Data Processing Addendum for Shopify Apps

Effective date: 2 November 2026

This Data Processing Addendum ("DPA") is part of the terms under which a merchant ("you") uses a Shopify app published by Kavio Labs Software Limited ("Kavio Labs", "we"), for example Kavio COD Desk and Kavio Make an Offer. It applies when the app processes personal data of your customers, prospective customers or store visitors. You accept it by installing the app.

1. Roles

• You are the controller of your customers' personal data.
• We are your processor. We process that data only to run the app for your store, on your documented instructions. Installing the app, configuring it and using its features are your instructions.
• We do not sell, rent or share your customers' personal data, and we do not use it for our own purposes, for advertising or to train models.

2. What we process

Each app's listing and settings page describe the data it uses. An app reads only the fields it needs.

3. Security measures

• In transit: all traffic uses HTTPS (TLS).
• At rest: personal data stored by the app is encrypted with AES-256 by the application before it is written to the database; list entries are matched through keyed hashes (HMAC-SHA256) and their values and labels are stored encrypted. Database backups therefore contain only the encrypted values. Shop access tokens are encrypted.
• Access: only authorised staff of Kavio Labs Software Limited can reach the servers and the database. Every view of customer personal data in the app is logged with the time, shop and user.
• Separation: development and testing use separate development stores and separate data.

Details are in our Security and Data Handling Policy.

4. Retention and deletion

• App records are kept only while they are needed. The default retention period is set in the app (see the Security and Data Handling Policy); you can shorten it in the app settings.
• When Shopify sends a customer redaction request, we delete that customer's personal data from the app within 30 days.
• When you uninstall an app, Shopify sends a shop redaction request; we then delete all data of your store from that app within 30 days.
• Kavio COD Desk lets you export records as CSV, delete single records and shorten the retention period (30 to 180 days) in Settings > Privacy. Kavio Make an Offer lets you export offers as CSV. To have all data of your store deleted at once, uninstall the app or contact us.

5. Subprocessors

We use our web hosting provider to run the apps and store their data, and our e-mail service provider (Our e-mail service provider) only where an app sends e-mail you have switched on. We will inform you before adding a subprocessor that processes your customers' personal data.

6. Personal data breaches

If we become aware of a breach affecting your customers' personal data, we notify you without undue delay and in any case within 72 hours, with what we know, and we cooperate with you and with Shopify as required by the Shopify Partner Program Agreement and applicable law.

7. Your rights and assistance

We help you answer requests from your customers (access, correction, deletion) through the app's export and deletion tools and through Shopify's privacy requests. Contact [email protected].

8. International transfers

Where personal data is transferred outside the UK or the EEA, we use the safeguards required by law, such as standard contractual clauses.

9. Contact

Kavio Labs Software Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, [email protected].