Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Zapstra Terms of Service, any applicable order form, statement of work, Shopify app installation, subscription, service agreement, or other written agreement governing Customer’s use of Zapstra Services (collectively, the “Agreement”).

This DPA applies when Zapstra LLC (“Zapstra,” “we,” “us,” or “our”) Processes Customer Personal Data on behalf of a customer, merchant, business, or organization (“Customer,” “you,” or “your”) in connection with the Services.

By using the Services, installing a Zapstra app, approving Shopify app permissions, accepting an Order Form, or otherwise agreeing to the Agreement, Customer agrees to this DPA.

1. Scope and Relationship to Agreement

This DPA applies only to Zapstra’s Processing of Customer Personal Data on behalf of Customer in connection with the Services.

This DPA supplements the Agreement. If there is a conflict between this DPA and the Agreement regarding Processing of Customer Personal Data, this DPA controls only for that conflict. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control for the applicable restricted transfer.

Except as expressly modified by this DPA, the Agreement remains in full force and effect.

This DPA does not apply to information that Zapstra Processes as an independent controller or business for its own purposes, including account administration, billing, business operations, security monitoring, legal compliance, fraud prevention, analytics, marketing, product administration, or communications, except where Applicable Data Protection Laws require otherwise. Zapstra’s Processing of such information is described in Zapstra’s Privacy Policy.

2. Definitions

For purposes of this DPA:

“Agreement” means the Zapstra Terms of Service, any applicable Order Form, statement of work, Shopify app installation, subscription, service agreement, beta terms, design partner terms, or other written agreement governing use of the Services.

“Applicable Data Protection Laws” means all privacy, data protection, data security, breach notification, consumer privacy, and similar laws applicable to Zapstra’s Processing of Customer Personal Data under the Agreement, including where applicable the GDPR, UK GDPR, Swiss FADP, CCPA, and other U.S. State Privacy Laws.

“CCPA” means the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations.

“Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Process,” “Processing,” and “Supervisory Authority” have the meanings given to them under the GDPR or other Applicable Data Protection Laws.

“Customer Data” means data, content, files, records, Shopify store data, product data, inventory data, order data, fulfillment data, supplier data, customer data, support data, logs, screenshots, exports, or other information submitted to, uploaded to, transmitted through, or made available to Zapstra by or on behalf of Customer.

“Customer Personal Data” means Customer Data that constitutes Personal Data and that Zapstra Processes on behalf of Customer as a Processor, service provider, contractor, or similar role under Applicable Data Protection Laws.

“Customer Organization” means the Zapstra organization, workspace, account, billing account, or administrative grouping under which Customer may operate one or more Shops, users, apps, modules, or Services.

“De-Identified Data” means data that does not identify and cannot reasonably be used to identify Customer, a Shop, a Data Subject, household, device, or individual, taking into account reasonably available means.

“Documented Instructions” means Customer’s instructions to Zapstra for Processing Customer Personal Data, including the Agreement, this DPA, Order Forms, app configurations, Shopify permissions, API calls, support requests, product settings, written instructions from authorized users, and Customer’s use of the Services.

“GDPR” means Regulation (EU) 2016/679.

“Order Form” means any online checkout, Shopify billing approval, invoice, quote, statement of work, subscription selection, email confirmation, or other written agreement identifying paid Services, scope, fees, or commercial terms.

“Restricted Transfer” means a transfer of Personal Data from the European Economic Area, United Kingdom, or Switzerland to a country or recipient that does not provide an adequate level of protection under Applicable Data Protection Laws.

“Security Incident” means a breach of Zapstra’s security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by Zapstra. Security Incident does not include unsuccessful attempts or activities that do not compromise Customer Personal Data, such as unsuccessful login attempts, pings, port scans, denial-of-service attacks, or similar events.

“Services” means Zapstra’s websites, software, Shopify apps, APIs, integrations, automations, beta products, early-access products, support, consulting, custom-development services, design partner programs, documentation, and related offerings.

“Shop” means a Shopify store, Shopify shop, storefront, merchant account, or other store-level account connected to or Processed through the Services.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses adopted by the European Commission under Commission Implementing Decision (EU) 2021/914, as updated, amended, replaced, or superseded from time to time.

“Subprocessor” means a third party engaged by Zapstra to Process Customer Personal Data on behalf of Customer in connection with the Services.

