Data Processing Agreement
This Data Processing Agreement is between the merchant using the App (the "Controller") and [COMPANY LEGAL NAME], [ADDRESS] (the "Processor").
1. Subject and duration
1.1 The Processor processes personal data of the Controller's customers to provide the App: an order form on the Controller's Shopify store, creation of orders in Shopify, bank transfer details, upsell and quantity offers, reports and, if enabled, purchase events to the Controller's advertising platforms.
1.2 The agreement lasts as long as the Controller uses the App and ends when all personal data has been deleted under section 9.
2. Data and data subjects
- Data subjects: customers of the Controller who place orders through the order form.
- Personal data: name, phone number, delivery address, email address (optional), order note, ordered products and amounts, payment method, technical data (IP address where available); with the customer's consent, advertising cookies and browser data.
- No special categories of personal data are processed.
3. Instructions
3.1 The Processor processes personal data only on the documented instructions of the Controller. The settings the Controller makes in the App (for example enabling bank transfer, pixels or form fields) are such instructions.
3.2 The Processor informs the Controller if it believes an instruction infringes data protection law.
4. Confidentiality
Everyone at the Processor who can access personal data is bound by confidentiality.
5. Security (technical and organisational measures)
- Encryption in transit (TLS) and at rest (AES-256 for customer personal data, access tokens and backups).
- Role-based staff access, two-factor authentication for staff, masking of personal data for roles that do not need it, logging of staff access to personal data.
- Separation of test and production systems.
- Automatic retention: customer personal data is removed from orders after 12 months.
- Regular encrypted backups and a tested restore procedure.
- A documented security incident response procedure.
6. Sub-processors
6.1 The Controller authorises the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Shopify Inc. and affiliates | Platform, order creation, customer emails | [LOCATION] |
| [HOSTING PROVIDER] | Servers and databases | [LOCATION] |
6.2 Meta, TikTok and Google receive data only if the Controller enables the related pixel; they act as independent controllers or processors of the Controller under the Controller's own agreements with them.
6.3 The Processor informs the Controller at least 30 days before adding or replacing a sub-processor. The Controller may object; if no solution is found, the Controller may stop using the App.
7. Assistance
The Processor helps the Controller, as far as possible, to answer data subject requests (access, rectification, erasure) and with data protection impact assessments. Shopify's compliance webhooks (customers/data_request, customers/redact, shop/redact) are processed automatically.
8. Personal data breaches
The Processor notifies the Controller without undue delay and at the latest within 48 hours after becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs for its own notifications (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken).
9. Deletion and return
When the Controller uninstalls the App, all personal data of the Controller is deleted after Shopify's shop/redact request (48 hours after uninstalling). Orders remain in the Controller's Shopify store. Before uninstalling, the Controller can view its orders in Shopify.
10. Audits
The Processor makes available the information necessary to demonstrate compliance with this agreement and allows audits by the Controller or an auditor mandated by it, with reasonable notice, at most once a year, at the Controller's cost.
11. International transfers
Where personal data is transferred outside the EEA, the UK or Türkiye, the parties rely on the EU Standard Contractual Clauses (Module 2 or 3 as applicable) or the transfer mechanisms of the Turkish KVKK.
12. Liability and precedence
Liability follows the Terms of Service. If this agreement conflicts with the Terms of Service on data protection, this agreement prevails.
[COMPANY LEGAL NAME] – [ADDRESS] – [PRIVACY EMAIL]