Data Processing Addendum

The short version

• Your brand decides how your customers’ data is used. We process it only to run BubbleSMS for you.
• We never sell or share it, never use it for anyone else, and never combine it with other brands’ data.
• We tell you about a security incident without undue delay, and no later than 72 hours after we confirm it.
• When you leave, we delete your customers’ data within 30 days (backups follow within 35 more).
• You agree to this addendum when you accept the Terms. There is nothing extra to sign.

1. Scope and how this addendum fits

1.1 This Data Processing Addendum (the “DPA”) forms part of the agreement between you (the “Merchant”) and BubbleSMS (“BubbleSMS”, “we”, “us”) made up of the Terms of Service, your Order Form and the documents they refer to (the “Agreement”).

1.2 It applies whenever we process Customer Personal Data in providing the Service. It takes effect when the Agreement does, and lasts for as long as we process Customer Personal Data.

1.3 If this DPA and the rest of the Agreement conflict on anything about personal data, this DPA wins. Words with capitals that are not defined here have the meanings in the Terms.

2. Definitions

• Data Protection Law: every law on privacy and personal data that applies to the processing under the Agreement. This includes the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (the “CCPA”) and the comprehensive privacy laws of other US states.
• Customer Personal Data: personal data about End Customers (and any other personal data) that we process on your behalf under the Agreement, as described in Annex 1.
• Security Incident: a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data held by us or our Subprocessors.
• Subprocessor: a third party we engage to process Customer Personal Data for the Service.
• Business, service provider, sell, share, consumer, controller, processor, personal data / personal information and processing have the meanings given in Data Protection Law.

3. Roles

3.1 For Customer Personal Data, you are the controller and the business, and we are your processor and service provider.

3.2 Each party will comply with the obligations Data Protection Law places on it in that role.

4. Processing on your instructions

4.1 We process Customer Personal Data only on your documented instructions, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it). Your instructions are: the Agreement; the way you set up and use the Service (including the flows you turn on, your settings and your discount ladder); and any other written instructions we agree to.

4.2 If we believe an instruction breaks Data Protection Law, we will tell you. We are not required to follow that instruction, and we may pause the affected processing until it is changed or confirmed in writing. We do not give legal advice on your compliance.

4.3 Processing you ask for that goes beyond the standard Service needs our written agreement, and may be charged for.

5. Your responsibilities

5.1 You promise, on a continuing basis, that:

• (a) you have a lawful basis, and every consent the law requires, to collect Customer Personal Data and to have us process it for the Service. This includes the prior express written consent required by the TCPA and similar laws for every End Customer the Service texts (see section 6 of the Terms);
• (b) you have given End Customers every notice the law requires, including a privacy policy that covers the use of service providers such as AI and messaging providers, and a link to your Messaging Terms;
• (c) Customer Personal Data you make available to us is accurate and was obtained lawfully, and you are entitled to give it to us and to our Subprocessors for the Service; and
• (d) your instructions will not cause us to break Data Protection Law.

5.2 You will not send us, or configure the Service to collect, sensitive personal information (such as health, financial-account, government-ID or precise-location data) beyond what the Service needs, which is described in Annex 1.

5.3 Your indemnity for breach of these promises is in section 15.1 of the Terms. It is not subject to the cap on liability.

6. Our people

We make sure everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality, and we give access only to those who need it to provide, support or secure the Service.

7. Security

7.1 We maintain the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against Security Incidents, taking into account the state of the art, the cost, and the nature, scope, context and purposes of the processing and its risks.

7.2 We may update these measures, but never in a way that reduces the overall protection of Customer Personal Data.

7.3 You are responsible for the security of your own systems, your Store, and your team’s access to the Service.

8. Subprocessors

8.1 Authorization. You give us general authorization to engage Subprocessors. The categories of Subprocessors we use, what they do, and where they process data are listed on our Subprocessors page.

