Data Processing Agreement

1. Parties and definitions

“Processor”, “we”, “us”: Orumio, represented by Masanori Iwata, Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan, contact support@orumio.com.

“Controller”, “you”, “Merchant”: the operator of the Shopify store in which the App is installed.

“App”: Standing Orders. “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR. “Data Protection Law” means every privacy or data protection law applicable to the Processing under this DPA, including the EU GDPR, the UK GDPR, Japan’s Act on the Protection of Personal Information (APPI), and the US state privacy laws addressed in Annex IV. “Merchant Commercial Data” means the non-personal business data the App processes for you — your standing orders and their schedules, the product and quantity lines they carry, and the execution and activity records computed from them.

2. Roles and scope

You are the Controller of the Personal Data in your Shopify store. We are your Processor, and we process that Personal Data only to provide the App to you.

Shopify is an independent party to this DPA. Your relationship with Shopify, including Shopify’s own role in respect of your store data, is governed by your agreement with Shopify and not by this document.

This DPA applies for as long as the App has access to your Shopify store and survives uninstallation for as long as we hold any of your data.

3. Instructions

We process data only on your documented instructions, including in respect of transfers to a third country. Your instructions are: (a) this DPA, including Annex I; (b) the App’s documented functionality, which you direct by configuring standing orders in your store; and (c) any further written instruction you give us that we accept.

We will tell you if, in our opinion, an instruction infringes Data Protection Law. We will not process your data for our own purposes — specifically not for marketing, advertising, profiling, resale, cross-customer benchmarking, or the training of machine-learning models.

If we are required by law to process data beyond your instructions, we will inform you of that legal requirement before processing, unless the law forbids us from doing so on important grounds of public interest.

4. Confidentiality

The App is operated by a single person, who is bound by a duty of confidentiality in respect of all data processed under this DPA. There are no staff accounts, contractors, or support agents with access to Merchant data. If that ever changes, we will ensure that any person authorised to process your data is placed under an equivalent obligation of confidentiality before access is granted.

Merchant Commercial Data is confidential business information even where it is not Personal Data. We apply the measures in Annex II to it in full, and we do not disclose it, aggregate it across customers, or use it for any purpose other than providing the App to you.

5. Security

We implement and maintain the technical and organisational measures set out in Annex II, which are appropriate to the risk, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing.

The primary measure is minimisation: the App does not store the Personal Data of your buyers at all. We may update the measures in Annex II over time, but we will not reduce the overall level of security.

6. Sub-processors

You give us general written authorisation to engage sub-processors. The sub-processors engaged as at the effective date of this DPA are listed in Annex III.

Before we add or replace a sub-processor we will update Annex III and announce the change to customers with an active installation at least 30 days in advance. You may object on reasonable data protection grounds within that period; if we cannot resolve your objection, you may terminate by uninstalling the App, and we will delete your data in accordance with §10.

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for each sub-processor’s performance.

7. Assistance with data subject rights

Because the App stores no buyer Personal Data, requests to access, rectify, erase, restrict, port, or object usually require no action from us — the data lives in Shopify, under your control.

Where a Data Subject nonetheless contacts us directly, we will not respond substantively ourselves. We will refer them to you, and tell you promptly. Taking account of the nature of the Processing, we will assist you by appropriate technical and organisational measures, so far as possible, in fulfilling your obligation to respond.

We honour the Shopify mandatory compliance webhooks: customers/data_request (we return nothing, because we hold nothing), customers/redact (no action required, for the same reason), and shop/redact (we delete your entire tenant, per §10).

8. Personal data breach

We will notify you of a Personal Data Breach affecting your data without undue delay after becoming aware of it, and in any event targeting within 72 hours of confirming it. The notification will describe, so far as it is known at the time: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information cannot be provided at once, we will provide it in phases without further undue delay rather than waiting for a complete root-cause analysis. We apply the same notification commitment to incidents affecting Merchant Commercial Data or your platform credentials.

We maintain a written security incident response policy covering detection, containment, assessment, notification, remediation and post-incident review, and we review it after every significant incident.

9. Data protection impact assessments

Taking into account the nature of the Processing and the information available to us, we will provide reasonable assistance with your data protection impact assessments and any prior consultation with a Supervisory Authority.

