Introduction

KondarSoft supports many merchants, who in turn work with several of buyers across the globe—it is absolutely essential for us to maintain the trust of our merchants and their buyers. Some of these merchants (or buyers) occasionally find themselves in legal disputes, which might create a need for need information about a particular merchant, store, or transaction. These guidelines explain how we handle these requests, and how we balance our legal obligations, the needs of the requesting party, and the privacy rights of our merchants and their buyers. Please note that if you are a merchant or a buyer seeking access to your own information, you do not need to follow these procedures—please consult our Privacy Policy for more information about your right of access.

In these guidelines, we provide some information about KondarSoft’s corporate structure, the types of information we have, and the conditions under which we will disclose this information. But initially, some first principles:

  • When a third party requests non-public information (such as personal or financial information), we will not share this information absent an enforceable court order, subpoena or search warrant;
  • We will notify affected users if we believe we are legally required to provide their information to a requesting party, unless we are prohibited by law from doing so;
  • When a third party requests information about a merchant, we will not also provide information about the individual’s activity as a Buyer, Partner, or consumer using KondarSoft’s consumer-facing services, unless the legal request or court order specifically requests this additional information;
  • When a third party requests information about a merchant, we generally will not also provide information about that merchant’s customers. We consider this information to be in the control and custody of the merchant, who is the controller of this information. If you are requesting information about a merchant’s customers, please send your request directly to the relevant merchant; and
  • KondarSoft will narrowly construe the language of the request.

KondarSoft’s Terminology

In order to understand what information we hold, you should understand few terms that we commonly use when describing our business:

  • “Merchants” are individuals who use KondarSoft’s ecommerce platform to power their stores in any capacity. When we talk about Merchants, we include all individuals who access KondarSoft on behalf of a store (or multiple stores)—not just the listed account owners.
  • “Buyers” are individuals who visit, engage with, or make a purchase from a store operated by a Merchant.
  • “Partners” are individuals who work with and provide a wide variety of ancillary services to Merchants, such as: developing apps or themes that can be used in conjunction with a Merchant’s store; helping Merchants build or set up their stores, or with other web development services; referring potential entrepreneurs looking to become a Merchant.

Which Entity Do I Need to Subpoena?

KondarSoft provides services through a collection of different affiliates, depending on the location of the data subject and the precise services at issue. Each of these affiliates is a distinct corporate legal entity, and will have access to different types of information, and is subject to different sets of laws. This section is intended to ensure that if you do intend to submit a legal request for information, that you direct it to the proper entity which has control over the information you seek.

  • KondarSoft is a Canadian corporation with its principal place of business in Burnaby, British Columbia. KondarSoft currently develops the KondarSoft platform available to Merchants.
    • KondarSoft has access to the following types of information: Merchant personal information; Merchant account information (including access records relating to use of KondarSoft); Merchant revenue information (including aggregate revenues generated through third party payment processors); information about orders placed through KondarSoft; Merchant’s payment information (to pay KondarSoft transactions fees); Partner personal information; Partner account information; Partner revenue information.
    • KondarSoft also has access to information associated with individual transactions made on Merchant stores that use KondarSoft platform, and information about Merchant revenues (including total amounts deposited into a Merchant’s bank account, and information about the Merchant’s bank account itself).
      • Please note that KondarSoft generally does not have access to the actual payment card information used by Buyers to transact on a Merchant’s store.
      • Legal requests to KondarSoft  should be directed to 4456 Dundas St, Burnaby, BC Canada, V5C 1B6, Attn: Legal/Privacy Team or to privacy@KondarSoft.com.

What Legal Process Should a Requesting Party Follow?

Criminal Matters For criminal matters, we will respond to requests issued by Canadian courts with jurisdiction to compel us to produce the requested information.

Civil or Regulatory Matters For civil or regulatory matters, we will respond to requests from Canadian courts with jurisdiction to compel us to produce the requested information.

What information do I need to provide in the court order?

Please provide enough information to uniquely identify the merchant or individual. Unique identifiers include the URL of a KondarSoft store or an email address.

A common name is not usually enough to identify an individual. Please do not provide us with an individual’s SSN/SIN, other government identification number, bank account number, or payment card number.

Does KondarSoft Hold or Control Merchant Funds On Deposit?

While KondarSoft does provide our commerce platform to our Merchants, it does not directly provide payments processing services that give it control over a Merchant’s revenues. At no time does KondarSoft hold these funds or control the bank account that deposits these funds.

Does KondarSoft Store or Process Merchant Bank Account or Credit Card Numbers?

KondarSoft will not retain a Merchant’s bank accounts records or its credit card numbers.

Will KondarSoft Voluntarily Disclose Non-Public Information to a Requesting Party?

No. KondarSoft will only disclose non-public information in response to an enforceable subpoena or court order from a court with jurisdiction to compel KondarSoft to disclose that information.

Will KondarSoft Notify Affected Merchants Before Disclosing Information?

Yes. We strongly believe that any individual should be informed when we are required to produce their information in response to a legal request. We will notify the affected individual of the request (or, if we serve as the processor of the data, the affected Merchant) so that they may pursue legal action and prevent disclosure. The only circumstance in which we will not provide this notice is if we are legally prohibited from doing so.

If you receive a notice that KondarSoft has been compelled to produce your personal information, you may seek a protective order from a court. If you are able to provide us with such a protective order, we will object to the production demanded by the subpoena.

Does KondarSoft Charge Anything to Respond to a Legal Request?

We reserve the right to seek reimbursement for the costs associated with responding to legal requests (where permitted by law).

How Does KondarSoft Handle Data Preservation Orders?

Preservation orders may capture two types of information: shop data, or metadata.

Shop data includes information such as data on Merchants themselves, the Merchant’s communication with KondarSoft, as well as a store’s customers, transactions, account ownership, and products. We generally keep shop data for the lifetime of a store, and do not require a preservation order to maintain this data. We purge personal information within 90 days of a store’s deactivation, after which the identifiable information is no longer capable of being recovered.

Metadata includes information such as who accessed a store and when, and actions that a Merchant performed on a store. Metadata is generally kept for a short period of time—in some instances for only 12 days. As such, depending on when a request for metadata is made, and the period of time for which the metadata is sought, we may no longer have the ability to preserve or produce the requested data.

Last updated: January 15, 2020
© 2020 Kondar Global Solutions Ltd.