Data processing agreement
Draft for legal review. Effective effective date.
This agreement is between the merchant who installs Checkout X-Ray (the "controller") and legal name, address, registration number registration number (the "processor"). It forms part of the Terms of service and applies to personal data the processor handles on the controller's behalf to provide the app, under Article 28 of the GDPR.
1. Subject, duration and purpose
The processor processes data only to provide Checkout X-Ray: calculating carts with Shopify, explaining prices, re-checking test carts and sending alerts. Processing lasts while the app is installed and ends with the deletion described in section 8.
2. Data and data subjects
- Store staff: the email address that receives alerts, and the store's contact email.
- Test addresses: country, region, city and postal code typed by the controller; no names, email addresses or phone numbers.
- Store customers: by default none: carts are calculated as guests. When the controller chooses to price a test cart as one of its customers, the app keeps that customer's Shopify ID and a label made from the customer's tags and order count, never a name, email address, phone number or address. Shopify classifies the calculated draft order as protected customer data; the app keeps only prices and discount outcomes from it. For Refund Watch the app keeps, per refund of the last 60 days, the amounts, refunded items, the staff's refund reason, the payment method type and the order's customer ID, never a name, email address, phone number or address. A customer's data is deleted when Shopify sends a redaction request for them (their test carts and the refunds on their orders are removed).
3. Instructions
The processor acts only on the controller's documented instructions, which are these terms and the controller's use of the app, unless EU or Member State law requires otherwise; in that case the processor tells the controller first unless the law forbids it.
4. Confidentiality
Everyone authorised to process the data is bound by confidentiality.
5. Security (Article 32)
- TLS for all connections; Shopify access tokens encrypted at rest (AES-256-GCM).
- Access to production systems and the database limited to the processor.
- Logs and error reports exclude customer data, access tokens, cookies and URL query strings.
- Data minimisation: only the fields the app needs are read from Shopify.
- Retention as in section 8; backups follow the hosting provider's retention.
6. Sub-processors
The controller authorises these sub-processors: Railway (hosting, database), Zoho ZeptoMail (email), Sentry (error reports) and Axiom (logs). The processor binds each to obligations equivalent to this agreement, informs the controller at least 30 days before adding or replacing one (in the app or by email), and the controller may object; if no solution is found the controller may uninstall the app.
7. Assistance
The processor helps the controller, taking into account the nature of the processing, to answer data subject requests, and with security, breach notification, impact assessments and prior consultation (Articles 32–36).
8. Deletion
On uninstall the access token is deleted at once; all other data is deleted when Shopify sends the shop deletion request (48 hours after uninstall). While the app is installed, price checks and store-change records older than 90 days are deleted, except the results the app still shows; refunds read for Refund Watch are deleted after 90 days.
9. Personal data breaches
The processor notifies the controller without undue delay, and within 48 hours of becoming aware of a breach affecting the controller's data, with the information Article 33(3) requires as it becomes available.
10. Audits
The processor makes available the information needed to show compliance with Article 28 and allows audits by the controller or its auditor, with reasonable notice, at the controller's cost, at most once a year unless a breach or a supervisory authority requires more.
11. International transfers
Where a sub-processor processes data outside the EEA, the transfer relies on an adequacy decision or the European Commission's Standard Contractual Clauses.
12. Contact
contact email