10. Deletion and return

• On uninstallation, we immediately revoke the stored Shopify credentials and cancel every scheduled occurrence that has not yet run, so no further Processing can occur.
• On receipt of Shopify’s shop/redact request (approximately 48 hours after uninstallation), we delete your installation record and everything attached to it — entitlement, standing orders, order lines, execution records, activity events and any feedback sent through the App.
• As a backstop against a lost webhook, the App deletes any installation that has been uninstalled for more than 30 days, with the same cascade.
• You may request earlier deletion at any time by writing to the contact address in §1.

Operational logs contain identifiers, classifications, counts and timestamps only, and no Personal Data; they expire on our hosting provider’s ordinary schedule.

11. Audits and information

We will make available to you all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In the first instance we will respond to a reasonable written request with our data protection policy, our incident response policy, and a written description of the measures in Annex II. An on-site inspection may be requested where that is not sufficient, on reasonable notice, no more than once in any twelve-month period except following a Personal Data Breach, and subject to confidentiality.

12. International transfers

We are established in Japan, and the App’s database and application servers are located in the United States, primarily — the database is placed there with a location hint to our hosting provider — and requests are served from its global network (Annex III).

Where Personal Data protected by the EU GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), Module Two (controller to processor) are incorporated into this DPA by reference and take precedence over it in the event of conflict. For the purposes of those Clauses: you are the data exporter and we are the data importer; the optional docking clause applies; the general authorisation for sub-processors in §6 applies with 30 days’ notice; the governing law is that of Ireland; disputes are resolved in the courts of Ireland; and Annexes I, II and III below serve as Annexes I, II and III to the Clauses.

Where Personal Data protected by the UK GDPR is transferred, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) is incorporated by reference, with the information in Annexes I–III below completing its Tables.

Japan has received an adequacy decision from the European Commission, and the United Kingdom has made an equivalent finding.

13. Japan (APPI)

Where Japan’s Act on the Protection of Personal Information applies, we act as a party entrusted with the handling of personal data (委託先) under Article 27(5)(i), and you retain the supervisory obligation under Article 25. The measures in Annex II are the measures we take for that purpose, and §12 records the locations of the servers on which the data is held.

14. Term, precedence and liability

This DPA takes effect when you install the app on your Shopify store and continues until we hold no data of yours. Where it conflicts with any other agreement between us, this DPA prevails on data protection matters; where it conflicts with the Standard Contractual Clauses, those Clauses prevail.

Nothing in this DPA limits either party’s liability to a Data Subject or to a Supervisory Authority under Data Protection Law.

15. Governing law

This DPA is governed by the laws of Japan, and the Tokyo District Court has exclusive jurisdiction as the court of first instance over any dispute arising from it. §12 governs the law and forum applicable to the Standard Contractual Clauses themselves.

Annex I — Details of the processing

A. Parties

Data exporter / Controller: the Merchant, being the operator of the Shopify store in which the App is installed. Contact details are those held in the Merchant’s Shopify account. Role: controller.

Data importer / Processor: Orumio, represented by Masanori Iwata, Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan, contact support@orumio.com. Activities: providing the Standing Orders app. Role: processor.

B. Description of the processing

C. Competent supervisory authority

The supervisory authority of the EU/EEA Member State in which the Merchant, as data exporter, is established; or, where the Merchant is not established in the EU/EEA but is subject to the GDPR under Article 3(2), the supervisory authority of the Member State in which the Merchant’s Article 27 representative is established.

Annex II — Technical and organisational measures

These are the measures actually implemented in the App, in order of how much risk each removes.

