Data processing addendum

Last updated: 27 October 2026

1. Scope and parties

This addendum is part of the 7BE terms of service between 7BE Inc., 2055 Limestone Road, Suite 200-C, Wilmington, Delaware 19808, USA ("7BE"), and the business that runs a store on 7BE ("the Merchant"). It applies to the personal data of the Merchant's buyers that the Merchant gives 7BE for verified reviews ("Buyer Data"): orders uploaded in the 7BE cabinet, orders sent by the 7BE plugin for WooCommerce, and fulfilled orders that Shopify sends to the 7BE app.

For Buyer Data the Merchant is the controller (a "business" under US state privacy laws) and 7BE is the processor (a "service provider" or "processor"). The Merchant accepts this addendum when it turns verified reviews on. Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning they have in the GDPR and the UK GDPR.

2. What 7BE processes, and why

Annex 1 sets out the details. In short: the buyer's email address and name, the order number and date, and the products in the order, used only to:

• email the buyer one review request a few days after the order, and one reminder;
• show the buyer the order's store and products on the review page;
• avoid asking the same buyer twice, for which 7BE keeps one-way hashes of the order number and the email address.

3. What 7BE does as processor

• Instructions. 7BE processes Buyer Data only on the Merchant's documented instructions: these terms, this addendum, turning verified reviews on and adding orders. 7BE tells the Merchant if it believes an instruction breaks data protection law, unless the law forbids that.
• Confidentiality. Only people at 7BE who need Buyer Data to run the service can reach it, and each of them is bound to confidentiality.
• Security. 7BE keeps the technical and organisational measures in Annex 2 and may improve them, but never lowers the overall level of protection.
• Subprocessors. The Merchant authorises the subprocessors in Annex 3. 7BE binds each one to data protection terms at least as protective as this addendum and stays responsible for them. 7BE announces a new subprocessor on this page at least 14 days before it starts processing Buyer Data; the Merchant may object by writing to info@7be.io, and if the objection cannot be resolved it may turn verified reviews off, which stops all processing of its Buyer Data.
• Data subjects' rights. Every review request lets the buyer stop all review requests with one click. 7BE passes on to the Merchant any request a buyer sends about the Merchant's orders, and helps the Merchant answer requests for access, correction and deletion; deletion requests that arrive through Shopify are carried out automatically.
• Breaches. 7BE notifies the Merchant of a personal data breach affecting its Buyer Data without undue delay, and within 48 hours of becoming aware of it, with what is known about the nature of the breach, the data and buyers concerned, the likely consequences and the measures taken. 7BE adds details as it learns them.
• Assistance. Taking into account the nature of the processing, 7BE helps the Merchant with security, breach notification, data protection impact assessments and prior consultation where the Merchant needs it.
• Deletion. When the Merchant turns verified reviews off, requests not yet sent are cancelled and their Buyer Data deleted at once. In every case 7BE deletes the buyer's email address and name from a request 120 days after it is sent, and deletes the Merchant's Buyer Data earlier on request, unless the law requires 7BE to keep it.
• Audits. 7BE makes available the information needed to show it meets this addendum. The Merchant may audit 7BE once a year, on 30 days' written notice, during business hours and at its own cost; 7BE may answer an audit with the security reports of its subprocessors where they cover the request.

4. What the Merchant does

• The Merchant has a lawful basis to give Buyer Data to 7BE for review requests, and tells its buyers in its own privacy notice that they may be asked for a review by a service such as 7BE.
• The Merchant adds only real orders, follows the review rules, and does not give 7BE special categories of personal data.

5. Published reviews

When a buyer writes and publishes a review, the review itself, with the name the buyer chose, is processed by 7BE as an independent controller, with the buyer's consent and under the 7BE privacy policy. It stays published until the buyer or 7BE takes it down. This addendum does not cover it.

6. International transfers

7BE and its subprocessors process Buyer Data in the United States. Where Buyer Data comes from the European Economic Area, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, Module Two (controller to processor), form part of this addendum, with the Merchant as data exporter and 7BE as data importer: the optional clause 7 does not apply; under clause 9 option 2 (general written authorisation) applies with the notice period in section 3; the optional wording in clause 11 does not apply; the competent supervisory authority under clause 13 is that of the Merchant's establishment or, where it has none in the EEA, of its EU representative, or else Ireland's; clauses 17 and 18 choose the law and courts of Ireland. Annexes 1 to 3 of this addendum complete the Clauses' annexes. For data from the United Kingdom, the UK International Data Transfer Addendum (version B1.0) applies to those Clauses; for data from Switzerland, the Clauses apply with references to the Swiss Federal Act on Data Protection. If the Clauses and this addendum conflict, the Clauses prevail.

7. US state privacy laws

As a service provider or processor, 7BE does not sell or share Buyer Data, does not keep, use or disclose it for any purpose other than the review requests described here or outside its direct business relationship with the Merchant, and does not combine it with other personal data except as those laws allow. 7BE tells the Merchant if it can no longer meet these obligations, and the Merchant may take reasonable steps to stop and fix any unauthorised use.

8. General

Each party's liability under this addendum is subject to the limits in the terms of service. On matters of data protection this addendum prevails over the terms. It ends when 7BE no longer holds any of the Merchant's Buyer Data. Questions and requests: info@7be.io.

Annex 1: details of the processing

Annex 2: technical and organisational measures

• Encryption. Buyer Data is stored in private storage on Vercel, which encrypts data at rest with AES-256, backups included. All traffic uses HTTPS (TLS 1.2 or higher). Shopify access tokens are also encrypted by 7BE with AES-256-GCM.
• Access control. Production systems are reached only through named 7BE accounts with two-factor authentication. Credentials live in the hosting provider's encrypted environment variables, never in code. Access is removed when a person no longer needs it.
• Minimisation and retention. Only the fields in Annex 1. Orders of stores without verified reviews are dropped without being stored. Email addresses and names are deleted automatically after 120 days; the opt-out list keeps only one-way hashes.
• Separation. Preview deployments write under a separate prefix and local development uses its own storage and test data, so test data never mixes with production.
• Integrity. Orders from the plugin and from Shopify are accepted only with a valid HMAC signature; dashboards open only with signed, short-lived links.
• Logging. 7BE's systems record each access to Buyer Data (time, purpose and store, without the data itself) and keep the record for 12 months. People at 7BE look at Buyer Data only to answer a request or handle an incident, and record why.
• Data loss prevention. Buyer Data is never exported to personal devices, spreadsheets or third-party tools; requests for a copy are answered by email to the Merchant only. Data is deleted on schedule rather than archived.
• Incidents. A written incident response policy covers detection, containment, assessment, notice to Merchants within 48 hours and to Shopify where its data is involved, and a review afterwards.
• Subprocessors and facilities. Physical security is provided by the subprocessors' certified data centres (Vercel holds SOC 2 Type 2 and ISO 27001 attestations).
• Review. 7BE reviews these measures at least once a year and after any incident.

Annex 3: subprocessors