Data Processing Agreement

1. Who it is between

This agreement is between Ovnit LTD (company number 17495977, registered office 128 City Road, London, EC1V 2NX, England) (“Ovnit”, “we”) and the business that uses Ovnit (“the brand”, “you”). It forms part of the Terms of Service and applies whenever we process personal data for you. For that data you are the controller and we are your processor.

2. The processing

• Subject matter and purpose: running the product pages your QR codes open; collecting the registrations, problem reports, warranty claims, returns and feedback your customers submit there; recording how the pages are used; sorting customers into groups and lifecycle stages and estimating when a consumable may need reordering, so you can choose who receives which message; sending the emails you send through Ovnit; storing, reporting on and deleting that data as you configure.
• Duration: while you use Ovnit, and until the data is deleted after you close your account (30 days after you ask, and in any event within 90 days).
• People whose data it is: your customers and other people who use your product pages or receive your emails. (Data about the people on your own team is account data, which we control ourselves under our privacy policy.)
• Types of data: contact details (email address, name); purchase details they give (retailer, serial or order number, purchase month); what they write in forms; their marketing choices and the wording they were shown; where someone turns marketing back on from a preferences or data-request page, the first three parts of their IP address; a random device identifier and how the pages were used; whether emails were opened or links clicked. Ovnit is not designed for special category data; please do not ask for it in your forms.

3. What we commit to

• Your instructions. We process the data only on your documented instructions — the way you set up and use Ovnit, and anything you agree with us in writing — unless the law requires otherwise, in which case we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you.
• Confidentiality. Anyone we allow to process the data is bound to keep it confidential.
• Security. We take appropriate technical and organisational measures to protect the data, as described on our security page.
• Sub-processors. You authorise the sub-processors listed on our sub-processors page. We tell you before adding or replacing one, so you can object; if you object on reasonable data protection grounds and we cannot resolve it, you may close your account. We require each sub-processor to accept data protection obligations equivalent to these, and we remain responsible to you for its work.
• Transfers. Where a sub-processor processes data outside the UK, the sub-processors page lists the safeguard each relies on, and says where one is still under review.
• Helping with people’s rights. Ovnit gives your customers a way to ask for a copy, correction, deletion or restriction of their data and to object, and gives you a queue to answer those requests and the tools to carry them out. We help further where you need it.
• Helping with your other duties. We help you meet your duties on security, on breach notification, and on data protection impact assessments and consulting the regulator, taking into account what we can see.
• Breaches. If we become aware of a breach affecting your data, we tell you without undue delay, with what we know and what we are doing about it.
• At the end. While your account is open you can export your registrations, customer records, scans, feedback and reported problems, and — on plans that include customer profiles — any one person’s complete record; anything else we provide on request. When you close it, we delete it as described above; copies in our backups are overwritten within 14 days. We keep only what the law requires us to.
• Showing we comply. We give you the information you reasonably need to show these obligations are met, and allow for and contribute to audits by you or an auditor you appoint, on reasonable notice.

4. Your side

You are responsible for having a lawful basis for the processing you ask Ovnit to do, for the wording your pages show, for publishing your own privacy notice, and for what you do with data once you export it or send it to your own systems.

5. Contact

privacy@ovnit.co.