Data Processing Agreement

Parties

1. Definitions

1.1Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in Regulation (EU) 2016/679 (the “GDPR”).

1.2“Data Protection Law” means the GDPR, the national laws implementing or supplementing it (including the German BDSG), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (revFADP), in each case to the extent applicable.

1.3“Customer Personal Data” means personal data of the Merchant’s customers (shoppers) that Nayvo processes on behalf of the Merchant through the app, as described in Annex I.

1.4“Sub-processor” means any third party engaged by Nayvo to process Customer Personal Data.

1.5“SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914.

2. Scope and roles

2.1The Merchant is the controller and Nayvo is the processor of Customer Personal Data. Nayvo processes Customer Personal Data solely to provide the app to the Merchant.

2.2The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

2.3This DPA does not apply to personal data of the Merchant itself and its staff (e.g. account owner name, store contact email, billing details, support conversations, product usage analytics). Nayvo processes such data as an independent controller, as described in its Privacy Policy.

3. Instructions of the Controller

3.1Nayvo processes Customer Personal Data only on documented instructions from the Merchant, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which Nayvo is subject; in that case Nayvo informs the Merchant of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).

3.2The Merchant’s documented instructions are this DPA, the Terms, and the Merchant’s configuration and use of the app (for example the form fields it enables, the emails it activates and any withdrawal records it deletes). Additional instructions require written form (email suffices).

3.3Nayvo informs the Merchant without undue delay if, in its opinion, an instruction infringes Data Protection Law (Art. 28(3) sentence 2 GDPR). Nayvo may suspend the execution of that instruction until it is confirmed or changed by the Merchant.

3.4The Merchant is responsible for the lawfulness of the processing, including having a legal basis, and for informing shoppers in its own privacy notice that it uses the app.

4. Confidentiality

Nayvo ensures that every person authorised to process Customer Personal Data has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR), and accesses Customer Personal Data only to the extent necessary to provide the app, provide support requested by the Merchant, or comply with law.

5. Security of processing

5.1Nayvo implements the technical and organisational measures described in Annex II to ensure a level of security appropriate to the risk (Art. 28(3)(c) and Art. 32 GDPR).

5.2The measures are subject to technical progress. Nayvo may replace them with alternative measures, provided that the overall level of security is not reduced. Material changes will be documented.

6. Sub-processors

6.1The Merchant grants Nayvo general written authorisation to engage Sub-processors (Art. 28(2) GDPR). The Sub-processors engaged at the effective date are listed in Annex III, which the Merchant hereby approves.

6.2Nayvo informs the Merchant of any intended addition or replacement of a Sub-processor at least 30 days in advance by email to the store contact email and by updating the list published at nayvo.eu/dpa. The Merchant may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Merchant may terminate its use of the app, and Nayvo will not process the Merchant’s Customer Personal Data through the objected Sub-processor in the meantime where technically feasible.

6.3Nayvo imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA (Art. 28(4) GDPR). Nayvo remains fully liable to the Merchant for the performance of each Sub-processor’s obligations.

6.4In an emergency (e.g. imminent loss of service), Nayvo may replace a Sub-processor with shorter notice, informing the Merchant without undue delay; the objection right under Section 6.2 applies accordingly.

7. International data transfers

7.1Nayvo is established in India and Customer Personal Data is hosted in the United States (see Annex III). Neither country is covered by a general adequacy decision of the European Commission, except for US recipients certified under the EU-U.S. Data Privacy Framework (“DPF”).

7.2Transfers from the Merchant to Nayvo. To the extent the Merchant is subject to the GDPR and Nayvo’s processing involves a transfer of personal data to a third country, the parties hereby conclude, and incorporate by reference, Module Two (controller to processor) of the SCCs, with the Merchant as “data exporter” and Nayvo as “data importer”, completed as follows:

• Clause 7 (docking clause): applies.
• Clause 9(a): Option 2 (general written authorisation), with a notice period of 30 days.
• Clause 11(a): the optional independent dispute resolution language does not apply.
• Clause 13: the competent supervisory authority is that of the EU Member State in which the Merchant is established, or, where the Merchant is not established in the EU, the authority of the Member State in which its representative under Art. 27(1) GDPR is established, or otherwise the authority of the Member State where the affected data subjects are located.
• Clause 17: the SCCs are governed by the law of Ireland.
• Clause 18: disputes are resolved by the courts of Ireland.
• Annex I.A and I.B of the SCCs are completed by Annex I of this DPA; Annex II of the SCCs by Annex II of this DPA; and Annex III of the SCCs by Annex III of this DPA.

