Terms of use

Part 1 · 1. Publisher and purpose

Impec is published by Audric Berlioz, sole trader (registration in progress), 374F rue Neuve, 69970 Marennes, France, support@impecfacture.com (“the publisher”).

Impec turns a Shopify store’s paid orders into invoices and credit notes that comply with French law, emails them to customers and prepares accounting exports (“the service”). The service is for businesses only and is provided through Shopify, whose terms also apply.

2. The service

• continuous numbering of invoices and credit notes, separate from order numbers;
• mandatory legal mentions, based on the information entered in “My business”;
• a credit note for every refund;
• PDFs in the Factur-X format;
• emailing to the customer, if the merchant chooses so;
• accounting exports: sales register, sales journal in the FEC format, full archive.

How it works in detail and the cases not supported yet (for example a payment in a currency other than the euro) are described in the help center: app.impecfacture.com/help. An unsupported order isn’t invoiced by Impec: it is reported to the merchant with its reason.

3. Merchant’s commitments

• provide accurate, up-to-date information about its business (identity, SIREN, VAT number, VAT scheme, type of operations): it appears on every invoice;
• check the documents issued and report any anomaly without delay;
• remain responsible for its tax and accounting obligations (VAT returns, bookkeeping, keeping invoices for 10 years): Impec is neither a chartered accountant nor a tax adviser;
• download its invoices and credit notes (“Exports” page) before uninstalling Impec: they are deleted 48 hours after uninstalling;
• not use Impec to send misleading or fraudulent messages, or messages unrelated to an actual sale, and not try to get around its limits (emails, exports, quotas) or its security.

4. Plans and payment

The plans, free or paid, and their limits are shown in the app and on the Shopify App Store listing. The subscription is taken out and paid through Shopify, under Shopify’s billing rules (period, renewal, plan changes).

Beyond a plan’s monthly quota, no order is lost: it stays on hold and is invoiced, in payment order, as soon as the quota allows (next month or a higher plan).

Any price increase is announced at least 30 days in advance; the merchant can then change plans or uninstall Impec.

5. Availability and support

The publisher uses reasonable means to keep the service available and working properly (best-efforts obligation). Interruptions remain possible: maintenance, an outage at Shopify, the host or the email provider. An order paid during an interruption is caught up afterwards, within the last 60 days that Shopify lets the app read.

Support by email at support@impecfacture.com, in French or English, on business days.

6. Liability

The publisher is responsible for the compliance of the documents produced by Impec with the rules described in the help center, based on the information provided by the merchant and by Shopify. It isn’t liable for the consequences of inaccurate or incomplete information provided by the merchant, of a setting the merchant chose, or of an error in the data sent by Shopify.

Except in case of gross negligence or wilful misconduct, the publisher’s total liability is limited to the higher of: the amounts paid by the merchant for Impec in the 12 months before the event giving rise to liability, or 100 euros. Indirect damages, such as loss of revenue, profit or customers, are not compensated.

7. Personal data

For the merchant’s customers’ data, the publisher acts as a processor: Part 2 below applies. For the merchant’s own data, see the privacy policy: app.impecfacture.com/privacy

8. Ownership

Impec (software, texts, brand) belongs to the publisher. The merchant has a personal, non-exclusive right to use it while the app is installed. Invoices, credit notes and exports belong to the merchant.

9. Term, suspension and termination

These terms apply as long as the app is installed. The merchant can end them at any time by uninstalling Impec; the subscription stops under Shopify’s rules. Data is then deleted as set out in section 20.

In case of abuse (misleading emails, attacks on security, fraud), the publisher may suspend emailing or access to the service, after notifying the merchant, except in an emergency.

If the publisher discontinues the service, it notifies merchants at least 90 days in advance, so that they have time to download their documents.

10. Changes

The publisher may change these terms. The new version is shown in the app at least 30 days before it applies, unless the change is required by law or by Shopify, and the merchant is asked to accept it. If the merchant refuses it, it may uninstall Impec; invoicing continues in the meantime, so that no order is left without an invoice.

11. Governing law and disputes

These terms are governed by French law; the French version prevails. In case of a dispute, the parties first seek an amicable solution (write to support@impecfacture.com). Failing that, the dispute is brought before the competent courts within the jurisdiction of the Lyon Court of Appeal.

Part 2 · 12. Data processing agreement: purpose and duration

The merchant, as controller, entrusts the publisher, as processor, with the processing of its customers’ data needed for the service: reading paid orders and refunds, issuing invoices and credit notes, storing them, emailing them to customers if the merchant chose so, preparing exports and helping the merchant answer its customers’ requests.

