ShopiDeck Data Processing Addendum
Common contractual duties when ShopiDeck processes personal data on a merchant's behalf. Each app's processing schedule defines its data, purposes, duration, safeguards, and providers.
1. Parties, scope, and precedence
This DPA is between the merchant as controller (or authorized processor) and BONILLA CARRENO ANDRES CAMILO, trading as ShopiDeck, as processor (or subprocessor as applicable). It applies only to personal data handled on the merchant's behalf, not ShopiDeck's own controller activities. It starts with the applicable app agreement and continues while that processing continues.
Each installed app's schedule specifies subject matter, purposes, operations, data categories, people, duration, measures, and relevant providers by reference to its privacy addendum. No schedule for an unused app is incorporated. This DPA governs processor duties over conflicting general commercial language; app schedules supplement technical details and cannot reduce these common duties or mandatory law.
2. Documented instructions and purpose limitation
Instructions comprise the applicable agreement, app schedule, authorized configuration/actions, and lawful written requests, including authorized transfers. ShopiDeck processes only on those instructions unless law requires otherwise, informing the merchant beforehand unless legally prohibited. It informs the merchant if it considers an instruction unlawful and may suspend that processing pending clarification. No sale, own advertising, own model training, or automatic reuse across apps is permitted by this DPA. The merchant warrants lawful authority, notices, legal bases, and rights in submitted materials.
3. Confidentiality and safeguards
Authorized personnel are bound by confidentiality or an appropriate statutory duty. Access is limited to necessity. ShopiDeck implements measures appropriate to risk, including access control, HTTPS, server-side secrets, input validation, encrypted stored app credentials, and app-specific safeguards in the schedule. Security controls may evolve without materially reducing agreed protection. No absolute-security guarantee is made.
4. Providers and subprocessor changes
The merchant gives general authorization only to relevant subprocessors identified for the used app in the register. Independent platforms are not thereby classified as subprocessors for all their activities. ShopiDeck imposes equivalent applicable data-protection obligations on subprocessors and remains responsible for their performance of those duties as required by law.
Proposed additions or replacements affecting the merchant's processing are notified in advance, normally at least 15 days before access, so the merchant may object on reasonable data-protection grounds at team@shopideck.com. ShopiDeck will seek an alternative or resolution; if none is feasible, the affected processing/service may be ended under applicable terms, without limiting legal rights. Urgent legally necessary or security-driven replacements are notified as soon as possible. Updating a list alone does not authorize a different purpose.
5. International transfers
Only transfers necessary for the relevant app's instructed purpose are permitted, subject to applicable law and required safeguards. Where standard clauses, UK instruments, or other transfer arrangements are necessary, they must be validly put in place; this public DPA does not by itself claim to execute them or prove provider certification. The merchant may request processing locations, relevant contractual information, and safeguards. A shared provider does not authorize cross-app data pooling.
6. Rights, assessments, and incidents
Considering the nature of processing and available information, ShopiDeck reasonably assists with data-subject requests, security duties, impact assessments, and supervisory consultations where required. Requests for merchant-controlled data are referred to the merchant unless law requires a direct response. Shopify compliance events are handled for the affected app; a no-data answer from Less Time Marketing does not erase Bot Cleaner's records.
ShopiDeck notifies the merchant without undue delay after awareness of a personal-data breach affecting instructed processing and provides available information on nature, affected data, likely consequences, mitigation, and contact, with updates as information becomes available. The merchant remains responsible for its controller notifications, with ShopiDeck assistance. Do not send secrets when reporting incidents.
7. Information and audits
ShopiDeck makes necessary information available to demonstrate compliance and permits or contributes to proportionate audits required by applicable law, including inspections by the merchant or an authorized auditor. Coordinate at team@shopideck.com, protecting confidentiality, security, and other merchants' data. Public documents do not replace mandatory audit rights; reasonable coordination must not defeat them.
8. Return, deletion, and survival
When processing ends, at the merchant's lawful choice ShopiDeck returns or deletes the relevant personal data, including copies, unless law requires retention. Coordinate return before uninstall where platform revocation would prevent export or deletion there. Local records follow the app's documented deletion flow. Backups pending rotation are restricted from ordinary use; statutory exceptions and minimal security/privacy evidence must be justified, limited, and not reused for unrelated purposes.
Independent Shopify Files, already-published posts, and platform-controlled records may require merchant action at the platform. Ending one app's processing does not end another app's lawful instructions. Confidentiality, justified retention, deletion, and other duties continue while applicable. Contact the general legal address for questions or requests.