7.3Onward transfers to Sub-processors. Where a Sub-processor is located in a third country, Nayvo ensures that the transfer is covered by the DPF certification of the Sub-processor or by the SCCs (Module Three, processor to processor) concluded with the Sub-processor, together with supplementary measures where required.

7.4United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) is incorporated, with Table 1–3 information taken from this DPA and either party able to end it as permitted by its Section 19.

7.5Switzerland. For transfers subject to the revFADP, the SCCs apply with the following adaptations: the Swiss FDPIC is the competent supervisory authority insofar as the transfer is governed by the revFADP; references to “Member State” include Switzerland so that Swiss data subjects may bring claims at their place of habitual residence; and references to the GDPR are read as references to the revFADP.

7.6Transfer impact assessment and government access. Nayvo has assessed the laws of the destination countries and applies the supplementary measures described in Annex II (encryption in transit, data minimisation, no storage of IP addresses). If Nayvo receives a legally binding request from a public authority for access to Customer Personal Data, it will (i) notify the Merchant promptly unless legally prohibited, (ii) review the legality of the request and challenge it where there are reasonable grounds, and (iii) disclose only the minimum data required.

7.7In the event of a conflict between the SCCs and this DPA, the SCCs prevail.

8. Assistance to the Controller

8.1Data subject rights. Taking into account the nature of the processing, Nayvo assists the Merchant by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR (Art. 28(3)(e) GDPR). The app lets the Merchant view, export (CSV) and delete individual withdrawal records itself. Nayvo also processes Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact). If a data subject contacts Nayvo directly, Nayvo forwards the request to the Merchant without undue delay and does not respond itself unless instructed.

8.2Other obligations. Nayvo assists the Merchant in ensuring compliance with Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Nayvo (Art. 28(3)(f) GDPR).

9. Personal data breaches

9.1Nayvo notifies the Merchant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data (Art. 33(2) GDPR), by email to the store contact email.

9.2The notification contains, to the extent available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point. Information not available at first may be provided in phases without undue further delay.

9.3Nayvo takes the necessary measures to secure the data and mitigate possible adverse effects, and documents every breach.

10. Deletion and return

10.1During the term, the Merchant can delete individual withdrawal records at any time in the app and can export all records as CSV.

10.2After the Merchant uninstalls the app, Shopify sends a shop/redact request (currently 48 hours after uninstall). Nayvo deletes all Customer Personal Data of that store within 30 days of receiving that request, unless Union or Member State law requires storage (Art. 28(3)(g) GDPR). The Merchant should export any records it must retain (e.g. as proof of withdrawals) before uninstalling.

10.3Residual copies in system logs and backups are overwritten in the ordinary course within the retention periods stated in Annex II and remain protected by this DPA until then.

11. Information and audits

11.1Nayvo makes available to the Merchant all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the Merchant or an auditor mandated by it (Art. 28(3)(h) GDPR).

11.2Nayvo will first answer the Merchant’s written questions and provide relevant documentation (including Sub-processors’ certifications such as SOC 2 or ISO 27001 reports, where available). Where this is not sufficient, the Merchant may conduct an audit, with at least 30 days’ notice, during normal business hours, without disrupting operations, not more than once per year (unless required by a supervisory authority or following a personal data breach), and subject to confidentiality. Each party bears its own costs.

12. Liability

Each party’s liability under this DPA is subject to the limitations of liability in the Terms, except where such limitations are not permitted by Data Protection Law. Art. 82 GDPR remains unaffected with regard to data subjects.

