Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between AppHero and each merchant that uses an AppHero application through the Shopify App Store. It applies whenever AppHero processes personal data on the merchant's behalf under data protection laws, including the GDPR.

1. Parties and Scope

This DPA forms part of the Terms of Use, end user agreement or other agreement that governs the merchant's use of AppHero services (the "Agreement").

AppHero is the "Processor" ("we", "us", "our"). The merchant, store owner or business using our services is the "Controller" ("Merchant", "you", "your").

This DPA applies where AppHero processes personal data on your behalf through our services, including our Shopify apps Attrac, Free Gift and Upsell, and other AppHero products.

By installing, accessing or using an AppHero service, you agree to this DPA. Where required by law, it is incorporated into the Agreement by reference.

2. Definitions

• Applicable Data Protection Law means the laws that apply to personal data processed under the Agreement, including, where applicable, the GDPR, the UK GDPR and similar laws.
• GDPR means Regulation (EU) 2016/679.
• Personal Data means any information about an identified or identifiable natural person that AppHero processes on your behalf.
• Process, Processing, Controller, Processor and Data Subject have the meanings given in Applicable Data Protection Law.
• Sub-processor means a third party engaged by AppHero to process personal data on your behalf.

3. Roles of the Parties

You are the Controller and AppHero is the Processor, except where AppHero determines the purposes and means of processing for its own independent business purposes.

You are responsible for having the rights, consents and legal bases needed to share personal data with AppHero and to authorize the processing described in this DPA.

4. Processing Details

AppHero processes personal data only as needed to provide, maintain, support, secure and improve the services you request, as described in Annex I.

AppHero does not sell Merchant customer data, and does not use Merchant customer data for its own advertising.

5. Processor Instructions

AppHero processes personal data only on your documented instructions, unless the law requires otherwise. The Agreement, your configuration and use of our apps, and this DPA together form your documented instructions.

If we believe an instruction breaches Applicable Data Protection Law, we will tell you, unless the law prevents us from doing so.

6. Confidentiality

AppHero ensures that personnel authorized to process personal data are bound by contractual or statutory confidentiality obligations, and that access is limited to those who need it.

7. Security Measures

AppHero implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These measures take into account the state of the art, the cost of implementation, the nature of the processing and the risks involved. A summary of our current measures is set out in Annex II.

8. Sub-processors

You authorize AppHero to engage Sub-processors to help provide the services. We require each Sub-processor to meet data protection obligations substantially similar to those in this DPA, as appropriate to the services it provides.

Our current Sub-processors are:

• Amazon Web Services (AWS), United States: cloud hosting, infrastructure, storage, backups and related technical operations.

AppHero may update its Sub-processors from time to time. Material changes may be published on the relevant public page.

9. International Transfers

You acknowledge that personal data may be processed outside the European Economic Area (EEA), including in the United States, where AppHero or its Sub-processors maintain infrastructure or provide services.

Where personal data is transferred outside the EEA, the UK or another jurisdiction that requires safeguards, AppHero relies on an appropriate transfer mechanism, such as:

• the European Commission's Standard Contractual Clauses;
• an adequacy decision;
• the EU-U.S. Data Privacy Framework, where applicable; or
• another lawful transfer mechanism.

More information about these safeguards is available on reasonable request, subject to confidentiality and legal limits.

10. Assistance to Controller

Taking into account the nature of the processing and the information available to us, AppHero provides reasonable assistance with:

• responding to requests from data subjects exercising their rights;
• your security obligations under Applicable Data Protection Law;
• personal data breach notifications, where applicable;
• data protection impact assessments and prior consultations, where required and reasonably necessary.

AppHero may charge a reasonable fee for assistance that is excessive, repetitive or goes beyond what the law requires.

11. Personal Data Breach

If AppHero confirms a personal data breach affecting your personal data, we will notify you without undue delay. The notice will include the information available to us about the nature of the breach, its likely consequences and the measures taken or proposed. We will take reasonable steps to mitigate its effects and minimize harm.

12. Retention and Deletion

AppHero keeps personal data only for as long as needed to provide the services, meet legal obligations, resolve disputes, enforce agreements, and support backup, security, fraud prevention and business continuity.

When the services end or an app is uninstalled, AppHero deletes or anonymizes the related personal data within a reasonable period, subject to legal and operational requirements. Limited data may remain temporarily in backups, logs or security systems until it is overwritten or deleted in the normal course.

13. Information and Audit Rights

AppHero makes available the information reasonably needed to demonstrate compliance with this DPA.

Where required by law, you may request further information or an audit limited to the processing covered by this DPA, generally no more than once a year unless following a confirmed security incident or a request from a regulator. Audits require reasonable advance notice, confidentiality, minimal disruption to our business, and a reasonable scope and timing. You bear your own costs and, where the law allows, AppHero's reasonable internal costs.

14. Liability

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Agreement, to the extent permitted by law.

Annex I: Processing Details

A. Subject matter. Processing personal data to provide Shopify apps and related services.

B. Duration. For as long as you use the services, plus the time needed to delete, anonymize or securely retain data under the Agreement, this DPA and the law.

C. Nature and purpose.

• Providing the app features you request.
• Displaying promotions, offers, widgets or campaigns.
• Processing the order, customer and store data the apps need to work.
• Customer support and troubleshooting.
• Monitoring, security, fraud prevention, logging and backups.
• Improving stability and performance.

D. Data subjects.

• Merchant personnel and users.
• Customers of the merchant's store.
• Website visitors who interact with app-enabled storefront elements.

E. Categories of personal data.

• Customer name.
• Email address.
• Order information.
• Purchase and product information.
• Store configuration and merchant account information.
• Technical and usage data, such as logs, device and browser data, and event records.

F. Sensitive data. AppHero does not intentionally request special categories of personal data. Merchants should not use the services to process sensitive data unless expressly agreed in writing.

Annex II: Technical and Organizational Measures

AppHero's measures may include:

• Logical access controls for systems and production environments.
• Role-based or need-to-know access management.
• Authentication controls for internal administrative access.
• Encryption in transit using TLS/HTTPS.
• Security controls provided by reputable cloud hosting vendors.
• Logging and monitoring of systems and events.
• Backup and recovery procedures.
• Change management and software update practices.
• Confidentiality obligations for personnel with access to personal data.
• Measures that support availability and resilience.

AppHero may update these measures over time, provided the updates do not materially reduce the overall security of the services.

Contact

For questions about privacy or data processing, please reach us through our help center. Our Privacy Policy explains how we handle personal information more generally.