Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement governing a Shopify merchant’s (“Merchant”) use of Merchantwell applications, including AOVLift Post Purchase Upsell (the “Service”), and is entered into between Merchant and Merchantwell. By installing or using the Service, Merchant enters into this DPA on behalf of itself and, where applicable, its authorized affiliates.

1. Roles and instructions

As between the parties, Merchant is the controller or business and Merchantwell is the processor or service provider for buyer personal data. Merchantwell will process personal data only on Merchant’s documented instructions, including instructions provided through Merchant’s configuration and use of the Service, unless applicable law requires otherwise.

2. Details of processing

• Subject matter: Merchant-configured post-purchase offer targeting, display, fulfillment support, safeguards, and analytics.
• Duration: For the period Merchant uses the Service and any limited retention period described below.
• Nature and purpose: Retrieving, evaluating, transmitting, and, where stated, recording information needed to select and measure post-purchase offers.
• Data subjects: Merchant’s buyers and prospective buyers who reach a Shopify post-purchase experience.
• Personal data: Shopify customer identifier, customer tags, previous-order count, purchased product and collection identifiers, order value, country, checkout reference, offer interactions, accepted product or variant, and attributed revenue.
• Sensitive data: The Service is not designed to process sensitive or special-category personal data, and Merchant must not configure customer tags containing such information.

3. Merchantwell obligations

1. Process personal data only to provide the Service and according to Merchant’s lawful instructions.
2. Ensure persons authorized to process personal data are bound by confidentiality obligations.
3. Maintain reasonable safeguards, including encryption in transit and at rest, access controls, and production-environment protections.
4. Notify Merchant if, in Merchantwell’s reasonable opinion, an instruction infringes applicable privacy law.
5. Provide reasonable assistance with verified data-subject requests, security obligations, and required assessments.
6. Notify affected merchants without undue delay after confirming a personal-data breach, as required by applicable law.
7. Make information reasonably necessary to demonstrate compliance with this DPA available to Merchant, subject to confidentiality and security limitations.

4. Merchant obligations

Merchant is responsible for the lawfulness, fairness, and accuracy of its instructions and data; providing required notices; establishing a lawful basis; honoring buyer rights and consent or opt-out choices where applicable; and ensuring that targeting rules do not use prohibited, discriminatory, sensitive, or special-category information.

5. Subprocessors

Merchant authorizes Merchantwell to use subprocessors needed to provide the Service. Current production subprocessors include Render for application hosting and managed database infrastructure. Shopify provides the underlying commerce platform and supplies or receives data under Merchant’s separate agreement with Shopify. Merchantwell remains responsible for its subprocessors’ performance of applicable data-protection obligations.

6. Data-subject requests

If Merchantwell receives a request directly from a buyer concerning Merchant-controlled personal data, Merchantwell may direct the buyer to Merchant unless prohibited by law. Merchantwell will respond to Shopify’s mandatory customer-data request and redaction mechanisms and provide reasonable assistance so Merchant can respond to verified requests.

7. Return and deletion

Customer tags and previous-order count are used transiently and are not stored in AOVLift’s database. Following termination or Shopify’s verified shop-redaction request, Merchantwell will delete store-associated application data within the period required by Shopify, unless applicable law requires limited continued retention. When retention is legally required, Merchantwell will isolate the data from further use except for that legal purpose and delete it when the obligation ends.

8. International transfers

Merchant authorizes processing in the United States and other locations where authorized subprocessors operate. The parties will use applicable transfer mechanisms, including standard contractual clauses or equivalent safeguards, when required by law.

9. U.S. state privacy terms

Where Merchantwell acts as a service provider or processor under applicable U.S. state privacy law, Merchantwell will not sell or share personal data for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship with Merchant, or combine it with personal data received from another source except as permitted by law and necessary to provide the Service.

10. Order of precedence and changes

If this DPA conflicts with another agreement between Merchant and Merchantwell concerning personal-data processing, this DPA controls for that conflict. We may update this DPA when necessary to reflect changes in law, the Service, or our subprocessors. Material changes will be communicated as required.

11. Contact

Privacy and data-processing notices must be sent to support@merchantwell.com and should identify the Merchant’s Shopify store domain.