1. Parties and scope
This Data Processing Agreement ("DPA") is between the Shopify merchant that installs MerchantKits Recall & GPSR ("Controller", "you") and MerchantKits, operated by Khalid Mehmood Durani (sole proprietor), Hyderabad 71700, Sindh, Pakistan, support@merchantkits.com ("Processor", "we"). It forms part of the Terms of Service and applies to personal data of your customers that we process for you through the app. It applies automatically when you install the app. Where it conflicts with the Terms, this DPA prevails for personal data.
2. Subject matter, nature and purpose
We process personal data to provide the app's recall functions: identifying customers who bought products you recall, sending the recall notices and reminders you confirm, recording deliveries, acknowledgments and remedy choices, providing your evidence records and exports, and answering privacy requests forwarded by Shopify. Details are in Annex 1.
3. Duration
This DPA applies for as long as we process personal data for you. Customer data of a recall is deleted 3 years after the recall is closed, when Shopify forwards a customer's erasure request, and in full when Shopify requests deletion of your store's data after you uninstall the app (48 hours after uninstall).
4. Your instructions
We process personal data only on your documented instructions, which are given by these Terms and DPA and by your use of the app (for example selecting products and order dates, excluding customers, and confirming that a recall notice should be sent), unless required to do otherwise by law, in which case we will inform you unless the law prohibits it. We will tell you if we believe an instruction breaks data protection law.
5. Our obligations
- · Confidentiality: everyone authorised to process the data is bound by confidentiality.
- · Security: we implement the technical and organisational measures in Annex 2 (Art. 32 GDPR) and keep them up to date.
- · No other use: we do not use the data for our own purposes, sell it, or use it for marketing.
- · Records: we keep a record of processing activities carried out for you.
6. Subprocessors
You give general authorisation to the subprocessors in Annex 3. We will notify you by email at least 30 days before adding or replacing a subprocessor; you may object on reasonable data protection grounds, and if we cannot address the objection you may stop using the app. We impose data protection obligations on each subprocessor equivalent to this DPA and remain responsible for their performance.
7. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, where possible within 48 hours, by email to your store owner address. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, likely consequences, and the measures taken or proposed. We will support you in notifying authorities and affected customers.
8. Assistance
Taking into account the nature of the processing, we assist you in responding to data subject requests (access, rectification, erasure, restriction, portability, objection), with data protection impact assessments and prior consultations, and with your security obligations. Requests made by your customers through Shopify are handled automatically: for an access request we email the store owner the recall records we hold about that customer; for an erasure request we delete them and keep only an anonymous count. Requests sent to us directly are forwarded to you.
9. Deletion and return
On Starter and Pro you can export a recall's customer records (CSV) and evidence report (PDF) at any time. When the services end, we delete the personal data as described in section 3, unless law requires us to keep it. Deleted data remains in Cloudflare's point-in-time database recovery (D1 Time Travel) for up to 30 days and then expires.
10. Audits
We make available the information necessary to demonstrate compliance with this DPA. You may audit our compliance, including by an independent auditor bound by confidentiality, on 30 days' written notice, no more than once a year unless a breach or a supervisory authority requires otherwise, at your cost and without access to other customers' data. We may first answer by written questionnaire and documentation, including our subprocessors' certifications.
11. International transfers
Our database and file storage are restricted to the European Union (Cloudflare EU jurisdiction). Application requests, background job messages and operational logs are handled in Cloudflare's global network, and Resend (email delivery) stores delivery data in the United States. Transfers outside the EEA are covered by the European Commission's Standard Contractual Clauses (modules 2 and 3) and the UK Addendum in the Cloudflare Customer DPA and the Resend DPA, and by both companies' participation in the EU-U.S. Data Privacy Framework.
12. Liability and law
Liability under this DPA is subject to the limitation in the Terms, except where law does not allow it. This DPA is governed by the laws of Pakistan, and the courts of Hyderabad, Sindh have jurisdiction. Mandatory data protection rights under the law of your country are not affected.
Annex 1 — Details of processing
Annex 2 — Security measures (summary)
- · Encryption in transit (HTTPS/TLS everywhere) and at rest (Cloudflare D1); Shopify access tokens additionally encrypted with AES-GCM; confirmation links stored as SHA-256 hashes.
- · Every request to the app's API is authenticated with a Shopify session token; webhooks and the confirmation page verify Shopify's signatures.
- · Least privilege: the app requests only the Shopify permissions it uses; each store's data is separated by store in every query.
- · Access to production systems limited to authorised staff with unique accounts, strong passwords and two-factor authentication; secrets kept in Cloudflare's secret store, never in code.
- · Separate test and production environments; test environments use development stores only.
- · Logs are designed not to contain customer contact data; no local copies or ad-hoc exports of customer data by staff.
- · Automated retention and deletion (section 3); point-in-time database recovery for availability; written incident response, data loss prevention and access policies.
Annex 3 — Subprocessors
Shopify is the platform you use and the source of the data; it acts under your own agreement with Shopify and is not our subprocessor.