This addendum supplements the Terms of Service and applies when Start Bigger LLC (the "Processor") processes personal data on behalf of a store owner (the "Controller") in providing the service.
1. Roles
The store owner is the controller of their store's customer data (accounts, orders, contact and delivery details). Tokanza is the processor. Tokanza remains the controller of the store owner's own account data under the Privacy Policy.
2. Subject matter and duration
Hosting the store, storing its data, running orders and messages, and backing them up, for the subscription term and until deletion under clause 8. Data types: customer identifiers, order and wallet data, technical logs. Data subjects: the store's customers and visitors.
3. Instructions
We process data only on your documented instructions, including this addendum and your use of platform features, and for security and legal compliance. We will tell you if we believe an instruction breaks the law.
4. Confidentiality
Personnel authorised to access the data are bound by confidentiality.
5. Sub-processors
You authorise the use of sub-processors to provide the service (such as the hosting and email providers). The current list is in the Privacy Policy. We impose equivalent data-protection obligations on them, notify you of any material addition, and you may object on reasonable grounds. We remain responsible for our sub-processors' performance.
6. Security measures
- Password hashing with scrypt.
- Separate database per store, isolated from others.
- HTTPS requirement and protected session cookies.
- Rate limiting on sign-in and public endpoints.
- Periodic backups.
- Restricted staff access and logging of administrative actions.
7. Breach notification
We will notify you without undue delay, normally within 72 hours of becoming aware of a breach affecting personal data we process on your behalf, with the information available on its nature, impact and our response, so you can meet your obligations.
8. Deletion and return
When the service ends we let you export your data for a limited time, then delete or anonymise it within a reasonable period; backups remain until their cycle expires, unless the law requires retention.
9. Assisting with data-subject rights
We help you with reasonable technical means to respond to your customers' requests (access, correction, deletion, portability). If we receive a request directly from one of your customers we will refer it to you.
10. Audit
We provide the information reasonably necessary to show compliance. You may request a review by writing to us once a year with reasonable notice and without disrupting the service or exposing other customers' data.
11. International transfers
Data may be transferred outside your country to our sub-processors; where required we rely on standard contractual clauses or other appropriate safeguards.
12. Your responsibilities as controller
You are responsible for the lawfulness of your data collection, for privacy notices and consents to your customers, and for the correctness of your instructions.
13. Contact
support@tokanza.com — Start Bigger LLC, 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, USA.