# DATA PROCESSING AGREEMENT — Shopify Connection **Version 1.0 — effective upon acceptance by the Brand.** **Between:** ENVRT LIMITED, company number 12710505, whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("**ENVRT**", the "**Processor**"), and the customer accepting this Data Processing Agreement when enabling its Shopify connection to the ENVRT dashboard ("**the Brand**", the "**Controller**"). This Data Processing Agreement ("**DPA**") forms part of the agreement governing the Brand's use of ENVRT's services (the "**Main Agreement**"). --- ## 1. Background and scope 1.1 The Brand may connect its Shopify store to the ENVRT dashboard (the "**Shopify Integration**"). In providing the Shopify Integration, ENVRT processes limited Personal Data on the Brand's behalf. 1.2 This DPA governs the processing of Personal Data by ENVRT on behalf of the Brand in connection with the Shopify Integration and related Shopify privacy-compliance requests. 1.3 Product data, company information, compliance records and other content submitted or selected by the Brand for use within the ENVRT dashboard are governed by the Main Agreement. Where any such content constitutes Personal Data and ENVRT processes it on the Brand's behalf, this DPA also applies to that processing. For clarity, a product image selected by the Brand for import from Shopify may become Service Content under the Main Agreement, but that classification does not disapply this DPA where the image contains Personal Data. 1.4 The Shopify Integration is designed to minimise the Personal Data processed by ENVRT. For order-destination analysis, ENVRT does not request customer names, customer email addresses, customer telephone numbers, full street addresses, payment details, order IDs, customer IDs or order line items. --- ## 2. Definitions 2.1 "**Data Protection Laws**" means, to the extent applicable to the relevant processing: - the UK GDPR; - the Data Protection Act 2018; - Regulation (EU) 2016/679 (the "**EU GDPR**"); and - any legislation that implements, supplements, replaces or materially amends the foregoing. 2.2 "**Brand Personal Data**" means Personal Data processed by ENVRT on behalf of the Brand under this DPA. 2.3 "**Restricted Transfer**" means a transfer of Personal Data that requires an adequacy decision, adequacy regulation or other safeguard under Chapter V of the UK GDPR or EU GDPR. 2.4 "**Sub-processor**" means a third party appointed by or on behalf of ENVRT to process Brand Personal Data. 2.5 "**UK GDPR**" has the meaning given to it in section 3(10), as supplemented by section 205(4), of the Data Protection Act 2018. 2.6 "**Personal Data**", "**processing**", "**Controller**", "**Processor**", "**Data Subject**", "**Personal Data Breach**" and other data-protection terms not defined in this DPA have the meanings given to them under the applicable Data Protection Laws. --- ## 3. Roles and documented instructions 3.1 The Brand is the Controller of Brand Personal Data and ENVRT is the Processor. 3.2 ENVRT shall process Brand Personal Data only on the Brand's documented instructions, including with respect to any Restricted Transfer, unless ENVRT is required to process Brand Personal Data by applicable law. 3.3 The Brand's documented instructions are to process Brand Personal Data only as reasonably necessary to: - provide and operate the Shopify Integration; - perform the processing described in Annex A; - import Shopify catalogue content affirmatively selected by the Brand into the ENVRT service; - maintain the security, integrity and availability of the Shopify Integration; - comply with Shopify privacy-compliance requests relating to the Shopify Integration; and - comply with any further written instructions issued by the Brand that are consistent with the Main Agreement, this DPA and Data Protection Laws. 3.4 If applicable law requires ENVRT to process Brand Personal Data other than on the Brand's documented instructions, ENVRT shall inform the Brand of that legal requirement before processing, unless applicable law prohibits ENVRT from doing so. 3.5 ENVRT shall promptly inform the Brand if, in ENVRT's opinion, an instruction infringes Data Protection Laws. ENVRT may suspend the affected processing until the parties have resolved the matter. --- ## 4. Controller responsibilities 4.1 The Brand is responsible for ensuring that: - its instructions to ENVRT comply with Data Protection Laws; - it has an appropriate lawful basis for the processing of Brand Personal Data; - it has provided Data Subjects with all privacy information required by Data Protection Laws; - its use of the Shopify Integration is consistent with applicable law and its obligations to Shopify; and - it does not instruct ENVRT to process Personal Data for a purpose that is unlawful or materially outside the scope of the Shopify Integration or Main Agreement. 4.2 The Brand remains responsible for responding to Data Subjects and supervisory authorities except to the extent that this DPA requires ENVRT to provide assistance. 