Data Processing Terms for Merchants

1. Two different roles

For your own account data — your name, email, store settings, billing — we are the controller and our Privacy Policy applies. For the data your customers give you when they place an order — name, phone number, address — you are the controller and we are your processor. These terms govern the second case.

2. What we do with customer data

We process your customers' data only to provide the service to you: storing and displaying orders, passing delivery details to the carrier you selected, and running the features you have switched on. We act on your instructions, and using the dashboard is how you give them. We do not use your customers' data for our own purposes.

3. Providers we use

We use providers to run parts of the service: hosting and storage, payment processing, the delivery carriers you connect, push notification delivery by your device platform's operator, and error monitoring. We require each of them to protect the data and to use it only for the service they provide us. We will tell you before adding a provider that changes this materially.

4. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control per store, and separation of each merchant's data. Your part is real too: use a strong password, do not share logins, and remove team members who no longer need access.

5. If something goes wrong

If we become aware of a breach affecting your customers' data we will tell you without undue delay and give you what you need to meet your own notification obligations.

6. Deletion and return

You can export your order data from the dashboard at any time. When your account is deleted we delete your customers' data with it, on the timetable in our Data Deletion page, except for what we must keep by law.

7. Your obligations

You must have a lawful basis for collecting your customers' data, tell them what you do with it, and honour their requests about it. If a customer asks us directly we will refer them to you, and help you respond.

8. International processing

As stated in our Privacy Policy, we operate from the United States and process data outside the country where it is collected. By using Zimam to process your customers' data you instruct us to do so.