Data Processing Agreement

This Data Processing Agreement ("DPA") applies when a merchant ("Merchant", "you") uses one of the Shopify apps published by SEAPIXEL L.P., Athens, Greece ("Seapixel", "we", "us") on the Shopify App Store (the "Apps"), and Seapixel processes personal data on the Merchant's behalf through them. It sets out the terms required by Article 28 of the EU General Data Protection Regulation 2016/679 ("GDPR"), and the equivalent provisions of the UK GDPR and the Swiss Federal Act on Data Protection where those apply.

This DPA forms part of the terms under which you use the Apps (the Shopify App Store terms, Shopify's Partner Program Agreement and API Terms, and each App's listing; together, the "Agreement"). It is concluded in electronic form, as permitted by Article 28(9) GDPR: it takes effect when you install an App, applies for as long as Seapixel processes personal data for you through it, and does not need to be signed. Seapixel offers this DPA on the same terms to all merchants and does not sign individual or merchant-drafted data processing agreements.

1. Roles

1.1 For personal data that an App processes from your store and your storefront ("Merchant Personal Data"), you are the controller and Seapixel is the processor.

1.2 This DPA does not cover data about you as our customer (for example your store's contact email and owner name, install records, support messages). For that data Seapixel is the controller, as described in our Privacy Policy.

1.3 The subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects for each App, are described in Annex I.

2. Instructions

2.1 Seapixel processes Merchant Personal Data only on your documented instructions, unless required otherwise by EU or Member State law, in which case we will inform you before processing unless that law prohibits it.

2.2 Your instructions are this DPA, the Agreement, and the way you install, configure and use an App (its settings and features). An App's features define the processing it can carry out; Seapixel is not required to carry out processing that an App does not offer.

2.3 We will inform you if, in our opinion, an instruction infringes the GDPR or other data-protection law. We are not obliged to carry out a full legal review of your instructions.

3. Your responsibilities

3.1 You are responsible for having a lawful basis for the processing you instruct, for giving shoppers and other data subjects the information required by law (for example in your store's privacy policy), and for collecting any consent you need, including through Shopify's cookie banner (Customer Privacy API), which our Apps' storefront analytics respect.

3.2 You will not use or configure an App to collect special categories of personal data (Article 9 GDPR, such as health data) or data about criminal convictions, for example through quiz questions or form fields, unless you have ensured that this processing is lawful. The Apps are not designed for such data, and you are responsible for any you choose to collect through them.

3.3 You are responsible for the accuracy and lawfulness of the personal data you or your shoppers provide through an App, and for deciding how long to keep data where an App lets you choose (for example quiz submission retention).

4. Confidentiality

Seapixel ensures that anyone it authorises to process Merchant Personal Data is bound by an appropriate duty of confidentiality.

5. Security

5.1 Seapixel implements the technical and organisational measures described in Annex II, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing.

5.2 We may update these measures over time, provided the overall level of protection is not reduced.

5.3 You are responsible for the security of your own Shopify store and accounts, including who on your staff can access the Apps.

6. Sub-processors

6.1 You give Seapixel a general authorisation to engage sub-processors. The current sub-processors are listed in Annex III.

6.2 We will inform you of any intended addition or replacement of a sub-processor by updating Annex III on this page at least 14 days before the change takes effect, except where a change is needed urgently for security or to keep an App running, in which case we will update it as soon as reasonably possible. If you object to a change on reasonable data-protection grounds, tell us at hello@seapixel.com. If we cannot reasonably accommodate the objection, your remedy is to stop using and uninstall the affected App.

6.3 We impose data-protection obligations on each sub-processor that are substantially the same as those in this DPA, through their terms of service or data processing terms. Seapixel remains responsible to you for its sub-processors' performance of those obligations, as required by Article 28(4) GDPR.

7. International transfers

Some sub-processors process data outside the European Economic Area, mainly in the United States. Where they do, the transfer relies on a mechanism recognised under Chapter V GDPR, as offered by each sub-processor: the EU–U.S. Data Privacy Framework where the sub-processor is certified, or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) included in its data processing terms.

8. Assistance

8.1 Data subject requests. The Apps support Shopify's mandatory privacy webhooks (customers/data_request, customers/redact and shop/redact), and some Apps let you view, export or delete records directly. If a data subject contacts Seapixel directly about Merchant Personal Data, we will pass the request to you and will not respond to it ourselves unless you instruct us to. Beyond these tools, we will provide reasonable assistance, taking into account the nature of the processing and the information available to us.

