Data Processing Addendum

1. Parties and scope#

This Data Processing Addendum ("DPA") is entered into under article 28 of the General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD) between the merchant who holds a NoHold Checkout account, as controller, and Miranda Network, S.L. (CIF B-75866194), as processor. It forms part of the Terms of Service and is accepted at signup. It applies to the personal data of shoppers that we process for the merchant ("Shopper Data"). On data protection matters, this DPA prevails over the Terms.

2. Subject matter, nature, purpose and duration#

• Subject matter and purpose: running the merchant's checkout: collecting the data the shopper enters, sending it to the merchant's Whop account to process the payment, creating the order in the merchant's Shopify store, running order bumps, post-purchase upsells and surveys, syncing shipment tracking to Whop and, if the merchant enables them, sending purchase events to the merchant's Meta, TikTok and Google accounts.
• Nature: collection, recording, storage, consultation, transmission to the recipients above, display in the merchant's dashboard and deletion.
• Duration: while the Terms are in force, plus the deletion period in section 9.

3. Data subjects and categories of data#

• Data subjects: shoppers and visitors of the merchant's checkout pages.
• Data: email, name, shipping address, phone, cart and order details, reference to the payment method saved in Whop (not card numbers), IP address and user agent, survey answers, marketing opt-in, cookie consent choice and, if the merchant enables pixels, advertising identifiers (Meta fbp/fbc, TikTok ttp/ttclid, Google gclid) and landing URL.
• No special categories of data are intended. The merchant must not use surveys or custom fields to collect them.

4. Instructions and confidentiality#

We process Shopper Data only on the merchant's documented instructions, which are the Terms, this DPA and the settings the merchant chooses in the dashboard, unless EU or Spanish law requires otherwise (in that case we will inform the merchant first, unless the law forbids it). We will tell the merchant if we believe an instruction infringes data protection law. Everyone authorised to process Shopper Data is bound by confidentiality.

5. Security measures#

We apply technical and organisational measures appropriate to the risk (art. 32 GDPR), including:

• encryption in transit (HTTPS/TLS);
• Shopify and Whop credentials encrypted at rest (AES-256-GCM) and passwords stored as scrypt hashes;
• hosting in a data centre in the EU (Germany);
• each merchant's data separated logically and accessible only from its own account;
• access to systems limited to authorised personnel, on a need-to-know basis;
• signature verification of incoming webhooks, rate limiting and abuse protection.

6. Sub-processors#

The merchant gives general authorisation for these sub-processors:

Shopify, Whop and, if enabled, Meta, TikTok and Google receive Shopper Data because the merchant connects its own accounts with them; they act under the merchant's own agreements with those providers.

We will notify the merchant by email at least 15 days before adding or replacing a sub-processor. The merchant may object on reasonable data protection grounds within that period; if we cannot address the objection, the merchant may terminate the Terms without penalty. We impose on each sub-processor data protection obligations equivalent to those in this DPA and remain responsible for them.

7. Assistance to the merchant#

• If a shopper sends us a request to exercise their rights, we will forward it to the merchant without undue delay and help the merchant respond, as far as possible, with the dashboard or on request.
• We will help the merchant with security, impact assessments and prior consultations (arts. 32 to 36 GDPR), taking into account the information available to us.

8. Personal data breaches#

We will notify the merchant of a personal data breach affecting Shopper Data without undue delay and in any case within 48 hours of becoming aware of it, with the information available under article 33(3) GDPR (nature of the breach, categories and approximate number of people and records affected, likely consequences and measures taken or proposed), and will keep the merchant updated.

9. Deletion at the end of the service#

When the account is closed, we delete Shopper Data within 30 days, except where EU or Spanish law requires us to keep it. Before closing, the merchant can ask us for a copy at support@mirandanetwork.es. The orders also exist in the merchant's own Shopify and Whop accounts, which we don't control.

10. Information and audits#

We will make available the information needed to demonstrate compliance with this DPA. The merchant may carry out an audit, itself or through an independent auditor bound by confidentiality, on reasonable request with at least 30 days' notice, no more than once a year unless a breach or an authority requires it, at the merchant's cost and without disrupting the service or exposing other merchants' data.

11. International transfers#

Shopper Data is hosted in the EU. Where a sub-processor processes it outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework if the provider is certified, or otherwise on the Standard Contractual Clauses approved by the European Commission, with additional measures where needed.

12. Merchant's obligations#

The merchant is responsible for having a legal basis for the processing, informing shoppers in its privacy policy, obtaining consent for pixels where required (including its cookie banner settings) and giving lawful instructions only.

13. Liability, law and contact#

Liability under this DPA follows the Terms of Service, as far as data protection law allows. This DPA is governed by Spanish law and the courts of Granadilla de Abona (Spain) have jurisdiction. Contact: support@mirandanetwork.es.