Data processing agreement
Last updated 7 October 2026
This agreement is between the retailer using Hephon Commerce (the "controller") and Hephon (the "processor"). It is part of the terms of service and applies whenever we process personal data for you.
1. Subject and duration
We process shopper personal data to run the shopping assistant for you, for as long as you use the service and until the data is deleted under section 8.
2. Data and people
- People: your shoppers who talk to the assistant, and your staff who use the admin.
- Data: messages and transcripts, basket and order activity, the shopper identifiers you send us, IP address and browser data, preferences the shopper agreed to have remembered.
- No special categories are requested. Shoppers may still mention health or dietary needs in a message; that text is processed only to answer them.
3. Our obligations
We will:
- process the data only on your documented instructions, which are these terms, your configuration of the service and your written requests;
- make sure everyone who can access the data is bound to confidentiality;
- apply the security measures in section 6;
- help you answer shoppers who exercise their rights, and with security and impact assessments where the law requires;
- tell you without undue delay, and within 48 hours where we can, after we become aware of a personal data breach affecting your data;
- not use your shoppers' data to train AI models, for advertising, or for any other customer.
4. Your obligations
You have a lawful basis for the processing, tell your shoppers about the assistant in your privacy notice, and only send us the data the service needs.
5. Subprocessors
You authorise the subprocessors listed on the subprocessors page. We give 30 days' notice of a new subprocessor by email to your admins; you may object on reasonable data protection grounds, and if we cannot resolve it you may end the affected service. Each subprocessor is bound to data protection terms at least as protective as these.
6. Security
- Encryption in transit (TLS) and of secrets and connector credentials at rest.
- Each retailer's data separated by organization in every query, tested on every release.
- Phone numbers and emails in shopper messages masked in stored copies by default.
- Production access limited to named staff, with audit logs of admin actions.
- Backups, monitoring and an incident process.
7. Transfers
Where data leaves the country it was collected in, we rely on the transfer safeguards each subprocessor offers, such as the EU standard contractual clauses.
8. Retention and deletion
- Conversations are deleted after the retention period you set (365 days by default).
- A deletion request for a shopper, made in the admin or through the API, is completed within 30 days: conversations, profile, sessions and traces are deleted, and order records keep only what you need for your accounts, without the shopper identifier.
- When the service ends, you can export your data for 30 days; we then delete it, and backups roll over within a further 30 days.
9. Audits
We will make available the information needed to show we meet this agreement, and allow audits by you or an auditor you appoint, on reasonable notice and no more than once a year unless a breach or a regulator requires it.