4.3 The Brand may exercise the information, assistance, audit, objection, deletion and return rights set out in this DPA. --- ## 5. Details and nature of processing 5.1 The subject matter, nature, purpose, categories of Data Subjects, categories of Personal Data, duration and retention arrangements are set out in Annex A. 5.2 In summary, ENVRT may read selling-market information and product catalogue information through the Shopify API; read only the destination-country element of recent Shopify orders for destination analysis; use Shopify pagination cursors where technically necessary; and transiently receive raw Shopify privacy-compliance webhook bodies solely for authentication and compliance purposes as described in this DPA. 5.3 For order-destination analysis, ENVRT computes country-level order counts and does not retain the underlying customer-level shipping information used to calculate those counts. 5.4 For the purposes of this DPA, ENVRT shall treat country-level order aggregates generated in connection with an identifiable Brand or Shopify store as Brand Personal Data. 5.5 Product catalogue information is ordinarily business or product data. Where catalogue content itself contains Personal Data, including where a product image depicts an identifiable individual, ENVRT shall treat that Personal Data in accordance with this DPA while processing it on the Brand's behalf. 5.6 ENVRT shall not intentionally request or process special-category Personal Data or criminal-offence data through the Shopify Integration. --- ## 6. Processor obligations 6.1 ENVRT shall: - process Brand Personal Data only in accordance with clause 3; - ensure that persons authorised to process Brand Personal Data are subject to an appropriate duty of confidentiality; - implement and maintain appropriate technical and organisational measures, including the measures described in Annex B; - appoint Sub-processors only in accordance with clause 7; - taking into account the nature of the processing, assist the Brand by appropriate technical and organisational measures, insofar as reasonably possible, in responding to requests from Data Subjects; - taking into account the nature of the processing and the information available to ENVRT, assist the Brand with its obligations under Articles 32 to 36 of the UK GDPR and, where applicable, the EU GDPR; - notify the Brand of Personal Data Breaches in accordance with clause 9; - delete or return Brand Personal Data in accordance with clause 11; and - make available the information reasonably necessary to demonstrate compliance with the obligations placed on processors by Data Protection Laws and this DPA. 6.2 ENVRT shall not: - sell Brand Personal Data; - use Brand Personal Data for advertising; - use Brand Personal Data to train machine-learning or artificial-intelligence models; - combine Brand Personal Data with personal data obtained from unrelated third parties for profiling or advertising purposes; or - process Brand Personal Data for any purpose incompatible with the instructions set out in clause 3. 6.3 Nothing in this DPA prevents ENVRT from using information that has been irreversibly anonymised so that it no longer constitutes Personal Data, provided that any anonymisation of Brand Personal Data is carried out within the Brand's documented instructions or as otherwise permitted by Data Protection Laws and ENVRT does not attempt to re-identify any Data Subject from that information. --- ## 7. Sub-processors 7.1 The Brand gives ENVRT general written authorisation to engage the Sub-processors listed in Annex C. 7.2 ENVRT shall give the Brand at least 30 days' prior notice of any intended addition or replacement of a Sub-processor that will process Brand Personal Data. Notice may be provided by email to the Brand's account administrator, through the ENVRT dashboard, or by another reasonable written method. 7.3 The Brand may object to a proposed Sub-processor during the notice period on reasonable grounds relating to data protection. 7.4 If the Brand raises a reasonable objection, the parties shall work in good faith to resolve it. ENVRT may, where reasonably practicable, avoid using the proposed Sub-processor for the Brand or propose an alternative arrangement. 7.5 If the parties cannot resolve a reasonable objection before the proposed Sub-processor begins processing Brand Personal Data, either party may discontinue the affected Shopify Integration. The Brand shall not incur a termination charge solely for discontinuing the affected Shopify Integration under this clause, but this clause does not automatically terminate unrelated ENVRT services. 7.6 ENVRT shall enter into a written agreement with each Sub-processor imposing data-protection obligations that provide an equivalent level of protection for Brand Personal Data, insofar as applicable to the services performed by that Sub-processor. 