Data Processing Addendum

1Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Supervisory Authority" and "Personal Data Breach" have the meanings given in Data Protection Law. "Customer Personal Data" means Personal Data of the Merchant's customers that Henqq processes for the Merchant through the Service. "Sub-processor" means a third party Henqq engages to process Customer Personal Data.

2Roles and instructions

1. The Merchant is the Controller and Henqq is the Processor of Customer Personal Data.
2. Henqq processes Customer Personal Data only to provide the Service and on the Merchant's documented instructions: this DPA, the agreement, and the way the Merchant configures and uses the Service. Henqq will tell the Merchant if it believes an instruction breaks Data Protection Law.
3. The Merchant is responsible for having a lawful basis, giving its customers the required notices, and the accuracy of the data it supplies.

3Details of processing (Annex I)

4Henqq's obligations

Henqq will:

1. process Customer Personal Data only as set out in section 2;
2. make sure staff with access are bound by confidentiality;
3. keep the technical and organisational measures in Annex II in place;
4. help the Merchant answer Data Subject requests, and pass on any request it receives directly instead of answering it;
5. help the Merchant with security, breach notification, data protection impact assessments and prior consultation, as far as the Service is involved;
6. notify the Merchant without undue delay, and within 72 hours where feasible, after becoming aware of a Personal Data Breach affecting Customer Personal Data;
7. delete or return Customer Personal Data as set out in section 9; and
8. make available the information reasonably needed to show compliance, and allow audits under section 8.

5Sub-processors

1. The Merchant gives general authorisation for Henqq to use the Sub-processors in Annex III.
2. Henqq will give at least 14 days' notice of a new or replacement Sub-processor by email to the store contact address and an update to the sub-processor list on this page. The Merchant may object on reasonable data protection grounds within that time. If the parties cannot resolve the objection, the Merchant may stop using the Service and uninstall it.
3. Henqq binds each Sub-processor to data protection terms at least as protective as this DPA, and stays responsible for their performance.

6International transfers

1. Henqq is located in the United States and processes Customer Personal Data mainly in the United States.
2. Where Customer Personal Data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Module Two, controller to processor) in Commission Implementing Decision (EU) 2021/914, incorporated by reference, with: the Clause 7 docking clause applied; Clause 9(a) Option 2, general authorisation with the notice period in section 5; the optional wording in Clause 11 not applied; Clause 17 Option 1, governed by the law of Ireland; and Clause 18, the courts of Ireland. For the UK, the UK Addendum issued by the ICO applies. For Switzerland, references to the GDPR include the Swiss FADP.
3. Annexes I, II and III of this DPA are the annexes to the Clauses. The competent Supervisory Authority is the one for the Merchant's establishment.

7Security

Henqq keeps the measures in Annex II in place and may update them, as long as overall protection is not materially reduced.

8Audit

On reasonable written request, at most once a year unless there has been a breach, Henqq will give the Merchant its available security documentation or answer a security questionnaire. If that is not enough, the parties will agree the scope of an on-site or remote audit, at the Merchant's cost, in business hours and under confidentiality.

9Return and deletion

1. When the Merchant uninstalls the Service, Henqq removes sessions at once and automatically deletes Customer Personal Data and uploaded files 30 days later, unless the law requires longer retention.
2. On a Shopify shop redaction request, Henqq deletes the shop's products, files, license keys, orders and settings straight away.
3. The Merchant may ask for deletion or export of specific Customer Personal Data at any time by emailing [email protected]. Henqq will complete the request within 30 days.
4. Raw order event copies are deleted after 7 days. Backups are overwritten automatically on a rolling basis.

10Liability and general terms

Each party's liability under this DPA is subject to the limits in the agreement. If this DPA conflicts with the agreement on data protection, this DPA wins. If it conflicts with the Standard Contractual Clauses, the Clauses win. This DPA is governed by the law that governs the agreement, except where the Clauses require otherwise.

The Merchant accepts this DPA by continuing to use the Service. A countersigned copy is available on request from [email protected].

11Annex II: Technical and organisational measures

• Encryption in transit (TLS) on every connection.
• Files kept in private cloud storage and delivered only through signed links that expire.
• Sign-in through Shopify OAuth. Session tokens removed on uninstall.
• Production access limited to authorised staff, with credentials held in a managed secrets store.
• Data separated per store. Rate limiting and abuse detection on download and email endpoints.
• Email sending controls: daily caps, bounce and complaint suppression, and a kill switch.
• Error monitoring, logging, and alerts on failed deliveries.
• Automatic deletion on uninstall and on Shopify shop redaction. Raw order event backups expire after 7 days.
• Regular automated database backups, held by our database provider.
• A breach response process that includes notifying affected Merchants.

12Annex III: Authorised sub-processors

Mantle, Userflow, Microsoft Clarity, Crisp, LaunchDarkly and features.vote receive merchant data only, not Customer Personal Data.