Privacy policy and data processing agreement

This document explains how Refitto processes personal data in accordance with the GDPR (EU Regulation 2016/679) of the European Parliament and of the Council of 27 April 2016 (in Spanish, the “RGPD”; hereinafter, the “GDPR”), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales; hereinafter, “LOPDGDD”). It is made up of two parts: Part I, in which Refitto acts as data controller, and Part II, which constitutes the data processing agreement under article 28 of the GDPR. Terms defined in the Terms and conditions have the same meaning here.

Allocation of roles

Part I. Refitto as data controller

1. Identity of the controller

The owner of the service operating under the trade name Refitto, whose identifying details (name, tax identification number (NIF) and address) are set out in the Legal notice. Contact email address for data protection matters: legal@refitto.com.

2. Data processed

• Identification and contact: first name, surname(s), email address and, where applicable, telephone.
• Company data: registered company name, tax identification number, address and connected shop.
• Account data: user identifier, sessions, access logs and preferences.
• Subscription data: Plan, status, dates, and shop and subscription identifiers in Shopify. Refitto does not receive full card details or details of other payment methods.
• Communications with support.

3. Purposes and legal bases

The contact details of persons who provide services within legal persons are processed under article 19 of the LOPDGDD.

4. Retention periods

Data will be retained for as long as the contractual relationship continues and, after it ends, duly blocked in accordance with article 32 of the LOPDGDD for the limitation periods of any actions that may arise, in particular five years under article 1964 of the Spanish Civil Code (Código Civil), four years under Spanish Law 58/2003 of 17 December, the General Tax Law (Ley 58/2003, de 17 de diciembre, General Tributaria), and six years under article 30 of the Spanish Commercial Code (Código de Comercio) for commercial records. Once these periods have elapsed, the data will be deleted.

5. Recipients

Data will not be disclosed to third parties except where required by law. The providers listed in section 9 of Part II will have access to it as Refitto’s processors, as well as Clerk, Inc. (authentication of dashboard users) and Vercel Inc. (anonymous visit measurement, see the cookie policy in the Legal notice). Shopify will process the data necessary for collecting payment as an independent controller, in accordance with its own privacy policy.

6. International transfers

Some providers are established in the United States. Transfers are based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, where the provider has signed up to it, or on the standard contractual clauses approved by the European Commission, in accordance with articles 45 and 46 of the GDPR.

7. Rights

You may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, as well as the right not to be subject to automated individual decision-making, by writing to legal@refitto.com and stating the right you are exercising. If you consider that the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD; www.aepd.es).

8. Minors

The Service is aimed exclusively at businesses and professionals. Registration on the platform by persons under eighteen years of age is prohibited, unless they act duly represented by whoever holds their legal representation and with sufficient capacity to bind the company on whose behalf they act. If Refitto detects an account that does not meet this requirement, it may suspend it and delete its data.

Part II. Data processing agreement (article 28 GDPR)

This Part II governs the processing that Refitto (the “Processor”) carries out on behalf of the Customer (the “Controller”) of End Buyers’ personal data. It is deemed accepted by the Customer upon accepting the Terms and conditions and forms an integral part of them.

1. Subject matter, nature and purpose

The Processor will process the data solely to provide the Service: displaying the Portal, verifying the order against the Commerce Platform, recording exchange and return requests and presenting them to the Controller, and generating statistics for the Controller itself. The processing operations comprise collection, recording, storage, consultation, structuring, disclosure to the Controller and erasure.

2. Types of data and categories of data subjects

• Data subjects: the Controller’s End Buyers who use the Portal.
• Data: email address, order number and identifier, products, sizes and variants, amounts, reason for the request, preference for exchange, return or credit, and comments. The Service does not request or retain the End Buyer’s name, address or telephone number.
• No special categories of data are processed. The Controller undertakes not to request or enter this type of data into the Service.

3. Duration

The processing engagement will have the same duration as the Controller’s subscription. When it ends, the provisions of section 11 will apply.

While the engagement is in force, exchange and return requests and the associated data will be retained for a maximum of 36 months from when the Controller resolves them, after which they will be deleted automatically.

4. Obligations of the Controller

The Controller warrants and undertakes to:

1. have a valid legal basis under article 6 of the GDPR, such as performance of the sale contract or compliance with its legal obligations regarding guarantees and withdrawal, to process the data of its End Buyers and to engage Refitto to carry out that processing, and, where the basis is consent, to have validly obtained it;
2. inform End Buyers in accordance with articles 13 and 14 of the GDPR, including the existence of this processing engagement, in its own privacy policy;
3. verify the age and capacity of its End Buyers where necessary, bearing in mind that article 7 of the LOPDGDD sets the age of consent to data processing at fourteen;
4. handle data subjects’ rights requests, with the assistance of the Processor provided for in section 7;
5. give lawful and documented instructions and supervise the processing.

