Data processing agreement (GDPR article 28)
This English version is a translation provided for information; in the event of any discrepancy, the French version prevails.
The shop is the controller of its customers’ data; Bike Shop Network (Benoît Morin, sole trader, see the legal notice) is the processor. This agreement is part of the subscription terms: it is accepted with them, by ticking a box when the shop is created and before the first payment, and applies for the whole term of the subscription.
1. Subject matter, nature, purpose and duration
- Subject matter and purpose: providing the service the shop subscribes to: website, bookings and appointments, workshop, counter, loyalty and gift cards, customer app, messages (emails, texts, notifications), AI assistant and agents, analytics, hiring.
- Nature of the processing: hosting, recording, consulting, updating, sending messages, calculations (points, follow-ups, statistics), export and erasure.
- Duration: the term of the subscription, plus the export and deletion period in section 10.
- Data subjects: the shop’s customers and prospects, visitors of its website and app, applicants to its job postings, its team members.
- Categories of data: identity and contact details, bikes and workshop history, bookings, purchases, quotes and invoices, loyalty and gift cards, messages exchanged and conversations with the assistant, consents and unsubscribes (register of proof: method, text shown, staff member who recorded it, address or number), job applications, team schedules and time records, sign-in data. The service asks for no sensitive data (health, opinions…): the shop and its customers must not enter any.
2. The shop’s instructions
Bike Shop Network processes the data only on the shop’s documented instructions: these terms, the settings it chooses in the back office and its written requests. If an instruction seems to us to infringe the GDPR or another data protection rule, we inform the shop immediately. We do not process this data for our own purposes (in particular not for our prospecting), unless the law requires it, in which case we inform the shop before processing where the law allows.
Rules for sending offers, which the shop accepts as instructions:
- Proof of consent: each consent or withdrawal is written to a register that can’t be changed or deleted, kept for 5 years after consent is withdrawn or the customer record is deleted.
- Double opt-in: a sign-up made on the shop’s website only counts once the link sent to the address or number entered is clicked (token kept hashed, valid for 7 days; request deleted after 30 days).
- Frequency and timing: 2 offers a month at most per customer and per channel (shops in the European Union, the United Kingdom and Switzerland); marketing texts only at permitted times; in the United States and Canada, written consent, a registered or verified number, and the required wording.
- Shared do-not-send list: a STOP, a hard bounce or a spam report received for an address or number applies to every shop on the platform, since they send through the same providers; consent to offers is then withdrawn in the customer’s record at every shop that wrote to them in the last 13 months. Bike Shop Network keeps this list (address or number, reason, provider, date) on its own behalf; no shop can view it.
3. Confidentiality
The people authorized to process the data (Benoît Morin and, where applicable, members of the support team) are bound by confidentiality through a written commitment or a legal obligation. The support team only has read access to a shop’s data, to answer a request from the shop or fix an incident.
4. Security (article 32)
Encrypted connections (HTTPS), isolation between shops enforced by the database (row-level security), access based on each team member’s role, passwords and PIN codes never stored in plain text, backups, security updates, bot protection for forms, confirmation links kept only as a fingerprint, sending caps per number and per shop against fraud, retention periods applied automatically.
5. Sub-processors
The shop gives general authorization to the sub-processors below. Bike Shop Network imposes on them by contract data protection obligations at least equivalent to those of this agreement, and remains liable to the shop for their performance.
| Sub-processor | Role | Country | Safeguards |
|---|---|---|---|
| Supabase | Database, sign-in | European Union (Europe region) | Data processing agreement, standard clauses |
| Vercel | Hosting of the websites and apps | United States | Data processing agreement, Data Privacy Framework |
| Cloudflare | DNS, network, bot protection | United States | Data processing agreement, Data Privacy Framework |
| Resend | Sending emails | United States | Data processing agreement, standard clauses |
| Brevo or Twilio | Sending text messages, depending on the provider in use | France (Brevo); United States (Twilio) | Data processing agreement; Data Privacy Framework (Twilio) |
| Anthropic | Website AI assistant, AI agents, suggested texts (messages deleted within 30 days, never used to train its models) | United States | Data processing terms in its commercial terms, standard clauses |
Customer app notifications go, encrypted, through the notification service of the customer’s browser (Google, Apple or Mozilla), only if the customer turned them on.
Any new or replacement sub-processor is announced to the shop by email 30 days in advance. During that time, the shop may object in writing on data protection grounds; if no solution is found, it may cancel its subscription at no cost, and the part paid in advance for the remaining period is refunded.
6. Transfers outside the European Union
When a sub-processor processes data outside the European Union, the transfer is covered by the EU–U.S. Data Privacy Framework when it is certified, otherwise by the European Commission’s standard contractual clauses.
7. Data subjects’ rights
The back office lets the shop answer requests itself: view, correct, export (CSV, JSON) or delete a record, manage consents and unsubscribes. If someone writes to us directly, we pass the request on to the shop without delay and don’t answer it in the shop’s place unless instructed to. We help the shop, as far as possible, to answer on time.
8. Personal data breaches
We notify the shop without undue delay, and no later than 48 hours after becoming aware of it, of any personal data breach affecting it: nature of the breach, categories and approximate number of people and records concerned, likely consequences, measures taken or proposed, contact person. The shop decides on notifying the supervisory authority and the people concerned; we help it prepare the notification.
9. Assistance to the shop
We help the shop meet its obligations on security (article 32), breach notification (articles 33 and 34), data protection impact assessments and prior consultation (articles 35 and 36), by giving it the information we have.
10. End of the contract: return, then deletion
When the subscription ends, the shop chooses: get its data back (full, free export, section 5 of the terms, for 30 days), then ask for it to be deleted, or ask for immediate deletion. We delete it within 30 days of the request, backups included. We only keep a copy where the law requires it (invoices we issued to the shop). The shared do-not-send list (section 2) isn’t the shop’s data: it is kept so that refusals continue to be honored.
11. Audits and inspections
We make available to the shop all the information needed to demonstrate compliance with article 28: description of the security measures, up-to-date list of sub-processors, agreements signed with them, certifications and audit reports of our hosting providers. The shop, or an independent auditor bound by confidentiality that it appoints, may carry out an audit, including an inspection, once a year or after a data breach, with 30 days’ written notice. The audit must not give access to other shops’ data or put the security of the service at risk. Each party bears its own costs.
12. The shop’s commitments
The shop collects its customers’ data lawfully, informs them (legal pages of its website: templates provided, to be checked) and obtains their consent where required (offers by email or text, advertising cookies). When it records a consent, it states how the consent was actually given; for marketing texts to the United States or Canada, it obtains written consent and declares its registered (10DLC) or verified number. It gives each team member the role that matches their job.
13. Contact
privacy@bikeshop-network.com · Version of October 26, 2026.