Data processing agreement

How this fits together

This agreement forms part of the terms of service and applies whenever Soran processes personal data on your behalf. Where it conflicts with the terms of service on the subject of that processing, this agreement wins.

It takes effect when you start using the service and needs no signature. If your procurement process requires a signed copy, write to marketing@soran.ai and we will provide one.

Roles

For the events, orders, and customer records you send us, you are the controller and Soran is the processor. You decide what is collected and why; we act on your instructions.

For the account data of the people who sign in to Soran, we are the controller in our own right. That processing is described in the privacy policy and is not covered here.

What is processed

• Subject matter. Providing marketing attribution and analytics: collecting events, reconstructing the path to each order, dividing credit, reporting against cost, and forwarding conversions where you have configured that.
• Duration. For as long as your account is open, plus the period described in Return and deletion below.
• Categories of data. Online identifiers and device data, behavioural events, order and transaction records, and the contact and identity details your store attaches to an order, which may include an email address and a name.
• Data subjects. Visitors to and customers of the sites and stores you connect.

Soran is not built to hold special categories of personal data, payment card numbers, or government identifiers, and you agree not to send them.

Our instructions from you

We process this data only on your documented instructions, which are given by your use of the service and its settings, and by any further written instruction you send us. We follow them unless the law requires otherwise, and where it does we will tell you before processing, unless that law forbids us from telling you.

If we believe an instruction breaches data protection law, we will tell you.

Confidentiality

Access to your data inside Soran is limited to people who need it to do their job. Everyone with access is under a duty of confidentiality that survives their leaving.

Security

We keep technical and organizational measures appropriate to the risk, including:

• encryption of data in transit and at rest;
• access control on a need to know basis, with administrative access logged;
• separation of every property, so one customer's data cannot be reached from another customer's account;
• encrypted storage of credentials for connected platforms, which are never displayed back in full;
• regular backups, and restoration procedures that are tested rather than assumed; and
• review of these measures as the service changes, since a measure that matched last year's system is not a measure.

Subprocessors

You give general authorization for us to engage the subprocessors below. Each is bound by written terms that impose obligations no less protective than these.

We will tell you before adding or replacing a subprocessor, giving you time to object on reasonable data protection grounds. If you object and we cannot offer you an alternative, you may terminate the affected part of the service and we will refund the unused balance of what you have paid for it. We remain liable to you for what a subprocessor does.

International transfers

Some subprocessors are outside the European Economic Area. Where data moves there, the transfer is made under the European Commission's standard contractual clauses together with the supplementary measures those clauses require, and for the United Kingdom under the UK international data transfer addendum. A copy of either is available on request.

Helping you with data subject requests

The product gives you the means to find, correct, export, and delete an individual's records yourself, which is normally the fastest way to answer a request. Where a request cannot be answered with those tools, we will help you, taking into account what you can reasonably do on your own.

If a data subject contacts us directly about data we hold for you, we will not answer for you. We will tell them to contact you, and tell you that they made contact.

Personal data breaches

If we become aware of a breach affecting your data, we will tell you without undue delay and in any event within 48 hours. We will describe what we know, what we are doing about it, and what we recommend you do, and we will keep you updated as the picture changes rather than waiting for it to be complete.

Assessments and prior consultation

We will give you the information you reasonably need to carry out a data protection impact assessment, and to consult your supervisory authority where the law requires it.

Return and deletion

You can delete a property, and everything in it, at any time during the term. When your account closes we delete your data, except where the law requires us to keep some of it. Backups age out on their own cycle, and nothing is restored from a backup into live use after you have asked for it to go.

Export what you want to keep before you close the account. On request made before closure we will provide a copy in a structured, commonly used format.

Audits

We will make available the information needed to show that we meet these obligations. Where that is not enough for you, you may audit us, or appoint an auditor who is not a competitor of ours, on reasonable notice, no more than once a year unless a regulator or a breach requires otherwise, during business hours, and without disrupting the service or exposing another customer's data.

Contact

Questions about this agreement, or a request for a signed copy, go to marketing@soran.ai.