13. Term and termination

This DPA applies for as long as Nayvo processes Customer Personal Data on behalf of the Merchant and ends automatically when all Customer Personal Data has been deleted in accordance with Section 10. Obligations that by their nature are meant to survive (in particular Sections 4, 9 and 10) survive termination.

14. Final provisions

14.1Order of precedence: (1) the SCCs, where applicable; (2) this DPA; (3) the Terms.

14.2Changes. Nayvo may update this DPA to reflect changes in law, guidance or the app, provided that the level of protection for Customer Personal Data is not reduced. Material changes are notified to the Merchant at least 30 days in advance. Previous versions remain available on request.

14.3Severability. If any provision is invalid, the remaining provisions remain unaffected; the invalid provision is replaced by a valid one that comes closest to its purpose.

14.4Governing law. Without prejudice to Clause 17 of the SCCs, this DPA is governed by the law of Ireland.

14.5Language. This DPA is drafted in English. Translations are for convenience only; the English version prevails.

Annex I — Description of the processing

A. List of parties

• Data exporter / Controller: the Merchant (see “Parties”). Role: controller. Activities: operating an online store and receiving withdrawal (right of withdrawal / Widerruf) declarations from its customers.
• Data importer / Processor: NAYVO PRIVATE LIMITED (see “Parties”). Role: processor. Activities: providing the app “EU Withdrawal Button & Form”.

B. Description of the processing

Annex II — Technical and organisational measures (Art. 32 GDPR)

1. Encryption and pseudonymisation

• All data in transit is encrypted with TLS (HTTPS only), between the storefront, Shopify, the app server and Sub-processors.
• Stored mail-server credentials (SMTP passwords) are encrypted with AES-256-GCM.
• IP addresses are not stored; logs and diagnostic output show masked IP addresses only.

2. Confidentiality: access control

• Merchant access to the app dashboard is authenticated by Shopify (session tokens signed by Shopify); a Merchant can only access its own store’s records.
• Storefront requests are verified via Shopify’s app proxy HMAC signatures; Shopify webhooks are verified via HMAC.
• Internal administrative access is restricted to the Director of Nayvo, protected by a strong password and secure, HTTP-only, signed session cookies.
• Production credentials and API keys are held as environment secrets on the hosting platform, not in source code.
• Hosting infrastructure (Railway) is accessed only through accounts protected by multi-factor authentication.

3. Integrity

• Server-side validation of all form input; protection against automated abuse (honeypot field, minimum fill time, rate limiting, per-store daily submission caps, optional Cloudflare Turnstile CAPTCHA).
• Optional “verified orders only” mode that accepts withdrawals only for real orders matching the customer’s email.
• Changes to the application are made through version control (Git) with a reviewable history.

4. Availability and resilience

• Hosting on managed cloud infrastructure with persistent, redundant storage volumes.
• Monitoring of application errors and service status; documented restore procedures.

5. Data minimisation and retention

• Only the fields required for a withdrawal declaration are collected; no file uploads; no IP storage.
• Country detection runs on a locally hosted database (MaxMind GeoLite2); IP addresses are not sent to a third party for this purpose.
• Application logs are retained for no longer than 30 days; backups for no longer than 30 days.
• Product analytics on the storefront form do not record form contents.

6. Procedures for regular review

• Review of these measures and of the Sub-processor list at least once a year and whenever the app changes materially.
• Documented personal data breach response procedure (Section 9).

7. Sub-processor management

• Sub-processors are selected for their security standards, bound by data processing agreements, and covered by SCCs or DPF certification where located in a third country.

Annex III — Sub-processors

The following Sub-processors may process Customer Personal Data:

Not Sub-processors under this DPA:

• Shopify: the Merchant’s own platform; data is read from and stays within the Merchant’s Shopify store under the Merchant’s agreement with Shopify.
• The Merchant’s own SMTP server: if the Merchant chooses to send emails via its own mail server, that provider acts on the Merchant’s instructions under the Merchant’s own contract.
• Tools Nayvo uses only for Merchant account data (e.g. support chat, CRM, analytics, internal alerts) are covered by Nayvo’s Privacy Policy (see Section 2.3).

Changes to this list are announced as described in Section 6.2.

Signature

Version history