Data Processing Agreement

1. Parties and conclusion

The controller is the Merchant — the owner of the Shopify store in which the Akademia application (the “App”) is installed.

The processor is Rafał Konieczny, ul. Krzycka 6c/6, 53-020 Wrocław, Poland, tax ID (NIP) 8992557720, EU VAT number PL8992557720, e-mail: support@akademia.studio (the “Operator”).

This agreement is concluded under Art. 28(3) GDPR upon installation of the App and acceptance of the Terms of Service, for the period in which the App is used, and forms part of them. Terms used here have the meaning given to them in the GDPR.

2. Subject matter, nature and purpose of processing

The Operator processes personal data on behalf of the Merchant solely to provide the service described in the Terms of Service: granting and maintaining access to purchased courses, tracking learning progress, handling refunds and data requests, and enforcing service limits. Processing consists of collecting data from Shopify, storing it, using it for these purposes and deleting it.

• Categories of data subjects: store customers who bought a course or were given access to it (Learners).
• Categories of data: customer identifier in Shopify, first name, last name, e-mail address, data on course orders and refunds, course access, learning progress, video playback telemetry.
• Special categories of data (Art. 9 GDPR) are not processed; the Merchant should not place them in materials or fields of the App.

3. Obligations of the Operator

The Operator:

• processes data only on documented instructions from the Merchant; the instructions are the Terms of Service, this agreement and the Merchant’s settings and actions in the App. If, in the Operator’s opinion, an instruction infringes the law, the Operator informs the Merchant without delay;
• gives access to the data only to persons bound by confidentiality;
• applies the security measures described in section 5;
• assists the Merchant in fulfilling data subjects’ rights (section 6) and the obligations under Arts. 32–36 GDPR, taking into account the nature of processing and the information available to it;
• makes available the information necessary to demonstrate compliance with Art. 28 GDPR (section 9).

4. Sub-processors

The Merchant gives general authorisation for the use of the following sub-processors:

• Fly.io, Inc. (USA) — App servers and database in a data centre in Frankfurt (Germany);
• BunnyWay d.o.o. (bunny.net, Slovenia) — storage of video materials in a data centre in Europe and their delivery through a global CDN.

Shopify, which the Merchant uses directly, passes data to the App under the Merchant’s own agreements with Shopify and is not a sub-processor of the Operator.

The Operator imposes on sub-processors data protection obligations no less protective than those in this agreement. The Operator announces any intended addition or replacement of a sub-processor on this page and by e-mail to the store owner’s address at least 14 days in advance. A Merchant who does not agree may, within that period, object or uninstall the App without further charges.

Data is transferred outside the European Economic Area only on the basis of the mechanisms in Chapter V GDPR, in particular standard contractual clauses concluded with the provider.

5. Security measures

• encrypted connections (HTTPS / TLS) between Shopify, the browser and the App servers;
• HMAC SHA256 signature verification of every Shopify webhook;
• database stored on disks encrypted by the infrastructure provider;
• separation of each store’s data — every query is limited to the store it comes from, and each store’s videos are kept in its own collection;
• cryptographically signed, expiring video playback URLs;
• administrative access to the infrastructure limited to the Operator;
• daily database backups with a rotation of no more than 30 days.

6. Data subjects’ rights

The App supports Shopify’s privacy webhooks. An access request (customers/data_request) results in an export of the Learner’s data in the Merchant’s admin; an erasure request (customers/redact) — in the deletion of their data. If a Learner contacts the Operator directly, the Operator forwards the request to the Merchant and does not respond to it on its own, unless the Merchant instructs otherwise.

7. Personal data breach

The Operator notifies the Merchant of a detected personal data breach without undue delay, by e-mail to the store owner’s address. The notification contains the information required by Art. 33(3) GDPR to the extent available; missing information is provided without delay once obtained.

8. Deletion of data after the service ends

After the App is uninstalled, the Operator deletes the store’s and Learners’ data together with the videos after 48 hours, and after the service is suspended because the subscription expired — after the 30 days allowed for resumption or export. Backups expire within a rotation of up to 30 days. Before deletion, the Merchant can download a data export from the App admin. The Operator keeps for longer only minimal proof that the deletion was carried out (without content or e-mail addresses) and data it is required by law to retain.

9. Information and audits

At the Merchant’s request, the Operator provides the information necessary to demonstrate compliance with this agreement. An audit or inspection is possible after agreeing the date and scope in advance, no more than once a year (unless required by a supervisory authority or following a breach), at the Merchant’s expense and while preserving the confidentiality of other stores’ data.

10. Final provisions

This agreement remains in force for as long as the App is used and until the deletion described in section 8 is completed. Matters not covered here are governed by the GDPR and Polish law. The Operator announces changes to this agreement on this page, with a new date and version.

Information on processing by the Operator as a controller is provided in the Privacy Policy.