prior consultation with a supervisory authority.

Your own duties. Please tell us without undue delay about a complaint, a request from a supervisory authority, or a buyer's request that concerns data we process for you.

9. Personal data breaches

If we become aware of a personal data breach that affects data we process for you, we tell you without undue delay and at the latest 48 hours after we became aware of it, by e-mail to the address of your LatchPay account. We tell you what we know at that moment: what happened, which kinds of data and roughly how many people and records are affected, the likely consequences, the contact for questions, and what we did and propose to do. What we learn later, we send as soon as we have it.

You decide whether to notify your supervisory authority (in the Netherlands the Autoriteit Persoonsgegevens) within 72 hours and the buyers concerned, and we help you with that. We do not notify them for you unless you ask us or the law requires it. We keep a record of every breach, its effects and the measures taken.

10. When the service ends

Within 30 days after the agreement ends, you can ask us for a copy of the buyer data we hold for you in a common machine-readable format (CSV or JSON). We delete that data within 30 days after the end, or, if you asked for a copy, within 30 days after we sent it.

We keep only what the law requires us to keep: the records behind our fee charges (order references, dates and amounts), which Dutch tax law requires us to keep for seven years, and only for that purpose. Your orders themselves are in your Shopify store and your payments with your payment provider. Data in our database provider's backups disappears as those backups expire.

While the agreement runs, the retention periods in the privacy notice apply, also to a store you disconnect. Ask us through the contact form if you want a disconnected store's data deleted sooner.

11. Information and audits

We make available the information you need to check that we meet article 28 GDPR: this agreement and its annexes, the sub-processor list, the published assessment, and answers to reasonable security questions.

If that is not enough, you, or an independent auditor bound to confidentiality who is not our competitor, may audit our compliance once per calendar year, and also after a personal data breach or when a supervisory authority asks for it. Give us at least 30 days' notice (less after a breach), keep it to normal working hours, and do not access other merchants' data. You pay for your own side of the audit and for your auditor. We do not charge for our time on audits up to four hours a year; for more time we may ask a reasonable fee, which falls away if the audit finds a material breach of this agreement by us.

12. Duration, liability and changes

This agreement runs as long as we process personal data for you. Sections 9, 10 and 11 apply until the data is deleted. The limits of liability in the terms apply to this agreement, including the separate limit for data protection set there. Nothing in this agreement limits the rights buyers have under the GDPR.

We change this agreement only as the terms describe, with at least 30 days' notice for a material change, unless a change is required by law. Dutch law applies, and the court named in the terms decides disputes.

Annex 1. The processing

• Subject matter. Running your hosted checkout and the features you use with it: writing paid orders, refunds and cancellations to Shopify, refunds and disputes, subscriptions, abandoned-checkout handling, tracking connections, Live View and insights, and LatchPay Protect.
• Duration. As long as the agreement runs, followed by the retention periods of the privacy notice and section 10.
• Nature. Collecting data at the checkout, storing, encrypting and hashing it, retrieving it, comparing a payment with earlier payments at the same merchant, sending it to the services you connect, and deleting it.
• Purposes. To provide the checkout and the features you use; to protect your payments from fraud and answer card disputes; to charge subscription renewals and send their service e-mails on your behalf; to send the events you switched on to your own connected services.
• People concerned. Your buyers and the visitors of your store and checkout; cardholders, who are not always the buyer; your subscribers; people named in an order, such as the recipient of a delivery.
• Kinds of data. E-mail address, name, phone number and addresses; carts, orders and their amounts; payment references and what the payment provider reports about the card and its checks (card network, first and last digits, the provider's card fingerprint, 3-D Secure, address and security-code results, authorisation code, network reference); the payment-security data (IP address, browser user agent, language, time zone, a device code made from a cookie); subscription contracts and consent records; storefront events under random ids; the approximate location for Live View; ad click ids and ad cookie values for server-side tracking; disputes, alerts and dispute evidence; blocklist codes with a masked e-mail address and card name.
• Special categories. LatchPay does not ask for special categories of personal data (such as health data), and you do not set up the checkout to collect them.
• Retention. As listed under "How long we keep it" in the privacy notice.
• Location. The database is in the EU (Ireland); for the sub-processors, see Annex 3.

Annex 2. Security measures

• Location and transport. The database is hosted by Supabase in the EU (Ireland). Pages and the API are served over HTTPS, and the app's connections to the database are encrypted.
• Encryption by LatchPay. Secrets (Shopify credentials, payment-provider and ad-platform tokens, webhook secrets, Klaviyo keys, authenticator secrets) and the most sensitive buyer fields (the IP address and browser of a payment, prepared dispute evidence) are encrypted with AES-256-GCM before they are stored, with a key that is never stored in the database. The key can be rotated.
• Codes instead of values. The device id from the checkout cookie is never stored. LatchPay keeps keyed codes (HMAC-SHA256) of the device, the IP address and, on the blocklist, the e-mail address and card. The merchant is part of every code, so the codes of one merchant cannot be matched with those of another.
• Passwords and sign-in. Passwords are stored only as scrypt hashes; recovery codes and e-mailed links only as hashes, and links work once and expire within 24 hours. Sign-in attempts are limited per e-mail address and per network. Merchants can turn on two-step sign-in.
• Access. Row-level security is on for every table without public access rules, so the database's public interface cannot read it; only LatchPay's server and LatchPay's administrators connect to it. The app scopes every merchant query to the signed-in merchant and store, and automated tests check that separation.
• Administrators. A separate admin console with personal accounts, mandatory two-factor authentication, a lockout after five failed attempts, sessions of at most 12 hours, and an audit log of sign-ins, actions and every time an administrator views a merchant's dashboard.
• Card data. Card numbers and security codes are typed only into the payment provider's own fields. LatchPay never receives or stores them.
• Logs. Our logs are written to hold ids and error codes rather than personal data, and tests check this for the payment-security data.
• Retention. Scheduled jobs delete data when its period in the privacy notice ends.
• Changes and monitoring. Every pull request runs the type check, a migration safety check and the automated test suite. Store health is checked every ten minutes. The riskier features (automatic Protect actions, ad-event sending, subscription renewals, and the Stripe, Mollie and Adyen connections) each have a switch to turn them off, and the checkout of any store can be switched off.
• Incidents. Breaches are handled and reported as section 9 describes.

Annex 3. Sub-processors

The current list, with each provider's purpose and location, and the services you connect yourself, is on the sub-processors page.

Questions

Questions about this agreement go through the contact form.

Who we are

Name

LatchPay

Legal form

sole proprietorship (eenmanszaak)

KvK number

74998129

VAT number

NL002373677B66

Address

Pinksterbloemweg 255, 1508 BT Zaandam, the Netherlands

E-mail

info@latchpay.io

Contact

Contact form; we answer by e-mail.