Download free

Embed: processor agreement

This text describes how we process personal data for you when you use Designer Embed. In Dutch it is a verwerkersovereenkomst.

This page applies from the moment you use Embed on a website. Please have your own adviser check whether it meets your needs. If you want a signed copy, contact us.

Parties and roles

You (the shop owner who uses Embed) are the controller for the personal data of the people who send an order request through your website. Twilper.com (KvK 98440217), Merelstraat 64, 8916 AX Leeuwarden, the Netherlands, which runs Vinyl Lettering Designer, is the processor and processes that data only to provide Embed to you.

Subject and duration

The subject is receiving, storing and passing on order requests created with the embedded designer. The agreement lasts as long as you use Embed.

Data and data subjects

Data subjects are the customers who send an order request on your website. Categories of data:

  • Name and e-mail address, and optionally a phone number and a message.
  • The design (texts, fonts, colours, sizes) and the production files generated from it.
  • An irreversible hash of the IP address, used only for rate limiting. The IP address itself is not stored with the order.

We do not ask for special categories of personal data. Your customers decide what they type in the message field.

Our obligations

  • We process the data only on your documented instructions, which are your settings in the dashboard and your use of Embed.
  • Persons who can access the data are bound to confidentiality.
  • We help you answer requests from data subjects, for example access or erasure, as far as possible. Orders are removed automatically when the retention period ends; contact us if one must go earlier.
  • We help you with security, breach notification and impact assessments, taking into account the nature of the processing.
  • We give you the information needed to show that we meet these obligations.

Subprocessors

We use these parties for Embed:

  • Railway, Inc. (a US-based cloud platform), which hosts the application, the database and the stored files in its EU region europe-west4 (the Netherlands).
  • Cloudflare, as the network layer in front of the site.
  • Resend, to send the order e-mails.
  • Twilper and Stripe, for payment and licences. They do not receive order data.

If we add or replace a subprocessor that handles order data we update this page and tell the account holders of active licences by e-mail.

Security

  • Traffic is encrypted with HTTPS.
  • Production files are stored outside the public web folder under random names and are only available through signed links that expire after 7 days.
  • The dashboard needs a verified account and checks that an order belongs to your shop.
  • Forms are protected against automated abuse with a rate limit, a hidden field and a form token.

Retention and deletion

Orders and their files are deleted automatically after 180 days. Uploaded files that never became an order are deleted after 24 hours. When your licence ends and you ask us to, we delete your shop settings and the orders that are still stored.

Rights and breaches

If we learn of a personal data breach that affects your data, we tell you without undue delay so that you can meet your own notification duty. You may check our compliance by asking us for information; audits are arranged together and with reasonable notice.

Questions

Write to [email protected]. See also the privacy policy.