7.7 ENVRT remains responsible to the Brand for the performance of its Sub-processors' data-protection obligations to the extent required by Data Protection Laws. --- ## 8. Data Subject and Shopify privacy requests 8.1 ENVRT shall, taking into account the nature of the processing, provide reasonable assistance to the Brand in responding to Data Subject requests concerning Brand Personal Data. 8.2 ENVRT shall not respond directly to a Data Subject concerning Brand Personal Data except: - on the Brand's documented instruction; - as required by applicable law; or - where a response is technically required by Shopify's privacy-compliance mechanism and is limited to completing or acknowledging the applicable Shopify request. 8.3 The Shopify Integration receives the privacy-compliance webhooks required by Shopify, including customer data-access, customer-erasure and store-erasure requests. 8.4 ENVRT receives the raw webhook request body solely to authenticate the request using Shopify's HMAC signature. ENVRT does not parse, retain or log customer identifiers, order identifiers, email addresses, telephone numbers or other customer-level fields contained in the webhook payload. Following authentication and handling, the raw request body is discarded. 8.5 Because ENVRT does not retain customer-attributable information through the order-destination functionality, customer data-access and customer-erasure webhooks require no customer-level lookup or deletion for that functionality. ENVRT records only the minimum operational information reasonably necessary to evidence receipt and handling of the webhook, currently the Shopify delivery identifier, webhook topic and shop domain. Store-erasure requests are handled in accordance with clause 11. 8.6 ENVRT shall provide assistance under this clause without undue delay and, where a request is forwarded directly by the Brand, normally within 10 business days or sooner where reasonably necessary to enable the Brand to meet a mandatory legal deadline. --- ## 9. Personal Data Breaches 9.1 ENVRT shall notify the Brand without undue delay and, in any event, within 48 hours after becoming aware of a Personal Data Breach affecting Brand Personal Data. 9.2 The notification shall, to the extent known and reasonably available at the time: - describe the nature of the Personal Data Breach; - identify the categories of Brand Personal Data and Data Subjects affected, where known; - describe the likely consequences of the Personal Data Breach, where reasonably capable of assessment; - describe the measures taken or proposed to contain, investigate or remediate the Personal Data Breach; and - provide contact details for further communication concerning the incident. 9.3 Where complete information is not available within the initial notification period, ENVRT may provide information in phases and shall provide material further information without undue delay as it becomes available. 9.4 ENVRT shall reasonably cooperate with the Brand in investigating, containing and remediating the Personal Data Breach and in enabling the Brand to comply with its applicable notification obligations. 9.5 ENVRT's notification of a Personal Data Breach does not constitute an admission of fault or liability. --- ## 10. International transfers 10.1 ENVRT shall not make a Restricted Transfer of Brand Personal Data unless the transfer is permitted by Data Protection Laws. 10.2 Where an applicable adequacy decision or adequacy regulation permits the transfer, the parties may rely on that mechanism for so long as it remains valid and applicable. 10.3 Where a Restricted Transfer is not covered by an applicable adequacy mechanism, ENVRT shall ensure that an appropriate safeguard is in place, which may include: - the European Commission's Standard Contractual Clauses, including Module Three where ENVRT and the relevant recipient act as processor and sub-processor; - the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses; - the UK International Data Transfer Agreement; or - another transfer mechanism recognised under applicable Data Protection Laws. 10.4 Where a Sub-processor makes or receives a Restricted Transfer, ENVRT shall require the Sub-processor to maintain an appropriate transfer mechanism under its applicable data-processing terms. 10.5 ENVRT's primary database for the Shopify Integration is hosted in Supabase's `eu-west-2` London region. Application hosting and server-side compute are provided through Vercel. ENVRT does not intentionally store Brand Personal Data at rest on Vercel. The parties acknowledge that ENVRT's Sub-processors and their authorised infrastructure providers may process limited Brand Personal Data in other locations where necessary to provide their services, subject to this clause 10. 