Data Processing
Addendum.

1. Scope

This DPA forms part of the Merchant Terms between the merchant as controller and DripCollector Ltd as processor. It applies to personal data DripCollector processes on the merchant's behalf through a connected store. Controller, processor, personal data, processing, and data subject have the meanings given by applicable UK data-protection law.

2. Processing Details

Subject and purpose: product import and display, shared-inventory synchronization, merchant-approved discounts, machine administration, support, and the store-side identity mapping used to begin customer authentication where enabled.

Duration: the store connection and the deletion period below. Data subjects: merchant staff and customers. Data: staff contact and authorization data; store-specific Shopify customer identifier and email for sign-in; and related discount or transaction references where enabled. The processor role applies to the store-side mapping. Once a customer creates or links a DripCollector account, DripCollector independently controls the resulting account identity record as described in Section 13. No special-category data is intended, and the merchant must not instruct us to process it.

3. Instructions and Purpose Limitation

We process merchant personal data only on documented instructions contained in this DPA, the Merchant Terms, Shopify permissions, and merchant configuration, unless law requires otherwise. We will inform the merchant if we believe an instruction infringes applicable data-protection law. Shopify customer identity data is limited to authentication, account linking, duplicate prevention, and recovery and is not used for advertising or profiling.

4. Confidentiality and Access

We limit merchant personal-data access to authorized personnel who need it to provide, secure, support, or legally administer the Service and who are subject to confidentiality obligations.

5. Security

Taking account of the nature and risk of processing, we maintain reasonable technical and organizational measures, including encrypted connections in transit, hosting-provider encryption at rest and for managed backups, protected storage of platform credentials, access restrictions, and logical separation of connected stores. No system is absolutely secure.

6. Subprocessors

The merchant generally authorizes subprocessors needed to provide the Service. Current categories include Supabase for database hosting; Cloudflare for delivery, tunneling, and storage; Vercel and Heroku/Salesforce for application hosting; Shopify for commerce APIs and customer authorization; Telegram for messaging where applicable; and payment, monitoring, warehouse, and logistics providers where the enabled feature requires them.

We require subprocessors to protect personal data consistently with applicable law and remain responsible for our processor obligations. We will provide notice of a material new subprocessor where required. A merchant may object on reasonable data-protection grounds and may disconnect if the parties cannot reasonably resolve the objection.

7. International Transfers

Where merchant personal data is transferred outside the United Kingdom or EEA, we use an applicable adequacy decision, approved standard contractual clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism.

8. Data-Subject Requests

Taking account of the processing, we will reasonably assist the merchant with requests for access, correction, deletion, restriction, portability, or objection. We treat a verified Shopify customer-data request or redaction event as a documented merchant instruction. A direct request relating solely to merchant-controlled data will be referred to the merchant unless law permits or requires us to act.

9. Deletion and Return

After disconnection, uninstall, a verified shop-redaction instruction, or termination, we will delete or return merchant personal data within a reasonable period and, where Shopify or applicable law specifies a deadline, within that deadline. This does not require deletion of records DripCollector must retain by law or independently controls for account security, fraud prevention, or completed transactions. Protected customer identity data will not be retained merely for possible future use.

10. Personal Data Breach

We will notify the merchant without undue delay after becoming aware of a personal-data breach affecting merchant personal data and provide reasonably available information about its nature, likely consequences, affected data and people, and mitigation. We will reasonably cooperate with the merchant's legally required assessment and notifications.

11. Assistance and Information

We will reasonably assist with data-protection impact assessments and regulator consultations relating to our processing. On reasonable notice, we will provide information necessary to demonstrate compliance and permit a proportionate audit no more than annually, during business hours, under confidentiality, at the merchant's cost, without exposing another party's data or security. We may first satisfy a request with written answers and existing documentation. DripCollector does not claim an independent SOC 2 or ISO 27001 certification.

12. Account-Link Conflicts

A Shopify customer identity is keyed to that store and customer, not merely to an email string. If an identity appears linked to another DripCollector account or an email matches an existing account, we will not merge or transfer accounts automatically. Resolution requires additional verification and may require support review.

13. Independent Processing

After a customer creates or links a DripCollector account, DripCollector is an independent controller for that account's identity record, authentication, recovery, platform security, fraud prevention, legal obligations, and completed DripCollector transactions. The store-side mapping remains governed by this DPA while it exists. Independent processing is governed by our Privacy Policy and is otherwise outside this processor DPA.

14. Precedence, Law, and Contact

This DPA is incorporated into the Merchant Terms and prevails on processor obligations. It is governed by the laws of England and Wales. Contact DripCollector Ltd, company number 17369183, at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, through official support channels, or at +44 7457 426504.