Data processing terms

1. Scope

These data processing terms are part of the agreement between the merchant who installs LÚMÉA Books ("the merchant", the controller) and LÚMÉA Apps ("we", the processor). They apply to personal data we process on the merchant's behalf to provide the app, as required by Article 28 of the GDPR and similar laws, and are accepted together with the terms of service.

2. The processing

• Subject and purpose: recording the store's sales, refunds, payments and payouts in the merchant's QuickBooks Online company, and creating accounts there when the merchant clicks a "Create" button, as described in the privacy policy.
• Duration: while the app is installed, then until deletion as set out below.
• People concerned: the merchant's staff using the app, and the merchant and accountant contacts entered in the settings. The app does not request the store's customers' names, addresses, emails or phone numbers.
• Data: staff names and emails (as provided by Shopify), notification and accountant email addresses, order numbers and amounts. No special categories of data.

3. Our commitments

• We process the data only on the merchant's documented instructions, which are the app's settings and these terms, unless the law requires otherwise.
• Everyone who can access the data is bound by confidentiality.
• We apply appropriate security measures, including encrypted connections, AES-256 encryption of access tokens at rest with a separately kept key, restricted access and regular backups.
• We help the merchant answer requests from people exercising their rights, and with security and data protection obligations.
• We inform the merchant without undue delay after becoming aware of a personal data breach affecting their data.
• At the end of the service (uninstall), we delete the data as set out in the privacy policy, unless the law requires us to keep it.
• We make available the information needed to show compliance with these terms, and answer reasonable written questions from the merchant.

4. Sub-processors

The merchant authorizes the following sub-processors. We will announce any new sub-processor in advance (on this page and in the app) so the merchant can object by uninstalling the app.

• Hetzner Online GmbH (Germany, EU): hosting and database.
• Brevo / Sendinblue SAS (France, EU): email delivery.

Intuit (QuickBooks Online) acts for the merchant under the merchant's own agreement with Intuit, not as our sub-processor.

5. Location of data

Data is processed and stored in the European Union. Data written to QuickBooks is held by Intuit under the merchant's own agreement with Intuit.

6. Liability

The limits of liability in the terms of service apply to these data processing terms, to the extent the law allows.