8.2 Other obligations. We will provide reasonable assistance with your obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us. This DPA, our Privacy Policy and the App listings are the primary information we provide for this purpose.

9. Personal data breaches

9.1 Seapixel will notify you without undue delay after becoming aware of a personal data breach affecting Merchant Personal Data, using the store contact email Shopify provides to us. You are responsible for keeping that email address current in Shopify; a notice sent to it counts as delivered. The notification will include the information reasonably available to us at the time, and we will provide further information as it becomes available.

9.2 Notifying a breach is not an acknowledgement of fault or liability.

10. Deletion and return

10.1 When an App is uninstalled, it stops processing your store's data. When Shopify sends the shop/redact notification (48 hours after uninstall), Seapixel deletes that store's Merchant Personal Data held by the App in our systems, unless EU or Member State law requires us to keep it.

10.2 Data that an App stores inside your own Shopify store (for example metaobjects, metafields, customer records and tags) stays in your store under your control, and you can delete it in Shopify.

10.3 Copies in our providers' backups are deleted when those backups expire in their normal cycle.

10.4 If you want a copy of your data before uninstalling, use the export features an App offers, or contact us before uninstalling.

11. Audits

11.1 Seapixel will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR. This means this DPA, our Privacy Policy, and written answers to a reasonable security or privacy questionnaire, at most once per year unless a supervisory authority requires otherwise or after a personal data breach.

11.2 If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, you may carry out an audit, either yourself or through an independent auditor who is bound by confidentiality and is not a competitor of Seapixel, on these terms:

• you give at least 30 days' written notice and agree the scope and timing with us in advance;
• the audit is carried out remotely, through document review and video calls, unless a supervisory authority requires an on-site inspection;
• it takes place during normal business hours, at most once in any 12 months unless a supervisory authority requires otherwise or after a personal data breach affecting your data, and in a way that does not disrupt our operations;
• it covers only the processing of your Merchant Personal Data, and never gives access to other customers' data or to information unrelated to that processing; and
• you bear your own costs and reimburse Seapixel's reasonable costs, including time spent, for any audit beyond the information described in 11.1, unless the audit reveals a material breach of this DPA by Seapixel.

12. Liability

12.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Agreement.

12.2 To the extent permitted by applicable law, Seapixel's total aggregate liability under or in connection with this DPA is limited to the greater of (a) the fees you paid to Seapixel for the App concerned in the 12 months before the event giving rise to the claim and (b) EUR 100, and Seapixel is not liable for any indirect, incidental, special or consequential loss, or for loss of profit, revenue, data or goodwill.

12.3 Nothing in this DPA limits liability that cannot be limited under applicable law, including a data subject's rights under Article 82 GDPR.

12.4 You will indemnify Seapixel against claims, fines and reasonable costs (including legal fees) brought by third parties or authorities that arise from your breach of this DPA or of data-protection law, including unlawful instructions, processing without a lawful basis or required consent, and special categories of data collected through an App as described in section 3.2.

13. General

13.1 If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails.

13.2 We may update this DPA to reflect changes in law, in our Apps or in our sub-processors. We will publish the updated version on this page with a new "Last updated" date. Changes that materially reduce the protection of Merchant Personal Data will be posted on this page at least 14 days before they take effect. If you do not accept a change, your remedy is to stop using the Apps.

13.3 This DPA is governed by the laws of Greece, and the courts of Athens, Greece have jurisdiction, without prejudice to any mandatory rights of data subjects or the powers of supervisory authorities.

13.4 If any provision of this DPA is held invalid, the rest remains in effect.

13.5 Only you and Seapixel can rely on and enforce this DPA. It gives no rights to any third party, without prejudice to the rights data subjects have under data-protection law.

Annex I: Details of the processing

Subject matter and nature: hosting, storage, retrieval and processing of data needed to provide each App's features to the Merchant's Shopify store, by automated means.

Purpose: providing the App's features as configured by the Merchant, and nothing else. Seapixel does not sell Merchant Personal Data or use it for advertising, profiling or training AI models.

Duration: while the App is installed, plus the deletion period in section 10.

Storefront analytics in our Apps are only sent when the Merchant's Storefront analytics setting is on, never from the theme editor, and only when the shopper allows analytics in Shopify's cookie banner (or their region does not ask for consent). They contain an event type, the product or content involved and the time, with no IP address, browser user agent or customer identity.

