Data processing agreement
Last updated: on publication
Appendix to the terms of use, entered into under Article 28 GDPR between the customer (“controller”) and RUWAD (“Laier”, “processor”). It applies as soon as the terms of use are accepted. The French version prevails; this English version is provided for information.
1. Subject matter and duration
Laier processes personal data on the customer’s behalf for the sole purpose of providing the Service described in the terms of use. This agreement applies for the whole term of the subscription, then until the data is deleted as set out in section 10.
2. Description of the processing
| Nature | Collection through APIs, storage, aggregation, analysis, generation of recommendations and reports; execution of actions on the customer’s ad accounts upon the customer’s express approval. |
| Purpose | Measuring and managing the customer’s advertising performance, including the margin and advertising return of its sales. |
| Categories of data | Data from connected advertising and analytics accounts (campaigns, aggregated audiences, conversions); data from connected Shopify stores: orders, line items, amounts, products, inventory, discounts, payouts, and the Shopify customer ID attached to an order. Laier does not request the name, email address, phone number or postal address of the customer’s own customers. |
| Data subjects | Customers, prospects and visitors of the customer’s websites and stores; users of the connected accounts. |
| Sensitive data | No special category of data within the meaning of Article 9 GDPR. |
3. Customer instructions
Laier only processes the data on the customer’s documented instructions, namely the terms of use, this agreement and the customer’s use of the Service. Laier informs the customer if an instruction appears to infringe the GDPR. The data is never sold, never used for Laier’s own advertising purposes, and never used to train artificial intelligence models.
4. Confidentiality
Persons authorised to access the data are bound by confidentiality and only access it as needed to provide the Service or the support requested by the customer.
5. Security
- Encryption of data in transit (TLS) and at rest, at the storage level of the hosting provider.
- Platform access tokens kept outside the application database, in a dedicated vault; never any password to the customer’s platforms.
- Per-customer isolation: every read carries the customer’s workspace, checked before use.
- Access to production systems restricted to the people who need it; encrypted backups.
- Cryptographic verification of every notification received from connected platforms.
6. Sub-processors
The customer authorises Laier to engage the sub-processors below. Laier imposes on them data protection obligations at least equivalent to those of this agreement and informs the customer, on this page, of any addition or replacement at least 30 days in advance; the customer may object by terminating its subscription.
| Sub-processor | Service | Data location | Safeguards |
|---|---|---|---|
| Railway Corporation | Hosting of the platform and its databases | European Union (Netherlands) | Standard contractual clauses |
| Cloudflare, Inc. | Object storage (backups, files), website delivery | European Union for storage | Standard contractual clauses, EU-US Data Privacy Framework |
| Scaleway SAS | Artificial intelligence models | France | — |
| OpenAI, L.L.C. | Artificial intelligence models | United States | Standard contractual clauses, EU-US Data Privacy Framework |
| Anthropic, PBC | Artificial intelligence models | United States | Standard contractual clauses |
| Langfuse GmbH | Monitoring of model calls | European Union (Germany) | — |
| Functional Software, Inc. (Sentry) | Application error tracking | European Union (Germany) | Standard contractual clauses |
| Resend, Inc. | Transactional email delivery | European Union (Ireland) | Standard contractual clauses |
7. Transfers outside the European Union
The data is hosted in the European Union. Where a sub-processor processes it outside the Union, the transfer is governed by the European Commission’s standard contractual clauses or by an adequacy decision, including the EU-US Data Privacy Framework.
8. Data subject rights and assistance
Laier helps the customer answer data subject requests. Requests sent by Shopify are handled automatically: an erasure request for a store customer is carried out within 30 days; an access request is recorded and the data held is provided to the customer within 30 days; when the app is uninstalled, all of the store’s data is deleted upon Shopify’s erasure request. Laier also assists the customer with impact assessments and prior consultation of the supervisory authority.
9. Personal data breach
Laier notifies the customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the available information on its nature, the data concerned and the measures taken.
10. End of processing
At the end of the subscription, or when a source is disconnected, Laier deletes the data concerned within 30 days, save for statutory retention obligations. The customer may request an export before deletion at hello@laier.io.
11. Audit
Laier makes available to the customer the information needed to demonstrate compliance with this agreement and allows, on reasonable notice and no more than once a year, audits by the customer or an auditor it appoints, bound by confidentiality.
12. Contact
hello@laier.io · RUWAD, 60 rue François Ier, 75008 Paris, France.