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office, as updated, amended, replaced, or superseded from time to time.

“UK GDPR” means the GDPR as incorporated into the laws of the United Kingdom.

“U.S. State Privacy Laws” means U.S. state privacy laws applicable to Processing under this DPA, including where applicable the CCPA, Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, and similar state consumer privacy laws.

3. Roles of the Parties

For Customer Personal Data Processed by Zapstra on behalf of Customer, Customer is the Controller, business, or equivalent entity under Applicable Data Protection Laws, and Zapstra is the Processor, service provider, contractor, or equivalent entity.

If Customer is itself acting as a Processor on behalf of a third-party Controller, Customer represents and warrants that Customer has authority to appoint Zapstra as a Subprocessor and to provide Documented Instructions to Zapstra.

Customer is responsible for:

1. determining the purposes and means of Processing Customer Personal Data;
2. providing legally required notices to Data Subjects;
3. obtaining legally required consents;
4. establishing and documenting a lawful basis for Processing;
5. ensuring Customer Personal Data may lawfully be provided to Zapstra;
6. configuring Shopify permissions, app scopes, user access, API keys, integrations, and settings appropriately;
7. responding to Data Subject requests except to the extent Zapstra is required to assist under this DPA;
8. ensuring Customer’s use of the Services complies with Applicable Data Protection Laws; and
9. ensuring Customer’s instructions to Zapstra are lawful.

Zapstra will Process Customer Personal Data only as described in this DPA, the Agreement, and Customer’s Documented Instructions, unless required otherwise by applicable law. If Zapstra is required by law to Process Customer Personal Data other than according to Customer’s Documented Instructions, Zapstra will inform Customer before such Processing unless legally prohibited from doing so.

4. Details of Processing

The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects are described in Schedule 1 — Details of Processing.

Customer acknowledges that the specific categories of Customer Personal Data Processed by Zapstra depend on:

1. the Services Customer uses;
2. the Shopify permissions or app scopes Customer approves;
3. the data Customer uploads, submits, imports, or makes available;
4. the integrations Customer enables;
5. the workflows Customer configures;
6. Customer’s support requests;
7. Customer’s use of beta, design partner, API, or custom services; and
8. the information available through Shopify or other connected platforms.

5. Customer Instructions

Customer instructs Zapstra to Process Customer Personal Data as necessary to:

1. provide, operate, maintain, secure, and support the Services;
2. provide Shopify apps, APIs, webhooks, integrations, automations, analytics, forecasts, recommendations, and workflows;
3. process orders, inventory, products, fulfillments, draft orders, purchase orders, supplier records, shipping information, and related ecommerce operations;
4. provide onboarding, implementation, support, debugging, troubleshooting, and training;
5. provide beta, early-access, design partner, consulting, and custom-development services;
6. monitor performance, reliability, usage, errors, and security;
7. prevent, detect, and investigate fraud, abuse, errors, policy violations, and security incidents;
8. comply with Shopify platform requirements and other third-party platform requirements;
9. comply with applicable law;
10. create Aggregated Data or De-Identified Data; and
11. perform other activities described in the Agreement, this DPA, or Customer’s Documented Instructions.

Zapstra may refuse or suspend Processing instructions that Zapstra reasonably believes violate applicable law, third-party platform requirements, security obligations, or the Agreement.

6. Confidentiality

Zapstra will ensure that personnel authorized to Process Customer Personal Data are subject to confidentiality obligations or are otherwise bound by professional or contractual obligations of confidentiality.

Zapstra will limit access to Customer Personal Data to personnel and Subprocessors who need access for purposes authorized by this DPA and the Agreement.

7. Security Measures

Zapstra will maintain reasonable technical and organizational measures designed to protect Customer Personal Data from unauthorized access, disclosure, alteration, and destruction, as further described in Schedule 2 — Technical and Organizational Security Measures.

Customer acknowledges that security measures may evolve over time. Zapstra may update or modify its security measures provided that such updates or modifications do not materially reduce the overall level of protection for Customer Personal Data.

Customer is responsible for securing its own accounts, devices, Shopify permissions, third-party integrations, API keys, credentials, exports, local copies of data, and user access.

8. Subprocessors

Customer provides general authorization for Zapstra to engage Subprocessors to Process Customer Personal Data in connection with the Services.

