Merchant data processing agreement

Draft for Deuver owner review. Not yet activated for merchant acceptance.

SHOPBRIDGE MERCHANT DATA PROCESSING AGREEMENT
Version: 2026-10-02-draft-2. Prepared for Deuver owner review; not offered for acceptance until activated.

1. Parties, purpose and duration
The merchant identified by its Shopify store and business name is the controller of its store records. Deuver, Steenplaetsstraat 6, Unit 4.14, 2288 AA Rijswijk, Netherlands, KVK 92707009, hello@everscope.app, acts as processor for store reporting. The accepting store owner confirms authority to bind the merchant. Processing lasts while the installation is active, followed by the deletion periods below. This agreement takes priority over conflicting service terms concerning personal data processing.

2. Documented instructions
The merchant instructs Deuver to retrieve the granted read-only Shopify fields and selected history range, maintain complete source snapshots, provide authenticated downloads and Power BI exports, and carry out verified access, correction, restriction and erasure instructions. Additional instructions go to support from an authorised merchant contact and are verified before execution. Deuver notifies the merchant if an instruction appears to infringe applicable data protection law. Legally required processing outside instructions is disclosed beforehand unless law prohibits disclosure. Store records are not reused for another purpose.

3. Records and people
Records concern customers and store owners: order/line identifiers, dates, quantities, amounts, currencies, payment/fulfilment statuses, refunds and owner identifiers for access checks. Catalog, inventory and location records can be linked to purchases. Customer names, emails, phone numbers and delivery addresses are not requested. Special-category personal data is outside scope. Purchase records may still identify customers when combined with merchant information.

4. Merchant responsibilities and consent
The merchant determines its lawful basis, supplies customer notices and obtains consent where its purposes require it. ShopBridge provides merchant-directed operational reporting, without advertising tracking, customer profiling, data sales or automated eligibility decisions. This agreement is not customer consent. Where a merchant use requires consent that has been withheld or withdrawn, the merchant stops that use and provides verified restriction/erasure instructions; Deuver implements these instructions. The merchant controls copies downloaded or published to its own reporting environment.

5. Confidentiality and security
Deuver limits operator access to authorised persons bound to confidentiality. Measures include HTTPS, signed Shopify owner-session verification, tenant-scoped exports, revocable hashed export keys, encrypted refreshable credentials and access-request files, and an encrypted Fly.io database volume. Records are not separately field-encrypted. Imports publish atomically and preserve the last complete source on failure. Deuver assesses measures as risks change. There is one application machine; no high-availability or recovery-time guarantee is made. Restored exports remain subject to outstanding erasure instructions.

6. Subprocessors and international transfers
The initially authorised hosting subprocessor is Fly.io, Inc., including its published hosting subprocessors. Deuver signed Fly.io's data-processing addendum on 2 October 2026. It includes Standard Contractual Clauses, but the exporter role recorded as Controller requires clarification for merchant records where Deuver acts as processor. Applicable processor terms and required transfer safeguards must be confirmed before commercial processing. Amsterdam application hosting does not guarantee that every platform record or backup stays in the Netherlands. This agreement does not itself establish transfer safeguards. Provider information is linked in the privacy notice. Deuver notifies intended additions or replacements at least 30 days ahead where practicable, allows reasoned data-protection objections and resolves them by an alternative or ending the affected service. Equivalent processing obligations must be imposed; Deuver remains responsible for its subprocessors. Shopify is the merchant's separately contracted commerce provider. Microsoft receives data only when the merchant uses its own Power BI software or service.

7. Assistance and incidents
Taking account of the processing and information available, Deuver assists with data-subject requests, security duties, breach assessment/notification, impact assessments and supervisory consultation. Deuver notifies the merchant without undue delay after becoming aware of a personal data breach, with known facts, affected records, likely consequences, mitigation and subsequent updates. Customer requests are handled on merchant instructions unless law requires otherwise. Shopify access-request webhooks create a merchant-only file; the merchant verifies the requester before delivery.

8. Return, retention and deletion
The merchant may download records before termination or request a verified return through support. Verified uninstall/shop erasure removes active records and credentials. Superseded snapshots expire after about 24 hours; sync logs and access-request files after 30 days. App backups are encrypted, daily, retained for seven daily dates and invalidated after verified erasure. Fly volume snapshots have a separate configured five-day expiry. The Fly.io addendum specifies provider retention for 90 days following termination of the Fly.io agreement; this is separate from uninstalling ShopBridge and the configured snapshot expiry. Deuver does not promise immediate erasure of all provider-held records. Deleted records must not be restored into service; outstanding erasure instructions must be applied before exports reopen. Verified customer/order erasure invalidates affected exports and prevents reimport of redacted orders. Merchant-downloaded copies remain under merchant control. Any legally required retention is identified and limited to that purpose.

9. Evidence and audits
Deuver makes information needed to demonstrate its processor obligations available to the merchant and competent authority, and allows and contributes to relevant audits, including inspections by the merchant or its mandated auditor. Arrangements protect other merchants' confidentiality and avoid unnecessary disruption without preventing legally required access. Contact support for current security, retention, subprocessor and incident information or to arrange an audit.

10. Acceptance and changes
The app records store, merchant business name, verified owner identifier, agreement version and server timestamp. Material changes require a new version and renewed acceptance before affected processing. The merchant may end the service instead. Commercial activation remains conditional on the provider agreement and required Shopify approval.