1. Parties and scope
This Data Processing Agreement (DPA) is proposed between the merchant using Proofify Products (the “Merchant”) and the legal person or entity operating Proofify Products under the brand The Ecom Pilot (the “Provider”). The Provider’s legal identity must be identified before this agreement is entered into. This DPA applies to personal data processed on the Merchant’s behalf to provide the Shopify product-review and rewards application (the “Service”).
2. Roles and instructions
To the extent the Merchant determines the purposes and means of processing its customers’ personal data, the Merchant acts as controller and the Provider acts as processor or service provider, as applicable. The Provider processes such data only on documented Merchant instructions, including instructions reflected in the Service configuration and this DPA, except where applicable law requires otherwise.
3. Processing details
Subject matter: product reviews, review-request messages, purchase verification, review rewards, storefront widgets, and related support. Duration: while the Service is used and for any lawful, documented retention period thereafter. Data subjects: Merchant customers and reviewers. Data categories: names, email addresses, Shopify customer and order IDs, purchased product information, review content, review media references, and reward activity. The Provider should not intentionally process sensitive personal data unless separately agreed and supported.
4. Merchant responsibilities
The Merchant is responsible for lawful instructions, appropriate notices, legal bases or consents where required, and compliance with marketing and review-incentive laws. The Merchant must not provide data unnecessary for the Service.
5. Confidentiality and security
The Provider will implement appropriate technical and organizational safeguards proportionate to the data and risks, including access controls, secure transmission, credential protection, and reasonable monitoring. Specific security measures and any claimed certifications must be verified against actual operational practices before acceptance of this DPA.
6. Subprocessors
The Service may use Shopify for platform integrations, Render for application hosting, Neon for database hosting, and Resend for email delivery, subject to the actual deployment and configuration. The Provider will identify material subprocessors, impose appropriate data-protection obligations, and provide notice of material changes where legally required.
7. Individual rights and privacy requests
The Provider will reasonably assist the Merchant with verified requests for access, correction, deletion, or other rights as required by applicable law. Shopify mandatory privacy webhooks must be processed in accordance with Shopify’s requirements. A webhook acknowledgement alone does not fulfill a data-access or deletion request.
8. Retention and deletion
Upon termination or a valid deletion request, the Provider will delete or return personal data as applicable, subject to lawful retention exceptions and reasonable backup procedures. The specific retention schedule, deletion workflows, and treatment of externally stored review media must be documented and operational before this DPA is finalized.
9. Security incidents
The Provider will notify the Merchant without undue delay after becoming aware of a confirmed personal-data breach affecting data processed on the Merchant’s behalf, as required by applicable law, and will provide reasonable information and cooperation. Incident-response procedures and contact channels must be established operationally.
10. International transfers
Data may be processed in countries where the Provider’s service providers operate. The parties will put appropriate safeguards in place where required by applicable data-protection law. Any transfer-specific contractual clauses should be added where legally necessary.
11. Assistance and accountability
Subject to reasonable confidentiality and security protections, the Provider will supply information reasonably necessary to demonstrate compliance with agreed obligations and assist with lawful impact assessments or regulator inquiries when applicable.
12. Term and precedence
This DPA is intended to supplement the applicable Terms of Service. If validly agreed, it governs conflicting provisions specifically concerning the processing of personal data on the Merchant’s behalf, unless mandatory law requires otherwise. Its effective date and acceptance mechanism must be established separately.
13. Contact
Proofify Products — The Ecom Pilot (brand). Email: support@theecompilot.com. The Provider’s full legal identity and address must be specified before this draft becomes a binding agreement.