Data processing agreement

This data processing agreement (“DPA”) is part of the terms of service between JPE IT AB, trading as Pixonaut, organisation number 559240-5855, Kivra: 559240-5855, 106 31 Stockholm, Sweden (“Pixonaut”, the processor), and the business that has accepted them (the “customer”, the controller). Accepting the terms accepts this DPA. We send a countersigned PDF copy on request to [email protected], which is also the address for anything else under this DPA.

It applies to the personal data Pixonaut processes on the customer’s behalf when providing the service, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning the GDPR gives them.

1. What is processed

• Subject matter and duration: providing the Pixonaut service under the terms, for as long as the customer uses it, and until the data is deleted as section 8 describes.
• Nature and purpose: storing, rendering, proofing and printing designs, and sending orders and messages, as the customer instructs through its use of the service.
• Categories of data subjects: the customer’s own customers (“shoppers”) and the recipients of their orders.
• Categories of personal data: an order’s recipient name, email address, phone number, ship-to address and final recipient; the text and pictures a shopper puts into a design, its revisions, proofs and print files; an address given through an address capture link. The service is not meant for special categories of personal data, and the customer does not send them on purpose.

2. Instructions

Pixonaut processes the personal data only on the customer’s documented instructions. The terms, this DPA, and the customer’s configuration and use of the service are those instructions. Pixonaut tells the customer if it believes an instruction breaks the GDPR, and if the law requires processing the customer did not instruct, tells it first unless the law forbids that.

3. Confidentiality

Everyone at Pixonaut authorised to process the personal data is bound by confidentiality.

4. Security

Pixonaut takes the technical and organisational measures Article 32 requires, appropriate to the risk. They are listed in the annex below, and include:

• encryption in transit, over TLS, of every connection to the service and between the service and its subprocessors. A delivery to a custom printshop uses the transport the customer chose for it, which may be FTP without encryption; the customer is responsible for that choice;
• separation of each customer’s data, enforced in every database query and backed by row-level security in the database;
• access to production systems limited to the people who need it, with their own credentials;
• an audit log of changes in each workspace;
• uploaded pictures kept only for the workspace’s retention, and erased when it ends.

5. Subprocessors

The customer authorises Pixonaut to engage the subprocessors named on the published subprocessor list. Pixonaut gives the customer at least 30 days’ notice, by email and on that list, before it adds or replaces a subprocessor. The customer may object to the change on reasonable grounds relating to data protection within those 30 days; if the parties cannot resolve the objection, the customer may terminate the affected service before the change takes effect, without penalty.

Pixonaut binds each subprocessor by contract to data protection obligations no less protective than this DPA’s, and remains responsible to the customer for its subprocessors’ performance of them.

A custom printshop the customer configures, and any other recipient the customer chooses to send data to through the service, is the customer’s own recipient, not Pixonaut’s subprocessor.

6. Transfers outside the European Economic Area

Pixonaut stores and hosts the personal data in the European Union. Where a subprocessor processes personal data outside the European Economic Area, the transfer rests on the EU-US Data Privacy Framework, where the subprocessor is certified under it, or on the European Commission’s Standard Contractual Clauses. The subprocessor list names the basis for each.

7. Helping the customer

Taking into account the nature of the processing, Pixonaut helps the customer, by the service’s own features where it can, to:

• answer data subjects exercising their rights, including erasing an order’s or a design’s personal data;
• meet its obligations under Articles 32 to 36, including data protection impact assessments.

Pixonaut passes on to the customer, without answering it itself, any request it receives directly from one of the customer’s data subjects.

Personal data breaches

Pixonaut notifies the customer of a personal data breach affecting its data without undue delay, and within 48 hours of becoming aware of it, with what is then known of its nature, the data and the data subjects concerned, its likely consequences, and the measures taken. It adds to that as it learns more.

8. Retention and deletion

Pixonaut keeps the personal data as set by the controller. The customer chooses its workspace’s personal data retention, from 14 to 365 days, 60 unless it chooses otherwise, and that setting and its other retention settings are the customer’s instruction: an order’s recipient data is erased that many days after the order is finished (shipped, failed or cancelled), and a design’s content, its uploaded pictures and its print files once every order of the design has been, or, for a design with no order, that many days after its last change. An order not yet finished keeps its data. The customer can erase an order’s or a design’s personal data sooner. A picture a shopper uploads and no design keeps, such as one left in a designer that was never submitted, is deleted when the workspace’s upload retention ends: seven days after the upload by default.

When the customer deletes its workspace, Pixonaut deletes the personal data at once, and its files shortly after. When Pixonaut terminates the service, the customer can retrieve its data until the termination takes effect, and Pixonaut then deletes the personal data. A paid plan that ends does neither: the workspace stays on the free plan, and its data stays under these terms. Copies are deleted with the data, unless the law requires them to be kept. Backups are encrypted, kept for 30 days and then deleted, so deleted data is gone from them within 30 days of its deletion.

9. Audits

Pixonaut makes available to the customer the information needed to show that it meets this DPA, and allows for and contributes to audits, including inspections, by the customer or an auditor it mandates. An audit is announced at least 30 days ahead, held during business hours, at the customer’s cost, and no more than once a year unless a personal data breach or a supervisory authority calls for one.

10. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the terms. Where this DPA and the terms disagree on the protection of personal data, this DPA prevails.

Annex: technical and organisational measures

The measures Pixonaut takes under section 4 and Article 32, which it keeps up to date with the state of the art:

• Encryption in transit: every connection to the service, and between the service and its subprocessors, over TLS. A delivery to a custom printshop uses the transport the customer chose for it.
• Encryption at rest: every backup is encrypted before it leaves the server, and passwords and API keys are stored only as hashes. The live database and files are kept on Pixonaut’s own servers in access-controlled data centres in the European Union.
• Access control: production systems are reached only by the people who run them, each with their own credentials and keys, over encrypted connections. Each workspace’s data is separated in every database query and by row-level security in the database; the service’s own database role cannot bypass it. Members sign in with a password stored only as a hash, and may add a second factor; API keys are stored as hashes and scoped to one workspace.
• Logging: an audit log records the changes made in each workspace and by whom. The service’s logs record requests and errors without the content of designs or orders, and are kept on Pixonaut’s own servers.
• Encrypted backups: the database and the print files on the server are backed up every night, encrypted before they leave it, to object storage in Germany, apart from the live data in Finland, and kept for 30 days.
• Restore tests: a backup is restored regularly beside the live database, checked and dropped, so a backup is known to restore before it is needed.
• Incident response: a suspected personal data breach is investigated at once, contained, and notified to the customer as section 7 describes; what happened and what was done is recorded.
• Data minimisation: uploaded pictures are kept only for the workspace’s retention, and the personal data of finished orders is erased as section 8 describes.
• Confidentiality: everyone authorised to process the personal data is bound by confidentiality, and subprocessors by contract, as sections 3 and 5 describe.