This addendum forms part of the GiftCourier Terms of Service and applies where you use the app to process personal data of individuals in the UK, the European Economic Area, or any jurisdiction with comparable law.
1. Roles
You are the controller. We are the processor, acting only on your documented instructions, which in practice are the app's configuration and the act of installing it. Shopify is a separate controller for the data it holds about your store.
2. Subject matter and duration
We process personal data for as long as you have the app installed, in order to deliver gift cards your customers have bought. Processing ends when you uninstall.
3. Nature and purpose of processing
Delivering a gift card by email, on a date the buyer chose, to a recipient the buyer nominated; showing you the state of those deliveries; and letting you resend or correct one that failed.
4. Categories of data subject
- Recipients: the people your customers nominate to receive gift cards.
- Buyers: your customers who purchase gift cards.
5. Categories of personal data
| Data | Source | Why |
|---|---|---|
| Recipient email address | Order line-item properties | The address the gift card is sent to |
| Recipient name | Order line-item properties | Addressing the gift card email |
| Sender name | Order line-item properties | So the gift card email reads as being from a person |
| Buyer's message | Order line-item properties | Rendered into the gift card email |
| Buyer email address | Order.email | Read only when a gift card email has permanently bounced, so the buyer can be told their gift card is stranded |
We do not process addresses, phone numbers, payment details, or any special category of personal data.
6. Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Shopify | Source of order data; system of record for the gift card | Per Shopify's own terms |
| Postmark | Transactional email delivery | United States |
| Render | Application hosting and database | United States (Oregon) |
We will give you notice before adding or replacing a subprocessor, and you may object by uninstalling the app.
7. International transfers
Our infrastructure is in the United States. Where you are in the UK or EEA, transfers rely on the appropriate safeguards offered by those subprocessors.
8. Security
- All traffic is over HTTPS. Data is encrypted at rest by our hosting provider.
- Gift-card codes carry an additional layer of application-level AES-256-GCM encryption. Only the last four characters are ever displayed.
- Personal data is never written to logs. Log output passes a redaction layer, and automated tests assert that neither a recipient nor a buyer address can reach the logs.
- Every webhook is verified by HMAC, with a constant-time comparison, before its body is parsed.
- All database queries are scoped to the installing shop. Cross-shop access is refused at the data layer, not merely hidden in the interface, and is covered by tests against a real database.
- We never receive payment data; the app is outside PCI scope.
9. Assistance with your obligations
- Deletion on uninstall. Shopify's
shop/redactrequest causes us to delete your store's records entirely: deliveries, email designs, sessions, the webhook ledger and stored privacy-request records. - Erasure requests. Shopify's
customers/redactrequest causes us to erase the recipient email, recipient name, sender name and message from matching deliveries. Any gift card still undelivered is cancelled first, because we can no longer deliver it. Erasure is irreversible and a cancelled gift card cannot be resent, so the underlying order is yours to settle with your customer. - Access requests. Shopify's
customers/data_requestis forwarded to you, since you are the controller and the party who must answer the individual. - Records of privacy requests are reduced to identifiers on receipt, never the raw payload, which contains the very data the request protects, and blanked after 30 days.
10. Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with what we know at the time: what happened, which categories of data and roughly how many records are affected, the likely consequences, and what we are doing about it. We will follow up as more becomes known.
11. Audit
On reasonable written request, and not more than once a year unless required by a supervisory authority, we will provide the information reasonably necessary to demonstrate compliance with this addendum.
12. Return and deletion
On uninstall, data is deleted as described in section 9. We do not retain a copy beyond the backup retention window of our hosting provider, after which backups expire in the ordinary course.