Data Processing Agreement.

01About this agreement

This Data Processing Agreement (“DPA”) is between you, the merchant who uses our apps (“you”), and eBazoo Technologies, a sole proprietorship based in Lahore, Pakistan (“eBazoo”, “we”, “us”). It forms part of our Terms of Service and applies whenever we process personal data on your behalf under a data protection law.

You accept it when you accept the Terms of Service. If you need a copy signed by both of us, write to hello@ebazoo.com. If this DPA and the Terms of Service disagree about personal data, this DPA wins.

02Definitions

• Data protection law: every law that applies to the processing, including the EU GDPR, the UK GDPR, the California Consumer Privacy Act (CCPA) and similar laws.
• Personal data, processing, controller, processor and data subject have the meanings those laws give them. “Business” and “service provider” have their CCPA meanings.
• Customer personal data: personal data we process on your behalf through our apps, described in Appendix 1.
• Sub-processor: a company we engage that processes customer personal data, listed on our sub-processors page.
• Personal data breach: a breach of our security that leads to the accidental or unlawful destruction, loss, change, disclosure of, or access to customer personal data. Unsuccessful attempts, such as blocked sign-ins or scans, aren’t breaches.
• Standard contractual clauses (SCCs): the European Commission’s clauses in Decision (EU) 2021/914, and for the UK, the UK Information Commissioner’s International Data Transfer Addendum to them.

03Who does what

For customer personal data, you are the controller (the “business” under the CCPA) and eBazoo is your processor (your “service provider”). You decide why that data is processed. You’re responsible for having a lawful basis for it, and for telling your customers how you use our apps, for example in your privacy policy.

We are a controller only for our own business data, such as your account, billing and support conversations with you. Our Privacy Policy covers that, not this DPA.

04Processing on your instructions

We process customer personal data only on your documented instructions. They are:

• the Terms of Service and this DPA;
• how you set up and use our apps;
• any other written instructions we agree with you.

If we believe an instruction breaks a data protection law, we tell you. If a law makes us process the data in another way, we tell you first, unless that law forbids it.

We don’t sell or share customer personal data, as the CCPA defines those words. We don’t use it for any purpose outside providing our apps to you, and we don’t combine it with personal data from elsewhere, except as data protection law allows a service provider to.

05Confidentiality

Only the people at eBazoo who need customer personal data to run, support or secure the apps can reach it, and they’re bound to keep it confidential.

06Security

We protect customer personal data with the technical and organisational measures in Appendix 2, which fit the risk of the processing. We may improve them over time, but we won’t lower the overall level of protection.

07Sub-processors

• You authorise the sub-processors listed on our sub-processors page.
• Before a new sub-processor starts handling customer personal data, we update that page. Ask us, and we’ll also email you.
• You can object within 30 days on reasonable data protection grounds. We’ll then work with you on a solution. If we can’t find one, you can stop using the affected app.
• Each sub-processor is bound by a written contract with data protection terms at least as protective as this DPA, and we stay responsible to you for its work.

08Requests from your customers

Shopify passes your customers’ requests to every app your store uses, and each of our apps answers them:

• A request for data: we report what the app holds about that customer, which is usually nothing.
• A request to be erased: we delete anything linked to them.

For any other request from a data subject, we help you answer it. If someone writes to us directly about customer personal data, we pass the request to you and don’t answer it ourselves, unless you ask us to.

09Personal data breaches

If we become aware of a personal data breach, we notify you without undue delay, and within 72 hours. We tell you:

• what happened, and the data and people likely to be affected;
• the likely consequences;
• what we’ve done, and what we suggest you do.

If some of this isn’t known yet, we send it as soon as it is. We then work to contain the breach and stop it happening again. Telling you isn’t an admission of fault.

10Help with assessments

Taking into account what we know about the processing, we help you with data protection impact assessments and with consulting a supervisory authority, where the law requires them.

11International transfers

We’re based in Pakistan. Our servers are in the United States and Europe, and several sub-processors, including our AI providers, are in the United States. Where data protection law restricts transferring customer personal data to those countries:

• the SCCs apply between you, as data exporter, and eBazoo, as data importer, under Module 2 (controller to processor). Appendix 1 gives the information their annexes need;
• for transfers from the UK, the UK Addendum applies;
• we put equivalent terms in place with our sub-processors.

The SCCs are part of this DPA by reference. If they conflict with anything else here, the SCCs win.

12Deletion at the end

When you uninstall an app, Shopify asks us to delete your store’s data, and we delete all of it, customer personal data included. A nightly check deletes the data of any store that has been uninstalled for more than 30 days, in case that request never arrives.

While you use our apps, each one also deletes data it no longer needs on a fixed schedule, listed in our Privacy Policy.

13Information and audits

We make available the information you need to check that we meet this DPA: this document, our Security page, and written answers to a reasonable security questionnaire once a year.

If a supervisory authority requires more, or a breach makes it necessary, we allow an audit by you or an independent auditor bound by confidentiality. We agree its scope and dates with you in advance, and you cover its costs.

14Liability, term and law

• Liability: the limits in our Terms of Service apply to this DPA, except where data protection law or the SCCs don’t allow them.
• Term: this DPA lasts as long as we process customer personal data for you.
• Law: it’s governed by the laws of Pakistan, like the Terms of Service. The SCCs are governed by the law and courts they name: EU member state to confirm.
• Changes: we may update this DPA to follow the law or how our apps work. We’ll tell you about important changes as the Terms of Service describe.

15Appendix 1: Processing details

The parties

Data exporter and controller: you, the merchant, with the contact details in your Shopify account. Data importer and processor: eBazoo Technologies, Lahore, Pakistan. Contact: hello@ebazoo.com.

The processing

• Subject matter and purpose: providing the apps you install, as the Terms of Service describe.
• Nature: receiving data from Shopify and your storefront, storing, organising, showing, printing and deleting it, and sending it to the sub-processors listed.
• Duration and frequency: continuous, while an app is installed. Data is then kept as Section 12 describes.
• Data subjects: your customers and storefront visitors, and your staff who use our apps.
• Sensitive data: none. Our apps don’t ask for special categories of personal data.

Personal data, by app

Sub-processors

As listed on our sub-processors page, with what each one does and where.

16Appendix 2: Security measures

• Sign-in through Shopify: every request from Shopify admin carries a Shopify session token. Store access uses Shopify’s expiring tokens. There are no merchant passwords.
• Least access: each app asks Shopify only for the permissions its features need, and protected customer data at the lowest level they allow.
• Encryption: HTTPS for all traffic, with HSTS. Store tokens, API keys and push credentials are encrypted with a dedicated key, never sent to a browser or phone.
• Separation: each store’s data is kept apart from every other store’s, and automated tests check it.
• Verified input: every message from Shopify is signature-checked and processed once. Order and customer messages are trimmed to the fields a feature needs. Every request is validated.
• Abuse protection: rate limits on app requests, printing, store changes and sign-in. Outbound requests from Mobile App Builder go only to public HTTPS addresses.
• AI guardrails: AI features get catalog and brand facts, never customers or orders. Their output is checked against strict rules and saved as a draft for you to review.
• Accountability: team roles and an audit log of design, publishing and billing changes in Mobile App Builder, with secrets left out.
• Staff access: separate staff accounts with roles, signing in through eBazoo’s own sign-in service, and rate-limited.
• Minimisation and retention: scheduled jobs delete data a feature no longer needs, as our Privacy Policy lists.
• Vulnerability handling: our Vulnerability Reporting policy invites reports and commits us to answer them.