Data processing agreement
This agreement applies between the merchant who installs Whenly (the controller) and Yazıpark Bilgi Sistemleri Ltd. Şti., Ünalan Mah. Sarnıç Sk. No:3 A1 Blok D:10, Üsküdar, İstanbul, Türkiye (the processor, “we”), for personal data Whenly processes on the merchant’s behalf. It forms part of the terms under which the merchant uses Whenly and takes effect when the app is installed. It follows Article 28 of the GDPR.
1. Subject, duration and purpose
We process personal data only to provide Whenly to the merchant: offering delivery, pickup and shipping dates to buyers, checking them at checkout, and helping the merchant plan orders. Processing lasts while the app is installed and ends with the deletion described in section 7.
2. Data and people concerned
Buyers and visitors of the merchant’s store. Data: order IDs and numbers, chosen dates, time windows, methods and pickup locations, delivery postal codes and zones; and, read from Shopify when shown without being stored, order line items, gift recipient names and messages, and (for the route list) delivery names, addresses, phone numbers and order notes, and (for reminder e-mails) the buyer’s e-mail address and language. No special categories of data.
3. Instructions
We process the data only on the merchant’s documented instructions, which are the app’s settings and this agreement, unless the law requires otherwise; we will tell the merchant if an instruction seems to break the law.
4. Confidentiality and security
- Only the developer of Whenly has access, bound to confidentiality.
- Encryption in transit (HTTPS) and at rest, backups included; server in the EU.
- Access to the server only by SSH key; the app’s secrets readable by root only.
- Data minimisation: no buyer names, e-mails, phone numbers or street addresses are stored.
- Daily backups kept 14 days, with a weekly restore test; monitoring and error alerts.
5. Sub-processors
The merchant authorises: netcup GmbH (server and storage, Austria), Cloudflare, Inc. (network delivery and protection; EU Standard Contractual Clauses) and, only for shops that turn on reminder e-mails, Resend (Plus Five Five, Inc.; sending e-mail, United States; EU Standard Contractual Clauses). We will announce new sub-processors on this page at least 30 days before using them; the merchant may object by uninstalling the app. We bind sub-processors to the same duties.
6. Helping the merchant
We help the merchant answer data subject requests (Shopify’s customer data request and erasure webhooks are handled automatically), and with security, breach notification and data protection impact assessments as far as Whenly is concerned. We tell the merchant without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting their data.
7. Deletion
Bookings are deleted 400 days after their date. When the merchant uninstalls Whenly, all of their data is deleted on Shopify’s shop deletion request (48 hours after uninstalling), and from backups within 14 days.
8. Audits
We make available the information needed to show compliance with this agreement and allow for reasonable audits, on request to [email protected].