Xupro Terms of Service

These Terms are the agreement between TRANSYLVANIA MARKETING LTD S.R.L. ("we", "us") and the business that installs one of our Xupro apps in its Shopify store ("you", the merchant). They apply to every Shopify app we publish under the Xupro brand (the "apps"). The apps covered are listed at the top of the Xupro Apps Privacy Policy: https://transylvaniamarketing.com/xupro/privacy.

Please read sections 9 (limitation of liability), 10 (suspension), 11 (term and termination) and 13 (applicable law and courts) with care. They limit our liability, allow us to suspend or end an app, and set the law and the courts that apply. By installing or using an app, you expressly accept these sections together with the rest of these Terms.

1. Who we are

TRANSYLVANIA MARKETING LTD S.R.L., a Romanian company, tax ID (CUI) RO43230933, trade register no. J2020001439320, registered office Str. Crișanei nr. 2, 550012 Sibiu, Romania.

• Support: xupro@xtbs.ro, https://transylvaniamarketing.com/xupro/support
• Privacy and legal matters: contact@transilvaniamarketing.ro

These Terms do not apply to the Transilvania Marketing PPC app, which our agency clients use under their services agreement with us.

2. Accepting these Terms

2.1. These Terms are linked from each app's listing in the Shopify App Store and from the install screen. You accept them when you install an app or when you use it.

2.2. The apps are for businesses. By installing an app you confirm that you use it for your business, that you are allowed to install apps in the store, and that you may accept these Terms for the business that owns the store.

2.3. Your agreement with Shopify continues to apply between you and Shopify. We are not Shopify, and Shopify is not a party to these Terms.

3. The apps and Shopify

3.1. Each app does what its App Store listing and its admin screen describe at the time you use it.

3.2. The apps work through the Shopify platform and its interfaces. When Shopify changes them, we may have to change or limit a feature.

3.3. We may improve, change or remove features. If a change removes a main feature of an app you use, or adds new categories of personal data, we tell you in the app's admin screen before it takes effect.

3.4. We do not guarantee that an app will always be available or free of errors, and we do not offer a service level agreement. We fix the problems reported to us as soon as we reasonably can.

4. Price

4.1. The apps are free today.

4.2. We may introduce paid plans. Any charge is billed by Shopify, through Shopify's billing system, and only after you approve it in Shopify. The price and what it includes are shown to you before you approve. Nothing is charged without your approval.

4.3. If we introduce a paid plan for an app you already use, we tell you in the app's admin screen before any charge applies.

5. Your responsibilities

5.1. You use the apps lawfully and in line with Shopify's terms.

5.2. You are the controller of your shoppers' personal data. You decide the legal basis for the processing in your store, you inform your shoppers in your own privacy policy, and you set the consent options of your store. If you connect your pixels or other tools to the events published by an app, configuring them and obtaining the related consent are your responsibility.

5.3. You do not try to access the data of other stores, bypass the security or the limits of an app, send automated or abusive traffic to it, or use it for unlawful content.

5.4. You keep access to your Shopify admin secure, and you tell us promptly if you suspect misuse that affects an app.

6. Support

You can ask for help at xupro@xtbs.ro. We answer as soon as we reasonably can, on Romanian business days. We do not guarantee a response time.

7. Intellectual property and your data

7.1. The apps, their code, design and documentation belong to us or to our licensors. While an app is installed in your store, you have a non-exclusive, non-transferable right to use it in that store.

7.2. Your store data and your shoppers' data remain yours. We use them only to provide the apps, as described in these Terms, in the Privacy Policy and in the data processing agreement (Annex 1).

7.3. If you send us suggestions, we may use them freely, without any obligation to you.

8. Personal data

8.1. The Xupro Apps Privacy Policy explains which personal data each app processes, where, why and for how long.

8.2. Where an app processes personal data on your behalf, the data processing agreement in Annex 1 applies. It is part of these Terms.

9. Limitation of liability

9.1. The apps are provided as they are and as available. To the extent the law allows, we give no warranties other than those written in these Terms. In particular, we do not warrant that an app will increase your sales or suit a particular purpose of yours.