5. Obligations of the Processor

The Processor undertakes to:

1. process the data only on the documented instructions of the Controller, which are understood to be constituted by this agreement and the configuration the Controller sets up in the Service, and to inform it immediately if it considers that an instruction infringes the regulations;
2. not use the data for its own purposes or disclose it to third parties except as provided in section 9 or where required by law;
3. ensure that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;
4. apply the security measures in section 6;
5. keep, where applicable, the record of processing activities carried out on behalf of the Controller in accordance with article 30(2) of the GDPR;
6. make available to the Controller the information necessary to demonstrate compliance with this agreement and allow reasonable audits, with at least thirty days’ prior notice, no more than once a year, at the Controller’s expense and without access to other customers’ data.

6. Security measures

Taking into account the state of the art, the costs and the risks, the Processor applies, among others, the following measures in accordance with article 32 of the GDPR: encryption in transit using TLS; encryption of the Commerce Platform access credentials with AES-256-GCM; isolation of each Customer’s data by means of row-level security policies in the database; access control based on authentication and the principle of least privilege; backups managed by the database provider; and access logging. These measures may be updated provided that they do not reduce the level of protection.

7. Assistance to the Controller

The Processor will assist the Controller, taking into account the nature of the processing, in responding to requests to exercise data subjects’ rights and in complying with the obligations in articles 32 to 36 of the GDPR. If a data subject contacts the Processor directly, it will forward the request to the Controller without delay. Customer data erasure requests that the Commerce Platform sends on behalf of the Controller are executed automatically. When the Commerce Platform sends an access request from an End Buyer, the Processor will provide the Controller, within a maximum of thirty days, with the data it holds on that End Buyer.

8. Security breaches

The Processor will notify the Controller, without undue delay and within a maximum of forty-eight hours of becoming aware of it, of any personal data breach, together with the available information necessary for the Controller to document it and, where applicable, notify it to the supervisory authority and the data subjects.

9. Sub-processors

The Controller gives general authorisation to engage the following sub-processors, with which the Processor has entered into contracts imposing obligations equivalent to those in this agreement:

The Processor will inform the Controller of any addition or replacement of sub-processors at least fifteen days in advance, by email or by updating this page. The Controller may object on reasonable grounds relating to data protection; if no solution is reached, it may cancel the subscription. The Processor will remain fully liable to the Controller for the sub-processors’ compliance.

The Commerce Platform is not a sub-processor of Refitto: it is a provider contracted directly by the Controller, from which Refitto receives the data with the Controller’s authorisation.

10. International transfers

Transfers of data outside the European Economic Area will only take place with the safeguards of Chapter V of the GDPR, as set out in the previous section.

11. Fate of the data on termination

Before the engagement ends, the Controller may request from legal@refitto.com a copy of the requests and the associated data in a structured, commonly used format (CSV), which the Processor will deliver within a maximum of thirty days. Once the service has ended, or when the Commerce Platform sends the shop erasure request after the app has been uninstalled, the Processor will delete the personal data processed on behalf of the Controller within a maximum of thirty days, unless a legal provision requires it to be retained, in which case it will be kept blocked. Backups will be deleted in their ordinary rotation cycle.

12. Liability

Each party will be liable for the breaches attributable to it in accordance with article 82 of the GDPR. If the Processor uses the data for another purpose, discloses it or uses it in breach of this agreement, it will be considered a controller in respect of that processing, in accordance with article 28(10) of the GDPR.

13. Customers subject to other regulations

Where the processing is subject to the United Kingdom General Data Protection Regulation (UK GDPR), references to the GDPR shall be understood to refer also to that regulation. Where the Controller is subject to the California Consumer Privacy Act or another US state privacy law, the Processor will act as a “service provider” or “processor” and undertakes to: (a) not sell or share the personal data; (b) not retain, use or disclose it for any purpose other than providing the Service, or outside the direct relationship with the Controller; (c) not combine it with data from other sources except as permitted by that law; (d) comply with the obligations applicable to it and notify the Controller if it cannot comply with them; and (e) allow the Controller to take reasonable steps to stop and remediate unauthorised use. If the Controller is established outside the European Economic Area, the transfer of data from the Processor to the Controller is based, to the extent necessary, on Module 4 of the standard contractual clauses in Commission Implementing Decision (EU) 2021/914.