Duration: as long as Impec is installed, then 48 hours, until the deletion set out in section 20.

13. Data and data subjects

• Data subjects: the merchant’s customers (buyers, individuals or businesses).
• Data: name, company, billing and shipping addresses, email address, VAT number and SIREN of a business customer, items ordered, amounts, taxes, payment method label, refunds.
• No sensitive data, no payment card data, no password.

14. Merchant’s instructions

The publisher processes the data only on the merchant’s documented instructions: these terms, the settings chosen in the app (activation, automatic emailing, exports) and its customers’ requests forwarded by Shopify. It doesn’t use the data for any other purpose, doesn’t sell it and doesn’t use it for advertising.

If an instruction seems to infringe the GDPR, the publisher immediately informs the merchant. If the law requires a processing (for example a court order), it informs the merchant beforehand, unless the law forbids it.

The merchant, for its part, gives instructions that comply with the GDPR and informs its customers about the processing of their data, for example in its store’s privacy policy.

15. Confidentiality and security

Only the publisher accesses the data, to run the service and provide support; anyone given access in the future would be bound by confidentiality and trained in data protection. Impec is built for data protection by design and by default (Article 25 GDPR: minimal data, isolated access). Security measures (Article 32 GDPR):

• hosting in the European Union (Frankfurt), encrypted database and backups, encrypted traffic (HTTPS); restore possible to any point in the last 3 days;
• isolation: each store only accesses its own data; Shopify notifications are verified by their signature; download links are signed and valid for 15 minutes;
• administration accounts (host, Shopify, source code, email sending) protected by two-factor authentication;
• technical logs without customer names, addresses or emails;
• limits against abuse (emails, exports); penetration tests and security review of the code.

16. Sub-processors

The merchant authorizes the publisher to use the following sub-processors:

• Render Services, Inc. (United States): hosting of the app and its database, in its Frankfurt region (Germany). Traffic goes through Cloudflare’s network. The host’s own sub-processors are listed in its data processing agreement: render.com/dpa
• Scaleway SAS (France): sending emails, from France.

The publisher imposes on them data protection obligations equivalent to those of this agreement and remains fully liable to the merchant for their failures. It informs the merchant of any addition or replacement at least 30 days in advance, in the app or by email; the merchant may object on data protection grounds and, failing agreement, end the service by uninstalling Impec.

Shopify, where the orders come from, isn’t a sub-processor of the publisher: the merchant uses it directly, under its own terms.

17. Transfers outside the European Union

Data is hosted in the European Union. Access from a third country by a sub-processor (for example Render Services, Inc., a US company, for maintenance) only takes place under the EU–US Data Privacy Framework or, failing that, the European Commission’s standard contractual clauses.

18. Data subject rights and assistance

Customer requests forwarded by Shopify are handled automatically. Access request: Impec sends the merchant the list and PDFs of the customer’s documents. Erasure request: Impec erases the customer’s data, except the invoices and credit notes the merchant must keep, from which the email address is removed. A request received directly by the publisher is forwarded to the merchant by email as soon as it is received.

The publisher helps the merchant, with the information available to it, meet its obligations on security, impact assessments and prior consultation of the supervisory authority.

19. Personal data breach

The publisher notifies the merchant of any personal data breach without undue delay, and at the latest 48 hours after becoming aware of it, by email to the store’s address, with the information available: nature of the breach, data and data subjects concerned, likely consequences, measures taken. The merchant remains in charge of notifying the supervisory authority (CNIL) and, where needed, the data subjects.

20. End of processing

The merchant can retrieve its data at any time from the “Exports” page: full archive with the PDFs, the sales register and the FEC journal. After uninstalling, the publisher deletes all of the store’s data 48 hours later, at Shopify’s request, without keeping a copy, except the last number used in each invoice and credit note series (a counter, with no personal data). The host’s backups are deleted automatically at the end of their retention period. On request, the publisher confirms the deletion in writing.

21. Documentation and audit

The publisher makes available to the merchant the information needed to show compliance with this agreement: description of the security measures and list of sub-processors. It accepts an audit, at the merchant’s expense, with 30 days’ notice, by an auditor bound by confidentiality, at most once a year except after a data breach.

The publisher keeps the record of processing activities required by Article 30(2) GDPR. It hasn’t appointed a data protection officer, as it isn’t required to; contact for any question: support@impecfacture.com.