Zapstra’s current Subprocessors and relevant customer-directed platforms are listed in Schedule 3 — Subprocessors and Third-Party Processing.

Zapstra will enter into written agreements with Subprocessors that impose data protection obligations materially similar to those imposed on Zapstra under this DPA, to the extent applicable to the nature of the services provided by the Subprocessor.

Zapstra remains responsible for Subprocessors’ performance of their data protection obligations to the extent required by Applicable Data Protection Laws.

Zapstra may add, replace, or remove Subprocessors from time to time. Where reasonably practicable, Zapstra will provide at least 30 days’ advance notice before authorizing a new Subprocessor to Process Customer Personal Data, either by email, account notice, in-app notice, website notice, subprocessor page, or other reasonable method.

If urgent replacement or addition of a Subprocessor is necessary for security, availability, compliance, continuity, legal, platform, or operational reasons, Zapstra may provide notice as soon as reasonably practicable.

Customer may object to a new Subprocessor on reasonable data protection grounds by providing written notice within 15 days after Zapstra’s notice. The objection must explain the specific data protection concern. Zapstra will use commercially reasonable efforts to address the concern.

If Zapstra cannot reasonably address Customer’s objection, Customer may terminate only the affected Services, subject to the Agreement. Customer is not entitled to a refund, credit, or penalty waiver unless expressly required by the Agreement or applicable law.

9. Customer-Directed Third-Party Platforms

The Services may connect with Shopify or other third-party platforms selected, authorized, or used by Customer.

Customer acknowledges that Shopify and other Customer-directed platforms may process Customer Personal Data under their own terms, policies, and agreements with Customer. Such platforms are not Subprocessors of Zapstra solely because Customer connects them to the Services, unless Zapstra separately engages them to Process Customer Personal Data on Zapstra’s behalf.

Zapstra is not responsible for third-party platforms’ privacy, security, availability, processing, policies, API changes, platform requirements, or acts or omissions.

10. Data Subject Requests

Zapstra will, taking into account the nature of the Processing and to the extent Customer cannot reasonably fulfill the request without Zapstra’s assistance, provide reasonable assistance to Customer in responding to requests from Data Subjects to exercise rights under Applicable Data Protection Laws.

If Zapstra receives a Data Subject request relating to Customer Personal Data, Zapstra may refer the request to Customer unless Zapstra is legally required to respond directly.

Customer is responsible for verifying the identity and authority of the requester and for determining whether and how to respond to a Data Subject request.

Zapstra may charge reasonable fees for assistance with Data Subject requests that are excessive, repetitive, technically complex, outside standard functionality, or not required by Applicable Data Protection Laws.

11. Shopify Privacy Webhooks and Shop-Scoped Redaction

Where required for Shopify apps, Zapstra may receive and respond to Shopify privacy and compliance webhooks, including customers/data_request, customers/redact, and shop/redact.

Customer acknowledges that Zapstra’s data model may support multiple Services, apps, modules, and Shops under a shared Customer Organization.

Zapstra will treat Shopify shop/redact requests as Shop-scoped redaction instructions unless applicable law, Shopify requirements, Customer’s written instructions, or the Agreement require broader deletion.

Customer Data for a Shop will be deleted, redacted, or de-identified within 30 days after Zapstra receives Shopify’s valid shop/redact webhook for that Shop, except to the extent retention is permitted or required under this DPA, the Agreement, applicable law, security obligations, audit obligations, backup practices, fraud-prevention obligations, dispute-resolution needs, or compliance requirements.

Where Customer operates multiple Shops under a single Customer Organization, deletion or redaction will be performed per Shop. A redaction request for one Shop does not require Zapstra to delete, redact, or disable Customer Data for other active Shops, apps, modules, Services, or Customer Organization records unless required by applicable law or Customer’s valid written instruction.

Zapstra may delete or de-identify Customer Organization-level records when there are no remaining active Shops, apps, modules, Services, billing obligations, legal retention requirements, security retention requirements, support obligations, or other legitimate retention needs associated with that Customer Organization.

12. Return and Deletion of Customer Personal Data

Upon termination of the Agreement, expiration of the applicable Services, valid written deletion request, or receipt of a valid platform deletion instruction, Zapstra will delete, redact, return, or de-identify Customer Personal Data in accordance with this DPA, the Agreement, Customer’s Documented Instructions, and applicable law.