8.2 Our obligations. Before a Subprocessor processes Customer Personal Data, we put a written contract in place that requires it to protect the data at least as well as this DPA does, to the extent relevant to its services. We remain responsible to you for each Subprocessor’s performance of those obligations.

8.3 Changes. We will notify you by email or in your dashboard at least 30 days before we (a) add a new category of Subprocessor or (b) begin processing Customer Personal Data outside the United States. Where Data Protection Law requires more specific notice of a Subprocessor engagement, we will give it to you directly.

8.4 Objections. You may object to a change on reasonable data-protection grounds by writing to us within 30 days of our notice. We will work with you in good faith to resolve the objection, for example by offering a reasonable alternative. If we can’t resolve it, you may end the Agreement, or the affected part of it, by notice before the change takes effect, without any penalty. Fees for Attributed Orders placed up to the end date remain payable.

9. Security Incidents

9.1 We will notify you without undue delay, and no later than 72 hours after we confirm a Security Incident affecting your Customer Personal Data.

9.2 Our notice will describe, as far as we know at the time: what happened; the categories and approximate number of individuals and records affected; the likely consequences; the steps we have taken or propose to take; and a contact for more information. We will update you as we learn more.

9.3 We will take reasonable steps to contain, investigate and remedy the Security Incident, and to help you meet your own obligations.

9.4 As the controller, you decide whether to notify End Customers, regulators or anyone else, unless the law requires us to do so ourselves. We will not notify your End Customers about a Security Incident without your agreement, unless the law requires it.

9.5 Notifying you of a Security Incident is not an admission of fault or liability.

10. Helping with requests and assessments

10.1 Individual requests. We help you respond to End Customers’ requests to access, delete, correct or port their information, or to opt out, as follows:

• Shopify’s data request and erasure requests for an End Customer, or for your whole Store, are handled automatically: we compile or erase that End Customer’s information in the Service when your Store sends the request.
• You can ask us for an export or a deletion for any End Customer at privacy@bubblesms.com. We act within 10 business days.
• STOP and other opt-out replies are honored immediately and recorded.

10.2 Requests that come to us. If an End Customer contacts us directly about their data, we will pass the request to you, and will not respond ourselves except to direct them to you, on your instructions, or where the law requires.

10.3 Assessments. We will give you the information you reasonably need, about the Service, to carry out any data protection or risk assessment that Data Protection Law requires of you.

10.4 Costs. Help that goes beyond what the Service does automatically and takes more than minimal effort may be charged at reasonable rates, which we will agree with you in advance.

11. Deletion and return

11.1 When the Agreement ends, or when you uninstall our app, we export and delete Customer Personal Data as set out in section 18 of the Terms. In short: you can ask for an export before you uninstall (or for 30 days after the Agreement ends, if the app stays installed); we delete within 30 days after the trigger described there; and backup copies are overwritten within a further 35 days.

11.2 We may keep Customer Personal Data where the law requires it, and keep a minimal record of each opt-out (a one-way hashed phone number and the date) so that it keeps being honored. Anything we keep stays protected by this DPA for as long as we hold it.

11.3 On request, we will confirm the deletion in writing.

12. Audits and information

12.1 We will make available to you the information reasonably necessary to show that we comply with this DPA. This includes answering a reasonable written security questionnaire once a year, and sharing any independent security reports or certifications we hold.

12.2 If those materials are not enough to meet a requirement of Data Protection Law or of a regulator, or after a Security Incident affecting your data, you may audit our compliance with this DPA through an independent auditor bound by confidentiality, on at least 30 days’ written notice, during business hours, no more than once in any 12 months (unless a regulator requires more), at your cost, and in a way that does not disrupt our operations or put other clients’ data at risk.

12.3 You may take reasonable and appropriate steps to make sure we use Customer Personal Data in a way consistent with your obligations under Data Protection Law. If you reasonably believe we are using it without authorization, you may, after notifying us, take reasonable and appropriate steps to stop and remedy that use.