9.2. We are not liable for: (a) loss of profit, revenue, sales, business opportunities or goodwill; (b) damage caused by Shopify, by your theme, by other apps or by your own settings, including the configuration of your pixels; (c) interruptions of Shopify or of our hosting provider that we could not prevent, or force majeure.

9.3. Our total liability to you, for all claims connected with the apps, is limited to the greater of: (a) the amounts you paid us for the apps in the 12 months before the event that caused the damage; and (b) EUR 100.

9.4. Nothing in these Terms excludes or limits liability for damage caused intentionally or by gross negligence, for harm to life, body or health, or any other liability that cannot be excluded or limited by law. This section applies only between you and us. It does not limit the rights of your shoppers.

10. Suspension

10.1. We may suspend an app for your store, fully or partly, without prior notice, when this is needed to: (a) protect the security of the app, of other stores or of shoppers; (b) stop a use that breaches section 5 or that creates abnormal traffic or costs; (c) comply with the law, with a request from an authority or with Shopify's rules.

10.2. We may also stop an app temporarily for all stores, when our monitoring detects abnormal traffic or costs, until the cause is removed.

10.3. We tell you as soon as we reasonably can, and we resume the app when the cause no longer exists.

11. Term and termination

11.1. These Terms apply to each app from the moment you install it until you uninstall it.

11.2. You may end these Terms for an app at any time, without notice and without cost, by uninstalling it. Charges you have already approved are governed by Shopify's billing rules.

11.3. We may stop offering an app, or end these Terms for your store, with at least 30 days' notice in the app's admin screen. We may end them with immediate effect if you seriously breach section 5, or if Shopify or the law requires it.

11.4. After termination, we delete the data as described in the Privacy Policy and in Annex 1. Sections 7.2, 9, 13 and 14, and Annex 1 for as long as we still hold personal data for you, continue to apply.

12. Changes to these Terms

12.1. We may change these Terms. We publish the new version on this page, with a new date.

12.2. If a change reduces your rights or adds obligations for you, we tell you in the app's admin screen before it takes effect. If you do not agree, you can uninstall the app before that date. If you keep using the app after the change takes effect, you accept the new version.

13. Applicable law and courts

13.1. These Terms are governed by Romanian law.

13.2. If a dispute arises, write to us first at contact@transilvaniamarketing.ro, and we will try to settle it amicably.

13.3. If the dispute is not settled within 30 days of your message, it will be decided by the competent courts of Sibiu, Romania.

14. Final provisions

14.1. These Terms, including Annex 1, and the Privacy Policy are the whole agreement between you and us about the apps. For the processing of personal data, Annex 1 prevails over the rest of these Terms.

14.2. If a provision of these Terms is invalid, the rest remains in force, and the invalid provision is replaced by a valid one as close as possible to its purpose.

14.3. We may transfer these Terms to a company that takes over an app from us. We tell you in the app's admin screen beforehand; if you do not agree, you can uninstall the app.

14.4. We send you notices in the app's admin screen. Where we have an email address for you, we may also use it. You send notices to us at the addresses in section 1.

14.5. These Terms are published in English and in Romanian. The English version is the one linked at installation. If the two versions differ, the English version prevails.

Annex 1. Data processing agreement (Article 28 GDPR)

This Annex is the agreement required by Article 28(3) of Regulation (EU) 2016/679 ("GDPR") between you, as controller, and us, as processor. Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meaning they have in GDPR.

1. Scope

1.1. This Annex applies whenever an app processes personal data on your behalf, in particular the personal data of your shoppers and customers, in your store or on another sales channel you connect to an app.

1.2. It takes effect when you install an app and applies for as long as we process personal data for you through that app.

1.3. It does not cover the data we process as controller (store connection data, messages you send us), which are described in Part A of the Privacy Policy.

2. Details of the processing

2.1. For each app, the part of the Privacy Policy dedicated to that app (for Xupro Wishlist, Part B) sets out the subject matter, the nature and purpose of the processing, the types of personal data, the categories of data subjects, the place of processing, the sub-processors and the retention periods. That part is incorporated into this Annex.