10.6 ENVRT shall, where required by Data Protection Laws, undertake or obtain the transfer assessments reasonably necessary in connection with Restricted Transfers for which ENVRT is responsible. --- ## 11. Return and deletion 11.1 On termination of the Shopify Integration or on the Brand's written request following termination, ENVRT shall, at the Brand's choice, return or delete Brand Personal Data, unless applicable law requires ENVRT to retain it. 11.2 Where Brand Personal Data is not retained by ENVRT in an identifiable or exportable customer-level form, ENVRT may satisfy a return request by providing the retained information in the form in which ENVRT holds it. 11.3 When the Brand disconnects its Shopify store through the ENVRT dashboard, uninstalls the relevant Shopify app, or otherwise validly revokes access, ENVRT shall disable the connection and hard-delete or otherwise invalidate the applicable store access token without undue delay. Where Shopify sends an `app/uninstalled` notification, ENVRT deletes the applicable token as part of that disconnection process. 11.4 On receipt of an applicable Shopify store-erasure request, including a `shop/redact` request or its replacement, ENVRT shall delete Brand Personal Data associated with the affected store from active systems without undue delay and in any event within 48 hours, except to the extent that: - the Brand has validly instructed ENVRT to return the data before deletion; - applicable law requires retention; or - the information remains temporarily in secure backup or disaster-recovery systems as described in clause 11.7. 11.5 Customer data-access and customer-erasure requests do not require customer-level lookup or deletion in relation to the order-destination functionality because ENVRT does not retain customer-attributable order data through that functionality. If the scope of the Shopify Integration changes so that customer-attributable data is retained, ENVRT shall update the applicable handling before enabling that processing. 11.6 Country-level order aggregates are maintained on a rolling 60-day window while the Shopify Integration is active and are deleted on disconnection or on the Brand's valid request. 11.7 Brand Personal Data contained solely in Supabase's encrypted daily backups may be retained for up to 7 days after deletion from active systems, reflecting the backup-retention period applicable to ENVRT's Supabase Pro service, provided that: - the data is not restored or otherwise processed except where reasonably necessary for disaster recovery, security or legal compliance; - the data remains protected by appropriate technical and organisational measures; and - if restored, the data is again made subject to the deletion requirements in this clause. 11.8 ENVRT may retain a minimal record that a deletion or privacy request was received and completed where reasonably necessary to demonstrate compliance, provided that any retained record is limited to the minimum information necessary for that purpose. --- ## 12. Audit and compliance information 12.1 ENVRT shall make available to the Brand the information reasonably necessary to demonstrate ENVRT's compliance with this DPA and the processor obligations imposed by Data Protection Laws. 12.2 Where appropriate, ENVRT may first satisfy a reasonable compliance request by providing relevant policies, security information, third-party reports, certifications or questionnaire responses. 12.3 Subject to clause 12.4, ENVRT shall allow for and contribute to reasonable audits or inspections conducted by the Brand or an independent auditor appointed by the Brand, provided that: - the Brand gives at least 30 days' written notice; - the audit occurs no more than once in any 12-month period; - the audit takes place during normal business hours and does not unreasonably disrupt ENVRT's operations; - the auditor is not a direct competitor of ENVRT and is subject to appropriate confidentiality obligations; and - the Brand bears its own audit costs and reimburses ENVRT for reasonable external costs directly caused by an audit, except where the audit identifies a material breach of this DPA by ENVRT. 12.4 The notice and frequency restrictions in clause 12.3 do not apply to the extent that: - a competent supervisory authority requires an audit or inspection; - a Personal Data Breach reasonably requires further investigation; - the Brand has reasonable grounds to suspect a material breach of this DPA; or - applicable Data Protection Laws require otherwise. 12.5 Audits shall be limited to systems, records and processing activities reasonably relevant to Brand Personal Data and shall not require ENVRT to disclose another customer's confidential information, information that would materially compromise the security of ENVRT's systems, or legally privileged material. --- ## 13. Term, acceptance, precedence, liability and governing law 13.1 This DPA takes effect when an authorised user acting on behalf of the Brand affirmatively accepts it in connection with enabling the Shopify Integration and continues for so long as ENVRT processes Brand Personal Data on behalf of the Brand. The DPA shall be presented or linked in full at the point of acceptance, and the accepting user shall be shown the version of the DPA being accepted. 