Data Processing Agreement

1Purpose and parties

This agreement binds the shop that uses the Elma app (the “Shop”) and MSTL LLC, a Delaware limited liability company doing business as Elma ia (“Elma”). It governs the personal data that Elma processes on the Shop’s behalf, as a processor within the meaning of Article 28 of the General Data Protection Regulation (GDPR): the emails of its customers, the conversations of its website chat, its private messages on Instagram, Messenger and WhatsApp, and what Elma reads, at its request, in its online store and its tools.

It is part of the Terms of Service: the Shop accepts it with them, by creating its account or by continuing to use Elma, without any other signature. For the protection of personal data, it prevails over them. A Shop that wants a signed copy writes to info@elmai.io.

The data for which Elma is itself the controller (the Shop’s account, the people who use it, payment) is covered by the Privacy Policy. This agreement is published in English and in French; if the two versions differ, the English version prevails.

2The processing

The retention period of each item of data is in the Privacy Policy.

3The Shop’s instructions

• Elma processes this data only on the Shop’s documented instructions: the Terms of Service, this agreement, and the settings it chooses in the app (the mailboxes and accounts it connects, its profile, its guidelines, the topics set to automatic sending, its website chat). Changing a setting is giving a new instruction.
• Elma makes no other use of it, unless the law requires it to; it then tells the Shop before doing so, unless the law forbids it.
• If an instruction seems to it to infringe the GDPR, Elma tells the Shop immediately.
• The Shop warrants that it has a lawful basis for this data, and that it tells its customers, in its own privacy policy, that their messages are processed by a service provider.

4Confidentiality

The people at Elma authorised to access this data are bound by confidentiality. Nobody at Elma reads the Shop’s messages, except: at its express request, to help it, and only the messages it points to; when necessary for the security of the service (investigating abuse or an incident); or to comply with the law.

5Security

Elma implements the measures required by Article 32 GDPR, in particular:

• exchanges are encrypted (HTTPS), and each shop is isolated from the others in the database by rules applied to every row;
• the access to connected mailboxes and accounts, passwords and keys are encrypted with AES-256-GCM, under a key specific to each shop, itself encrypted by a master key kept outside the database; they are never displayed;
• the agent cannot execute anything on its own: it proposes a reply, and the action gateway refuses anything the Shop’s settings do not allow;
• the language models are only called at zero-retention hosts, which do not keep the texts and train nothing with them;
• the Shop’s people sign in with a single-use link, with Google or with a password, and can add a second factor; a session lasts 30 days at most, and Elma keeps only a hash of the IP address;
• data is deleted automatically, every day, at the end of the periods set out in the Privacy Policy;
• a sealed audit log records sensitive actions, deletions included.

Elma reviews these measures when the service changes, and the Privacy Policy describes them up to date.

6Sub-processors

The Shop authorises Elma to engage the sub-processors below. Elma imposes on them by contract data protection obligations equivalent to those of this agreement, and remains liable to the Shop for their compliance.

The Shop’s own services, which Elma queries on its instructions (its email host, its online store, its email marketing tool, Meta for Instagram, Messenger and WhatsApp), are not Elma’s sub-processors: the Shop chose them, and their own terms apply to it.

Before adding or replacing a sub-processor, Elma informs the Shop at least 30 days in advance, by email to the account owner and on this page. The Shop may object on data protection grounds by writing to info@elmai.io; if no solution is found, it may end its plan before the change, at no cost.

7Requests from individuals

• “A person’s data” (Settings → Connections, reserved for the account owner): there the Shop finds what Elma keeps about a person, from her email address, her phone number, or her username or name on Instagram, Messenger or WhatsApp; it downloads it as a file, for an access or portability request, and erases it, for an erasure request. Each export and each erasure is recorded in the audit log, without the address or the name. Elma erases nothing in the Shop’s mailbox, online store or Meta accounts: the Shop deletes there itself what must be deleted.
• For a Shopify Shop, a customer erasure request that Shopify forwards to Elma is carried out the same way, automatically; an access request that Shopify forwards is handled within 30 days.
• A request that a person sends directly to Elma is passed on to the Shop without delay; Elma does not answer it itself, except on the Shop’s instruction.
• For a rectification, a restriction or an objection, Elma helps the Shop, which writes to info@elmai.io.