1. Data minimisation as the primary control. Buyer Personal Data is never written to the database. Data that was never stored cannot be exfiltrated from storage, exposed in a backup, or disclosed by a database compromise. The phone and address protected-data fields are not declared to Shopify and are never read.
2. Encryption in transit. The App is served exclusively over HTTPS/TLS. The database is reached through a binding internal to the hosting provider (Annex III) rather than a network connection: no database endpoint, credential or connection string exists to be exposed.
3. Encryption at rest. The hosting provider (Annex III) encrypts all data and its point-in-time history at rest (provider-managed). No self-managed backup, export or snapshot pipeline exists, so no unencrypted copy of the database exists anywhere.
4. Application-layer encryption of credentials. Shopify offline access and refresh tokens are encrypted with AES-256-GCM before they reach the database, with the shop domain as additional authenticated data, so a record lifted into another tenant fails to decrypt.
5. Tenant isolation. Row-level tenancy: every domain record reaches the installation record by foreign key and every query filters through it.
6. Bounded egress. While processing your data, the App communicates server-side with two destinations: the Shopify Admin API and the transactional email provider. Two further requests carry none of it: once per installation the App tells the affiliate network your store domain and the opening browser’s IP address, as described under Affiliate attribution in the Privacy Policy; and the public pages on this domain are fetched from Orumio’s own hub site, which receives no store data. There is no analytics SDK, no error-reporting service receiving payloads, and no third-party script in the server path. Separately from all of the above, the Merchant’s browser sends a masked measurement of the App’s own screens to Orumio’s processor as described under Product usage measurement in the Privacy Policy; it carries none of the data this DPA covers, and it never runs in the server path.
7. Log hygiene. Logs record identifiers, classifications, counts and timestamps only. Token material, HMAC signatures, raw webhook bodies and buyer Personal Data are excluded by rule, and two automated layers enforce it: redaction of fields whose names indicate a credential, and scrubbing of credential patterns out of third-party error messages. Both are covered by automated tests.
8. Access logging. Every read of a protected customer field records the purpose, the resource, the names of the fields read, whether a person or the scheduler triggered it, and the record count — never the values.
9. Endpoint authorisation. Merchant routes require an authenticated Shopify admin session; internal scheduler endpoints require a bearer secret and return 401 rather than redirecting; webhook routes reject invalid HMAC signatures with 401.
10. Client exposure boundary. Credentials never leave the server. Route loaders return only the fields the interface renders; raw platform responses are never shipped to the browser.
11. Separation of test and production data. Production data lives only in the production database, which the deployed App reaches through its binding and which the operator can reach only through the hosting provider’s authenticated command-line tooling. Development uses a local database on the developer machine and the automated tests a throwaway database created for each run; neither has ever contained production data. Production secrets are held in the hosting provider’s secret store, are never committed to source control, and are not kept on a developer machine.
12. Access control. Single operator; no staff accounts, contractors or support agents. Every account in scope is protected by two-factor authentication and a unique password generated and stored in a password manager. Access is reviewed whenever the operator set changes.
13. Availability and incident detection. A health endpoint plus an independent external monitor detect a stalled or unreachable scheduler; runtime logs surface failures; an environment kill switch halts all order creation without requiring a deployment.
14. Governance. A written data protection policy and a written security incident response policy are maintained and reviewed at each release gate and after every significant incident.

Annex III — Sub-processors

Shopify is not listed as a sub-processor: it is the platform on which your store runs and the source from which we read, under your own separate agreement with Shopify. Our affiliate network is not listed either, and for a different reason. It is the affiliate network through which we pay partners who recommend the App. Once per installation we tell it that your store installed the App, sending your myshopify domain and the IP address of the browser that opened the App — and nothing else, ever. None of that is Personal Data we process on your behalf under this DPA: it is our own record of our own marketing, for which we are the controller rather than your processor. It is therefore outside Annex I, it is not an engagement of a sub-processor under §6, and it does not touch the undertaking in §3 not to process your Personal Data for our own purposes. It is set out in full under Affiliate attribution in our Privacy Policy, and you can have the record erased by writing to the contact address in §1. Our product-analytics service is not listed either, for the same reason. The App measures how its own screens are used — seven named events and a recording in which every piece of text is masked and every form control is blocked — and sends that from your browser to that service, hosted in the European Union, under an opaque installation identifier and with nothing stored in the browser. It is our own measurement of our own product, for which we are the controller and the service is our processor under its data processing agreement with us; it processes none of the Personal Data this DPA covers, so it is outside Annex I, it is not an engagement of a sub-processor under §6, and it does not touch the undertaking in §3. Because it nonetheless narrows what an existing Merchant agreed to, installations that predate this version are not measured until 30 days after its effective date — the notice period §6 would give — and see a notice in the App until then. It is set out in full under Product usage measurement in our Privacy Policy, and you can have your store excluded by writing to the contact address in §1.

Annex IV — United States state privacy laws

Where the California Consumer Privacy Act as amended (CCPA/CPRA) or a comparable US state privacy law applies, we act as a service provider (or processor, where that is the statutory term) and:

• we do not sell or share personal information, as those terms are defined in the CCPA, and we receive no consideration for it;
• we do not retain, use, or disclose personal information for any purpose other than the business purposes specified in this DPA, including not for our own commercial purposes;
• we do not combine personal information received from you with personal information received from any other source, except as permitted by the CCPA;
• we will notify you if we determine we can no longer meet these obligations;
• you may take reasonable and appropriate steps to stop and remediate any unauthorised use of personal information.

The App performs no cross-context behavioural advertising, no profiling for advertising or marketing purposes, and no automated decision-making producing legal or similarly significant effects.