Data Processing Agreement

1. Roles

To be completedThe registered legal name and address of the Merchgram entity, once incorporation is complete.

The Controller is the merchant. The Processor is Merchgram. The Processor processes personal data only on the Controller's documented instructions; installing and configuring the app constitutes those instructions.

2. Subject matter and duration

Processing lasts for as long as the app is installed, plus the deletion period in §7.

3. Nature and purpose

Enabling the Controller to sell customisable products and to fulfil the resulting orders: applying customer-specific pricing at checkout, creating production jobs from paid orders, and presenting the Controller with their own customer records.

4. Categories of data subject

The Controller's customers and store visitors.

5. Categories of personal data

Email address; first and last name; phone number; Shopify customer ID; customer tags; and order references (order ID, order number, line items and the customisation choices attached to them).

Expressly excluded: shipping and billing addresses, payment card data, government identifiers, and any special category data under GDPR Article 9.

6. Processor obligations

The Processor shall:

1. Process personal data only on documented instructions from the Controller.
2. Ensure personnel with access are bound by confidentiality.
3. Implement the technical and organisational measures in Annex A.
4. Not engage a sub-processor without notifying the Controller and imposing equivalent obligations.
5. Assist the Controller in responding to data subject requests, including through Shopify's customers/data_request and customers/redact mechanisms.
6. Notify the Controller without undue delay on becoming aware of a personal data breach.
7. Delete or return personal data at the end of processing, per §7.
8. Make available the information needed to demonstrate compliance.

Current sub-processors:

To be completedThe full list of sub-processors — hosting provider, email provider, and any other service that touches personal data.

7. Deletion

On uninstall, Shopify sends a shop/redact request. The Processor marks the Controller's data for deletion and permanently erases it 30 days later. The buffer exists so that an accidental uninstall can be reversed; it can be shortened on request.

On customers/redact, the identified customer's record is anonymised.

8. Transfers

To be completedHosting region and the transfer mechanism for merchants outside it.

9. Audit

The Processor shall make available information reasonably necessary to demonstrate compliance, and allow audits on reasonable notice, no more than once a year unless required by a supervisory authority.

Annex A — Technical and organisational measures