13. US state privacy law terms (CCPA and others)

13.1 We process Customer Personal Data as your service provider, only for the limited and specified business purposes described in Annex 1, which are to provide, secure, support and maintain the Service for you.

13.2 We will not:

• (a) sell or share Customer Personal Data;
• (b) retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes in Annex 1, or as the CCPA otherwise permits a service provider to do;
• (c) retain, use or disclose it outside our direct business relationship with you;
• (d) combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with the individual, except as the CCPA permits a service provider to do; or
• (e) attempt to re-identify any de-identified data we receive from you, and we will publicly commit to keep such data in de-identified form.

13.3 We will comply with the obligations the CCPA places on service providers, and give Customer Personal Data the level of privacy protection the CCPA requires. We will tell you if we decide we can no longer meet these obligations.

13.4 We engage Subprocessors only under a written contract that binds them to these same requirements, and we notify you of engagements as described in section 8.

13.5 Section 12.3 gives you the rights the CCPA requires to make sure we use Customer Personal Data appropriately, and to stop and remedy unauthorized use.

13.6 Where other US state privacy laws apply, we will also: keep Customer Personal Data confidential (section 6); delete or return it at the end of the Agreement (section 11); give you the information you need to show compliance and allow assessments (section 12); and engage Subprocessors only under written contracts, with notice and an opportunity to object (section 8).

13.7 We certify that we understand the restrictions in this section 13 and will comply with them.

14. Liability

Each party’s liability under or in connection with this DPA is subject to the exclusions and limits in section 16 of the Terms. This DPA and the Terms share one cap; this DPA does not create a separate or additional one. Nothing in this DPA limits liability that cannot be limited under Data Protection Law.

15. General

15.1 This DPA is governed by the same law, and disputes go to the same courts, as the Terms (section 20 of the Terms).

15.2 We may update this DPA under section 19 of the Terms. An update will not reduce the protection of Customer Personal Data unless the law requires it.

15.3 Questions about this DPA: privacy@bubblesms.com.

Annex 1: Details of the processing

Annex 2: Security measures

Access and people

• Access to production systems and Customer Personal Data is limited to authorized staff who need it, with permissions set per person.
• Staff sign in with one-time codes; staff sessions expire after 12 hours.
• Staff are bound by confidentiality duties and trained on handling personal data.
• Access to sensitive records, such as partner bank details, is logged on every view.

Encryption and secrets

• All traffic is encrypted in transit with TLS.
• Data is encrypted at rest by our hosting providers.
• Store access tokens and bank details are additionally encrypted in our application with AES-256-GCM, using keys held outside the database and rotated as needed.
• Session tokens are stored only as hashes.

Application controls

• Every webhook from Shopify and from our messaging providers is verified by signature; duplicate and out-of-order events are handled safely.
• A consent check runs before every message. Opt-outs take effect immediately, and quiet hours are enforced in the recipient’s time zone.
• The store permissions we request are the minimum the Service needs.
• Shopify’s data erasure and data request webhooks are processed automatically.
• Logs and error reports are scrubbed of message content, personal data, secrets and cookies.
• Referral click records keep a salted hash of the IP address, never the address itself.
• A safety switch limits test environments to sending only to approved test numbers.

Resilience and monitoring

• Databases are backed up regularly, and backups are overwritten on a rolling basis within 35 days.
• Errors and unusual activity are monitored and alerted on.
• Development, test and production environments are kept separate.

Vendors and incidents

• Subprocessors are assessed before use and bound by written data protection terms.
• We follow a documented process for handling Security Incidents, including notifying clients (section 9).

Annex 3: Subprocessor categories

The current categories, with their purpose, the data they handle and where they process it, are listed on our Subprocessors page: messaging platforms and carriers; AI model providers; cloud hosting and database; payments processing; email delivery; error monitoring; network security and DNS; and the e-commerce platform and apps you connect.