2.2. Duration: while the app is installed in your store and until the data is deleted as described in clause 11.

3. Your instructions

3.1. Installing an app, configuring it and using its settings are your documented instructions. You may give further instructions in writing, to contact@transilvaniamarketing.ro. If an instruction cannot be carried out with the app as it is, we tell you; you can then uninstall the app.

3.2. We process the personal data only on your documented instructions, including with regard to transfers to third countries, unless Romanian or EU law requires otherwise. In that case we inform you of the legal requirement before the processing, unless that law forbids it on important grounds of public interest.

3.3. We inform you immediately if, in our opinion, an instruction infringes GDPR or other EU or Romanian data protection rules.

4. Confidentiality

We ensure that the persons we authorise to process the personal data have committed themselves to confidentiality or are under an appropriate legal obligation of confidentiality.

5. Security

We take the measures required by Article 32 GDPR. They are described in section A6 of the Privacy Policy and in the part of each app. We may change them, as long as the level of protection does not decrease.

6. Sub-processors

6.1. You give us a general written authorisation to engage sub-processors. The sub-processors of each app are named in that app's part of the Privacy Policy.

6.2. We impose on each sub-processor, by contract, data protection obligations that meet the requirements of Article 28 GDPR. We remain fully liable to you for the performance of a sub-processor's data protection obligations.

6.3. Before we add or replace a sub-processor for an app you use, we tell you in the app's admin screen and update the Privacy Policy. You may object in writing, with reasons, before the change takes effect. If we cannot address your objection, you may end these Terms for that app by uninstalling it.

6.4. Shopify, the platform you chose for your store, is not our sub-processor. Neither are other platforms you connect to an app, such as a marketplace: they receive data on your instructions, under their own terms with you.

7. Transfers outside the European Economic Area

You authorise the transfers described in each app's part of the Privacy Policy. We transfer personal data outside the European Economic Area only on the basis of Chapter V of GDPR, such as the EU Standard Contractual Clauses incorporated in our contract with the sub-processor or an adequacy decision of the European Commission.

8. Requests from data subjects

8.1. Taking into account the nature of the processing, we help you respond to requests from data subjects. Shopify forwards your shoppers' requests to us automatically (customers/data_request, customers/redact), and we handle them as described in each app's part, within 30 days of receipt. Requests that do not reach us through Shopify are handled as described in the app's part.

8.2. If a data subject writes to us directly about data we process for you, we forward the request to you and do not answer it ourselves, unless you instruct us to.

9. Other assistance

Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 GDPR: security, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority.

10. Personal data breaches

10.1. We notify you without undue delay after we become aware of a personal data breach affecting personal data we process for you.

10.2. The notification describes, as far as we know at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Where we cannot give all the information at once, we give it in phases, without further undue delay.

10.3. We take reasonable measures to contain the breach and limit its effects, and we document it.

11. End of the processing: deletion or return

11.1. Before you uninstall an app, you can ask us in writing for a copy of the personal data it holds for your store. Where an app's part says that the data is also stored in your Shopify store, you already have that copy.

11.2. After you uninstall an app, we delete the personal data we hold for your store as described in that app's part of the Privacy Policy, unless EU or Romanian law requires us to keep it. Copies kept automatically in a sub-processor's restore history expire as described there.

12. Information and audits

12.1. On request, we make available to you the information needed to show that we comply with this Annex: this Annex, the Privacy Policy, written answers to your questions and the certifications or audit reports of our sub-processors that we can share.

12.2. If this information is not enough, you, or an independent auditor bound by confidentiality whom you appoint, may audit our compliance with this Annex. You give us reasonable advance notice, the audit takes place during business hours and does not give access to the data of other customers, and each party bears its own costs. Unless a personal data breach or a supervisory authority requires otherwise, an audit takes place at most once a year.

12.3. Our sub-processors are audited through their own certifications and audit reports.

13. Your obligations

You make sure that your instructions are lawful, that there is a legal basis for the processing, that your shoppers are informed, and that the personal data you send through the apps was obtained lawfully.

14. Liability and precedence

14.1. Section 9 of these Terms applies to this Annex, to the extent the law allows. It does not limit the rights of data subjects under GDPR.

14.2. For the processing of personal data, this Annex prevails over the rest of these Terms.