Data Processing Addendum

1. Parties and roles

For the store data we process in order to provide the app — your product catalog, campaign configuration, aggregate widget analytics and order line items — you are the controller (or "business" under US state privacy laws) and Summer Apps is the processor ("service provider").

For the data we collect for our own purposes — your account and contact details, billing records, the in-app activity log and admin product analytics — Summer Apps is an independent controller. That processing is described in our Privacy Policy.

"Personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR.

2. Subject matter and duration

The subject matter of the processing is the provision of the Summer Upsell & Cross Sell app and its storefront widgets to your Shopify store. Processing continues for as long as the app is installed and ends when the app is uninstalled and your data has been deleted in accordance with Section 6.

3. Nature and purpose of processing

We process personal data only to the extent necessary to:

• display upsell and cross-sell widgets on your storefront and apply the discounts you configure;
• measure widget performance (impressions, add-to-cart clicks, conversions and attributed revenue) and show it to you in the app;
• generate product recommendations with Summer AI when you request them;
• operate, secure and support the app.

4. Categories of data subjects

• Merchant staff: the shop owner and the staff members who use the app in the Shopify admin.
• End customers: shoppers who visit your storefront or place orders. We process their data only in aggregate (counts and order line items) and do not store names, addresses, email addresses, phone numbers or any shopper identifier.

5. Categories of personal data

The categories of personal data are described in Section 2.3 of our Privacy Policy. In summary:

• Shop and account data: shop domain, shop name, shop owner name and email, store locale, currency and markets, product catalog.
• Staff session data: name, email and locale of staff members using the app.
• Order data: order id and line items (product, quantity, price, discounts, campaign property).
• Aggregate storefront analytics: impressions, clicks, conversions and attributed revenue, with no shopper identifiers.
• Activity log: action performed, shop domain and, where available, the acting staff member's email.

We do not process special categories of personal data.

6. Processor obligations

Summer Apps will:

• process personal data only on your documented instructions — your installation and configuration of the app, Shopify's APIs and this DPA constitute those instructions — unless required otherwise by law, in which case we will inform you before processing where legally permitted;
• ensure that every person authorised to process personal data is bound by a duty of confidentiality;
• implement the technical and organisational measures described in Section 7;
• engage sub-processors only as set out in Section 8;
• assist you, taking into account the nature of the processing, in responding to data subject requests and in meeting your obligations regarding security, breach notification and data protection impact assessments;
• notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting your data, and provide the information you need to meet your own notification duties;
• delete your personal data when the app is uninstalled or this DPA terminates, within the periods set out in Section 7 of the Privacy Policy, unless law requires retention;
• make available on request the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice and no more than once a year unless a supervisory authority requires otherwise.

7. Security measures

We maintain appropriate technical and organisational measures, including:

• encryption in transit (HTTPS/TLS) for all traffic between shoppers, the Shopify admin, our servers and our providers;
• encryption at rest for our database (MongoDB Atlas);
• Shopify OAuth with the minimum access scopes required, and signature (HMAC) verification of every webhook and storefront proxy request;
• role-based access to production systems limited to authorised personnel, with Cloudflare in front of our servers;
• server logs retained for no more than 90 days, and deletion of app data on uninstall.

8. Sub-processors

You authorise us to engage the sub-processors listed in Section 5 of our Privacy Policy, which constitutes the current sub-processor list. We will update that list and give you at least 30 days' notice — by email or an in-app notice — before adding or replacing a sub-processor that processes your personal data. If you object on reasonable data protection grounds and we cannot resolve the objection, you may terminate by uninstalling the app.

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA and remain responsible for their performance.

9. International transfers

We are based in the United States and process your data there. Where your data originates in the EEA, the United Kingdom or Switzerland, the transfer is governed by the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference, and by the equivalent clauses in our sub-processors' agreements. Where a sub-processor is certified under the EU-US Data Privacy Framework we also rely on that certification. A copy of the applicable mechanism is available on request via our contact page.

10. Data subject requests

If we receive a request from a data subject relating to your store, we will forward it to you without undue delay and will not respond directly except to confirm receipt or where required by law. Requests submitted through Shopify's privacy request flow reach us as customers/data_request and customers/redact webhooks, which we answer within 30 days. Because we hold no end-customer personal data, a data request is answered with a confirmation that there is nothing to return.

11. Liability

Each party's liability under this DPA is subject to the exclusions and limitations set out in the Terms of Service. Nothing in this DPA limits either party's liability towards data subjects or supervisory authorities where applicable law prohibits such a limitation.

12. Governing law and contact

This DPA is governed by the law that governs the Terms of Service. Where the Standard Contractual Clauses apply, their governing-law and jurisdiction clauses prevail for the matters they cover. In case of conflict between this DPA and the Terms, this DPA prevails for data protection matters.

Questions about this DPA:

• Form: summer-apps.com/contact
• Address: Summer Apps, 6401 JF Kennedy Blvd E, West New York, NJ, USA