Unless otherwise required by applicable law or the Agreement, Zapstra will delete or de-identify Customer Personal Data within 30 days after the applicable deletion trigger, subject to the retention exceptions in this Section.

Zapstra may retain Customer Personal Data to the extent necessary for:

1. legal, tax, accounting, audit, or regulatory obligations;
2. security, fraud prevention, abuse prevention, or incident investigation;
3. dispute resolution or enforcement of the Agreement;
4. backup, archival, or disaster recovery systems;
5. compliance with Shopify or other platform requirements;
6. records of deletion, redaction, consent, access, or compliance activity;
7. support records and communications;
8. billing and transaction records; or
9. other legitimate business purposes permitted by Applicable Data Protection Laws.

Backup, audit, and security copies may be retained for up to 90 days, or longer where required by law, legal hold, security investigation, dispute, or compliance obligation, and will be deleted or overwritten in the ordinary course.

Zapstra may retain Aggregated Data and De-Identified Data indefinitely.

13. Security Incidents and Personal Data Breaches

Zapstra will notify Customer without undue delay and, where feasible, within 72 hours after confirming a Personal Data Breach affecting Customer Personal Data.

Zapstra’s notice will include information reasonably available to Zapstra, which may include:

1. the nature of the Personal Data Breach;
2. categories of Customer Personal Data affected;
3. categories of Data Subjects affected;
4. likely consequences, if known;
5. measures taken or proposed to address the Personal Data Breach;
6. measures recommended for Customer to mitigate potential adverse effects; and
7. a contact point for follow-up.

Zapstra may provide information in phases as it becomes available.

Zapstra’s notice of or response to a Security Incident is not an admission of fault, liability, or violation of law.

Customer is responsible for determining whether a Security Incident requires notification to Data Subjects, Supervisory Authorities, regulators, customers, merchants, Shopify, or other third parties, except where Zapstra has a direct legal obligation.

14. Assistance with Compliance

Taking into account the nature of Processing and the information available to Zapstra, Zapstra will provide reasonable assistance to Customer, to the extent required by Applicable Data Protection Laws and where Customer cannot reasonably fulfill the obligation without Zapstra’s assistance, with:

1. Data Subject requests;
2. security obligations;
3. Personal Data Breach notifications;
4. data protection impact assessments;
5. prior consultations with Supervisory Authorities;
6. deletion, redaction, access, and export requests;
7. Shopify privacy compliance workflows; and
8. other obligations required by Applicable Data Protection Laws.

Zapstra may charge reasonable fees for assistance that is excessive, repetitive, outside standard functionality, requires custom engineering, requires legal analysis specific to Customer, or is not required by Applicable Data Protection Laws.

15. Audits and Compliance Information

Zapstra will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and operational restrictions.

Zapstra may satisfy audit obligations by providing documentation, written responses, security summaries, subprocessor information, compliance questionnaires, policies, technical descriptions, or third-party reports if available.

Customer may request such information no more than once per calendar year unless a Security Incident affecting Customer Personal Data or a legally binding request requires additional review.

Onsite audits, penetration tests, source code reviews, vulnerability scans, infrastructure access, employee interviews, or inspections of Zapstra systems are not permitted unless legally required or separately agreed in writing.

If an onsite audit is legally required or separately agreed:

1. Customer must provide at least 30 days’ written notice;
2. the audit must occur during normal business hours;
3. the audit must be limited to the scope required by Applicable Data Protection Laws;
4. the audit must not unreasonably disrupt Zapstra’s operations;
5. the audit must not compromise security, confidentiality, trade secrets, or other customers’ data;
6. Customer must use an independent auditor reasonably acceptable to Zapstra;
7. all auditors must sign confidentiality obligations acceptable to Zapstra;
8. Customer is responsible for all costs and expenses; and
9. Zapstra may object to audit activities that create security, confidentiality, legal, operational, or technical risk.

16. International Transfers

Customer authorizes Zapstra and its Subprocessors to Process Customer Personal Data in the United States and other countries where Zapstra or its Subprocessors operate, subject to this DPA and Applicable Data Protection Laws.

For Restricted Transfers from the European Economic Area, United Kingdom, or Switzerland, the terms in Schedule 4 — International Data Transfers apply.

