Data Processing Addendum

Souvely: Returns & Exchanges · Version returns-dpa-v1.0-2026-09-30 · Last updated: September 30, 2026

1. Scope and order of precedence

This Data Processing Addendum (“DPA”) forms part of the Merchant Terms for Souvely: Returns & Exchanges (the “App”) between the merchant (“Controller”, “you”) and Souvely (“Processor”, “we”). It applies when we process personal data on your behalf in providing the App. The Privacy Policy describes processing more generally. If this DPA conflicts with the Merchant Terms on processor topics, this DPA controls.

2. Roles

You determine the purposes and means of processing store customer personal data through the App (controller). We process that data on your documented instructions as processor, except where law requires otherwise or where we act as an independent controller for limited purposes (App security, shop-level billing/account records, and Shopify compliance obligations), as described in the Privacy Policy.

3. Instructions

You instruct us to process personal data solely to provide, maintain, secure, and support the App features you enable—including portal authentication, eligibility evaluation, return request storage, merchant admin display, Shopify Returns/refund/credit API calls you trigger, notification delivery you enable, and compliance with Shopify webhooks. The App’s configuration and your use of admin actions constitute documented instructions. We will not process personal data for unrelated advertising. If an instruction appears unlawful, we may refuse and notify you.

4. Confidentiality

We ensure personnel authorized to process personal data are bound by confidentiality obligations and access data only as needed to operate the App.

5. Security

We implement reasonable technical and organizational measures appropriate to the risk, including:

TLS/HTTPS for App traffic in transit
Authentication for merchant admin via Shopify
Least-privilege Shopify access scopes as configured for the App
Application and database hosting on Heroku with Heroku Postgres
Logging and operational access controls on our infrastructure accounts

We do not claim specific encryption-at-rest configurations, SOC 2/ISO certifications, or other unaudited controls in this DPA. Measures may evolve; material reductions will not be made without considering impact on security.

6. Subprocessors

You authorize us to use the following categories of subprocessors (and the named providers currently used for the App, where applicable):

Shopify Inc. and affiliates — store APIs, App Proxy, Customer Accounts, Returns APIs, and Shopify Files for return photo storage
Heroku (Salesforce) — application hosting for the App
Heroku Postgres — primary application database (PostgreSQL)
Resend — transactional email delivery when RESEND_API_KEY is configured for the App (Pro branded emails and related App emails)

We will impose data-protection obligations on subprocessors no less protective than those in this DPA in substance. We remain responsible for subprocessors’ performance insofar as they process personal data for the App. We may update the subprocessor list by updating this DPA version; material additions that require re-acceptance will be gated in the App admin when we bump the DPA version.

7. Assistance with data subject rights

Taking into account the nature of processing, we will assist you with reasonable requests to fulfill data subject rights (access, deletion, etc.) by providing App tools and cooperating with Shopify’s mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact). Store customers should generally contact you first. You remain responsible for verifying requester identity and deciding responses.

8. Personal data breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting App personal data we process for you, and provide information reasonably available to help you meet your notification obligations. No fixed hour deadline is guaranteed beyond “without undue delay,” unless required by applicable law and separately agreed.

9. International transfers

Personal data may be processed in the United States and other countries where we or our subprocessors operate (including Heroku/AWS regions used for the App database). Where a transfer mechanism is required by law (for example EU Standard Contractual Clauses), the parties will use an appropriate mechanism. Pending verification: signed SCCs or other transfer tools may need to be executed as a separate packet once Souvely’s legal entity details are confirmed.

10. Deletion and return

On termination of the App for your shop (uninstall) or on Shopify shop/redact, we delete shop sessions and shop-owned return configuration and return-request data from the App database as implemented in our compliance cleanup jobs, except where retention is required by law, dispute, or security. On customers/redact, we clear customer email, name (if any), note, and customer id on matching return requests and delete related customer upload records. We do not promise a specific calendar-day deletion SLA beyond what the running implementation and Shopify’s webhook timing provide. “Return” of data is fulfilled via export/assistance reasonable for the App (for example data_request webhook handling and admin visibility), not a separate archival media service.

11. Audits

Upon reasonable written request no more than once per year (unless a competent authority requires more), we will provide information reasonably necessary to demonstrate compliance with this DPA (for example architecture summaries and this documented processing schedule). On-site audits are not routinely offered for a multi-tenant Shopify app; alternative evidence will be discussed in good faith where legally required.

12. Liability

Liability under this DPA is subject to the limitations in the Merchant Terms, except where prohibited by applicable data-protection law.

13. Term

This DPA lasts for as long as we process personal data on your behalf for the App. Sections that by nature should survive (confidentiality, deletion, liability) survive termination.

Schedule A — Processing details (Returns & Exchanges)

This schedule reflects the current implementation of the App as of the version date. It does not invent fields or controls that are not present in the product.

A.1 Subject matter and duration

Operation of Souvely: Returns & Exchanges for the Merchant’s Shopify store. Duration: while the App remains installed and thereafter until deletion/redaction as described above.

A.2 Nature and purpose of processing

Authenticate shoppers to the returns portal (order name + email; optional Customer Account bridge)
Evaluate return eligibility using merchant rules
Create and store return requests and related events
Store references to return photos uploaded via Shopify Files
Display requests to merchant staff in the embedded admin
Call Shopify APIs to create/approve/decline/process returns, refunds, and store credit as instructed by merchant actions
Send or log transactional notifications (Resend when configured; otherwise logging / Shopify-native channels)
Respond to Shopify compliance webhooks and uninstall cleanup
Provide merchant analytics/exports derived from return records

A.3 Types of personal data

Shop domain and merchant admin session context (including staff user id when an online session provides it)
Shopper email (portal entry and notification recipient)
Shopify customer id (GID) and customer tags; product/order tags; shipping-address country code only (not street address or phone)
Order identifiers/names; line-item and fulfillment-line identifiers; titles; quantities; SKUs; prices/currency
Return reasons, resolutions, customer comments/notes, merchant notes/internal tags
Return photo files via Shopify Files (filename, mime type, size, storage key/URL references in App DB)
Customer name: not requested from Shopify GraphQL for this App; the database field exists but is not populated from Shopify name fields in the current queries
Notification delivery metadata (recipient, subject, status) when emails are sent or logged

A.4 Categories of data subjects

Merchant staff users of the Shopify admin
Store customers / shoppers using the returns portal or whose orders are processed for returns

A.5 Retention

Return and configuration data are retained while the merchant uses the App and as needed to operate returns and support. Customer-identifying fields on matching returns are cleared on customers/redact. Shop-owned data is deleted on uninstall or shop/redact per the App’s cleanup implementation, subject to legal/security exceptions. No separate fixed retention period (for example “delete after N days of inactivity”) is currently implemented beyond those events.

A.6 Contact for processor

support@souvely.com. Legal entity name and registered address: pending verification — do not invent.