13.2 ENVRT shall maintain an electronic record of acceptance sufficient to identify the Brand, the accepting user and email address, the connected Shopify store, the DPA version accepted, the date and time of acceptance, and a document hash evidencing the text accepted. 13.3 An ENVRT administrator shall not ordinarily accept this DPA on the Brand's behalf. Where assisted onboarding requires an ENVRT administrator to enable the Shopify Integration, the Brand shall first accept this DPA through an authorised Brand-side user or provide separate durable written authorisation expressly permitting ENVRT to enable the Shopify Integration under the identified version of this DPA. 13.4 If this DPA conflicts with the Main Agreement in relation to the processing or protection of Brand Personal Data, this DPA prevails to the extent of that conflict. 13.5 If mandatory terms of an applicable Standard Contractual Clause, International Data Transfer Agreement, International Data Transfer Addendum or other legally required transfer mechanism conflict with this DPA or the Main Agreement, the mandatory transfer terms prevail to the extent of the conflict. 13.6 Liability between ENVRT and the Brand arising under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Main Agreement, except to the extent that applicable law prohibits such limitation. For the purposes of applying those exclusions and limitations, claims arising under this DPA shall be treated as arising in connection with the Main Agreement and shall form part of, rather than be additional to, any aggregate liability cap under the Main Agreement. 13.7 Nothing in this DPA limits either party's obligations to Data Subjects or supervisory authorities where those obligations cannot lawfully be limited by contract. 13.8 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, subject to any mandatory rights or jurisdiction that cannot lawfully be excluded. --- # Annex A — Processing details | Item | Description | |---|---| | **Subject matter** | Operation of the Brand's Shopify Integration with the ENVRT dashboard, including store configuration, selling-market information, product catalogue information, recent order-destination analysis, Brand-selected catalogue imports and Shopify privacy-compliance requests. | | **Shopify access** | Shopify Admin API access under read-only scopes approved by the Brand through Shopify. The scopes used for the functionality described in this Annex are `read_markets`, `read_orders` and `read_products`. ENVRT does not request `read_customers`, `read_all_orders` or any `write_*` scope for this functionality. | | **Nature and purpose** | (i) Reading the Brand's configured selling markets to populate and automate relevant ENVRT compliance functionality. (ii) Reading authorised product catalogue information available under `read_products`, including titles, URLs, descriptions, prices, product images, product weight or measurement information and country-of-origin information where available, to populate or automate relevant ENVRT product and compliance functionality. Product images are not copied into ENVRT storage merely because they are read from Shopify; an image is copied into ENVRT storage only when the Brand affirmatively selects it for import. (iii) Reading only the shipping-destination country of orders from the trailing 60 days, transiently, to compute country-level order counts used to identify where actual shipping destinations diverge from the Brand's declared markets. (iv) Receiving and authenticating mandatory Shopify privacy-compliance webhooks. | | **Categories of Data Subjects** | Customers of the Brand's Shopify store in relation to order-destination processing and Shopify privacy requests; and, to the extent product catalogue content contains Personal Data, individuals depicted or identified in that content. | | **Categories of Personal Data** | Order shipping-destination country code, processed transiently; country-level 60-day order aggregates; and raw Shopify privacy-compliance webhook bodies, which may contain customer-level Personal Data but are received solely for HMAC verification, are not parsed or logged, and are discarded following authentication and handling. Product catalogue content may also constitute Personal Data where it depicts or identifies an individual. ENVRT does not request Shopify order IDs or customer identifiers through its order-destination query. | | **Product catalogue data** | Product titles, URLs, descriptions, prices, product images, weight or measurement information and country-of-origin information are ordinarily product or business data rather than Personal Data. Where any such content constitutes Personal Data, it is protected under this DPA while ENVRT processes it on the Brand's behalf. A product image selected by the Brand for import becomes Service Content under the Main Agreement, subject also to this DPA where it contains Personal Data. | | **Data intentionally excluded from order-destination analysis** | ENVRT does not request customer