Where the Standard Contractual Clauses apply, the parties agree that:

1. Customer is the data exporter;
2. Zapstra is the data importer;
3. Module Two applies where Customer is a Controller and Zapstra is a Processor;
4. Module Three applies where Customer is a Processor and Zapstra is a Subprocessor;
5. the details of Processing are described in Schedule 1;
6. the security measures are described in Schedule 2; and
7. the Subprocessors are described in Schedule 3.

17. U.S. State Privacy Laws

For Customer Personal Data subject to U.S. State Privacy Laws, the terms in Schedule 5 — U.S. State Privacy Addendum apply.

Without limiting Schedule 5, Zapstra will not sell or share Customer Personal Data, retain, use, or disclose Customer Personal Data outside the business purposes described in the Agreement and this DPA, or combine Customer Personal Data with personal information from other sources except as permitted by Applicable Data Protection Laws.

18. AI-Assisted Processing

Customer acknowledges that Zapstra may use AI-assisted tools and AI-related Subprocessors to provide, support, troubleshoot, analyze, parse, summarize, develop, test, secure, or improve the Services.

Zapstra will not intentionally use Customer Personal Data to train general-purpose AI models unless Customer has provided separate authorization or Zapstra has provided additional notice where required by Applicable Data Protection Laws.

Zapstra will use reasonable measures to limit Customer Personal Data submitted to AI-assisted tools to what is reasonably necessary for the applicable Service, support request, document parsing, troubleshooting activity, product function, or Customer instruction.

Customer should not submit unnecessary sensitive personal information, payment card numbers, health information, government identifiers, authentication credentials, or other unnecessary confidential information through support channels, prompts, uploads, forms, documents, or integrations.

AI-assisted Subprocessors that Process Customer Personal Data are listed in Schedule 3 where applicable.

19. Sensitive Personal Data

Customer agrees not to submit sensitive personal data, special categories of personal data, protected health information, government identifiers, full payment card numbers, authentication credentials, children’s data, biometric data, or other highly sensitive information to the Services unless:

1. the information is necessary for Customer’s use of the applicable Services;
2. Customer has obtained all legally required rights, notices, consents, and authorizations;
3. Customer’s submission complies with Applicable Data Protection Laws;
4. the applicable Service is designed to Process that type of data; and
5. Zapstra has agreed to such Processing where required.

Zapstra does not intentionally store full payment card numbers. Payment card processing, where applicable, is handled by third-party payment processors.

20. Aggregated and De-Identified Data

Zapstra may create, use, retain, disclose, and commercialize Aggregated Data and De-Identified Data for analytics, benchmarking, product development, operations, security, research, reporting, and business purposes.

Zapstra will not attempt to re-identify De-Identified Data except as permitted by Applicable Data Protection Laws, including for testing whether de-identification measures are effective.

21. Customer Warranties

Customer represents and warrants that:

1. Customer has all rights, permissions, notices, consents, and legal bases necessary to provide Customer Personal Data to Zapstra;
2. Customer’s Documented Instructions comply with Applicable Data Protection Laws;
3. Customer’s use of the Services complies with Applicable Data Protection Laws;
4. Customer has provided all required notices to Data Subjects;
5. Customer has obtained all required consents and authorizations;
6. Customer has authority to connect Shops, approve Shopify app permissions, authorize integrations, and submit Customer Personal Data;
7. Customer will not submit prohibited or unnecessary sensitive data; and
8. Customer will configure the Services, app scopes, integrations, automations, and user permissions appropriately.

22. Liability

Each party’s liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in the Agreement.

This DPA does not create any separate or additional liability cap, indemnity, warranty, representation, remedy, or cause of action except as expressly stated.

Nothing in this DPA limits liability to the extent such limitation is prohibited by Applicable Data Protection Laws.

23. Term

This DPA remains in effect for as long as Zapstra Processes Customer Personal Data on behalf of Customer.

Sections that by their nature should survive termination will survive, including provisions relating to deletion, confidentiality, security, audits, international transfers, liability, and U.S. State Privacy Laws.

24. Changes to this DPA

Zapstra may update this DPA from time to time.

If Zapstra makes material changes, Zapstra may provide notice by posting the updated DPA, emailing Customer, providing in-app notice, updating a legal page, or using another reasonable method.

Continued use of the Services after the effective date of an updated DPA constitutes acceptance of the updated DPA, except where Applicable Data Protection Laws require a different process.

25. Contact

Questions about this DPA may be sent to: