Data Processing Agreement

Effective date: August 20, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Ezy Kiwi Limited ("we", "us", "our", the "Processor") and a merchant who installs the Ezy-OTB application ("the App") from the Shopify App Store (the "Merchant", the "Controller"). It applies automatically, without further signature, from the point the Merchant installs the App, and describes how we process personal data on the Merchant's behalf while doing so. It supplements, and should be read alongside, our Privacy Policy, which describes our practices in more general terms.

1. Roles

For the personal data of the Merchant's own customers that passes through the App (order and customer records synced from Shopify), the Merchant is the data controller and we act as a data processor, processing that data solely to provide the App's inventory planning, open-to-buy, and reporting features. For account and billing data relating to the Merchant themselves, we act as an independent controller, as described in the Privacy Policy.

2. Subject matter, duration, and purpose

Subject matter	Processing of Shopify store, order, and customer data to provide the App's inventory planning and reporting functionality.
Duration	For as long as the App remains installed on the Merchant's store, plus any retention period described in Section 7 below.
Nature of processing	Collection (via Shopify's API and webhooks), storage, organization, and analysis of the data described in Section 3, to generate planning and reporting output shown back to the Merchant.
Purpose	Solely to operate the App's features for the Merchant; never for our own marketing, advertising, or resale purposes.

3. Categories of data subjects and personal data

Data subjects: the Merchant's own customers, whose orders are synced from Shopify.
Categories of personal data: name, email address, phone number, shipping and billing addresses, and marketing-consent state, all as provided by Shopify and only in connection with an order. We do not collect any special categories of data (e.g. health, biometric, or similarly sensitive data).

4. Our obligations as processor

We process personal data only on the Merchant's documented instructions - in practice, the instructions embedded in what the App is built to do (sync, plan, report), plus any explicit support request the Merchant makes to us directly.
We ensure that anyone we allow to access this data (our own personnel, and the sub-processors listed in Section 5) is bound by confidentiality obligations.
We apply the technical and organizational security measures described in Section 6.
We assist the Merchant in responding to their own customers' data subject requests, via the mechanisms described in Section 7.
We notify the Merchant without undue delay after becoming aware of a personal data breach affecting their data.
On request, we make available the information reasonably necessary to demonstrate compliance with this DPA, and permit and contribute to reasonable audits or inspections, subject to reasonable notice and confidentiality.
At the end of the App's installation, we delete or anonymize the Merchant's data as described in Section 7, except where we are required to retain it by law.

5. Sub-processors

We use the following sub-processors in connection with the App. We will update this page if this list changes, and Merchants are welcome to contact us with any question about a sub-processor before continuing to use the App.

Sub-processor	Purpose	Location
Shopify	Source platform for all store, order, and customer data; also processes Merchant billing via Shopify's own Billing API.	Per Shopify's own data processing terms
isx.net.nz	Hosting provider for our database and application servers, and for outbound transactional email (sync alerts, compiled data-request exports).	New Zealand
Anthropic PBC	Processes supplier purchase order documents that a Merchant deliberately uploads, so the App can extract order line data from them automatically. Used only for that merchant-initiated action - never for routine Shopify data syncing or reporting - and Anthropic does not use the content to train its models under its commercial API terms.	United States

6. Security measures and data loss prevention

We take a defence-in-depth approach: no single control is relied on alone. Concretely, we maintain:

Access control

All application access requires authentication, and every account is scoped to the specific Merchant company and store it belongs to - one Merchant's staff cannot see another Merchant's data through the App.
Access levels within a Merchant's own account are role-based, so day-to-day staff accounts can be limited to what their role needs rather than defaulting to full access.
Shopify OAuth access tokens are stored server-side only and are never exposed to the browser or any third party.

Encryption

All communication with Shopify's API and webhooks is made over HTTPS (with HTTP Strict Transport Security enforced), and incoming webhooks are verified using Shopify's HMAC signature before being processed.
Database connections between our application and our hosting provider use encrypted transport (TLS, with certificate validation).
Disk-level (at rest) encryption and backup encryption are managed by our hosting provider; we are actively confirming and documenting the specifics of that configuration as part of an ongoing review as of this DPA's effective date.

Monitoring and incident response

Unhandled application errors are logged centrally (via Serilog and Sentry) and trigger a throttled alert email to our own team, so failures - including ones that could indicate a data-integrity or access problem - are actively monitored rather than only discovered when reported.
Data is backed up by our hosting provider as part of their standard hosting service.
In the event of a suspected personal data breach, we will notify affected Merchants without undue delay, per Section 4.

Data minimisation and retention

The App only requests the Shopify data scopes it actually needs to provide its features.
The GDPR erasure webhooks described in Section 7 actively remove or anonymize personal data rather than retaining it indefinitely once it is no longer needed.

Honest scope note: as a small team, we do not yet maintain a dedicated, human-reviewed audit log of individual personal-data access events (distinct from the application-error monitoring above), and we do not yet apply API rate limiting. Neither gap is specific to any one Merchant's data, and we track closing them as part of our ordinary development backlog rather than treating this statement as a one-time claim we won't revisit.

7. Data subject requests, retention, and deletion

The App implements Shopify's mandatory privacy webhooks, which are the primary mechanism for exercising data subject rights over data processed through the App:

Customer data request - we compile the relevant order and profile data on request, for the Merchant to provide to their customer.
Customer redact - we erase personally identifying fields (name, email, phone, address details) from the affected orders, retaining only non-identifying, aggregate fields (such as region) needed for the Merchant's own reporting.
Shop redact - after the Merchant uninstalls the App, we delete the store's synced order data and anonymize any customer profiles no longer referenced by any retained order, on Shopify's own post-uninstall retention schedule.

A Merchant (or a data subject, via the Merchant) can also reach us directly at admin@ezy.kiwi for any request this DPA covers.

8. International data transfers

Our own infrastructure is hosted in New Zealand, so Merchant and customer data is transferred to, and stored in, New Zealand regardless of where the Merchant or their customers are located. Where a sub-processor operates outside New Zealand (currently, Anthropic PBC, for the merchant-initiated purchase order upload feature described in Section 5), we rely on that sub-processor's own commercial terms and safeguards for the transfer.

9. Liability and general terms

This DPA is governed by, and subject to the liability terms of, the general Terms of Service that apply to a Merchant's use of the App. Nothing in this DPA expands either party's liability beyond what those Terms of Service provide.

10. Changes to this DPA

We may update this DPA from time to time, for example to reflect a change in sub-processors or applicable law. Material changes will be reflected by an updated effective date at the top of this page.

11. Contact

Questions about this DPA can be sent to admin@ezy.kiwi.