Data Processing Addendum

This Data Processing Addendum ("DPA") describes how Partner Metrics processes personal data on your behalf and supplements our Terms of Service. It reflects the requirements of the GDPR and similar data-protection laws. If you require a signed copy for your records, contact us at [email protected].

This page is a summary of our processing terms; a countersigned DPA is available on request for business customers.

For the Shopify Partner data and any customer personal data you connect to the Service, you are the data controller and Partner Metrics is your data processor, processing that data only on your documented instructions (which include your configuration and use of the Service). For your own account and billing data, Partner Metrics acts as controller as described in the Privacy Policy.

The subject matter is the provision of the Service. Processing lasts for the term of your use of the Service. The nature and purpose of processing is providing analytics, rank tracking and notifications. The types of data include your Shopify Partner app, subscription, transaction and event data and related merchant identifiers; the categories of data subjects are your app's merchants and end customers.

As your processor we will: process personal data only on your instructions; ensure persons authorized to process data are bound by confidentiality; implement appropriate technical and organizational security measures; assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification and impact-assessment obligations; and, at your choice, delete or return the data at the end of the Service.

You authorize us to engage the sub-processors listed below to help provide the Service. We impose data-protection obligations on each sub-processor and remain responsible for their performance. We will give notice of intended changes to sub-processors so you have the opportunity to object on reasonable data-protection grounds.

Where processing involves transferring personal data outside the EEA, UK or your jurisdiction, we rely on appropriate safeguards such as the Standard Contractual Clauses or an equivalent approved mechanism.

We maintain measures appropriate to the risk, including encryption in transit, hashed credentials, signed session tokens, strict per-organization isolation, access controls and least-privilege administration. A current description is available on request.

We will promptly notify you if we receive a request from a data subject relating to data we process for you, and assist you in responding. We will notify you without undue delay after becoming aware of a personal-data breach affecting your data and provide information reasonably needed for you to meet your notification obligations.

On termination of the Service, or on your request, we will delete or return the personal data we process on your behalf, unless retention is required by law. Deleting an organization in the app removes its associated connected data.

On reasonable request and subject to confidentiality, we will make available information necessary to demonstrate compliance with this DPA and support audits as required by applicable law.

To request a signed DPA or ask questions about our processing, contact [email protected].