8Personal data breaches

If Elma becomes aware of a personal data breach affecting the Shop’s data (loss, disclosure or unauthorised access), it informs the Shop without undue delay, and no later than 48 hours after becoming aware of it, by email to the account owner. It gives what it knows: the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, the measures taken or proposed, and the contact person; what is not yet known follows as soon as it is.

Elma immediately takes the measures to end it and limit its effects, and helps the Shop notify the supervisory authority within 72 hours and, where necessary, inform the people concerned.

9Assistance with compliance and audits

• Elma assists the Shop, with what it knows of the processing, with its data protection impact assessments and, where required, with the prior consultation of the supervisory authority.
• Elma makes available to it the information needed to demonstrate compliance with this agreement: this page, the Privacy Policy and, if the Shop asks for them, the up-to-date description of the security measures and of the safeguards of each sub-processor.
• If this information is not enough, the Shop may have an audit carried out, once a year, by an independent auditor bound by confidentiality, giving Elma 30 days’ notice. The audit is at its expense, during business hours, without disrupting the service or giving access to other shops’ data. A supervisory authority may always audit Elma, without these limits.

10Transfers outside the European Union

MSTL LLC is established in the United States, where the data is processed. For a Shop established in the European Economic Area, or whose processing is subject to the GDPR, the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914 of 4 June 2021), Module Two (controller to processor), are part of this agreement, the Shop being the data exporter and Elma the data importer, with these choices:

• Clause 7 (docking clause): it does not apply;
• Clause 9 (sub-processors): Option 2, general authorisation, with the 30 days’ notice of the section “Sub-processors”;
• Clause 11 (redress): the option of an independent dispute resolution body does not apply;
• Clause 13 (supervision): the supervisory authority competent for the Shop;
• Clause 17 (governing law): the law of the Member State in which the Shop is established or, if it does not allow for third-party beneficiary rights, Irish law;
• Clause 18 (forum and jurisdiction): the courts of the Member State in which the Shop is established;
• annexes: the section “The processing” stands as Annex I, the section “Security” as Annex II, and the list of sub-processors as Annex III.

For data subject to the law of the United Kingdom, these clauses apply with the International Data Transfer Addendum issued by the Information Commissioner (ICO); for Switzerland, with the adaptations required by the Federal Data Protection and Information Commissioner, the Swiss Federal Act on Data Protection replacing the GDPR where it is referred to. If this agreement and these clauses conflict, the clauses prevail.

Elma likewise frames each transfer to a sub-processor outside the Union: with the standard contractual clauses (Module Three, processor to processor) or, for a provider that participates in it, with the EU–U.S. Data Privacy Framework.

11End of the service

• A cancelled plan pauses the agent without closing the account: the data stays, so that the Shop can resume.
• “Disconnect everything” (Settings → Connections) closes the account and immediately deletes the data processed for the Shop, as the Privacy Policy says. A closure requested by email, at info@elmai.io, is carried out within 30 days. Elma then keeps only what the law requires it to keep.
• Before closing its account, the Shop retrieves a person’s data with “A person’s data”; its emails stay in its own mailbox. For a complete copy, it writes to info@elmai.io before the closure, and Elma hands it over in a readable file (JSON).

12Liability and changes

Each party’s liability follows the Terms of Service, except where the GDPR and the standard contractual clauses provide otherwise. Elma announces any change to this agreement at least 30 days before it applies, by email to the account owner and on this page; a change cannot reduce the protection that this agreement and these clauses give the data.

13Contact

For this agreement, a request, a data breach or an audit: info@elmai.io, or MSTL LLC, 8 The Green, Suite A, Dover, Delaware 19901, United States.