Data Processing Agreement
This agreement under Article 28 of the GDPR is entered into between the merchant who accepts it in the app (controller) and Igor Kazazic (sole trader), Malmö, Sweden (processor). It applies to all personal data the processor processes on the controller's behalf through Lexara.
1. Subject matter, duration, nature and purpose
Subject matter: providing the app's features to the controller's Shopify store. Duration: while the app is installed, plus the deletion period in section 9. Nature: collection from Shopify, storage, structuring, display, calculation and deletion. Purpose: product compliance documentation, accountability (audit log), access control, packaging and producer-responsibility reporting, and notifications.
2. Categories of data and data subjects
Data subjects: the controller's customers (only through order IDs) and the controller's staff. Personal data: order ID, destination country, product/variant IDs, quantities, fulfilment and cancellation dates; staff Shopify user ID, name, e-mail address, store-owner flag, role and activity timestamps; contact details of economic operators entered by the controller. No special categories of personal data are processed.
3. Instructions
The processor processes personal data only on the controller's documented instructions. The configuration and use of the app by the controller and these terms constitute those instructions. The processor informs the controller if it considers an instruction to infringe data protection law.
4. Confidentiality
Persons authorised to process the personal data are bound by confidentiality.
5. Security (Article 32)
The processor maintains appropriate technical and organisational measures, including: TLS encryption in transit; encryption at rest by the hosting and database provider; access tokens kept server-side only; verification of Shopify webhook signatures; role-based access in the app; logging of all changes; data minimisation (no customer names, addresses, e-mail or payment data); separation of each store's data; and restricted administrative access to production systems.
6. Sub-processors
The controller gives general authorisation to use the sub-processors listed below. The processor announces intended additions or replacements in the app at least 30 days in advance; the controller may object on reasonable grounds and, if no solution is found, terminate by uninstalling the app. The processor imposes data protection obligations on sub-processors equivalent to this agreement.
Shopify Inc. / Shopify International Ltd – the platform the app runs on and reads data from.
Railway Corp. (EU West, Amsterdam, Netherlands) – app hosting and PostgreSQL database – hosting of the app and its database.
Anthropic PBC (USA) – AI features (Pro plan only, and only when an AI feature is used). Receives product, page and passport text, never order data or customer details. Transfers are covered by the EU Standard Contractual Clauses.
E-mail delivery provider (SMTP) – only if e-mail notifications are enabled; receives the store's notification address and the notification content.
7. International transfers
Transfers outside the EU/EEA take place only with an adequacy decision or the EU Standard Contractual Clauses and, where needed, supplementary measures.
8. Assistance
Taking into account the nature of the processing, the processor assists the controller with data subject requests (in particular through Shopify's customers/data_request and customers/redact mechanisms), with security, with data protection impact assessments and with prior consultations. The processor notifies the controller of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it, with the information available at the time.
9. Deletion and return
When the app is uninstalled and Shopify sends shop/redact, the processor deletes all personal data for the store, normally within 48 hours, and backups expire within 30 days. The controller can export its data from the app (CSV exports) before uninstalling.
10. Audits
The processor makes available the information necessary to demonstrate compliance with this agreement and allows for audits by the controller or an auditor it mandates, with at least 30 days' notice, at the controller's cost and without access to other customers' data.
11. Liability and precedence
Liability follows the Terms of Service. If this agreement conflicts with the Terms of Service on data protection, this agreement prevails. Swedish law applies.