Per App:

• Snap Compare: Compare Products. Data subjects: storefront visitors and buyers. Data: anonymous storefront analytics (Insights plan only); for purchase attribution, the Shopify order id, order date and line-item properties, limited by Shopify's field filter so that no customer name, email, phone number or address is received. AI comparison summaries are generated from product data only. Retention: rolling 400 days.
• Snap Reels: Shoppable Videos. Data subjects: storefront visitors and buyers. Data: anonymous storefront analytics; for purchase attribution, the order id and, for the attributed line, product id, amount, quantity and currency, with no customer identity. Retention: rolling 100 days.
• Snap Quiz: Product Finder Quiz. Data subjects: shoppers who take a quiz and buyers. Data: quiz answers and results; if the shopper chooses to enter it, their email address, the Shopify customer id and their marketing opt-in choice; anonymous funnel analytics; for purchase attribution, the order id and attributed line amounts, with no customer identity. Depending on the Merchant's settings, a shopper's email is used to create or update a customer in the Merchant's store and to send the shopper one results email the shopper requested. Retention: quiz submissions for the period the Merchant chooses (30 to 365 days); funnel events 40 days; daily totals (counts only) 760 days.
• Snap Login: Login as Customer. Data subjects: the Merchant's customers. Data: customer email address and account status, looked up at the time of a request and not stored; for account invitations the Merchant sends, the Shopify customer id and email. Retention: invitations while the App is installed.
• Snap Locator: Store Finder. Data subjects: storefront visitors; people who submit the dealer application form. Data: store location details the Merchant enters (business data); dealer-form submissions (store name, email, phone, address and website the applicant enters), saved as draft locations in the Merchant's own store; anonymous storefront analytics, including the search text and map position a visitor searches. Retention: analytics rolling 400 days; dealer submissions stay in the Merchant's store until the Merchant deletes them.
• Snap Redirects: 301 & 404s. Data subjects: storefront visitors. Data: for each missing URL, the path, hit counts, and the referring page and browser user agent of the most recent visit. No IP addresses. Retention: until resolved or purged by the Merchant's settings.
• Snap Help, Snap Looks: Shop the Look, Snap Blocks: Theme Sections, Snap Search: Live Search Layer. These Apps work with store content (products, FAQs, theme settings) stored in the Merchant's own Shopify store and do not process shopper personal data on Seapixel's systems.

Store content sent to AI: some features in Snap Compare, Snap Quiz, Snap Locator, Snap Redirects and Snap Help send store content (such as product titles, descriptions and prices, FAQs, store policies, or a location's address and opening hours) to OpenAI to write text. These features are not designed to send shopper personal data, and the Merchant should not put shopper personal data into the content they use.

Annex II: Technical and organisational measures

• Encryption in transit: all traffic between the Apps, Shopify, shoppers' browsers and our providers uses HTTPS/TLS.
• Encryption at rest: data is stored with providers that encrypt it at rest.
• Access control: access to production systems and data is limited to Seapixel's authorised personnel, who need it to operate the Apps.
• Authentication and request verification: admin requests are authenticated with Shopify session tokens; Shopify webhooks are verified by HMAC signature; app-proxy requests from storefronts are verified by Shopify's signature.
• Store isolation: every request is scoped to the store identified by Shopify's signed token, so one store cannot read another store's data.
• Data minimisation: each App requests only the Shopify access scopes its features need; order notifications are limited with Shopify's field filter; storefront analytics carry no IP address, user agent or customer identity.
• Abuse protection: public storefront endpoints are rate-limited.
• Retention and deletion: automated retention periods as described in Annex I, and deletion on Shopify's shop/redact and customers/redact notifications.
• Review: from time to time we review the Apps' code for security issues, including with Shopify's app security checks.

Annex III: Sub-processors

• Vercel Inc.: application hosting and key-value storage (session and token storage, rate-limit counters). United States.
• Neon Inc. (Databricks): managed PostgreSQL database. United States (AWS us-east-1).
• Inngest Inc.: background job and webhook processing. United States.
• OpenAI, L.L.C.: AI text features, processing store content only (see Annex I). United States.
• Sendinblue SAS (Brevo): sending the results email a shopper requests in Snap Quiz. Paris, France; data hosted in the EU.

Shopify itself is the Merchant's own platform provider and not a sub-processor of Seapixel. Map providers used by Snap Locator's storefront (Mapbox or Google Maps, as the Merchant chooses) are loaded directly in the shopper's browser under the Merchant's control.

Contact

Questions about this DPA: hello@seapixel.com.