names, customer email addresses, customer telephone numbers, full street addresses, payment details, Shopify order IDs, Shopify customer IDs, order line items, special-category Personal Data or criminal-offence data for the order-destination functionality. | | **Frequency** | Periodic or on-demand synchronisation while the Shopify Integration is active, Brand-triggered imports of selected catalogue content, and event-driven Shopify privacy-compliance requests. | | **Duration** | While the Shopify Integration is active and for any limited post-termination deletion, return, backup-retention or compliance-record period described in this DPA. Brand-selected Service Content may continue to be processed under the Main Agreement after disconnection to the extent required to provide the Services, subject to this DPA where that content contains Personal Data. | | **Retention** | Underlying customer-level destination data is processed transiently and is not retained at rest. Country-level aggregates are maintained on a rolling 60-day window while the Shopify Integration is active. Store access tokens are retained only while required for the active connection and are deleted or invalidated on disconnection. Raw privacy-webhook bodies are not retained. ENVRT retains only the Shopify delivery identifier, webhook topic and shop domain as the minimal operational record of privacy-webhook handling. Brand-selected catalogue content imported into ENVRT is retained in accordance with the Main Agreement and applicable Brand instructions. Brand Personal Data contained solely in Supabase daily backups may remain in those backups for up to 7 days in accordance with clause 11.7. | | **Special-category / criminal-offence data** | Not intentionally requested or processed. | --- # Annex B — Technical and organisational security measures ENVRT shall maintain technical and organisational measures appropriate to the limited nature, scope and risk of the processing. Those measures currently include: - TLS 1.2 or higher for Brand Personal Data in transit; - encryption of Shopify store access tokens at rest using AES-256-GCM under a dedicated encryption key maintained in protected server-side environment configuration; - rejection rather than truncation or silent alteration of malformed encryption-key material; - database row-level security configured to deny direct client access to Shopify connection and order-aggregate tables, with access provided through authenticated server-side functionality; - OAuth protection using single-use state values consumed atomically and timing-safe HMAC verification; - authentication of Shopify webhooks using timing-safe HMAC verification over the raw request body; - configuration and source-level controls intended to prevent Shopify access tokens and Brand Personal Data from being written to ordinary application logs; - read-only Shopify API permissions for the functionality described in Annex A; - controls preventing the Shopify Integration from requesting or accepting any `write_*` scope, `read_customers`, `read_all_orders`, or scopes broader than those requested and authorised for the connection; - replacement rather than accumulation of credentials when a store reconnects; - least-privilege access to production systems and Brand Personal Data for personnel who reasonably require that access; - software changes managed through version control and a controlled deployment process; - automated tests covering material Shopify integration security and data-minimisation controls; and - a documented security-incident response procedure covering containment, investigation, Processor-to-Controller notification and regulatory-assistance responsibilities. ENVRT may update these measures from time to time provided that the overall level of protection for Brand Personal Data is not materially reduced. --- # Annex C — Approved Sub-processors | Sub-processor | Role | Primary processing / hosting location | Transfer safeguard | |---|---|---|---| | **Supabase Pte. Ltd** | Database hosting, storage and related infrastructure | `eu-west-2` — London, United Kingdom, for ENVRT's primary project data | Supabase DPA, including the EU Standard Contractual Clauses (Module Three where ENVRT acts as processor and Supabase as sub-processor) and the UK International Data Transfer Addendum where applicable; applicable adequacy mechanisms may also be relied upon where available | | **Vercel Inc.** | Application hosting, server-side compute and related infrastructure | Vercel infrastructure; ENVRT does not intentionally store Brand Personal Data at rest on Vercel | Vercel DPA applicable to ENVRT's Pro plan; applicable adequacy mechanism and, where required, processor-to-processor SCCs and Vercel's applicable UK transfer mechanism | Shopify is not listed as an ENVRT Sub-processor because ENVRT does not appoint Shopify to process Brand Personal Data on ENVRT's behalf; the Brand separately uses Shopify and authorises ENVRT to access the Brand's Shopify environment.