Data processing terms

• Controller: the merchant who opened the store and accepted the terms of service.

• Processor: Devya Solutions, Cairo, Egypt; contact hello@devya.dev.

The merchant accepts these terms with the terms of service: at signup, and again when they change. Devya’s own processing as a controller — merchant and staff accounts, billing, this website — is covered by our privacy policy, not by these terms.

• Subject matter and duration: hosting and running the merchant’s store for as long as it uses Moving Stores, and until its data is deleted or returned at the end (see “End of the service”).

• Nature and purpose: storing, showing and organising the store’s data; taking, processing and tracking its orders, payments, deliveries, returns and messages; sending its emails; passing data to the services the merchant connects; keeping it secure and backed up.

• Data subjects: the store’s customers and visitors, people who contact the store or subscribe to its newsletter, and couriers whose details are attached to a delivery.

• Personal data: names, email addresses, phone numbers, delivery and pickup addresses; account details (passwords only as one-way hashes); orders and their payment status; returns, reviews and their photos, payment receipts the customer uploads; contact messages; marketing choices; the IP address and browser type of an order, a sign-in or a contact message; cookie consent receipts; and the random visit id of the store’s own visit counter. No special categories of data are expected, and the merchant must not ask for them.

Devya processes the store’s personal data only on the merchant’s documented instructions: these terms, the terms of service, and what the merchant sets and does in the back office — its settings, the services it connects, its exports and its erasures. Devya tells the merchant at once if it believes an instruction breaks data protection law. If a law requires Devya to process the data otherwise, Devya tells the merchant before it does, unless that law forbids it.

Only people who need it to run, support or secure the service can reach a store’s data, and each of them is bound to confidentiality. Devya staff open a store’s back office only when the merchant asks for support: the access lasts at most 60 minutes, its reason is recorded, and every change made during it is logged.

Devya keeps the measures required by GDPR Art. 32 in place and improves them over time, including:

• encryption of every connection (HTTPS);

• each store can reach only its own data, enforced in the code and checked automatically on every change to it;

• passwords stored only as one-way hashes, and payment and courier keys encrypted;

• back office access by role, as the merchant sets it, and sessions that can be revoked at once;

• limits on repeated attempts, temporary lockouts, and IP addresses shortened in logs;

• a log of important actions in every store;

• daily backups, kept for 14 days and copied to a separate server.

The merchant gives Devya a general authorisation to use the sub-processors on our sub-processor list. Devya binds each of them by contract to data protection obligations at least as protective as these terms, and remains responsible to the merchant for them.

Before it adds or replaces a sub-processor, Devya updates the list and its date at least 14 days in advance and tells merchants in the back office or by email. A merchant may object on reasonable data protection grounds within that time; if no solution is found, the merchant may close its store before the change applies.

The services a merchant chooses to connect to its store — such as Paymob, Bosta, Google Analytics, the Meta Pixel or its own webhooks — are not Devya’s sub-processors: they work under the merchant’s own agreement with them, and Devya passes them data on the merchant’s instruction.

• Requests from customers: the back office lets the merchant find, export (as a file) and anonymise a customer’s data, and customers can delete their own account in the store. If a customer writes to Devya, Devya passes the request on to the merchant and does not answer it itself, unless the merchant asks it to.

• Security, impact assessments and authorities: Devya gives the merchant the information about the service it reasonably needs for its own security obligations, data protection impact assessments and any prior consultation with a supervisory authority.

If Devya becomes aware of a breach affecting a store’s personal data, it tells the merchant without undue delay, and aims to do so within 24 hours. The notice says, as far as is known: what happened; the kinds and approximate number of people and records concerned; the likely consequences; what Devya has done and proposes to do; and whom to contact. Devya adds what it learns later. The merchant, as controller, decides whether to notify the supervisory authority and its customers, and Devya helps it to do so.

The store’s data is hosted in Germany, in the European Union. Devya transfers it outside the European Economic Area only to a sub-processor on the list, with a safeguard the GDPR recognises (Art. 44–46). Today every sub-processor on the list is in the European Union, so nothing is transferred outside it; a sub-processor elsewhere would be added only with its safeguard named on the list. The services the merchant connects receive data where they operate, under the merchant’s own agreement with them.

Before closing a store, the merchant can export its data from the back office: products, orders and customers as files, and each customer’s data as a file. At the merchant’s choice, Devya returns the data instead: those exports are the return, and anything they do not cover Devya provides on request in a common machine-readable format.

After a store is closed, Devya deletes or anonymises its personal data within one month of the merchant’s request, unless the law requires Devya to keep some of it, and then only for that purpose. Backups holding it, on the platform’s server and on the separate backup server, are deleted in rotation within 14 days after that.

Devya makes available to the merchant the information needed to show that it meets these terms: these terms, the sub-processor list and, on request, a description of its security measures. Devya allows audits, including inspections, by the merchant or an auditor it mandates who is bound to confidentiality, on 30 days’ written notice, during business hours, at the merchant’s cost and no more than once a year, unless a breach or a supervisory authority requires otherwise. An audit must not give access to other merchants’ data.

To keep the platform secure for every store, Devya also uses some technical data of store visits as a controller, under its own privacy policy: shortened IP addresses in access logs, and limits on repeated attempts. Devya does not use a store’s customer data for any other purpose of its own, does not sell it and does not use it for advertising.

Questions about these terms: hello@devya.dev.