{
 "id": "9.3",
 "title": "Data processing agreement",
 "department": "Security, privacy and legal",
 "department_slug": "security-privacy-and-legal",
 "direction": null,
 "branded": false,
 "status": "needs-you",
 "owner": "Param",
 "last_verified": "Mon Oct 26",
 "holds": "For partner brands",
 "urls": {
  "html": "https://handbook.joinsquareup.com/security-privacy-and-legal/data-processing-agreement",
  "markdown": "https://handbook.joinsquareup.com/security-privacy-and-legal/data-processing-agreement.md",
  "json": "https://handbook.joinsquareup.com/security-privacy-and-legal/data-processing-agreement.json"
 },
 "other_directions": [],
 "tldr": {
  "headline": "No partner has a data processing agreement, so we drafted one",
  "points": [
   {
    "icon": "warn",
    "text": "None of the five partners has a DPA, signed or drafted."
   },
   {
    "icon": "lock",
    "text": "Proposed promises: no training our own model, 72 hour breach notice, deletion within 7 days."
   },
   {
    "icon": "people",
    "text": "Only named staff should open brand data; today anyone at two email domains can."
   },
   {
    "icon": "link",
    "text": "Subprocessors get 14 days' notice, with the right to object and leave."
   },
   {
    "icon": "check",
    "text": "Every promise must already be true in code or a runbook, or we fix the code."
   }
  ],
  "stat": {
   "value": "72",
   "label": "hour breach notice proposed"
  },
  "decide": "Offer the DPA now with the partner agreement, since PUMA India is likely to ask?",
  "mood": "waiting"
 },
 "sources": [
  "brew/legal-pages.js:23-33",
  "brew/docs/shopify-app-review.md:18, 39, 89-93",
  "brew/docs/shopify.app.toml:12-15",
  "brew/vault.js:1-3",
  "brew/docs/production.md:11-12, 35-41",
  "brew/public/live.js:348-351",
  "memory brew-meta-app-review, brew-live-stores, brew-prod-backend",
  "handbook content/sales-and-partnerships/contracts.md"
 ],
 "open_questions": [
  "**Do we offer a DPA now, or only when a partner asks?** Proposal: now, with the partner agreement, because PUMA India is likely to ask.",
  "**Breach notice time?** Proposal: 72 hours from confirming, which is a common standard; the lawyer checks Indian law.",
  "**Backups after deletion?** Point in time recovery keeps 7 days and daily backups keep 14. Proposal: say backups roll off within 14 days and are never restored for a deleted brand.",
  "**Who signs for us?** Proposal: Param, as a designated partner of the LLP; he confirms he is one."
 ],
 "parts": {
  "Answer": "No data processing agreement exists with any partner brand; this document proposes the one we offer, so a partner's lawyer has a short, true answer to \"what do you do with our data\", and it waits on Param and a lawyer before anyone signs it.",
  "Today": "| What exists | Source |\n|---|---|\n| No DPA, signed or drafted, with any of the five partners | [src: handbook content/sales-and-partnerships/contracts.md] |\n| The five partners whose data is on production: Arata, Nutrova, Mana, PUMA India, Scrubroom | [src: memory brew-live-stores] [src: memory brew-prod-backend] |\n| Meta's data handling form names Yellow Monk Technologies LLP as controller and Google LLC, Google Cloud, India and the US, as processor | [src: memory brew-meta-app-review] |\n| Shopify protected customer data: Level 1 requested, no names, emails, phones or addresses | [src: brew/docs/shopify-app-review.md:18, 89-93] [src: brew/docs/shopify.app.toml:12-15] |\n| Shopify's data request and erasure webhooks are handled | [src: brew/docs/shopify-app-review.md:39] |\n| Connected accounts are read only and their keys are encrypted with AES-256-GCM | [src: brew/legal-pages.js:23] [src: brew/vault.js:1-3] |\n| Production data sits in Cloud SQL and a bucket in asia-south1 with backups | [src: brew/docs/production.md:11-12, 35-41] |\n| Deletion is an email request, promised within 7 days | [src: brew/public/live.js:348-351] |",
  "Tomorrow": "| Item | Version | Tag |\n|---|---|---|\n| A short DPA offered with the design partner agreement | v1 | New, proposed |\n| The same DPA linked from the full terms for every brand | v1 | New, proposed |\n| A DPA update when posting and scheduling write to the brand's accounts | v2 | Changes |\n| A DPA update when results are measured from order data | v3 | Changes |\n\n### The proposed DPA, for Param and a lawyer\n\nThis is a draft, not legal advice. Every number is a proposal.\n\n| Clause | Proposal |\n|---|---|\n| Parties | The brand, and Yellow Monk Technologies LLP |\n| Roles | The brand controls its store data and its customers' data; we process it only to run the service for the brand |\n| What we process | Public data about the brand and its rivals; numbers from connected accounts; order totals and counts from Shopify, never a customer's name, email, phone or address; names and emails of the brand's team; what the team writes and uploads |\n| Purpose | Read the store, write Plays, cards, drafts and briefs for the brand's team; nothing else; never to train a model of our own |\n| Instructions | We act only on the brand's use of the service and its written requests |\n| People | Only named staff open brand data, and only to support the brand; today anyone at `joinsquareup.com` or `shopos.ai` can, so this clause needs the access change proposed in access rules first |\n| Subprocessors | The list on our subprocessors page; 14 days' email notice before a new one, with the right to object and leave |\n| Where | Google Cloud in India; some AI and email vendors in the US |\n| Security | As on our security practices page: encryption of keys, read only access, revocable sessions, backups |\n| Breaches | We tell the brand's admins within 72 hours of confirming a breach that touches their data, with what we know |\n| Help | We help with the brand's own data requests within 7 days |\n| Deletion | Within 7 days of a request or the end of the agreement; backups roll off within 14 days after that |\n| Proof | A written answer to a security questionnaire once a year; no on-site audits |\n| Term | As long as the brand uses the service |",
  "How we do it": "1. Param and a lawyer settle the table above into a two page document.\n2. Send it with the design partner agreement to the five partners; record each yes in the contracts register.\n3. Keep the subprocessors page current; any new vendor in the code means an email to every partner 14 days before it goes live.\n4. Every DPA promise must be something the code or a runbook already does; if not, fix the code first or change the promise.",
  "Numbers": "| Metric | Definition | Where measured | Status |\n|---|---|---|---|\n| Partners with a signed DPA | Of the five design partners | Contracts register | Proposed, 0 on record |\n| Subprocessor notices sent | Emails sent before a new vendor | hello@ outbox | Proposed |",
  "Open": "1. **Do we offer a DPA now, or only when a partner asks?** Proposal: now, with the partner agreement, because PUMA India is likely to ask.\n2. **Breach notice time?** Proposal: 72 hours from confirming, which is a common standard; the lawyer checks Indian law.\n3. **Backups after deletion?** Point in time recovery keeps 7 days and daily backups keep 14. Proposal: say backups roll off within 14 days and are never restored for a deleted brand.\n4. **Who signs for us?** Proposal: Param, as a designated partner of the LLP; he confirms he is one."
 }
}